Function at 0x140090990
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1401770a0]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov rsi, rdx
mov dword [rdx], 1
mov r8d, 1
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140090c89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rbp - 0x70], 0x80728045
mov dword [rbp - 0x6c], 0x806f8072
mov dword [rbp - 0x68], 0x802c8072
mov dword [rbp - 0x64], 0x80638020
mov dword [rbp - 0x60], 0x806c8061
mov dword [rbp - 0x5c], 0x8069806c
mov dword [rbp - 0x58], 0x8067806e
mov dword [rbp - 0x54], 0x804f8020
mov dword [rbp - 0x50], 0x80658070
mov dword [rbp - 0x4c], 0x8053806e
mov dword [rbp - 0x48], 0x804d8043
mov dword [rbp - 0x44], 0x806e8061
mov dword [rbp - 0x40], 0x80678061
mov dword [rbp - 0x3c], 0x80728065
mov dword [rbp - 0x38], 0x803a8057
mov dword [rbp - 0x34], 0x807b8020
mov dword [rbp - 0x30], 0x8000807d
xor r14d, r14d
mov word [rbp - 0x2c], r14w
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.14001a290
nop
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
mov dword [rsp + 0x60], ebx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x40], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x40], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140090ad0
mov qword [rsp + 0x48], rax
lea r8, [rbp]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.1400222b0
nop
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea r12, [rbp + 0x10]
mov r13, qword [rbp + 0x28]
cmp r13, 8
setae byte [rsp + 0x30]
mov r15, qword [rbp + 0x10]
cmovae r12, r15
mov rbx, qword [rbp + 0x20]
cmp rbx, 8
jae 0x140090b3b
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], 7
mov esi, 7
jmp 0x140090b7d
mov rsi, rbx
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
cmova rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x70]
call fcn.140043ab0
mov qword [rsp + 0x70], rax
lea r8, [rbx*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400fabc0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], rbx
lea rbx, [rsp + 0x70]
cmp rsi, 8
cmovae rbx, qword [rsp + 0x70]
call fcn.14003cb20
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._BDREINIT__::_GetServiceState____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.14003f560
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140090bf2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090bed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091211
call fcn.1400f877c
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
cmp byte [rsp + 0x30], 0
je 0x140090c41
lea rdx, [r13*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x140090c38
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091217
mov rcx, r15
call fcn.1400f877c
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x140090c81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090c7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009121d
call fcn.1400f877c
xor sil, sil
jmp 0x1400911c6
mov r8d, 4
lea r14, str.wersvc
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
setne byte [rsp + 0x31]
test rax, rax
jne 0x140090edc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdx, [rbp + 0x30]
call fcn.140091240
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x140090cd9
mov rcx, qword [rax]
mov dword [rbp], esi
mov qword [rsp + 0x60], r14
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x20], xmm1
mov qword [rsp + 0x60], 0xc2
lea rax, [rbp + 0x10]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x60], rcx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140090d20
mov qword [rsp + 0x68], rax
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.1400222b0
nop
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea r12, [rbp - 0x20]
cmp qword [rbp - 8], 8
setae byte [rsp + 0x30]
mov r13, qword [rbp - 0x20]
cmovae r12, r13
mov rsi, qword [rbp - 0x10]
cmp rsi, 8
jae 0x140090d8a
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], 7
lea r15d, [r14 + 7]
jmp 0x140090dcc
mov r15, rsi
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rsp + 0x70]
call fcn.140043ab0
mov qword [rsp + 0x70], rax
lea r8, [rsi*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400fabc0
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], rsi
lea rsi, [rsp + 0x70]
cmp r15, 8
cmovae rsi, qword [rsp + 0x70]
call fcn.14003cb20
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str._BDREINIT__::_GetServiceState____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.14003f560
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140090e41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091223
call fcn.1400f877c
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
cmp byte [rsp + 0x30], 0
je 0x140090e94
mov rdx, qword [rbp - 8]
lea rdx, [rdx*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x140090e8b
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091229
mov rcx, r13
call fcn.1400f877c
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1400911a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400911a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009120b
jmp 0x1400911a3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x70], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400911ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rbp - 0x70], 0x80728045
mov dword [rbp - 0x6c], 0x806f8072
mov dword [rbp - 0x68], 0x802c8072
mov dword [rbp - 0x64], 0x80638020
mov dword [rbp - 0x60], 0x806c8061
mov dword [rbp - 0x5c], 0x8069806c
mov dword [rbp - 0x58], 0x8067806e
mov dword [rbp - 0x54], 0x80518020
mov dword [rbp - 0x50], 0x80658075
mov dword [rbp - 0x4c], 0x80798072
mov dword [rbp - 0x48], 0x80658053
mov dword [rbp - 0x44], 0x80768072
mov dword [rbp - 0x40], 0x80638069
mov dword [rbp - 0x3c], 0x80538065
mov dword [rbp - 0x38], 0x80618074
mov dword [rbp - 0x34], 0x80758074
mov dword [rbp - 0x30], 0x803a8073
mov dword [rbp - 0x2c], 0x807b8020
mov dword [rbp - 0x28], 0x8000807d
xor r14d, r14d
mov word [rbp - 0x24], r14w
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x10]
call fcn.14001a290
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
mov dword [rbp], esi
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x60], 2
lea rax, [rbp]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140091000
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.1400222b0
nop
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r14
lea r12, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
setae byte [rsp + 0x30]
mov r13, qword [rbp + 0x30]
cmovae r12, r13
mov rsi, qword [rbp + 0x40]
cmp rsi, 8
jae 0x140091068
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], 7
mov r15d, 7
jmp 0x1400910a8
mov r15, rsi
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rbp - 0x20]
call fcn.140043ab0
mov qword [rbp - 0x20], rax
lea r8, [rsi*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400fabc0
mov qword [rbp - 8], r15
mov qword [rbp - 0x10], rsi
lea rsi, [rbp - 0x20]
cmp r15, 8
cmovae rsi, qword [rbp - 0x20]
call fcn.14003cb20
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str._BDREINIT__::_GetServiceState____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.14003f560
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14009111a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091115
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009122f
call fcn.1400f877c
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
cmp byte [rsp + 0x30], 0
je 0x14009116c
mov rdx, qword [rbp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x140091163
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091235
mov rcx, r13
call fcn.1400f877c
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1400911a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400911a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091205
call fcn.1400f877c
xor sil, sil
jmp 0x1400911b5
mov eax, dword [rbp + 0x54]
mov dword [rsi], eax
mov sil, 1
cmp byte [rsp + 0x31], 0
je 0x1400911c6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rdi, rdi
je 0x1400911d4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, sil
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.1400f8730
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400ff670
nop
call fcn.1400ff670
nop
call fcn.1400ff670
nop
call fcn.1400ff670
nop
call fcn.1400ff670
nop
call fcn.1400ff670
nop
call fcn.1400ff670
nop
call fcn.1400ff670
nop
call fcn.1400ff670
int3