Function at 0x140002e60
Capabilities:
Copy file
Create service
Delete file
Enumerate processes
Get installed programs
Modify service
Move file
Query service status
Set registry value
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x518
mov ebp, ecx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x510], rax
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140002f2b
mov rsi, rax
lea rdi, [rsp + 0xc0]
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140002f6c
lea rdx, str.MozillaMaintenance
mov rcx, rsi
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
jne 0x140002fad
cmp eax, 0x424
je 0x140002fad
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003f93
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service.____lu_
jmp 0x140002f9e
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003f11
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service_manager.____lu_
mov r8d, eax
call fcn.140009d30
xor ebp, ebp
jmp 0x140003692
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003f52
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_obtain_module_filename_when_attempting_to_install_service.____lu_
mov r8d, eax
call fcn.140009d30
xor ebp, ebp
jmp 0x140003689
test rbx, rbx
je 0x140003331
lea r14, [rsp + 0x2d0]
mov qword [r14], 0
mov rcx, rbx
mov rdx, r14
call fcn.1400047b0
mov edi, eax
mov rcx, qword [r14]
test rcx, rcx
je 0x140002fe0
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x14000301e
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003fd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_reset_security_ACE_on_service_handle._It_might_not_be_possible_to_start_the_service._This_error_should_never_happen.____lu_
mov r8d, eax
call fcn.140009d30
lea r9, [rsp + 0x9c]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140003047
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400035d0
lea r14, [rsp + 0x9c]
mov r15d, dword [r14]
mov rcx, r15
call fcn.14000a484
mov rdi, rax
mov rcx, rbx
mov rdx, rax
mov r8d, r15d
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x140003418
cmp byte [0x140038114], 0
je 0x14000345f
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov rcx, qword [rdi + 0x10]
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0x94]
lea r9, [rsp + 0x90]
call fcn.140005030
mov r14d, eax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x88]
lea r8, [rsp + 0x84]
lea r9, [rsp + 0x80]
call fcn.140005030
test eax, eax
je 0x140003645
cmp ebp, 2
je 0x140003114
test r14d, r14d
je 0x140003114
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x98], eax
jae 0x1400036f7
mov rcx, rbx
call fcn.140002950
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x1400036b8
mov r14, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r15, rax
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov ecx, dword [rcx + 4]
test r15, r15
je 0x140003751
cmp eax, ecx
jg 0x140004224
lea rdx, str.Sending_stop_request...
call fcn.140009c20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rsp + 0xa0]
mov rcx, r15
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400031ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x1400031ff
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000442c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Error_sending_stop_request.____lu_
mov r8d, eax
call fcn.140009d30
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call rbx
mov rcx, r15
call rbx
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004265
lea rdx, str.Waiting_for_service_stop...
call fcn.140009c20
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov qword [rsp + 0x70], rdi
je 0x14000377e
mov r15, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000388d
mov r12, rax
lea r14, [rsp + 0x2d0]
mov dword [r14 + 4], 0xcf
mov edi, 0xffffffce
lea r13, [rsp + 0xbc]
mov rbp, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r13
mov rcx, r12
xor edx, edx
mov r8, r14
mov r9d, 0x24
call rbp
test eax, eax
je 0x1400032d7
cmp dword [rsp + 0x2d4], 1
jne 0x140003308
jmp 0x140003939
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x1400032f4
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x140003308
jmp 0x1400039a2
cmp eax, 0x79
jle 0x140003915
cmp eax, 0x41c
jne 0x14000397c
mov ecx, 0x32
call rbx
add edi, 0x32
cmp edi, 0x74fe
jb 0x1400032af
mov eax, dword [rsp + 0x2d4]
mov dword [rsp + 0x6c], eax
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400039d5
test ebp, ebp
je 0x1400035c6
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
lea rdx, str.MozillaMaintenance
lea r8, str.Mozilla_Maintenance_Service
mov rcx, rsi
mov r9d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x14000360e
mov rbx, rax
lea r14, [rsp + 0x2d0]
mov qword [r14], 0
mov rcx, rax
mov rdx, r14
call fcn.1400047b0
mov edi, eax
mov rcx, qword [r14]
test rcx, rcx
je 0x1400033c8
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x140003406
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004161
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_set_security_ACE_on_service_handle__the_service_will_not_be_able_to_be_started_from_unelevated_processes._This_error_should_never_happen.____lu_
mov r8d, eax
call fcn.140009d30
mov rcx, rbx
call fcn.140002950
mov ebp, 1
jmp 0x140003680
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004015
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_open_service_but_could_not_query_service_config.____lu_
mov r8d, eax
call fcn.140009d30
mov rcx, rdi
call fcn.14000a48c
jmp 0x14000360a
mov r14, qword [rdi + 0x10]
mov rcx, r14
call fcn.14000a544
cmp rax, 3
jb 0x1400034ce
mov r15, rax
lea rdx, str.maintenanceservice_tmp.exe
mov rcx, r14
call fcn.14000bd5c
test rax, rax
jne 0x1400034ce
cmp word [r14], 0x22
jne 0x1400034ce
cmp word [r14 + r15*2 - 2], 0x22
jne 0x1400034ce
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004369
lea rdx, str.The_MozillaMaintenance_service_path_is_correct.
call fcn.140009c20
jmp 0x140003084
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004056
lea rdx, str.The_MozillaMaintenance_path_is_NOT_correct._It_was:__ls
mov r8, r14
call fcn.140009c20
lea r15, [rsp + 0x2d0]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call fcn.14000baa0
mov r8d, 0x104
mov rcx, r15
mov rdx, r14
call fcn.14000a494
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1400037a8
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400040d8
lea r14, str.Couldnt_remove_file_spec.____lu_
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, r14
mov r8d, eax
call fcn.140009d30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004097
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_fix_service_path._This_should_never_happen.____lu_
mov r8d, eax
call fcn.140009d30
mov ebp, 1
jmp 0x140003678
mov ebp, 1
jmp 0x140003689
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004120
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_determine_buffer_size_for_query_service_config.____lu_
mov r8d, eax
call fcn.140009d30
xor ebp, ebp
jmp 0x140003680
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400041a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_create_Windows_service._This_error_should_never_happen_since_a_service_install_should_only_be_called_when_elevated.____lu_
jmp 0x140002f9e
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400041e3
lea rdx, str.Could_not_obtain_version_number_from_new_path
call fcn.140009d30
xor ebp, ebp
mov rcx, rdi
call fcn.14000a48c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.140018440
mov eax, ebp
add rsp, 0x518
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400042e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service_manager.____lu_
mov r8d, eax
call fcn.140009d30
jmp 0x140003777
jne 0x140003736
mov eax, dword [rsp + 0x84]
cmp dword [rsp + 0x94], eax
jb 0x140003114
jne 0x140003736
mov eax, dword [rsp + 0x80]
cmp dword [rsp + 0x90], eax
jb 0x140003114
jne 0x140003736
mov eax, dword [rsp + 0x8c]
cmp eax, dword [rsp + 0x7c]
jb 0x140003114
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x1400035bc
cmp eax, ecx
jg 0x140004328
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_open_service.____lu_
mov r8d, eax
call fcn.140009d30
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebp, ebp
jmp 0x140003f04
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov eax, 0xfd
cmovne eax, ecx
mov dword [rsp + 0x6c], eax
jmp 0x1400039df
lea rdx, [0x14002f8b2]
lea r14, [rsp + 0x2d0]
mov rcx, r14
call int.140025c90
test eax, eax
je 0x1400038e4
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov edx, 0xffffffff
mov r8d, 0xffffffff
mov r9d, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x14000394a
cmp ecx, edx
jg 0x140004571
lea rdx, str.Fixed_service_path_to:__ls.
