Function at 0x100b178
Capabilities:
Modify service

Disassembly:
mov r11, rsp
push r12
push r13
push r15
sub rsp, 0x110
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
lea rax, [rsp + 0x60]
mov qword [r11 + 0x10], rax
lea r12, [0x01005150]
mov qword [rsp + 0x60], r12
lea r13, [0x01004860]
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], 0x30c
mov dword [rsp + 0x74], 0x4000
xor esi, esi
mov dword [rsp + 0x78], esi
mov word [r11 - 0x58], si
mov byte [r11 - 0x56], sil
mov byte [r11 - 0x55], 1
lea r15d, [rsi + 0x50]
mov r8, r15
xor edx, edx
lea rcx, [r11 - 0xa8]
call sub.MSVCR80.dll_memset
nop
lea r8, [0x01005a20]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.010060b0
nop
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
cmp rax, rsi
jne 0x100b2b7
lea rax, [rsp + 0x60]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], 0x317
mov dword [rsp + 0x74], 0x4000
mov dword [rsp + 0x78], esi
mov word [rsp + 0xd0], si
mov byte [rsp + 0xd2], sil
mov byte [rsp + 0xd3], 1
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.MSVCR80.dll_memset
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, 0x80070000
cmp eax, esi
cmovle r8d, eax
lea r9, [0x01005a68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.0100e930
mov r8d, 2
lea rdx, [0x01004718]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
cmp rax, rsi
jne 0x100b368
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x138], r11
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], 0x327
mov dword [rsp + 0x74], 0x4000
mov dword [rsp + 0x78], esi
mov word [rsp + 0xd0], si
mov byte [rsp + 0xd2], sil
mov byte [rsp + 0xd3], 1
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.MSVCR80.dll_memset
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, 0x80070000
cmp eax, esi
cmovle r8d, eax
lea r9, [0x01005a88]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.0100e930
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
or edx, 0xffffffff
mov r9d, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
cmp eax, esi
jne 0x100b440
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x138], r11
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], 0x340
mov dword [rsp + 0x74], 0x4000
mov dword [rsp + 0x78], esi
mov word [rsp + 0xd0], si
mov byte [rsp + 0xd2], sil
mov byte [rsp + 0xd3], 1
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x80]
call sub.MSVCR80.dll_memset
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, 0x80070000
cmp eax, esi
cmovle r8d, eax
lea r9, [0x01005aa0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.0100e930
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0xd8]
call fcn.010061b0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret