Function at 0x140002058
Capabilities:
Create service
Modify service

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x190
mov qword [rax - 0xd0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x140031020]
xor rax, rsp
mov qword [rsp + 0x188], rax
lea r15, str.Te.Service
mov rcx, r15
call qword [sym.imp.Wex.Common.dll_bool___cdecl_TAEF::Common::ServiceOperations::Exists_unsigned_short_int_const____ptr64_]
xor r14d, r14d
test al, al
je 0x140002381
mov rdx, r15
lea rcx, [rsp + 0x108]
call qword [sym.imp.Wex.Common.dll_class_std::filesystem::path___cdecl_TAEF::Common::ServiceOperations::GetFullPathOfServiceBinary_unsigned_short_int_const____ptr64_]
nop
lea rcx, [rsp + 0x108]
call qword [sym.imp.Wex.Common.dll_bool___cdecl_TAEF::Common::FileInfo::Exists_class_std::filesystem::path_const____ptr64_]
test al, al
je 0x14000225b
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0xf8]
call qword [sym.imp.Wex.Common.dll_class_TAEF::Common::Version___cdecl_TAEF::Common::FileInfo::GetFileVersion_class_std::filesystem::path_const____ptr64_]
movdqa xmm0, xmmword [0x140026480]
movdqu xmmword [rsp + 0x138], xmm0
mov word [rsp + 0x128], r14w
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140026480]
movdqu xmmword [rsp + 0x80], xmm1
mov word [rsp + 0x70], r14w
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xfc]
lea r8, str._u._u._u._u
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x70]
call fcn.140001cc0
mov rcx, qword [rax + 8]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb8], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0xa8], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0xb8], xmm1
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
lea rcx, [rsp + 0x70]
call fcn.140001d00
nop
lea rax, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rax, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r15
lea r8, str.WARNING:__s_installation_skipped_as_it_was_detected_to_already_be_installed._Found__s_with_file_version:__s.
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x128]
call fcn.140001cc0
nop
lea rcx, [rsp + 0xa8]
call fcn.140001d00
lea edx, [r14 + 0xe]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.Wex.Common.dll_public:_void___cdecl_TAEF::Common::AutoConsoleColor::constructor_enum_TAEF::Common::TextColor____ptr64]
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 8
cmovae rcx, qword [rsp + 0x128]
call qword [sym.imp.Wex.Common.dll_void___cdecl_TAEF::Common::Console::WriteLine_unsigned_short_int_const____ptr64_]
lea rcx, [rsp + 0xe8]
call qword [sym.imp.Wex.Common.dll_public:_void___cdecl_TAEF::Common::AutoConsoleColor::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x128]
call fcn.140001d00
nop
lea rcx, [rsp + 0x108]
call fcn.140001d00
xor al, al
jmp 0x1400024e6
mov rcx, r15
call qword [sym.imp.Wex.Common.dll_bool___cdecl_TAEF::Common::ServiceOperations::IsRunning_unsigned_short_int_const____ptr64_]
test al, al
je 0x140002272
mov rcx, r15
call qword [sym.imp.Wex.Common.dll_void___cdecl_TAEF::Common::ServiceOperations::StopRunningService_unsigned_short_int_const____ptr64_]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140026480]
movdqu xmmword [rsp + 0x80], xmm1
mov word [rsp + 0x70], r14w
lea rax, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae rax, qword [rsp + 0x108]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r15
lea r8, str.WARNING:__s_installation_is_removing_previous__s_install__as_associated_binary_has_been_removed_or_is_no_longer_accessible_at__s.
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.140001cc0
mov rcx, qword [rax + 8]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x158], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x148], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x158], xmm1
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
lea rcx, [rsp + 0x70]
call fcn.140001d00
mov edx, 0xe
lea rcx, [rsp + 0xf0]
call qword [sym.imp.Wex.Common.dll_public:_void___cdecl_TAEF::Common::AutoConsoleColor::constructor_enum_TAEF::Common::TextColor____ptr64]
nop
lea rcx, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae rcx, qword [rsp + 0x148]
call qword [sym.imp.Wex.Common.dll_void___cdecl_TAEF::Common::Console::WriteLine_unsigned_short_int_const____ptr64_]
mov rcx, r15
call qword [sym.imp.Wex.Common.dll_bool___cdecl_TAEF::Common::ServiceOperations::RemoveService_unsigned_short_int_const____ptr64_]
test al, al
je 0x140002514
lea rcx, [rsp + 0xf0]
call qword [sym.imp.Wex.Common.dll_public:_void___cdecl_TAEF::Common::AutoConsoleColor::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x148]
call fcn.140001d00
nop
lea rcx, [rsp + 0x108]
call fcn.140001d00
mov ebx, 2
mov r8d, ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x14000252f
lea rcx, [rsp + 0x168]
call qword [sym.imp.Wex.Common.dll_class_std::filesystem::path___cdecl_TAEF::Common::ProcessInformation::GetExecutableFileName_void_]
nop
lea rax, [rsp + 0x168]
cmp qword [rsp + 0x180], 8
cmovae rax, qword [rsp + 0x168]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
lea rcx, str.RpcSs
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x20
mov r9d, ebx
mov r8, r15
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
mov qword [rsp + 0xe8], rax
test rax, rax
setne sil
test rax, rax
je 0x140002556
lea rax, str.Test_Authoring_and_Execution_Framework_Service
mov qword [rsp + 0xe0], rax
lea r8, [rsp + 0xe0]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
test eax, eax
je 0x1400025b8
movdqa xmm1, xmmword [0x140026480]
movdqu xmmword [rsp + 0x80], xmm1
mov word [rsp + 0x70], r14w
mov r9, r15
lea r8, str._s_was_successfully_installed.
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.140001cc0
mov rcx, qword [rax + 8]
cmp qword [rcx + 0x18], 8
jb 0x1400024ac
mov rcx, qword [rcx]
call qword [sym.imp.Wex.Common.dll_void___cdecl_TAEF::Common::Trace::WriteLine_unsigned_short_int_const____ptr64_]
nop
lea rcx, [rsp + 0x70]
call fcn.140001d00
nop
test sil, sil
je 0x1400024cd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x168]
call fcn.140001d00
nop
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140018430
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140002958
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r9d, 0x8a
lea rdx, str.::OpenSCManager_failed.
call fcn.1400028d4
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400015a4
nop
mov r9, r15
lea r8, str.CreateServiceW_failed_for__s.
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140001cc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r9d, 0x94
lea r8, str.E:BA163_s_srcWex.ServicesService.cpp
mov rdx, rbx
call fcn.140001a0c
nop
movups xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400015a4
nop
mov r9, r15
lea r8, str.ChangeServiceConfig2_failed_for__s
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140001cc0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r9d, 0x98
lea r8, str.E:BA163_s_srcWex.ServicesService.cpp
mov rdx, rbx
call fcn.140001a0c
int3