Function at 0x1400084f0
Capabilities:
Modify service

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r12, rcx
xor ecx, ecx
mov r13d, edx
xor bpl, bpl
call fcn.14003c8b0
mov rcx, r12
mov dword [rsp + 0xb0], eax
call fcn.14003b770
xor edx, edx
mov rcx, r12
movzx r14d, al
call fcn.140024b70
lea rcx, str.Setting_start_value_to__u_for_service__S_n
mov r8, r12
mov edx, r13d
call fcn.1400154e0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov r15, rax
jne 0x140008579
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR__ConfigureServiceStart:_Cannot_OpenSCManager._GetLastError_d_n
mov edx, eax
call fcn.1400154e0
xor al, al
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r8d, 2
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rsi, rax
jne 0x1400085b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR__ConfigureServiceStart:_Failed_to_get_handle_to_service._GetLastError_d_n
mov edx, eax
call fcn.1400154e0
jmp 0x140008732
or r9d, 0xffffffff
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x60], rdi
xor edi, edi
mov r8d, r13d
mov rcx, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
or edx, r9d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
setne bpl
test bpl, bpl
jne 0x140008619
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR__ConfigureServiceStart:_Failed_to_set_start_value_to__u._GetLastError_d_n
mov edx, r13d
mov r8d, eax
call fcn.1400154e0
mov qword [rsp + 0x30], rdi
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000868a
mov qword [rsp + 0x30], rdi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000868a
mov rbx, rdi
jmp 0x1400086c4
test rbx, rbx
je 0x1400086c4
cmp rbx, 0xffffffffffffffff
je 0x1400086c4
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, r12
call fcn.14003b6e0
test rax, rax
mov rdi, rax
je 0x140008711
test bpl, bpl
je 0x1400086f4
lea r8, [rsp + 0xb8]
lea rdx, str.Start
mov rcx, rax
call fcn.14003b440
test al, al
jne 0x140008709
lea rdx, str.Start
mov r8d, r13d
mov rcx, rdi
call fcn.14003b350
movzx ebp, al
mov rcx, rdi
call fcn.140039380
test rbx, rbx
mov rdi, qword [rsp + 0x60]
je 0x14000872a
cmp rbx, 0xffffffffffffffff
je 0x14000872a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0xb0]
call fcn.14003c8b0
test r14b, r14b
je 0x14000874f
movzx edx, r14b
mov rcx, r12
call fcn.140024b70
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x140008766
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bpl
mov rsi, qword [rsp + 0x68]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rbp
ret