Function at 0x1600b1608
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov r15, rcx
mov byte [rdx], 0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rbp - 0x11], rax
test rax, rax
jne 0x1600b1674
mov rcx, qword [rbp + 0x5f]
lea r8, str.onecoreuap_base_appmodel_search_search_search_searchdll_searchlifetimemanager.cpp
lea edx, [rax + 0x20]
call fcn.1600b29e0
mov esi, eax
jmp 0x1600b18bf
mov r8d, 4
lea rdx, str.wsearch
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rbx, rax
mov qword [rbp - 9], rax
test rax, rax
jne 0x1600b169b
lea edx, [rax + 0x23]
jmp 0x1600b16d4
mov esi, 0x24
mov r8d, esi
xor edx, edx
lea rcx, [rbp - 1]
call sub.msvcrt.dll_memset
and dword [rbp - 0x41], 0
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp - 1]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1600b16eb
lea edx, [rsi + 3]
lea r8, str.onecoreuap_base_appmodel_search_search_search_searchdll_searchlifetimemanager.cpp
mov rcx, qword [rbp + 0x5f]
call fcn.1600b29e0
mov esi, eax
jmp 0x1600b18b0
cmp dword [rbp + 3], 4
je 0x1600b16f8
xor esi, esi
jmp 0x1600b18b0
and qword [rbp - 0x39], 0
lea rax, [rbp - 0x39]
mov qword [rbp - 0x31], rax
and qword [rbp - 0x29], 0
mov byte [rbp - 0x21], 1
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.SOFTWAREMicrosoftWindows_SearchSearchIdle
mov rcx, 0xffffffff80000002
call fcn.16005ab8c
test eax, eax
sete sil
cmp byte [rbp - 0x21], 0
je 0x1600b1749
mov rdx, qword [rbp - 0x29]
mov rcx, qword [rbp - 0x31]
call fcn.16005e8e8
test sil, sil
je 0x1600b1755
xor esi, esi
jmp 0x1600b18a0
and qword [rbp - 0x49], 0
lea rcx, [rbp - 0x49]
call fcn.16000db94
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
lea r9, [0x1601f85f0]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [0x160200a18]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov esi, eax
add eax, 0x7ff8fbe3
cmp eax, 0x11
ja 0x1600b17a0
mov ecx, 0x280a1
bt ecx, eax
jb 0x1600b1894
cmp esi, 0x800704db
je 0x1600b1894
test esi, esi
jns 0x1600b17cd
mov rcx, qword [rbp + 0x5f]
mov r9d, esi
lea r8, str.onecoreuap_base_appmodel_search_search_search_searchdll_searchlifetimemanager.cpp
mov edx, 0x42
call fcn.1600b29f8
jmp 0x1600b1896
and qword [rbp - 0x51], 0
mov rsi, qword [rbp - 0x49]
lea rcx, [rbp - 0x51]
call fcn.16000db94
mov rax, qword [rsi]
lea rdx, [rbp - 0x51]
mov rcx, rsi
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov esi, eax
test eax, eax
jns 0x1600b1813
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_searchdll_searchlifetimemanager.cpp
mov edx, 0x45
call fcn.1600b29f8
jmp 0x1600b1889
and qword [rbp - 0x59], 0
lea rcx, [rbp - 0x59]
call fcn.16000db94
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
lea r8, [rbp - 0x59]
lea rdx, [0x1601f85e0]
mov rax, qword [rax]
call qword [case.0x16003fc5a.0]
mov esi, eax
test eax, eax
jns 0x1600b185c
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_searchdll_searchlifetimemanager.cpp
mov edx, 0x48
call fcn.1600b29f8
jmp 0x1600b187f
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x1600b1876
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rbp - 0x59]
mov qword [r15], rcx
mov byte [r14], 1
xor esi, esi
lea rcx, [rbp - 0x59]
call fcn.16000db94
nop
lea rcx, [rbp - 0x51]
call fcn.16000db94
jmp 0x1600b1896
xor esi, esi
lea rcx, [rbp - 0x49]
call fcn.16000db94
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1600b18b0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
test rbx, rbx
je 0x1600b18bf
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop
test rdi, rdi
je 0x1600b18cd
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret