Function at 0x140060c70
Capabilities:
Query service status
Start service

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6f8]
sub rsp, 0x7f8
mov rax, qword [0x140212c80]
xor rax, rsp
mov qword [rbp + 0x6e0], rax
mov r13, qword [rbp + 0x740]
mov ebx, dword [rbp + 0x748]
mov eax, dword [rbp + 0x750]
mov dword [rsp + 0x48], eax
mov dword [rbp + 0x430], eax
xor esi, esi
mov dword [rsp + 0x40], esi
lea r8d, [rsi + 1]
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rbp + 0x490], rax
test rax, rax
je 0x14006158c
mov rdx, r13
cmp qword [r13 + 0x18], 7
jbe 0x140060d06
mov rdx, qword [r13]
or ebx, 4
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rbp + 0x498], rax
test rax, rax
je 0x1400615bb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x460], xmm0
mov qword [rbp + 0x470], rax
mov dword [rbp + 0x478], eax
lea rdx, [rbp + 0x460]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140061611
mov qword [rbp + 0x410], r13
cmp qword [r13 + 0x18], 7
jbe 0x140060d72
mov rax, qword [r13]
mov qword [rbp + 0x410], rax
mov r15, qword [r13 + 0x10]
xor r8d, r8d
mov rdx, r15
add rdx, 0x22
mov r12, 0xffffffffffffffff
cmovb rdx, r12
lea rcx, [rbp + 0x438]
call fcn.1400576b0
lea r14, [rbp + 0x438]
cmp qword [rbp + 0x450], 7
cmova r14, qword [rbp + 0x438]
lea r8d, [r12 + 0x45]
lea rdx, str.SYSTEMCurrentControlSetServices_
mov rcx, r14
call fcn.140175f40
lea rcx, [r14 + 0x44]
mov rax, qword [rbp + 0x410]
lea r8, [rax + r15*2]
sub r8, rax
mov rdx, rax
call fcn.140175f40
nop
lea rax, [rbp + 0x438]
cmp qword [rbp + 0x450], 7
cmova rax, qword [rbp + 0x438]
mov qword [rbp + 0x410], rax
mov rax, qword [rbp + 0x448]
mov qword [rbp + 0x418], rax
movaps xmm0, xmmword [rbp + 0x410]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x4a0]
call fcn.1400544e0
nop
mov byte [rbp + 0x420], 0
lea rax, [rbp + 0x4a0]
mov qword [rbp + 0x428], rax
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x1c0], rax
lea rdx, [rbp + 0x4a8]
lea rcx, [rbp + 0x1c8]
call fcn.140054750
mov r14d, dword [rbp + 0x6d8]
mov dword [rbp + 0x3f8], r14d
mov eax, dword [rbp + 0x6dc]
mov dword [rbp + 0x3fc], eax
mov byte [rbp + 0x400], 1
and r14d, 0x300
or r14d, 1
mov rax, qword [rbp + 0x1c0]
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x78]
call fcn.140054750
mov r8d, dword [rbp + 0x3fc]
mov dword [rbp + 0x1bc], r8d
mov dword [rbp + 0x1b8], r14d
mov qword [rbp + 0x410], rsi
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 7
cmova rdx, qword [rbp + 0x198]
lea rax, [rbp + 0x410]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
mov rcx, rsi
jne 0x140060f09
mov rcx, qword [rbp + 0x410]
mov qword [rbp + 0x410], rsi
test rcx, rcx
je 0x140060f27
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140060f27
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rbp + 0x190]
call fcn.140054870
nop
lea rcx, [rbp + 0x1c0]
call fcn.140054450
test r14d, r14d
jne 0x140060f51
mov byte [rbp + 0x420], 1
jmp 0x1400613b6
xorps xmm0, xmm0
movups xmmword [rbp + 0x480], xmm0
mov rax, qword [rbp + 0x4a0]
mov qword [rbp - 0x80], rax
lea rdx, [rbp + 0x4a8]
lea rcx, [rbp - 0x78]
call fcn.140054750
mov eax, dword [rbp + 0x6d8]
mov dword [rbp + 0x1b8], eax
mov eax, dword [rbp + 0x6dc]
mov dword [rbp + 0x1bc], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x1c0], rax
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x1c8]
call fcn.140054750
mov eax, dword [rbp + 0x1bc]
mov dword [rbp + 0x3fc], eax
mov dword [rbp + 0x3f8], 2
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x410]
call fcn.140090b50
mov r14, qword [rax]
mov qword [rax], rsi
mov qword [rbp + 0x480], r14
mov byte [rbp + 0x488], 1
mov dword [rsp + 0x40], 0x47
mov rcx, qword [rbp + 0x410]
test rcx, rcx
je 0x140061015
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140061015
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rbp + 0x410], rsi
lea rcx, [rbp + 0x3d0]
call fcn.140054870
nop
lea rcx, [rbp + 0x190]
call fcn.140054870
nop
lea rax, str.ErrorControl
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x418], recvfrom
xor edx, edx
mov r8d, 0xc0
lea rcx, [rbp - 0x80]
call fcn.140176680
nop
mov qword [rbp - 0x80], r14
mov byte [rbp - 0x78], 0
movaps xmm0, xmmword [rbp + 0x410]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400570b0
nop
mov dword [rsp + 0x40], 0x57
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
mov qword [rsp + 0x30], rcx
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400610a3
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x1c0], rax
mov byte [rbp + 0x1c8], 0
mov byte [rbp + 0x400], 0
mov dword [rbp + 0x410], 1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp + 0x410]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.140091090
nop
lea rcx, [rbp + 0x1c0]
call fcn.140054450
mov dword [rsp + 0x40], 0x47
mov r8, qword [rbp + 0x38]
cmp r8, 7
jbe 0x140061124
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.140056b80
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], si
cmp byte [rbp - 0x78], 0
jne 0x140061143
mov rcx, rsi
mov qword [rbp - 0x80], rcx
jmp 0x140061147
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14006115e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14006115e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, str.Start
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 5
xor edx, edx
mov r8d, 0xc0
lea rcx, [rbp - 0x80]
call fcn.140176680
nop
mov qword [rbp - 0x80], r14
mov byte [rbp - 0x78], 0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400570b0
nop
mov dword [rsp + 0x40], 0x67
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
mov qword [rsp + 0x30], rcx
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400611c5
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x1c0], rax
mov byte [rbp + 0x1c8], 0
mov byte [rbp + 0x400], 0
mov dword [rbp + 0x410], 3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp + 0x410]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.140091090
nop
lea rcx, [rbp + 0x1c0]
call fcn.140054450
mov dword [rsp + 0x40], 0x47
mov r8, qword [rbp + 0x38]
cmp r8, 7
jbe 0x140061246
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.140056b80
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], si
cmp byte [rbp - 0x78], 0
jne 0x140061265
mov rcx, rsi
mov qword [rbp - 0x80], rcx
jmp 0x140061269
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140061280
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140061280
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, str.Type
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 4
xor edx, edx
mov r8d, 0xc0
lea rcx, [rbp - 0x80]
call fcn.140176680
nop
mov qword [rbp - 0x80], r14
mov byte [rbp - 0x78], 0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.1400570b0
nop
mov dword [rsp + 0x40], 0x4f
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rax, qword [rbp + 0x20]
mov qword [rsp + 0x30], rax
inc r12
cmp word [rax + r12*2], 0
jne 0x1400612e4
mov qword [rsp + 0x38], r12
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x1c0], rax
mov byte [rbp + 0x1c8], 0
mov byte [rbp + 0x400], 0
mov eax, dword [rbp + 0x460]
mov dword [rbp + 0x410], eax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp + 0x410]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.140091090
nop
lea rcx, [rbp + 0x1c0]
call fcn.140054450
nop
mov r8, qword [rbp + 0x38]
cmp r8, 7
jbe 0x140061361
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.140056b80
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], si
cmp byte [rbp - 0x78], 0
jne 0x140061380
mov rcx, rsi
mov qword [rbp - 0x80], rcx
jmp 0x140061384
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14006139c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x14006139c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
test r14, r14
je 0x1400613b6
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400613b6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15d, dword [rbp + 0x760]
mov eax, dword [rbp + 0x464]
cmp eax, dword [rbp + 0x758]
je 0x140061412
cmp eax, r15d
je 0x140061412
mov edx, dword [rsp + 0x48]
mov rcx, rbx
test edx, edx
je 0x1400613f2
lea r8, [rbp + 0x460]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140061537
jmp 0x140061412
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140061412
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x140061667
cmp byte [rbp + 0x420], 0
jne 0x140061436
lea rax, [rbp + 0x420]
mov qword [rbp + 0x430], rax
lea rcx, [rbp + 0x430]
call fcn.140061a80
nop
lea rcx, [rbp + 0x6b0]
call fcn.140054870
nop
lea rcx, [rbp + 0x438]
call fcn.140025e80
mov r14d, dword [rbp + 0x768]
test r14d, r14d
je 0x1400614b3
nop dword [rax + rax]
cmp esi, 0xffffffff
je 0x14006146f
cmp esi, r14d
jae 0x14006149c
cmp esi, 0xffffff9b
jae 0x14006149c
cmp dword [rbp + 0x464], r15d
je 0x1400614b3
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x460]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400614eb
add esi, 0x64
jmp 0x140061460
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400614c8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rbp + 0x6e0]
xor rcx, rsp
call fcn.140133600
add rsp, 0x7f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, str.Unable_to_query_status_of_the_service__
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov r9, r13
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140054d30
lea rdx, [0x14020e468]
lea rcx, [rsp + 0x50]
call fcn.140135f84
nop
lea rax, str.Unable_to_send_control_code__to_the_service__
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], getservbyname
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x430]
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140061970
lea rdx, [0x14020e468]
lea rcx, [rsp + 0x50]
call fcn.140135f84
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, str.Unable_to_open_the_service_control_manager_
lea rcx, [rbp + 0x438]
call fcn.140096840
lea rdx, [0x14020e468]
lea rcx, [rbp + 0x438]
call fcn.140135f84
nop
lea rax, str.Unable_to_open_the_service__
mov qword [rbp + 0x420], rax
mov qword [rbp + 0x428], 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rbp + 0x420]
movdqa xmmword [rsp + 0x30], xmm0
mov r9, r13
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rbp + 0x438]
call fcn.140054d30
lea rdx, [0x14020e468]
lea rcx, [rbp + 0x438]
call fcn.140135f84
int3
lea rax, str.Unable_to_query_status_of_the_service__
mov qword [rbp + 0x420], rax
mov qword [rbp + 0x428], 0x2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rbp + 0x420]
movdqa xmmword [rsp + 0x30], xmm0
mov r9, r13
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rbp + 0x438]
call fcn.140054d30
lea rdx, [0x14020e468]
lea rcx, [rbp + 0x438]
call fcn.140135f84
nop
lea rax, str.Unable_to_start_the_service__
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x21
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov r9, r13
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140054d30
lea rdx, [0x14020e468]
lea rcx, [rsp + 0x50]
call fcn.140135f84
int3