Function at 0x140074e50
Capabilities:
Check for time delay via gettickcount
Create process on windows
Get common file path
Modify service
Query service status
Set current directory
Start service
Stop service

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x420
mov qword [rsp + 0x220], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov rdi, qword [0x140183698]
xor r14d, r14d
mov dword [rsp + 0x64], r14d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x140074f35
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x298], rax
add rax, 0x18
mov qword [rsp + 0xb0], rax
mov r9d, 0x1be8
xor r8d, r8d
lea rdx, str.OpenSCManager___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xb0]
call fcn.140016060
nop
mov rax, qword [rsp + 0xb0]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x1c8], rax
or rdi, 0xffffffffffffffff
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140074f30
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.LTVSrv
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x14007547f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x60], eax
cmp eax, 0x424
je 0x140074ffb
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x230], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x108], rcx
mov r9d, 0x1bf6
mov r8d, ebx
lea rdx, str.OpenService___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0x108]
call fcn.140016060
nop
mov rax, qword [rsp + 0x108]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x178], rax
or rdi, 0xffffffffffffffff
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140074ff6
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x2c0]
call fcn.1400dd9f0
mov dword [rsp + 0x2c0], WSAGetLastError
xor eax, eax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rax
call fcn.14007da60
mov r8, rax
lea rdx, str.cmd.exe__C
lea rcx, [rsp + 0x1d8]
call fcn.140036910
nop
lea r8, [0x14012ed28]
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.1400162e0
nop
lea rcx, str.Ltprxinstall64.cmd
lea r8, str.Ltprxinstall.cmd
cmp dword [rdi + 0x188], 0
cmovne r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400162e0
nop
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x188], rcx
or rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x1400750c9
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x198], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x1400750fb
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x2b0], rax
add rax, 0x18
mov qword [rsp + 0x70], rax
call fcn.14007da60
mov rdx, rax
lea r8, [0x14012ed28]
lea rcx, [rsp + 0x138]
call fcn.1400162e0
nop
lea r8, str.Ltprx
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.1400162e0
nop
mov rcx, qword [rsp + 0x138]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1a8], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x140075184
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x70]
lea rax, [rbx - 0x18]
mov qword [rsp + 0x240], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x148], ecx
mov eax, dword [rax + 0xc]
sub eax, 0x104
mov dword [rsp + 0x200], eax
or eax, ecx
jge 0x1400751cb
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.1400020c0
mov rbx, qword [rsp + 0x70]
cmp dword [rbx - 0xc], 0x104
jge 0x1400751de
mov ecx, 0x80070057
call fcn.1400022b0
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], r14w
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd r11, dword [rbx - 0xc]
mov dword [rsp + 0x158], r11d
mov rdx, r11
mov rcx, rbx
call fcn.1400d4f10
mov dword [rsp + 0x210], eax
test eax, eax
js 0x140075474
cmp eax, dword [rbx - 0xc]
jg 0x140075474
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdx, qword [rsp + 0x90]
lea rax, [rdx - 0x18]
mov qword [rsp + 0x290], rax
cmp dword [rax + 0x10], 1
jle 0x140075274
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x90]
call fcn.140001fb0
mov rdx, qword [rsp + 0x90]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
test eax, eax
je 0x14007533e
mov edx, 0x7530
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
jmp 0x1400752db
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x20
lea rdx, str.LTVSrv
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400753c4
lea r8, [rsp + 0x3f0]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x1400753c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x60], eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x250], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0xc8], rcx
mov r9d, 0x1c1c
mov r8d, ebx
lea rdx, str.CreateProcess___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xc8]
call fcn.140016060
nop
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1e8], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x1400753bf
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rsp + 0xf8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1b8], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x14007540f
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x208], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x14007543f
mov rdx, qword [rsp + 0x208]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x90]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x160], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x14007546f
