Function at 0x14000f400
Capabilities:
Delete registry key
Delete registry value
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r15, r8
mov r13d, ecx
mov r12b, 1
mov rbx, qword [rdx]
mov qword [rsp + 0x30], rbx
mov rdi, qword [rdx + 8]
mov qword [rsp + 0x38], rdi
cmp rbx, rdi
je 0x14000fac7
xor r14d, r14d
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400025c0
nop
test r13d, r13d
jne 0x14000f5d4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [0x1400bd338]
call fcn.1400262b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.1400025c0
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.140072740
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
xor dil, dil
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000f4e0
mov r9, qword [rbx]
lea r8, str.schtasks__delete__TN___s___F
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.140002b10
lea r8, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.1400096f0
mov rcx, qword [rbx + 0x18]
mov rdx, rbx
test eax, eax
jne 0x14000f528
mov dil, 1
cmp rcx, 8
jb 0x14000f51a
mov rdx, qword [rbx]
lea rcx, str.Deleting_Scheduled_Task_t:_t_s_tSUCCESSFULL...
call fcn.1400262b0
jmp 0x14000f543
cmp rcx, 8
jb 0x14000f531
mov rdx, qword [rbx]
mov r8d, dword [rsp + 0x48]
lea rcx, str.Deleting_Scheduled_Task_t:_t_s_tFAILED____Error_:__d
call fcn.1400262b0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000f582
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000f57d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010221
mov rcx, r8
call fcn.140070654
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
test dil, dil
jne 0x14000fa69
xor r12b, r12b
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x14000f5bf
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400025c0
add qword [r15 + 8], 0x20
jmp 0x14000fa69
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, r15
call fcn.140017190
jmp 0x14000fa69
cmp r13d, 7
jne 0x14000f7ba
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [0x1400bd338]
call fcn.1400262b0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov r8, qword [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.1400027d0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.14006d500
test al, al
sete bl
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000f682
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f67d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010227
call fcn.140070654
test bl, bl
je 0x14000fa6e
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14000f758
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov r8, qword [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.1400027d0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
call fcn.14006d500
test al, al
sete bl
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000f74c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f747
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001022d
call fcn.140070654
test bl, bl
jne 0x14000f758
mov r12b, 1
jmp 0x14000fa6e
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14000f781
mov r12b, 1
jmp 0x14000fa6e
xor r12b, r12b
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x14000f7a5
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400025c0
add qword [r15 + 8], 0x20
jmp 0x14000fa6e
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, r15
call fcn.140017190
jmp 0x14000fa6e
cmp r13d, 3
jne 0x14000f7f8
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [0x1400bd338]
call fcn.1400262b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400025c0
mov rcx, rax
call fcn.14000eb40
jmp 0x1400101dd
cmp r13d, 2
jne 0x14000f836
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, str.Killing_Process_t:_t_s
call fcn.1400262b0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call fcn.14000b570
jmp 0x1400101dd
cmp r13d, 4
jne 0x14000faf5
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [0x1400bd338]
call fcn.1400262b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.1400025c0
nop
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
setae r14b
cmovae rcx, qword [rbp - 0x50]
mov qword [rsp + 0x20], 1
lea r9, [0x1400bc204]
xor r8d, r8d
mov rbx, qword [rbp - 0x40]
mov rdx, rbx
call fcn.1400176b0
mov rdi, rax
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], ax
movsxd r8, edi
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp - 0x50]
test r14b, r14b
cmovne rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.1400027d0
nop
lea eax, [rdi + 1]
movsxd rcx, eax
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rax, qword [rbp - 0x40]
cmp rax, rcx
jb 0x140010245
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x70]
call fcn.1400027d0
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400025c0
mov rcx, rax
call fcn.14000e210
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14000f995
xor r12b, r12b
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x14000f984
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400025c0
add qword [r15 + 8], 0x20
jmp 0x14000f995
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, r15
call fcn.140017190
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000f9d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010233
call fcn.140070654
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000fa29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010239
call fcn.140070654
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14000fa69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001023f
call fcn.140070654
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000fab5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001021b
call fcn.140070654
add rbx, 0x20
mov qword [rsp + 0x30], rbx
cmp rbx, rdi
jne 0x14000f460
movzx eax, r12b
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140070140
mov rbx, qword [rsp + 0x370]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r13d, 5
jne 0x14000fd30
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [0x1400bd338]
call fcn.1400262b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.1400025c0
nop
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
setae r14b
cmovae rcx, qword [rbp - 0x50]
mov qword [rsp + 0x20], 1
lea r9, [0x1400bc204]
xor r8d, r8d
mov rbx, qword [rbp - 0x40]
mov rdx, rbx
call fcn.1400176b0
mov rdi, rax