lea r8, [rsp + 0x2d0]
call fcn.140009c20
mov byte [0x140038114], 1
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400045b2
lea rdx, str.Restarting_install_action:__d
mov r8d, ebp
call fcn.140009c20
mov ecx, ebp
call fcn.140002e60
mov ebp, eax
jmp 0x140003678
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, 0x7a
jg 0x1400038c2
cmp ebx, 5
je 0x14000395e
cmp ebx, 6
jne 0x140003972
mov dword [rsp + 0x6c], 0xec
jmp 0x1400039df
cmp ebx, 0x7b
je 0x140003968
cmp ebx, 0x424
jne 0x140003972
mov dword [rsp + 0x6c], 0xee
jmp 0x1400039df
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400045f3
lea r14, str.Couldnt_append_file_spec.____lu_
jmp 0x140003571
cmp eax, 5
je 0x140003994
cmp eax, 6
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x14000399b
cmp eax, 0x57
jne 0x1400039b7
mov eax, 0xdc
jmp 0x1400039ca
mov eax, 1
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400039d1
cmp ecx, edx
jg 0x14000460b
lea r14, str.Could_not_fix_service_path.____lu_
jmp 0x140003571
mov dword [rsp + 0x6c], 0xeb
jmp 0x1400039df
mov dword [rsp + 0x6c], 0xed
jmp 0x1400039df
mov dword [rsp + 0x6c], 0xef
jmp 0x1400039df
cmp eax, 0x7a
je 0x1400039be
cmp eax, 0x7c
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x1400039b7
mov eax, 0xdd
jmp 0x1400039ca
mov eax, 0xda
jmp 0x1400039c3
mov eax, 0xd9
jmp 0x1400039ca
cmp eax, 0x45b
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x1400039b7
mov eax, 0xde
jmp 0x1400039ca
mov eax, 0xdf
jmp 0x1400039ca
mov eax, 0xdb
mov rdi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x2d4], eax
mov dword [rsp + 0x6c], eax
mov rcx, r12
call rdi
mov rcx, r15
call rdi
xor r14d, r14d
lea r15, [rsp + 0x2fc]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
lea r12, [rsp + 0x2d0]
lea r13, [0x14002f8b2]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140003a54
mov rbp, rax
mov dword [rsp + 0x2d0], 0x238
mov rcx, rax
mov rdx, r12
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140003a5e
mov rcx, r13
mov rdx, r15
call fcn.140011b70
test eax, eax
je 0x140003a68
mov rcx, rbp
mov rdx, r12
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140003a2f
mov ebx, 0x490
jmp 0x140003a6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003a73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140003a6a
xor ebx, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x490
je 0x140003a8f
mov ecx, 0x3e8
call rdi
inc r14d
cmp r14d, 0x1e
jne 0x140003a00
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400042a6
lea rdx, str.Done_waiting_for_service_stop__last_service_state:__lu
mov edi, dword [rsp + 0x6c]
mov r8d, edi
call fcn.140009c20
xor ebp, ebp
cmp edi, 1
mov rdi, qword [rsp + 0x70]
jne 0x140003f04
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0xc0]
call fcn.140013c18
test eax, eax
je 0x140003c41
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0xc0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140003c84
lea r14, [rsp + 0x2d0]
mov r8d, 0x100
mov rcx, r14
xor edx, edx
call fcn.14000baa0
mov eax, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x84]
mov r9d, dword [rsp + 0x88]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._d._d._d._d
mov edx, 0x80
mov rcx, r14
call fcn.140001090
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallMozillaMaintenanceService
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20206
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003bd5
mov rcx, r14
call fcn.14000a544
add eax, eax
add eax, 2
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
lea rdx, str.DisplayVersion
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140003c06
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400044ae
lea rdx, str.The_uninstaller_version_string_could_not_be_updated.
call fcn.140009c20
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400043aa
lea rdx, str.The_new_service_binary_was_copied_in.
call fcn.140009c20
mov ebp, 1
jmp 0x140003e91
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000446d
lea rdx, str.File_is_already_in_the_correct_location__no_action_needed_for_upgrade.__The_path_is:___ls_
lea r8, [rsp + 0xc0]
call fcn.140009c20
mov ebp, 1
jmp 0x140003f04
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400044ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_overwrite_old_service_binary_file._This_should_never_happen__but_if_it_does_the_next_upgrade_will_fix_it__the_service_is_not_a_critical_component_that_needs_to_be_installed_for_upgrades_to_work.____lu_
mov r8d, eax
call fcn.140009d30
mov r14, qword [rdi + 0x10]
mov rcx, r14
call fcn.14000a544
cmp rax, 4
jb 0x140003d9c
mov r15, rax
inc rax
lea r12, [r15 + r15 + 2]
mov rcx, 0xffffffffffffffff
cmovns rcx, r12
call fcn.14000a484
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call fcn.14000baa0
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14000a494
lea rcx, [rbx + r15*2]
add rcx, 0xfffffffffffffffa
lea rdx, [0x14002fa54]
mov r8d, 3
call fcn.14000a494
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140003dd4
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0xc0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140003e1a
cmp ecx, edx
jg 0x140004664
lea rdx, str.The_new_service_binary_was_copied_in_by_first_moving_the_old_one_out_of_the_way.
call fcn.140009c20
mov ebp, 1
jmp 0x140003e30
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004623
lea rdx, str.Service_binary_path_was_less_than_3__service_will_not_be_updated.__This_should_never_happen.
call fcn.140009d30
xor ebp, ebp
jmp 0x140003e91
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400046e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rdi + 0x10]
mov dword [rsp + 0x20], eax
lea rdx, str.Could_not_move_old_service_file_out_of_the_way_from:___ls__to___ls_._Service_will_not_be_upgraded.____lu_
mov r9, rbx
call fcn.140009d30
xor ebp, ebp
jmp 0x140003e89
cmp ecx, edx
jg 0x140004727
lea rdx, str.The_new_service_binary_could_not_be_copied_in._The_service_will_not_be_upgraded.
call fcn.140009d30
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140003e75
cmp ecx, edx
jg 0x1400046a5
lea rdx, str.The_old_temp_service_path_was_deleted:__ls.
mov r8, rbx
call fcn.140009c20
jmp 0x140003e89
cmp ecx, edx
jg 0x140004768
lea rdx, str.The_old_temp_service_path_was_not_deleted.
call fcn.140009d30
mov rcx, rbx
call fcn.14000a48c
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [0x140038330]
mov edx, dword [0x140036d60]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov edx, dword [rdx + 4]
test eax, eax
je 0x140003ee8
cmp ecx, edx
jg 0x1400043eb
lea rdx, str.Deleting_the_old_file_path_on_the_next_reboot:__ls.
lea r8, [rsp + 0xc0]
call fcn.140009c20
jmp 0x140003f04
cmp ecx, edx
jg 0x140004530
lea rdx, str.Call_to_delete_the_old_file_path_failed:__ls.
lea r8, [rsp + 0xc0]
call fcn.140009d30
mov rcx, rdi
call fcn.14000a48c
jmp 0x140003689
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140002f50
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140002f50
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140002f91
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140002f91
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140002f1c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140002f1c
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003009
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003009
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000343d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000343d
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400034f3
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400034f3
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400035a7
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400035a7
lea rcx, [0x140038330]
call fcn.14000a740
lea r14, str.Couldnt_remove_file_spec.____lu_
cmp dword [0x140038330], 0xffffffff
jne 0x140003571
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003571
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400035f5
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400035f5
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400033f1
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400033f1
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003633
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003633
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000366a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000366a
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x14000318a
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x14000318a
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003235
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003235
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003ab4
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003ab4
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400036dd
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400036dd
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003759
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003759
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400034bd
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400034bd
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003c2b
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003c2b
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003ed2
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003ed2
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x1400031ea
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x1400031ea
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003c66
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003c66
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003bfa
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003bfa
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003ca9
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003ca9
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003ef0
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003ef0
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003830
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003830
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003870
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003870
lea rcx, [0x140038330]
call fcn.14000a740
lea r14, str.Couldnt_append_file_spec.____lu_
jmp 0x1400040eb
lea rcx, [0x140038330]
call fcn.14000a740
lea r14, str.Could_not_fix_service_path.____lu_
jmp 0x1400040eb
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003dc1
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003dc1
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003d86
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003d86
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003e64
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003e64
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003df9
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003df9
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003e22
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003e22
lea rcx, [0x140038330]
call fcn.14000a740
cmp dword [0x140038330], 0xffffffff
jne 0x140003e7d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8d8
lea rcx, [0x140038330]
call fcn.14000a7a8
jmp 0x140003e7d