Function at 0x14000b25c
Capabilities:
Delete service

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r14d, r14d
xor edx, edx
xor ecx, ecx
mov dword [rbp + 0x48], r14d
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov qword [rbp + 0x50], rax
lea r12, [0x1400df278]
lea r13, [0x1400b7030]
mov r15d, 0x80070000
mov rbx, rax
test rax, rax
jne 0x14000b2f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, r15d
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x14000b2f9
mov rcx, qword [0x1400df278]
cmp rcx, r12
je 0x14000b414
test byte [rcx + 0x1c], 1
je 0x14000b414
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x23]
mov r9d, esi
mov r8, r13
call fcn.14000a9b0
jmp 0x14000b414
mov r8d, 0x10000
lea rdx, [0x1400b5fc0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov qword [rbp + 0x58], rax
mov rdi, rax
test rax, rax
jne 0x14000b37d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, r15d
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x14000b37d
mov rcx, qword [0x1400df278]
cmp rcx, r12
je 0x14000b360
test byte [rcx + 0x1c], 1
je 0x14000b360
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x24]
mov r9d, esi
mov r8, r13
call fcn.14000a9b0
test rbx, rbx
je 0x14000b414
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x14000b414
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
nop dword [rax + rax]
test eax, eax
jne 0x14000b3ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx esi, ax
or esi, r15d
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x14000b3ea
mov rcx, qword [0x1400df278]
cmp rcx, r12
je 0x14000b3d1
test byte [rcx + 0x1c], 1
je 0x14000b3d1
mov rcx, qword [rcx + 0x10]
mov edx, 0x25
mov r9d, esi
mov r8, r13
call fcn.14000a9b0
test rdi, rdi
je 0x14000b360
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
jmp 0x14000b360
test rdi, rdi
je 0x14000b3fe
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test rbx, rbx
je 0x14000b412
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
xor esi, esi
test esi, esi
jns 0x14000b42c
mov edx, esi
mov dword [rbp + 0x48], esi
lea rcx, str.Failed_to_unregister_service__hr___08X_n
mov r14d, esi
call fcn.14000be14
and qword [rbp + 0x50], 0
lea r8, str.AppID
and qword [rsp + 0x20], 0
lea rcx, [rbp + 0x50]
mov r9d, 0x10000
mov rdx, 0xffffffff80000000
call fcn.1400a3fc8
mov edi, eax
test eax, eax
jns 0x14000b497
mov rcx, qword [0x1400df278]
cmp rcx, r12
je 0x14000b480
test byte [rcx + 0x1c], 1
je 0x14000b480
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayPutElement
mov r9d, eax
mov r8, r13
call fcn.14000a9b0
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14000b4f6
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14000b4f6
mov rbx, qword [rbp + 0x50]
lea rdx, str.2eb6d15c_5239_41cf_82fb_353d20b816cf
mov rcx, rbx
call fcn.1400a4d80
mov edi, eax
test eax, eax
jns 0x14000b4e0
mov rcx, qword [0x1400df278]
cmp rcx, r12
je 0x14000b4d6
test byte [rcx + 0x1c], 1
je 0x14000b4d6
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r9d, eax
mov r8, r13
call fcn.14000a9b0
test rbx, rbx
je 0x14000b4f6
mov rcx, rbx
jmp 0x14000b489
test rbx, rbx
je 0x14000b4f4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor edi, edi
test edi, edi
jns 0x14000b50e
mov edx, edi
mov dword [rbp + 0x48], edi
lea rcx, str.Failed_to_unregister_AppID__hr___08X_n
mov r14d, edi
call fcn.14000be14
xor r15d, r15d
lea rdx, str.8X_v_
mov dword [rbp + 0x50], r15d
mov r12, rdx
movsxd rax, r15d
imul rcx, rax, 0x70
add rcx, rdx
lea rdx, [rbp - 0x38]
call fcn.14000aa8c
test eax, eax
js 0x14000b6cc
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x14000b6e5
mov r14, qword [rbp - 0x30]
lea r15, [0x1400df278]
mov r13d, eax
and qword [rbp + 0x58], 0
lea r8, str.CLSID
and qword [rsp + 0x20], 0
lea rcx, [rbp + 0x58]
mov r9d, 0x10000
mov rdx, 0xffffffff80000000
call fcn.1400a3fc8
mov esi, eax
test eax, eax
jns 0x14000b5c9
mov rcx, qword [0x1400df278]
cmp rcx, r15
je 0x14000b5ab
test byte [rcx + 0x1c], 1
je 0x14000b5ab
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b7030]
mov edx, SafeArrayGetLBound
mov r9d, eax
call fcn.14000a9b0
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14000b69b
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x14000b69b
and qword [rbp + 0x60], 0
lea rcx, [r14 + 8]
lea rdx, [rbp + 0x60]
call fcn.14007d63c
mov esi, eax
test eax, eax
jns 0x14000b61b
mov rcx, qword [0x1400df278]
cmp rcx, r15
je 0x14000b60b
test byte [rcx + 0x1c], 1
je 0x14000b60b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b7030]
mov edx, SafeArrayGetLBound
mov r9d, eax
call fcn.14000a9b0
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x14000b5ab
call fcn.1400ac0d0
jmp 0x14000b5ab
mov rbx, qword [rbp + 0x60]
mov rdi, qword [rbp + 0x58]
mov rdx, rbx
mov rcx, rdi
call fcn.1400a4d80
mov esi, eax
test eax, eax
jns 0x14000b678
mov rcx, qword [0x1400df278]
cmp rcx, r15
je 0x14000b65e
test byte [rcx + 0x1c], 1
je 0x14000b65e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400b7030]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov r9d, eax
call fcn.14000a9b0
test rbx, rbx
je 0x14000b66b
mov rcx, rbx
call fcn.1400ac0d0
test rdi, rdi
je 0x14000b69b
mov rcx, rdi
jmp 0x14000b5b8
test rbx, rbx
je 0x14000b685
mov rcx, rbx
call fcn.1400ac0d0
test rdi, rdi
je 0x14000b699
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
xor esi, esi
test esi, esi
jns 0x14000b6b4
mov rdx, qword [r14]
lea rcx, str.Failed_to_unregister_class__ls__hr___08X_n
mov r8d, esi
mov dword [rbp + 0x48], esi
call fcn.14000be14
add r14, 0x28
sub r13, 1
jne 0x14000b553
mov r15d, dword [rbp + 0x50]
mov r14d, dword [rbp + 0x48]
jmp 0x14000b6e5
mov rdx, qword [r12]
lea rcx, str.Failed_to_load_plugin__ls__hr___08X_n
mov r8d, eax
mov dword [rbp + 0x48], eax
mov r14d, eax
call fcn.14000be14
lea rcx, [rbp - 0x38]
call fcn.14000aa44
inc r15d
lea rdx, str.8X_v_
add r12, 0x70
mov dword [rbp + 0x50], r15d
cmp r15d, 0x12
jb 0x14000b51f
mov eax, r14d
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret