Function at 0x140193630
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x650]
sub rsp, 0x750
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0x640], rax
movzx r15d, r8b
mov esi, edx
mov r12, rcx
xor dil, dil
add rcx, 0x238
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rbp + 0x30]
mov rcx, r12
call fcn.140193bb0
test al, al
je 0x140193b60
mov edx, 1
lea rcx, [rbp + 0x30]
call fcn.1401b2a60
mov r14, rax
test rax, rax
je 0x140193b60
mov rcx, rax
call fcn.1401b0850
cmp eax, 1
je 0x140193b58
mov rdx, qword [r14 + 0x138]
xor ebx, ebx
test rdx, rdx
je 0x140193a8e
lea r9d, [rbx + 4]
lea r8, str.SERVERS
mov rcx, r14
call fcn.1401b20b0
mov rbx, rax
test rax, rax
je 0x140193a8c
mov dword [rsp + 0x20], r15d
mov r9d, esi
lea r8, str.SERVER_NAME_08X__02X
mov edx, 0x40
lea rcx, [rbp - 0x50]
call fcn.1401aef00
mov r9d, 3
lea r8, [rbp - 0x50]
mov rdx, rbx
mov rcx, r14
call fcn.1401b2700
mov r15, rax
test rax, rax
je 0x140193a8c
mov edx, 0x5c
lea rsi, str.GLOBALOPTION_OPTNAMEListeningPort
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x140193830
mov edx, 0x22
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x1401937aa
nop dword [rax + rax]
cmp rax, rbx
jae 0x1401937aa
lea rcx, [rax + 2]
mov edx, 0x22
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rdi, rax
test rax, rax
je 0x1401937aa
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rbx, rax
test rax, rax
je 0x140193830
lea rcx, [rdi + 2]
mov edx, 0x22
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x140193760
mov rcx, rbx
sub rcx, rsi
sar rcx, 1
lea eax, [rcx - 1]
cmp eax, 0x1fe
ja 0x140193a79
movsxd rax, ecx
lea rdi, [rax + rax]
mov r8, rdi
mov rdx, rsi
lea rcx, [rbp + 0x240]
call sub.VCRUNTIME140.dll_memcpy
cmp rdi, 0x400
jae 0x140193b9c
xor eax, eax
mov word [rbp + rdi + 0x240], ax
lea r9d, [rax + 3]
lea r8, [rbp + 0x240]
mov rdx, r15
mov rcx, r14
call fcn.1401b20b0
test rax, rax
je 0x140193a79
lfence
lea r8, [rbx + 2]
mov r9d, 3
mov rdx, rax
mov rcx, r14
call fcn.1401b2700
mov rsi, rax
jmp 0x140193958
mov edx, 0x3b
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rsi, rax
test rax, rax
je 0x1401938ef
xor eax, eax
mov ebx, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov rdi, rsi
lea rax, str.GLOBALOPTION_OPTNAMEListeningPort
sub rdi, rax
sar rdi, 1
lea rdx, [rdi + 1]
test rdx, rdx
je 0x140193893
lfence
add rdx, rdx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
test rax, rax
je 0x1401938e8
mov qword [rsp + 0x38], rax
lea rax, str.GLOBALOPTION_OPTNAMEListeningPort
test rdi, rdi
je 0x1401938a7
lea r8, [rdi + rdi]
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov word [rbx + rdi*2], ax
lea r9, [rsi + 2]
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov r8, rbx
mov rdx, r15
mov rcx, r14
call fcn.1401b1c00
mov rsi, rax
test rbx, rbx
je 0x140193958
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140193958
mov rbx, qword [rsp + 0x38]
jmp 0x1401938ad
xor edi, edi
mov ebx, edi
cmp rbx, 0xffffffffffffffff
je 0x140193955
test rbx, rbx
jne 0x140193919
mov rsi, qword [r15 + 0x80]
mov rax, rdi
test rsi, rsi
je 0x140193926
mov rbx, qword [rsi + 0x88]
mov rax, rbx
jmp 0x140193926
mov rsi, rbx
mov rax, qword [rbx + 0x88]
mov rbx, rax
test rax, rax
mov rax, 0xffffffffffffffff
cmove rbx, rax
test rsi, rsi
je 0x140193955
lea rdx, [rsi + 4]
lea rcx, str.GLOBALOPTION_OPTNAMEListeningPort
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1401938f3
cmp dword [rsi], 5
jne 0x1401938f3
jmp 0x140193958
mov rsi, rdi
test rsi, rsi
je 0x140193a79
xor eax, eax
mov ebx, eax
cmp rbx, 0xffffffffffffffff
je 0x140193a79
test rbx, rbx
jne 0x14019398c
mov rdi, qword [rsi + 0x80]
test rdi, rdi
je 0x140193999
mov rbx, qword [rdi + 0x88]
mov rax, rbx
jmp 0x140193999
mov rdi, rbx
mov rax, qword [rbx + 0x88]
mov rbx, rax
test rax, rax
mov rax, 0xffffffffffffffff
cmove rbx, rax
test rdi, rdi
je 0x140193a79
lea rdx, [rdi + 4]
lea rcx, str.VALUE
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
mov eax, 0
jne 0x140193965
cmp dword [rdi], 6
jne 0x140193965
mov ebx, eax
mov rax, qword [rdi + 0x70]
cmp dword [rdi + 0x68], ebx
je 0x1401939e0
mov qword [r14 + 0x50], rax
jmp 0x1401939e4
mov qword [r14 + 0x18], rax
mov esi, 8
nop dword [rax]
mov edx, dword [rdi + 0x68]
test edx, edx
je 0x1401939fd
mov rax, qword [r14 + 0x50]
jmp 0x140193a01
mov rax, qword [r14 + 0x18]
cmp rax, qword [rdi + 0x78]
jae 0x140193a3e
mov ecx, 0x40
test edx, edx
cmove rcx, rsi
add rcx, r14
mov r8d, 1
lea rdx, [rsp + 0x34]
call fcn.1401b2ec0
test eax, eax
je 0x140193a79
cmp rbx, 0x10
jae 0x140193a79
movzx eax, word [rsp + 0x34]
mov word [rbp + rbx*2 - 0x78], ax
inc rbx
jmp 0x1401939f0
cmp rbx, 0x10
jae 0x140193a79
xor ecx, ecx
mov word [rbp + rbx*2 - 0x78], cx
mov word [rsp + 0x30], cx
lea r8, [rsp + 0x30]
lea rdx, [0x14020bbe8]
lea rcx, [rbp - 0x78]
call fcn.140035fe0
cmp eax, 1
jne 0x140193a79
lea rcx, [r12 + 0x10]
lea rdx, [rsp + 0x30]
call fcn.140193db0
mov rdx, r15
mov rcx, r14
call fcn.1401b2870
mov dil, 1
dec dword [r12 + 0xc]
xor ebx, ebx
mov rcx, r14
call fcn.1401b2c70
test dil, dil
je 0x140193b60
cmp dword [r12 + 0xc], 0
jle 0x140193ab4
mov rcx, r12
call fcn.140192b60
jmp 0x140193b60
lea rcx, [r12 + 0x238]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [r12]
test rcx, rcx
jne 0x140193b01
xor edx, edx
mov r8d, 0xf0000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140193b48
lea rdx, [r12 + 0x20]
mov r8d, 0x134
mov rcx, rax
call qword [case.0x1401ba071.44]
mov qword [r12], rax
mov rcx, rax
test rax, rax
je 0x140193b3a
lea r8, [rsp + 0x68]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140193b2a
mov r8d, 1
mov rdx, qword [r12]
call fcn.140193cb0
mov byte [r12 + 9], 0
mov rcx, qword [r12]
call qword [case.0x1401ba071.43]
xor eax, eax
mov qword [r12], rax
test rbx, rbx
je 0x140193b48
mov rcx, rbx
call qword [case.0x1401ba071.43]
lea rcx, [r12 + 0x238]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140193b60
mov rcx, r14
call fcn.1401b2dd0
lea rcx, [r12 + 0x238]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, dil
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0x7a8]
add rsp, 0x750
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1401c54a4
int3