Function at 0x14006de70
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
mov rax, qword [0x14044b080]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
xor ebx, ebx
lea rax, str.CGenericService::DefaultMainHandler.
mov qword [rsp + 0x30], rax
lea r15, [0x14031b830]
mov r13, rcx
mov qword [rsp + 0x28], r15
lea r8, [0x1404675c0]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 2]
lea edx, [rbx + 0x74]
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
call fcn.140039f30
lea edi, [rbx + 2]
call fcn.140247d14
mov r12d, 1
cmp dword [rax], r12d
jle 0x14006df75
mov esi, r12d
call fcn.140247d14
cmp dword [rax], r12d
jle 0x14006df75
lea r14d, [rbx + 8]
mov r15d, 0xfffd
nop
call fcn.140247d1c
mov rcx, qword [rax]
mov rdx, qword [r14 + rcx]
movzx eax, word [rdx]
sub ax, 0x2d
test r15w, ax
jne 0x14006df5f
lea r15, [rdx + 2]
mov rcx, r15
lea rdx, str.Install
call fcn.1402389bc
test eax, eax
jne 0x14006df44
mov edi, ebx
jmp 0x14006df59
lea rdx, str.Uninstall
mov rcx, r15
call fcn.1402389bc
test eax, eax
cmove edi, r12d
mov r15d, 0xfffd
inc esi
add r14, 8
call fcn.140247d14
cmp esi, dword [rax]
jl 0x14006df10
lea r15, [0x14031b830]
test edi, edi
je 0x14006e1b6
sub edi, r12d
je 0x14006e08a
cmp edi, r12d
jne 0x14006e5ff
lea rax, str.Executing_service.
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
mov edx, 0xa5
mov qword [rsp + 0x20], rbx
call fcn.140039f30
mov r9d, 2
lea rax, str.CGenericService::Run.
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
mov qword [rsp + 0x20], rbx
lea edx, [r9 + 0x1f]
call fcn.140039f30
mov rdx, qword [r13 + 8]
lea rcx, [rbp - 0x60]
mov qword [0x140460348], r13
call fcn.140058860
mov rcx, qword [rax]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rbp - 0x60]
cmp rcx, rax
je 0x14006e024
call fcn.1402384fc
lea rax, [0x14006db80]
mov qword [rbp - 0x78], rbx
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov edi, eax
test eax, eax
jne 0x14006e601
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r9d, [rdi + 2]
lea rax, str.Failed_to_start_the_service._Error_code___d.
mov edx, 0xa9
mov qword [rsp + 0x28], rax
lea r8, [0x1404675c0]
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
mov qword [rsp + 0x20], rbx
call fcn.140039f30
mov eax, edi
jmp 0x14006e601
lea rax, str.Un_installing_service.
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
mov edx, 0xa0
mov qword [rsp + 0x20], rbx
call fcn.140039f30
mov r14, qword [r13 + 8]
xor eax, eax
mov r8d, r12d
mov qword [rsp + 0x78], rax
xor edx, edx
mov qword [rbp - 0x80], rax
xor ecx, ecx
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x70], eax
mov rdi, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
jne 0x14006e140
mov r9d, eax
lea r8, str.OpenSCManager_failed.
lea rdx, str._s._Error_Code___d.
lea rcx, [rbp + 0x3a0]
call fcn.14006ed90
lea rax, [rbp + 0x3a0]
mov r9d, r12d
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea edx, [rsi + 0x31]
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.h
mov qword [rsp + 0x20], rbx
call fcn.140039f30
jmp 0x14006e155
mov r8d, 0x10024
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x14006e58a
lea r8, [rsp + 0x78]
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14006e1a6
nop dword [rax]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14006e1a6
cmp dword [rsp + 0x7c], 3
jne 0x14006e1a6
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006e180
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
jmp 0x14006e5e8
lea rax, str.Installing_service.
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
mov edx, 0x94
mov qword [rsp + 0x20], rbx
call fcn.140039f30
mov rdi, qword [r13 + 0x10]
lea rcx, [rbp + 0x3a0]
mov r14, qword [r13 + 8]
xor edx, edx
mov r8d, 0x208
call fcn.140222790
mov r8d, 0x104
lea rdx, [rbp + 0x3a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14006e31e
cmp word [rbp + 0x3a0], bx
je 0x14006e31e
xor edx, edx
mov dword [rbp - 0x60], 0x22
mov r8d, 0x204
lea rcx, [rbp - 0x5c]
call fcn.140222790
lea r8, [rbp + 0x3a0]
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.140242df8
lea r8, [0x14032a1f8]
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.140242df8
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.OpenSCManager_failed.
mov rdx, rsi
mov r9d, eax
call fcn.14006dab0
test rsi, rsi
je 0x14006e31e
mov qword [rsp + 0x60], rbx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x58], rbx
mov r9d, 4
mov qword [rsp + 0x50], rbx
mov r8, rdi
mov qword [rsp + 0x48], rbx
mov rdx, r14
mov qword [rsp + 0x40], rbx
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], shutdown
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.CreateService_failed.
mov rdx, rdi
mov r9d, eax
call fcn.14006dab0
test rdi, rdi
je 0x14006e315
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, str.Setting_service_description.
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
mov edx, 0x97
mov qword [rsp + 0x20], rbx
call fcn.140039f30
mov r15, qword [r13 + 0x18]
mov r8d, r12d
mov r14, qword [r13 + 8]
xor edx, edx
xor ecx, ecx
mov rdi, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
jne 0x14006e3cd
mov r9d, eax
lea r8, str.OpenSCManager_failed.
lea rdx, str._s._Error_Code___d.
lea rcx, [rbp + 0x3a0]
call fcn.14006ed90
lea rax, [rbp + 0x3a0]
mov r9d, r12d
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
lea rax, [0x14031b830]
mov qword [rsp + 0x28], rax
lea edx, [rsi + 0x31]
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.h
mov qword [rsp + 0x20], rbx
call fcn.140039f30
jmp 0x14006e3e2
mov r8d, 2
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
jne 0x14006e442
mov r9d, eax
lea r8, str.OpenService_failed.
lea rdx, str._s._Error_Code___d.
lea rcx, [rbp + 0x3a0]
call fcn.14006ed90
lea rax, [rbp + 0x3a0]
mov r9d, r12d
mov qword [rsp + 0x30], rax
lea r15, [0x14031b830]
mov qword [rsp + 0x28], r15
lea r8, [0x1404675c0]
lea edx, [rdi + 0x31]
mov qword [rsp + 0x20], rbx
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.h
call fcn.140039f30
jmp 0x14006e4b8
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], r15
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x14006e46b
mov r14d, 0x1b2
lea r15, str.Service_description_has_been_updated.
jmp 0x14006e478
mov r14d, 0x1b7
lea r15, str.ChangeServiceConfig2_failed.
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov r9d, 2
mov qword [rsp + 0x28], r15
lea r8, [0x1404675c0]
mov edx, r14d
mov qword [rsp + 0x20], rbx
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
call fcn.140039f30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r15, [0x14031b830]
test rsi, rsi
je 0x14006e4c6
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, str.Executing_service.
mov r9d, 2
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.cpp
mov edx, 0x9a
mov qword [rsp + 0x20], rbx
call fcn.140039f30
mov r14, qword [r13 + 8]
mov r8d, r12d
xor edx, edx
xor ecx, ecx
mov rdi, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
jne 0x14006e56a
mov r9d, eax
lea r8, str.OpenSCManager_failed.
lea rdx, str._s._Error_Code___d.
lea rcx, [rbp + 0x3a0]
call fcn.14006ed90
lea rax, [rbp + 0x3a0]
mov r9d, r12d
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea edx, [rsi + 0x31]
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.h
mov qword [rsp + 0x20], rbx
call fcn.140039f30
jmp 0x14006e57f
mov r8d, 0x10
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
jne 0x14006e5d4
mov r9d, eax
lea r8, str.OpenService_failed.
lea rdx, str._s._Error_Code___d.
lea rcx, [rbp - 0x60]
call fcn.14006ed90
lea rax, [rbp - 0x60]
mov r9d, r12d
mov qword [rsp + 0x30], rax
lea r8, [0x1404675c0]
mov qword [rsp + 0x28], r15
lea rcx, str.d:jenkinsworkspacemainrel4_dellconsumermainrel4_dellconsumerplatform_vista_sharedgenericservice.h
mov edx, 0x31
mov qword [rsp + 0x20], rbx
call fcn.140039f30
jmp 0x14006e5f1
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
cmovne ebx, r12d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x14006e5ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.140202880
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret