Function at 0x140004c48
Capabilities:
Delete registry key
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140013c70], eax
jg 0x140004cff
xor esi, esi
lea rdi, [0x1400138e0]
lea rax, [0x1400138f8]
cmp rax, rdi
sbb rbx, rbx
not rbx
and ebx, 3
mov rbp, qword [rdi]
mov rcx, 0xffffffff80000000
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegDeleteKeyW]
test eax, eax
je 0x140004cda
mov rcx, qword [rsp + 0x28]
lea r8, str.onecoreuap_analog_sdk_simulation_servicesperceptionsimulationexemain.cpp
mov r9d, 0x80004005
mov edx, 0x113
call fcn.1400028fc
mov rdx, rbp
lea rcx, str.Failed_to_delete_key_HKCR_ls_n
call fcn.14000c950
add rdi, 8
inc rsi
cmp rsi, rbx
jne 0x140004c98
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x14000b014
lea rcx, [0x140013c70]
call fcn.14000bdf8
cmp dword [0x140013c70], 0xffffffff
jne 0x140004c7c
lea rax, str.AppID9F7BC6EE_A81C_479D_B8A5_DAC928772875
mov qword [0x1400138e0], rax
lea rcx, [0x140013c70]
lea rax, str.AppIDPerceptionSimulationService.exe
mov qword [0x1400138e8], rax
lea rax, str.CLSIDAC7FBAB1_2C10_4A11_97B8_D563F29980DB
mov qword [0x1400138f0], rax
call fcn.14000bd90
jmp 0x140004c7c
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140013148]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
xor ebx, ebx
mov qword [r11 - 0x38], rax
xor edx, edx
mov qword [r11 - 0x30], rax
xor ecx, ecx
mov qword [r11 - 0x28], rax
xor esi, esi
lea r8d, [rbx + 1]
mov dword [rsp + 0x38], eax
xor edi, edi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov r14d, 0x80070000
test rax, rax
je 0x14000b072
mov rsi, rax
jmp 0x14000b099
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
lea rcx, str.OpenSCManager_failed__0x_08X__n
or ebx, r14d
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.14000c950
test ebx, ebx
js 0x14000b1c5
lea rbp, str.PerceptionSimulation
mov r8d, 0x10024
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
test rax, rax
je 0x14000b0bc
mov rdi, rax
jmp 0x14000b0db
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
lea rcx, str.OpenService_failed__0x_08X__n
or ebx, r14d
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.14000c950
test ebx, ebx
js 0x14000b1a1
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
test eax, eax
je 0x14000b162
mov rdx, rbp
lea rcx, str.Stopping__ls
call fcn.14000c950
lea rcx, [0x14000f488]
call fcn.14000c950
mov ecx, 0xfa
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
je 0x14000b139
cmp dword [rsp + 0x24], 3
je 0x14000b109
lea rcx, [0x14000e378]
call fcn.14000c950
cmp dword [rsp + 0x24], 1
lea rcx, str._ls_is_stopped._n
mov rdx, rbp
je 0x14000b15d
lea rcx, str._ls_failed_to_stop._n
call fcn.14000c950
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
test eax, eax
jne 0x14000b18e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
lea rcx, str.DeleteService_failed__0x_08X__n
or ebx, r14d
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.14000c950
test ebx, ebx
js 0x14000b1a1
mov rdx, rbp
lea rcx, str._ls_is_removed._n
call fcn.14000c950
test rdi, rdi
je 0x14000b1b3
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test eax, eax
je 0x14000b206
test rsi, rsi
je 0x14000b1c5
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test eax, eax
je 0x14000b1ef
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000b710
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r14d
test eax, eax
cmovle ecx, eax
call fcn.140003d00
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, r14d
test eax, eax
cmovle ecx, eax
call fcn.140003d00
int3