Function at 0x1400ec080
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x5a0
mov rax, qword [0x14020cc08]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov esi, ecx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbp, rax
je 0x1400ec32b
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x5b0], rbx
mov qword [rsp + 0x5b8], rdi
call fcn.1400012c0
lea rdx, [0x1401b4900]
lea rcx, [rsp + 0x50]
call fcn.140178250
call fcn.1400ce2b0
test rax, rax
je 0x1400ec10b
call fcn.1400ce2b0
lea rdx, str.___s_
lea rcx, [rsp + 0x50]
mov r8, rax
call fcn.140178e90
mov r8, qword [rsp + 0x58]
cmp byte [r8], 0
je 0x1400ec135
movzx eax, byte [r8]
cmp al, 0x5c
je 0x1400ec122
cmp al, 0x2f
jne 0x1400ec126
mov byte [r8], 0x20
add r8, 1
cmp byte [r8], 0
jne 0x1400ec116
mov r8, qword [rsp + 0x58]
lea rcx, [rsp + 0x380]
mov edx, 0x101
call fcn.14017c8b0
lea rcx, [rsp + 0x50]
call fcn.140177510
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rdi, rax
je 0x1400ec269
lea rcx, [rsp + 0x50]
call fcn.1400012c0
lea rdx, [0x1401b4900]
lea rcx, [rsp + 0x50]
call fcn.140178250
call fcn.1400ce2b0
test rax, rax
je 0x1400ec1ab
call fcn.1400ce2b0
lea rdx, str.___s_
lea rcx, [rsp + 0x50]
mov r8, rax
call fcn.140178e90
mov r8, qword [rsp + 0x58]
cmp byte [r8], 0
je 0x1400ec1d5
movzx eax, byte [r8]
cmp al, 0x5c
je 0x1400ec1c2
cmp al, 0x2f
jne 0x1400ec1c6
mov byte [r8], 0x20
add r8, 1
cmp byte [r8], 0
jne 0x1400ec1b6
mov r8, qword [rsp + 0x58]
lea rcx, [rsp + 0x170]
mov edx, 0x101
call fcn.14017c8b0
lea rcx, [rsp + 0x50]
call fcn.140177510
lea rdx, [rsp + 0x170]
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rbx, rax
je 0x1400ec260
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400ec257
lea rdx, [rsp + 0x170]
mov r9d, 1
mov r8d, 0xea60
mov rcx, rdi
call fcn.1400ebac0
test eax, eax
jne 0x1400ec257
lea rdx, [rsp + 0x170]
mov rcx, rdi
call fcn.1400eba00
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x380]
mov r8d, 0x10000
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, qword [rsp + 0x5b8]
test rax, rax
mov rbx, rax
je 0x1400ec2e0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400ec2d5
test esi, esi
je 0x1400ec2d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
je 0x1400ec2d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1402006b8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x20a0]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5ce0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ec318
test esi, esi
je 0x1400ec318
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x1400ec318
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1402006b8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2078]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5ce0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x5b0]
jmp 0x1400ec356
test esi, esi
je 0x1400ec356
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [0x1402006b8]
mov edx, reloc.WS2_32.dll_recv
mov r9, qword [r8 + 0x2088]
mov r8, qword [r8]
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.1400d5ce0
lea rcx, str.InstallService
xor edx, edx
call fcn.140146450
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.1401a8fd0
mov rbp, qword [rsp + 0x5c0]
add rsp, 0x5a0
pop rsi
ret