Function at 0x14002a180
Capabilities:
Delete service
Query service configuration
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov ebx, edx
mov esi, ecx
mov rax, qword [0x14008ae00]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ecx, ecx
xor edx, edx
mov r8d, 3
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x14002a228
mov rdi, rax
lea rdx, str.WindowsHostServicess
mov rcx, rax
mov r8d, 0x10021
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14002a242
mov r14, rax
test sil, sil
je 0x14002a25c
mov dword [rsp + 0x50], 0
mov r12, qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea r15, [rsp + 0x50]
mov rcx, r14
xor edx, edx
xor r8d, r8d
mov r9, r15
call r12
mov edx, dword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov r8d, dword [rsp + 0x50]
mov rcx, r14
mov rdx, rax
mov r9, r15
call r12
test eax, eax
setne bpl
jmp 0x14002a25e
test bl, bl
je 0x14002a48b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManagerW_failed_0x_08lx_n
jmp 0x14002a484
test bl, bl
je 0x14002a48b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenServiceW_failed_0x_08lx_n
jmp 0x14002a484
xor ebp, ebp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14002a473
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov rcx, r14
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov r15, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call r15
mov rcx, rdi
call r15
test bpl, bpl
je 0x14002a536
test bl, bl
je 0x14002a2bf
mov rdx, qword [rsi + 0x10]
lea rcx, str.Removing__s_n
call fcn.140002d40
call fcn.14002d0a8
mov rdi, rax
call fcn.14002d08c
mov rcx, rax
cmp rdi, 0x989680
jne 0x14002a559
imul rdx, rcx, 0x64
movabs rbp, 0x2540be400
add rbp, rdx
lea rdi, [rsp + 0x50]
lea r14, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov r15, qword [rsi + 0x10]
mov rcx, r15
call fcn.14003b4f0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
call fcn.14002dac0
mov rcx, rdi
mov edx, eax
mov r8, r14
call fcn.140017930
cmp qword [rsp + 0x68], 8
mov rcx, rdi
jb 0x14002a338
mov rcx, qword [rsp + 0x50]
call fcn.14002dd6c
mov r15, rax
mov rax, qword [rsp + 0x68]
cmp rax, 8
jb 0x14002a388
mov rcx, qword [rsp + 0x50]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14002a383
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a608
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
shr r15, 0x20
je 0x14002a522
mov ecx, 0x64
call r13
call fcn.14002d0a8
mov r12, rax
call fcn.14002d08c
mov rcx, rax
cmp r12, 0x989680
jne 0x14002a3c5
imul rdx, rcx, 0x64
cmp rdx, rbp
jl 0x14002a300
jmp 0x14002a492
mov rax, rcx
cmp r12, 0x16e3600
jne 0x14002a426
movabs r9, 0xb2f4fc0794908cf3
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
imul rax, r8, 0x3b9aca00
add rdx, rcx
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x18
add rdx, rcx
add rdx, rax
jmp 0x14002a3b7
or rax, r12
shr rax, 0x20
je 0x14002a439
mov rax, rcx
cqo
idiv r12
jmp 0x14002a440
mov eax, ecx
xor edx, edx
div r12d
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, r12
or rdx, rax
shr rdx, 0x20
je 0x14002a464
cqo
idiv r12
mov rdx, rax
jmp 0x14002a46b
xor edx, edx
div r12d
mov edx, eax
add rdx, rcx
jmp 0x14002a3b7
test bl, bl
je 0x14002a48b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.DeleteService_failed_0x_08lx_n
mov edx, eax
call fcn.140002d40
xor esi, esi
jmp 0x14002a539
test r15, r15
je 0x14002a522
test bl, bl
je 0x14002a536
mov rax, qword [0x14008a5b0]
lea rcx, [0x14008a5b0]
lea rdi, [rsp + 0x50]
mov rdx, rdi
mov r8d, r15d
call qword [rax + reloc.WS2_32.dll_recv]
cmp qword [rsp + 0x68], 0x10
jb 0x14002a4cc
mov rdi, qword [rsp + 0x50]
mov rdx, qword [rsi + 0x10]
lea rcx, str.Failed_to_remove__s:__s__n
mov r8, rdi
call fcn.140002d40
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x14002a536
mov rcx, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002a51b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a608
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
jmp 0x14002a536
test bl, bl
je 0x14002a536
mov rdx, qword [rsi + 0x10]
lea rcx, str._s_Successfully_removed_n
call fcn.140002d40
mov sil, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002bd70
mov eax, esi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rcx
cmp rdi, 0x16e3600
jne 0x14002a5bd
movabs r9, 0xb2f4fc0794908cf3
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
imul rax, r8, 0x3b9aca00
add rdx, rcx
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x18
add rdx, rcx
add rdx, rax
jmp 0x14002a2e0
or rax, rdi
shr rax, 0x20
je 0x14002a5d0
mov rax, rcx
cqo
idiv rdi
jmp 0x14002a5d6
mov eax, ecx
xor edx, edx
div edi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rdi
or rdx, rax
shr rdx, 0x20
je 0x14002a5fa
cqo
idiv rdi
mov rdx, rax
jmp 0x14002a600
xor edx, edx
div edi
mov edx, eax
add rdx, rcx
jmp 0x14002a2e0
call fcn.140038150
int3