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
mov ecx, 0x80070057
call fcn.1400022b0
nop
lea r9, [rsp + 0x64]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov dword [rsp + 0x68], eax
test eax, eax
jne 0x140075e65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x60], eax
cmp eax, 0x7a
je 0x140075541
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x2b8], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0xd8], rcx
mov r9d, 0x1c2e
mov r8d, edi
lea rdx, str.QueryServiceConfig___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xd8]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0xd8]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x170], rax
or rdi, 0xffffffffffffffff
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x14007553c
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
mov r12d, dword [rsp + 0x64]
mov dword [rsp + 0x21c], r12d
mov ecx, r12d
mov qword [rsp + 0x260], rcx
mov qword [rsp + 0x360], r14
or rdi, 0xffffffffffffffff
test r12d, r12d
je 0x14007559d
xor edx, edx
mov rax, rdi
div rcx
cmp rax, 1
jae 0x140075582
mov ecx, 0x80070216
call fcn.1400022b0
cmp rcx, 0x80
jbe 0x14007559d
mov rdx, rcx
lea rcx, [rsp + 0x360]
call fcn.14001c170
jmp 0x1400755ad
lea rax, [rsp + 0x368]
mov qword [rsp + 0x360], rax
mov r13, qword [rsp + 0x360]
mov qword [rsp + 0x2a0], r13
lea r9, [rsp + 0x64]
mov r8d, r12d
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov dword [rsp + 0x68], eax
test eax, eax
jne 0x14007568a
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x270], rax
add rax, 0x18
mov qword [rsp + 0x118], rax
mov r9d, 0x1c3d
mov r8d, 0x7a
lea rdx, str.AgentGuard:_QueryServiceConfig___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0x118]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0x118]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x180], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075666
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lea rax, [rsp + 0x368]
cmp qword [rsp + 0x360], rax
je 0x140075685
lea rcx, [rsp + 0x360]
call fcn.140043680
jmp 0x140075efb
cmp dword [r13 + 4], 2
je 0x140075787
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
or r9d, 0xffffffff
mov r8d, 2
or edx, r9d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [rsp + 0x68], eax
test eax, eax
jne 0x140075787
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x2a8], rax
add rax, 0x18
mov qword [rsp + 0xe8], rax
mov r9d, 0x1c55
mov r8d, 0x7a
lea rdx, str.ChangeServiceConfig___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xe8]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0xe8]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x190], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075763
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
lea rax, [rsp + 0x368]
cmp qword [rsp + 0x360], rax
je 0x140075782
lea rcx, [rsp + 0x360]
call fcn.140043680
jmp 0x140075efb
lea rax, [rsp + 0x368]
cmp qword [rsp + 0x360], rax
je 0x1400757a6
lea rcx, [rsp + 0x360]
call fcn.140043680
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x330]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov dword [rsp + 0x68], eax
test eax, eax
jne 0x14007586c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov dword [rsp + 0x60], eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x280], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0xb8], rcx
mov r9d, 0x1c70
mov r8d, r12d
lea rdx, str.QueryServiceStatusEx___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xb8]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0xb8]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x1a0], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075867
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
mov eax, dword [rsp + 0x334]
cmp eax, 1
je 0x140075881
cmp eax, 3
jne 0x140075e4d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
mov dword [rsp + 0xa0], eax
mov r12d, dword [rsp + 0x344]
mov dword [rsp + 0xa8], r12d
mov r14d, 0x2710
nop word [rax + rax]
cmp dword [rsp + 0x334], 3
jne 0x140075a86
mov eax, 0xcccccccd
mul dword [rsp + 0x348]
shr edx, 3
cmp edx, 0x3e8
jae 0x1400758dc
mov edx, 0x3e8
jmp 0x1400758e3
cmp edx, r14d
cmova edx, r14d
mov dword [rsp + 0x9c], edx
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x64]
mov qword [rsp + 0x20], r11
mov r9d, 0x24
lea r8, [rsp + 0x330]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov dword [rsp + 0x218], eax
test eax, eax
jne 0x1400759bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov dword [rsp + 0x60], eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x228], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0xc0], rcx
mov r9d, 0x1c94
mov r8d, r12d
lea rdx, str.QueryServiceStatusEx___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xc0]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0xc0]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x1b0], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x1400759b6
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
cmp dword [rsp + 0x344], r12d
jbe 0x1400759ea
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
mov dword [rsp + 0xa0], eax
mov r12d, dword [rsp + 0x344]
mov dword [rsp + 0xa8], r12d
jmp 0x140075a81
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r13d
cmp eax, dword [rsp + 0x348]
jbe 0x140075a81
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x238], rax
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rdx, str.Timeout_waiting_for_service_to_stop._n
lea rcx, [rsp + 0xd0]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0xd0]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x1c0], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075a7c
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
jmp 0x1400758b0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [rsp + 0x68], eax
test eax, eax
jne 0x140075b37
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov dword [rsp + 0x60], eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x248], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0xe0], rcx
mov r9d, 0x1cb4
mov r8d, r12d
lea rdx, str.StartService___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xe0]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0xe0]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x1d0], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075b32
mov rdx, qword [rsp + 0x1d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x330]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov dword [rsp + 0x68], eax
test eax, eax
jne 0x140075bfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov dword [rsp + 0x60], eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x258], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0xf0], rcx
mov r9d, 0x1cc2
mov r8d, r12d
lea rdx, str.AgentGuard:_QueryServiceStatusEx___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0xf0]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0xf0]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x1e0], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075bf8
mov rdx, qword [rsp + 0x1e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x140075efb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
mov dword [rsp + 0xa4], eax
mov r12d, dword [rsp + 0x344]
mov dword [rsp + 0xac], r12d
nop dword [rax]
cmp dword [rsp + 0x334], 2
jne 0x140075d6a
mov eax, 0xcccccccd
mul dword [rsp + 0x348]
shr edx, 3
cmp edx, 0x3e8
jae 0x140075c4c
mov edx, 0x3e8
jmp 0x140075c53
cmp edx, r14d
cmova edx, r14d
mov dword [rsp + 0x98], edx
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x64]
mov qword [rsp + 0x20], r11
mov r9d, 0x24
lea r8, [rsp + 0x330]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov dword [rsp + 0x168], eax
test eax, eax
jne 0x140075d27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x60], eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x268], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x100], rcx
mov r9d, 0x1ce1
mov r8d, ebx
lea rdx, str.QueryServiceStatusEx___returned_ERROR__0x_X____u._n
lea rcx, [rsp + 0x100]
call fcn.140016060
nop
mov rcx, qword [rsp + 0x100]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1f0], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
dec eax
test eax, eax
jg 0x140075d15
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
jmp 0x140075d6a
cmp dword [rsp + 0x344], r12d
jbe 0x140075d53
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
mov dword [rsp + 0xa4], eax
mov r12d, dword [rsp + 0x344]
mov dword [rsp + 0xac], r12d
jmp 0x140075d65
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r13d
cmp eax, dword [rsp + 0x348]
ja 0x140075d6a
jmp 0x140075c20
cmp dword [rsp + 0x334], 4
je 0x140075e4d
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x278], rax
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.AgentGuard:_Service_not_started._n
lea rcx, [rsp + 0x78]
call fcn.140016060
mov r8d, dword [rsp + 0x334]
lea rdx, str._Current_State:__d_n
lea rcx, [rsp + 0x78]
call fcn.140016060
mov r8d, dword [rsp + 0x33c]
lea rdx, str._Exit_Code:__d_n
lea rcx, [rsp + 0x78]
call fcn.140016060
mov r8d, dword [rsp + 0x344]
lea rdx, str._Check_Point:__d_n
lea rcx, [rsp + 0x78]
call fcn.140016060
mov r8d, dword [rsp + 0x348]
lea rdx, str._Wait_Hint:__d_n
lea rcx, [rsp + 0x78]
call fcn.140016060
nop
mov rax, qword [rsp + 0x78]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x140], rax
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075e3d
mov rdx, qword [rsp + 0x140]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x140075efb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x60], eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
mov qword [rsp + 0x288], rax
lea rcx, [rax + 0x18]
mov qword [rsp + 0x110], rcx
mov r9d, 0x1c61
mov r8d, edi
lea rdx, str.QueryServiceConfig___returned_ERROR__0x_X___cannot_be_there___u._n
lea rcx, [rsp + 0x110]
call fcn.140016060
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rsp + 0x110]
add rax, 0xffffffffffffffe8
mov qword [rsp + 0x150], rax
or rdi, 0xffffffffffffffff
lock xadd dword [rax + 0x10], edi
dec edi
test edi, edi
jg 0x140075efb
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop r12
ret