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], ax
movsxd r8, edi
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp - 0x50]
test r14b, r14b
cmovne rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.1400027d0
nop
lea eax, [rdi + 1]
movsxd rcx, eax
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rax, qword [rbp - 0x40]
cmp rax, rcx
jb 0x140010257
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rax, qword [rbp - 0x50]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x70]
call fcn.1400027d0
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400025c0
mov rcx, rax
call fcn.14000e210
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14000fc54
xor r12b, r12b
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x14000fc43
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400025c0
add qword [r15 + 8], 0x20
jmp 0x14000fc54
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, r15
call fcn.140017190
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000fc95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001024b
call fcn.140070654
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000fce8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fce2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010251
call fcn.140070654
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14000fa69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001020f
jmp 0x14000fa64
cmp r13d, 6
jne 0x14001013d
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [0x1400bd338]
call fcn.1400262b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.1400025c0
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
setae r14b
cmovae rcx, qword [rbp - 0x70]
mov qword [rsp + 0x20], 1
lea r9, [0x1400bc204]
xor r8d, r8d
mov rbx, qword [rbp - 0x60]
mov rdx, rbx
call fcn.1400176b0
mov rdi, rax
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp], rax
mov qword [rbp + 8], 7
mov word [rbp - 0x10], ax
movsxd r8, edi
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp - 0x70]
test r14b, r14b
cmovne rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x10]
call fcn.1400027d0
nop
lea eax, [rdi + 1]
movsxd rcx, eax
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rax, qword [rbp - 0x60]
cmp rax, rcx
jb 0x140010209
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rax, qword [rbp - 0x70]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x70]
call fcn.1400027d0
nop
lea r10, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
setae sil
mov rdi, qword [rsp + 0x70]
cmovae r10, rdi
mov r11, qword [rbp - 0x80]
cmp r11, 1
jb 0x14000fec1
lea rcx, [r11 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea rbx, [r10 + rax*2]
mov r9, rbx
lea rax, [0x1400bc204]
sub r9, rax
nop
movzx ecx, word [rbx]
cmp cx, 0x5c
jne 0x14000feaa
mov edx, 0x5c
lea r8d, [rdx - 0x5b]
jb 0x14000fea3
cmp cx, dx
ja 0x14000fea3
cmp r8, 1
je 0x14000feb9
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x14000fe87
lea rax, [0x1400bc204]
cmp rbx, r10
je 0x14000fec1
sub rbx, 2
sub r9, 2
jmp 0x14000fe70
sub rbx, r10
sar rbx, 1
jmp 0x14000fec8
mov rbx, 0xffffffffffffffff
lea eax, [rbx + 1]
movsxd rcx, eax
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r14w
cmp r11, rcx
jb 0x140010275
sub r11, rcx
mov r8, 0xffffffffffffffff
cmp r11, r8
cmovb r8, r11
lea rax, [rsp + 0x70]
test sil, sil
cmovne rax, rdi
lea rdx, [rax + rcx*2]
lea rcx, [rbp - 0x50]
call fcn.1400027d0
nop
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
movsxd r8, ebx
cmp qword [rbp - 0x80], r8
cmovb r8, qword [rbp - 0x80]
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400027d0
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000ff8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001025d
call fcn.140070654
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbp - 0x80], xmm1
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.1400025c0
mov rcx, rax
call fcn.14000e210
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r8, qword [rbp - 0x50]
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
je 0x140010010
xor r12b, r12b
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x14000ffff
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400025c0
add qword [r15 + 8], 0x20
jmp 0x140010010
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, r15
call fcn.140017190
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140010050
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001004b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010263
call fcn.140070654
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400100a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001009d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010269
call fcn.140070654
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400100f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400100ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001026f
call fcn.140070654
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000fa69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fa64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010215
jmp 0x14000fa64
cmp r13d, 1
jne 0x1400101a0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, str.Stopping_Service_t:_t_s
call fcn.1400262b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400025c0
mov rcx, rax
call fcn.14000df80
test al, al
jne 0x14000fa73
xor r12b, r12b
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
jne 0x1400101f2
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, r15
call fcn.140017190
jmp 0x14000fa73
cmp r13d, 0xa
jne 0x14000fa73
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [0x1400bd338]
call fcn.1400262b0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400025c0
mov rcx, rax
call fcn.14000ac50
test al, al
jne 0x14000fa73
xor r12b, r12b
mov rax, qword [r15 + 8]
cmp rax, qword [r15 + 0x10]
je 0x14001018b
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1400025c0
add qword [r15 + 8], 0x20
jmp 0x14000fa73
call fcn.140015b70
nop
call fcn.14007d0fc
int3
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3
call fcn.14007d0fc
int3
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.140015b70
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.140015b70
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.140015b70
int3