Function at 0x140207dd0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14049bcb8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r13, r9
mov r12, r8
movzx r14d, dl
mov byte [rsp + 0x30], dl
mov r15, rcx
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x38], rbx
mov rdi, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
call fcn.1402063d0
cmp eax, 0x80004004
jne 0x140208099
lea rcx, str.Timed_out_while_waiting_for_NetCfgInstanceId__try_again_immediately..._n
call fcn.140204f50
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, r13
mov r8, r12
movzx edx, r14b
mov rcx, r15
call fcn.1402063d0
mov ebx, eax
cmp eax, 0x80004004
jne 0x140208099
lea rcx, str.Timed_out_again_while_waiting_for_NetCfgInstanceId__try_again_after_a_while..._n
call fcn.140204f50
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x140208031
mov r8d, 0x80000000
lea rdx, str.NetSetupSvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140208008
xor ebx, ebx
lea r14, [0x140000000]
nop dword [rax + rax]
mov dword [rsp + 0x44], 4
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140207fa8
mov eax, dword [rsp + 0x44]
dec eax
cmp eax, 6
ja case.default.0x140207ef8
mov ecx, dword [r14 + rax*4 + 0x2080c0]
add rcx, r14
jmp rcx
lea rdx, str.is_not_running
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
lea rdx, str.is_stopping
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
lea rdx, str.continue_is_pending
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
lea rdx, str.pause_is_pending
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
lea rdx, str.is_paused
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
lea rdx, str.is_running
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
lea rdx, str.is_starting
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
lea rdx, str.state_is_invalid
lea rcx, str.NetSetupSvc__s_n
call fcn.140204f50
jmp 0x140207fbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryServiceStatus_failed__0x_x__n
call fcn.140204f50
cmp dword [rsp + 0x44], 1
je 0x140207fd9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3c
jl 0x140207ec0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
movzx edx, byte [rsp + 0x30]
mov rcx, r15
call fcn.1402063d0
mov ebx, eax
jmp 0x14020801c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed___Rwc__n
call fcn.140204f50
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, 0x80004004
je 0x140208045
mov eax, ebx
jmp 0x140208099
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed___Rwc_
call fcn.140204f50
test rdi, rdi
je 0x140208094
mov qword [rsp + 0x38], 0
lea rdx, str.Querying_NetCfgInstanceId_failed__ERROR_FILE_NOT_FOUND_
lea rcx, [rsp + 0x38]
call fcn.140204ba0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140208079
mov qword [rsp + 0x38], 0
jmp 0x140208086
mov rcx, qword [0x1403c1fa0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
lea rcx, [rsp + 0x38]
call fcn.1402041c0
nop
mov eax, 0x80004005
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140202f70
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret