Function at 0x14000c350
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1402b8d08]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test al, 1
jne 0x14000c3b1
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000b960
nop
lea rsi, [0x1402c00f0]
cmp byte [r8 + rdx + 1], 0
je 0x14000c3f7
lea rdx, str.unsigned_long___cdecl_ServicesInfoCommand::Execute_int_wchar_t____
mov rcx, rsi
call fcn.140012600
mov rax, qword [0x1402c00f0]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call fcn.140013c50
movzx edx, al
mov rcx, rsi
call fcn.140013a90
mov rcx, rsi
call fcn.1400118c0
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x188]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x160]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14000c4c9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
lea rcx, [rsp + 0x40]
call fcn.140005480
xor eax, eax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], ax
lea rdx, str.Cannot_query_service_state_0x
lea rcx, [rsp + 0x50]
call fcn.140009120
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
and dword [rsp + rdx + 0x68], 0xfffff9ff
or dword [rsp + rdx + 0x68], 0x800
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.14001bb40
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
and dword [rsp + rcx + 0x68], 0xfffff3ff
or dword [rsp + rcx + 0x68], 0x200
lea rcx, [rsp + 0x50]
call fcn.14000cb50
nop
lea rcx, [rsp + 0x40]
call fcn.14000ba70
test edi, edi
je 0x14000c4c9
mov eax, edi
jmp 0x14000c646
movups xmm0, xmmword [rsp + 0x160]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x170]
movups xmmword [rbx + 0x20], xmm1
mov eax, dword [rsp + 0x180]
mov dword [rbx + 0x30], eax
lea rdx, str.Service_status:
mov rcx, rsi
call fcn.140012600
mov edx, dword [rsp + 0x17c]
mov rcx, rsi
call fcn.14000cd70
mov rcx, rax
lea rdx, [0x14025af3c]
call fcn.140012600
mov eax, dword [rsp + 0x164]
dec eax
cmp eax, 6
ja case.default.0x14000c537
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xc66c]
add rcx, rdx
jmp rcx
lea rdx, str.SERVICE_STOPPED
jmp 0x14000c585
lea rdx, str.SERVICE_START_PENDING
jmp 0x14000c585
lea rdx, str.SERVICE_STOP_PENDING
jmp 0x14000c585
lea rdx, str.SERVICE_RUNNING
jmp 0x14000c585
lea rdx, str.SERVICE_CONTINUE_PENDING
jmp 0x14000c585
lea rdx, str.SERVICE_PAUSE_PENDING
jmp 0x14000c585
lea rdx, str.SERVICE_PAUSED
mov rcx, rsi
call fcn.140012600
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140012600
mov rax, qword [0x1402c00f0]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call fcn.140013c50
movzx edx, al
mov rcx, rsi
call fcn.140013a90
mov rcx, rsi
call fcn.1400118c0
mov rcx, qword [rbx + 8]
call fcn.140019880
mov edi, eax
mov dword [rbx + 0x34], eax
mov edx, eax
test eax, eax
je 0x14000c60e
sub edx, 1
je 0x14000c605
sub edx, 1
je 0x14000c5fc
mov rcx, rsi
cmp edx, 1
je 0x14000c5f3
lea rdx, str.Service_is_set_to_INVALID_STATE:
call fcn.140012600
mov rcx, rax
mov edx, edi
call fcn.14000cd70
jmp 0x14000c61d
lea rdx, str.Service_is_set_to_DEMAND_START
jmp 0x14000c618
lea rdx, str.Service_is_set_to_AUTO_START
jmp 0x14000c615
lea rdx, str.Service_is_set_to_System_START
jmp 0x14000c615
lea rdx, str.Service_is_set_to_BOOT_START
mov rcx, rsi
call fcn.140012600
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.140013c50
movzx edx, al
mov rcx, rbx
call fcn.140013a90
mov rcx, rbx
call fcn.1400118c0
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401b1920
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret