Function at 0x1400daf00
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x20
xor esi, esi
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400daf8b
mov r8d, 0xf01ff
lea rdx, str.RtkAudioService
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x1400daf75
mov rdx, rax
call fcn.1400db170
test eax, eax
jne 0x1400daf6c
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_DeleteService]
mov esi, eax
mov ecx, 0x64
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, esi
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, [rbp + 0x30]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rbp + 0x48], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400db14f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rdi, str.stop_RtkAudioService
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.14000c4c0
mov rbx, 0xffffffffffffffff
test al, al
jne 0x1400daffc
mov rax, rbx
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400dafe2
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.14000c750
nop
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400db15a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rbp + 0x38], rax
lea rdi, str.sc.exe
mov rdx, rdi
lea rcx, [rbp + 0x38]
call fcn.14000c4c0
test al, al
jne 0x1400db05a
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400db040
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp + 0x38]
call fcn.14000c750
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.1400efa40
mov ecx, 0x1f4
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rax, [rbp + 0x30]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rbp + 0x48], rax
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400db165
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rbp + 0x30], rax
lea r14, str.delete_RtkAudioService
mov rdx, r14
lea rcx, [rbp + 0x30]
call fcn.14000c4c0
test al, al
jne 0x1400db0dd
mov rax, rbx
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400db0c2
mov r8d, eax
mov rdx, r14
lea rcx, [rbp + 0x30]
call fcn.14000c750
nop
call fcn.14000cd60
mov rcx, rax
test rax, rax
je 0x1400db144
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14005eeb3.0]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov rdx, rdi
lea rcx, [rbp + 0x38]
call fcn.14000c4c0
test al, al
jne 0x1400db12a
nop
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400db110
mov r8d, ebx
mov rdx, rdi
lea rcx, [rbp + 0x38]
call fcn.14000c750
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.1400efa40
mov eax, esi
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
nop
mov ecx, 0x80004005
call fcn.14000ce90
int3