Function at 0x140056c80
Capabilities:
Create service
Delete service
Query service status
Start service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x330], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r13, rdx
mov qword [rbp - 0x78], rdx
mov r15, rcx
xor eax, eax
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x80], 8
lea rcx, [rbp - 0x40]
call fcn.140057720
test eax, eax
jne 0x140056ee5
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.ProcObsrv.NT.Wdf
test rdx, 0xffffffffffff0000
jne 0x140056d2f
movzx edi, dx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140056d40
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400029f0
jmp 0x140056d40
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x70]
call fcn.140002120
nop
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
lea rcx, [rbp - 0x40]
lea rax, [rbp - 0x40]
xor r12d, r12d
or rsi, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x140056d9e
movzx edi, cx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140056e97
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400029f0
mov rbx, qword [rsp + 0x78]
jmp 0x140056e97
xor eax, eax
mov rcx, rsi
lea rdi, [rbp - 0x40]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x140056e16
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140056e97
cmp dword [rdx + 0x10], eax
jge 0x140056de9
cmp dword [rbx - 0xc], eax
jge 0x140056ddc
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x140056e97
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140056dff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
jmp 0x140056e97
mov r14d, dword [rbx - 0x10]
lea r13, [rbp - 0x40]
sub r13, rbx
sar r13, 1
test ecx, ecx
jns 0x140056e33
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140056e55
mov edx, edi
lea rcx, [rsp + 0x78]
call fcn.1400020c0
mov rbx, qword [rsp + 0x78]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r13, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x140056e79
lea r8, [rbx + r13*2]
call fcn.1400d4ebc
jmp 0x140056e82
lea r8, [rbp - 0x40]
call fcn.1400d4e34
cmp edi, dword [rbx - 0xc]
jg 0x1400570d6
mov dword [rbx - 0x10], edi
mov word [r14 + rbx], r12w
mov r13, qword [rbp - 0x78]
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
call qword [0x140183048]
test eax, eax
je 0x140056eec
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140056ec8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x70]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140056ee5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor al, al
jmp 0x1400570e1
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
lea r8, str.ProcObsrv
lea rdx, str.ProcObsrv
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x140056f81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x140056f5f
cmp eax, 0x430
jne 0x140057068
mov r8d, 0xf01ff
lea rdx, str.ProcObsrv
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x140057068
xor eax, eax
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], eax
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140057008
test rdi, rdi
je 0x140057017
lea rdx, [rbp - 0x68]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov r12d, eax
test eax, eax
je 0x140057017
mov r13d, 0x2710
cmp dword [rbp - 0x64], 4
je 0x140057017
mov eax, 0xcccccccd
mul dword [rbp - 0x50]
shr edx, 3
cmp edx, 0x3e8
jae 0x140056fe3
mov edx, 0x3e8
jmp 0x140056fea
cmp edx, r13d
cmova edx, r13d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x68]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov r12d, eax
test eax, eax
jne 0x140056fc3
jmp 0x140057017
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
sete r12b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r12d, r12d
jne 0x14005705a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test rdi, rdi
je 0x14005703a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140057055
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x140056ec8
test rdi, rdi
je 0x140057068
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
call qword [0x140182f78]
test eax, eax
je 0x14005709a
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140057095
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x140056ec8
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400570b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rax, qword [rsp + 0x70]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400570d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov al, 1
jmp 0x1400570e1
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x330]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret