Function at 0x1403c80a9
Capabilities:
Query service status

Disassembly:
push rax
pushf
mov eax, 0xccd4234c
pushf
not eax
add eax, 0xe8f6964c
xor eax, 0xa4f03da0
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xb3629ed3
xor eax, 0xc39cd585
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xadf7fbef
xor eax, 0x8d422e50
rol eax, 0x36
popf
pushf
not eax
add eax, 0xe265e995
xor eax, 0x846b3b93
rol eax, 0xaa
popf
cmp eax, 4
jne 0x1403c810c
popf
pop rax
jmp 0x1403c8391
cmp eax, 0
jne 0x1403c811b
popf
pop rax
jmp 0x1403c8175
cmp eax, 3
jne 0x1403c812a
popf
pop rax
jmp 0x1403c834b
cmp eax, 1
jne 0x1403c8139
popf
pop rax
jmp 0x1403c8260
cmp eax, 5
jne 0x1403c8148
popf
pop rax
jmp 0x1403c84c1
cmp eax, 7
jne 0x1403c8157
popf
pop rax
jmp 0x1403c8558
cmp eax, 6
jne 0x1403c8166
popf
pop rax
jmp 0x1403c850e
cmp eax, 2
jne 0x1403c8175
popf
pop rax
jmp 0x1403c82c0
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x79ea30dd
pushf
not r8d
add r8d, 0x8ccce4e6
xor r8d, 0xe11740f6
rol r8d, 0xc8
popf
pushf
not r8d
add r8d, 0x92ce691a
xor r8d, 0xbc524b71
rol r8d, 0xee
popf
pushf
not r8d
add r8d, 0x869b1440
xor r8d, 0xbe654c1d
rol r8d, 0xad
popf
xor edx, edx
xor ecx, ecx
jmp 0x1403c81d4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1403c821a
push rax
pushf
mov eax, 0x2531734b
pushf
not eax
add eax, 0x9b580de7
xor eax, 0xf50ba4be
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xbf77581b
xor eax, 0x99f42bdc
rol eax, 0x78
popf
jmp 0x1403c80fd
push rax
pushf
mov eax, 0x7356b88b
pushf
not eax
add eax, 0xd871e8f9
xor eax, 0xebfd78f0
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xf03cf755
xor eax, 0xa056ecc2
rol eax, 0xed
popf
pushf
not eax
add eax, 0x97c5a87a
xor eax, 0xe687d2df
rol eax, 0x75
popf
jmp 0x1403c80fd
xor eax, eax
jmp 0x1403c8558
mov r8d, 0x9f2c469c
pushf
not r8d
add r8d, 0x914775d8
xor r8d, 0xee019881
rol r8d, 0xd
popf
pushf
not r8d
add r8d, 0xc44b95de
xor r8d, 0x837cf2e1
rol r8d, 0xdf
popf
pushf
not r8d
add r8d, 0x899230ee
xor r8d, 0x9f45fc52
rol r8d, 0xbc
popf
pushf
not r8d
add r8d, 0xedda757e
xor r8d, 0xcd06f3b9
rol r8d, 0xff
popf
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
jmp 0x1403c8338
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1403c8391
mov rcx, qword [rsp + 0x38]
jmp 0x1403c8351
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1403c8558
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 0xbb9f3168
pushf
not r9d
add r9d, 0xf089ec65
xor r9d, 0x810e6062
rol r9d, 0x97
popf
pushf
not r9d
add r9d, 0xe5f34e24
xor r9d, 0x9a226b63
rol r9d, 0x5f
popf
pushf
not r9d
add r9d, 0xd25684ef
xor r9d, 0xcbf96c80
rol r9d, 0x23
popf
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, qword [rsp + 0x40]
jmp 0x1403c83f9
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x40]
jmp 0x1403c8409
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x38]
jmp 0x1403c8415
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x30], 0
jne 0x1403c847b
push rax
pushf
mov eax, 0x7b2089
pushf
not eax
add eax, 0xd2a92adf
xor eax, 0xc1b1f340
rol eax, 0x33
popf
pushf
not eax
add eax, 0x82cab64b
xor eax, 0x9c8c7fd0
rol eax, 0x91
popf
pushf
not eax
add eax, 0x86021272
xor eax, 0x95b09156
rol eax, 0xef
popf
pushf
not eax
add eax, 0x9fe14255
xor eax, 0xf5beeb97
rol eax, 0x72
popf
jmp 0x1403c80fd
push rax
pushf
mov eax, 0xd7ae2738
pushf
not eax
add eax, 0xdc83bd6b
xor eax, 0xd9d733f0
rol eax, 6
popf
pushf
not eax
add eax, 0x9d70df27
xor eax, 0xd7062978
rol eax, 0xad
popf
pushf
not eax
add eax, 0xd0a2b10c
xor eax, 0xa7bfbf95
rol eax, 0x40
popf
jmp 0x1403c80fd
xor eax, eax
jmp 0x1403c8558
mov eax, dword [rsp + 0x4c]
push rax
pushf
mov eax, 0x5e155ac7
pushf
not eax
add eax, 0xbb29d225
xor eax, 0x90e4d5bc
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xd5b5d694
xor eax, 0x81efd738
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x87de1e3d
xor eax, 0xfcb87adb
rol eax, 0x72
popf
jmp 0x1403c80fd
add rsp, 0x78
ret