Function at 0x140002750
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x280
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rcx
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp + 0x58], xmm0
xor r15d, r15d
mov word [rbp + 0x48], r15w
lea r9, str._C:Program_FilesHuaweiPCManagerMateBookService.exe_
lea edx, [r15 + 0x37]
lea rcx, [rbp + 0x48]
call fcn.140004e80
nop
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r15w
lea r9, str._C:Program_FilesHuaweiBasicServiceBasicService.exe_
lea edx, [r15 + 0x37]
lea rcx, [rbp + 0x28]
call fcn.140004e80
nop
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r15w
lea r9, str.Huawei_PCManager_Windows_Service
lea edx, [r15 + 0x20]
lea rcx, [rbp + 8]
call fcn.140004e80
nop
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r15w
lea r9, str.Huawei_PC_Core_Service
lea edx, [r15 + 0x16]
lea rcx, [rbp - 0x18]
call fcn.140004e80
nop
mov r14d, r15d
mov dword [rsp + 0x70], r15d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14000291d
lea rcx, [rbp + 0x70]
call fcn.140001e50
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.fail_to_Open_SC_Manager._error_
lea rcx, [rbp + 0x80]
call fcn.140004980
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000774c]
call fcn.140004790
mov rcx, rax
lea rdx, str._anonymous_namespace::InstallService
call fcn.140004980
mov rcx, rax
lea rdx, [0x140007748]
call fcn.140004790
call qword [sym.imp.LogHelper.dll_public:_static_class_HwLogger____ptr64___cdecl_HwLogger::GetInstance_void_]
mov rcx, rax
lea r8, [rbp + 0x70]
lea edx, [r15 + 4]
call qword [sym.imp.LogHelper.dll_public:_void___cdecl_HwLogger::Log_enum_LOG_MESSAGE_LEVEL__class_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x88]
call fcn.140004190
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
jmp 0x140003247
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x14000292a
mov r8, qword [rsi]
mov r14d, 0xe
lea rdi, [0x140007750]
cmp qword [rsi + 0x10], r14
jne 0x14000295e
mov edx, r14d
mov rcx, rdi
sub r8, rdi
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x14000295e
add rcx, 2
sub rdx, 1
jne 0x140002946
mov al, 1
jmp 0x140002960
xor al, al
lea rcx, str.C:Program_FilesHuaweiPCManagerMateBookService.exe
lea r9, str.C:Program_FilesHuaweiBasicServiceBasicService.exe
test al, al
cmovne r9, rcx
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140002990
lea rcx, [rbp - 0x78]
cmp rdx, 7
ja 0x1400029c0
mov qword [rbp - 0x68], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx - 0x78], r15w
jmp 0x1400029c6
call fcn.140004e80
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.HwFileUtil.dll_bool___cdecl_DE::FileExists_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64_]
test al, al
jne 0x140002aeb
mov r14d, 4
lea rcx, [rbp + 0x70]
call fcn.140001e50
nop
lea rdx, str.InstallService_exe_not_exist
lea rcx, [rbp + 0x80]
call fcn.140004790
mov rcx, rax
lea rdx, [0x14000774c]
call fcn.140004790
mov rcx, rax
lea rdx, str._anonymous_namespace::InstallService
call fcn.140004980
mov rcx, rax
lea rdx, [0x140007748]
call fcn.140004790
call qword [sym.imp.LogHelper.dll_public:_static_class_HwLogger____ptr64___cdecl_HwLogger::GetInstance_void_]
mov rcx, rax
lea r8, [rbp + 0x70]
mov edx, r14d
call qword [sym.imp.LogHelper.dll_public:_void___cdecl_HwLogger::Log_enum_LOG_MESSAGE_LEVEL__class_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x88]
call fcn.140004190
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140002acf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002aca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rsi, qword [rsp + 0x78]
jmp 0x14000323d
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x140002af8
mov r8, qword [rsi]
cmp qword [rsi + 0x10], 0xe
jne 0x140002b28
mov rdx, r14
mov rcx, rdi
sub r8, rdi
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140002b28
add rcx, 2
sub rdx, 1
jne 0x140002b10
mov al, 1
jmp 0x140002b2a
xor al, al
lea r12, [rbp + 8]
lea rcx, [rbp - 0x18]
test al, al
cmove r12, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov r13, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x140002b51
mov r12, qword [r12]
movabs rdx, 0x7ffffffffffffffe
mov ebx, 7
movabs r8, 0x7fffffffffffffff
cmp r13, 8
jae 0x140002b85
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x58], xmm0
mov r15d, ebx
mov qword [rbp - 0x40], rbx
jmp 0x140002c28
mov r15, r13
or r15, rbx
cmp r15, rdx
cmova r15, rdx
lea rax, [r15 + 1]
lea rdx, [rax + rax]
cmp rax, r8
jbe 0x140002bab
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x140002bbb
cmp rdx, 0x1000
jb 0x140002be8
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.140005a44
mov rcx, rax
test rax, rax
je 0x140002be1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002bf9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdx, rdx
je 0x140002bf7
mov rcx, rdx
call fcn.140005a44
jmp 0x140002bf9
xor eax, eax
mov qword [rbp - 0x58], rax
lea r8, [r13*2 + 2]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x40], r15
movabs rdx, 0x7ffffffffffffffe
movabs r8, 0x7fffffffffffffff
mov qword [rbp - 0x48], r13
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140002c39
mov rcx, qword [rsi]
cmp qword [rsi + 0x10], 0xe
jne 0x140002c5a
sub rcx, rdi
movzx eax, word [rdi]
cmp word [rdi + rcx], ax
jne 0x140002c5a
add rdi, 2
sub r14, 1
jne 0x140002c43
mov al, 1
jmp 0x140002c5c
xor al, al
lea rdi, [rbp + 0x48]
lea rcx, [rbp + 0x28]
test al, al
cmove rdi, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov r14, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140002c80
mov rdi, qword [rdi]
cmp r14, 8
jae 0x140002c92
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x38], xmm0
jmp 0x140002d22
mov rbx, r14
or rbx, 7
cmp rbx, rdx
cmova rbx, rdx
lea rax, [rbx + 1]
lea rdx, [rax + rax]
cmp rax, r8
jbe 0x140002cb9
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x140002cc9
cmp rdx, 0x1000
jb 0x140002cf6
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.140005a44
mov rcx, rax
test rax, rax
je 0x140002cef
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002d07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdx, rdx
je 0x140002d05
mov rcx, rdx
call fcn.140005a44
jmp 0x140002d07
xor eax, eax
mov qword [rbp - 0x38], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r15, qword [rbp - 0x40]
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x28], r14
lea rax, [rbp - 0x38]
cmp rbx, 8
cmovae rax, qword [rbp - 0x38]
lea r8, [rbp - 0x58]
cmp r15, 8
cmovae r8, qword [rbp - 0x58]
cmp qword [rsi + 0x18], 8
jb 0x140002d4e
mov rsi, qword [rsi]
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov rdx, rsi
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x140002f5c
lea rcx, [rbp + 0x70]
call fcn.140001e50
nop
lea rdx, str.InstallService_createError
lea rcx, [rbp + 0x80]
call fcn.140004790
mov rcx, rax
lea rdx, [0x14000774c]
call fcn.140004790
mov rcx, rax
lea rdx, str._anonymous_namespace::InstallService
call fcn.140004980
mov rcx, rax
lea rdx, [0x140007748]
call fcn.140004790
call qword [sym.imp.LogHelper.dll_public:_static_class_HwLogger____ptr64___cdecl_HwLogger::GetInstance_void_]
mov rcx, rax
lea r8, [rbp + 0x70]
lea edx, [rdi + 4]
call qword [sym.imp.LogHelper.dll_public:_void___cdecl_HwLogger::Log_enum_LOG_MESSAGE_LEVEL__class_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x88]
call fcn.140004190
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea r14d, [r15 + 3]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140002e9b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], r15w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140002ef0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002eeb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r15w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140002f45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
jmp 0x14000323d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140003130
lea rcx, [rbp + 0x70]
call fcn.140001e50
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.InstallService_Start_failed:
lea rcx, [rbp + 0x80]
call fcn.140004790
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000774c]
call fcn.140004790
mov rcx, rax
lea rdx, str._anonymous_namespace::InstallService
call fcn.140004980
mov rcx, rax
lea rdx, [0x140007748]
call fcn.140004790
call qword [sym.imp.LogHelper.dll_public:_static_class_HwLogger____ptr64___cdecl_HwLogger::GetInstance_void_]
mov rcx, rax
lea r8, [rbp + 0x70]
mov edx, 4
call qword [sym.imp.LogHelper.dll_public:_void___cdecl_HwLogger::Log_enum_LOG_MESSAGE_LEVEL__class_std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x88]
call fcn.140004190
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
mov r14d, 5
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14000307d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003078
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003078
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], r15w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400030d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r15w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140003222
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003126
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
jmp 0x140003222
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140003173
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000316e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000316e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], r15w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400031c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r15w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14000321d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003218
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003218
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
mov r14d, dword [rsp + 0x70]
movdqa xmm0, xmmword [0x140008150]
mov word [rbp - 0x78], r15w
movdqu xmmword [rbp - 0x68], xmm0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14000328a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003285
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003285
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r15w
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x1400032df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r15w
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140003334
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000332f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000332f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
movdqa xmm0, xmmword [0x140008150]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r15w
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x140003389
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003384
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003384
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056f4
mov eax, r14d
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400056d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret