Function at 0x489300
Capabilities:
Create service
Delete service
Query service configuration
Query service status
Start service
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rbx, rcx
mov ecx, 0x20
call fcn.0086bb00
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
movdqa xmm0, xmmword [0x008915c0]
mov rsi, rax
mov byte [rax], 0
mov qword [rax + 0x18], 0
mov qword [rbx], rax
movups xmmword [rax + 8], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx]
cmp qword [rax + 0x10], 0
je 0x489900
pxor xmm0, xmm0
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor r8d, r8d
movaps xmmword [rsp + 0x70], xmm0
mov eax, 0x104
lea rbp, [rsp + 0x70]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x80], 0
jmp 0x4893db
jae 0x4893ab
lea rax, [rdx + rax*2]
cmp rax, r8
je 0x4893ab
mov qword [rsp + 0x78], rax
mov r8, rax
sub r8, rdx
xor ecx, ecx
sar r8, 1
call rdi
call rsi
mov r12d, eax
cmp eax, 0x7a
jne 0x489408
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov ecx, 0x104
mov rax, r8
sub rax, rdx
cmp r8, rdx
cmove rax, rcx
mov rcx, r8
sub rcx, rdx
sar rcx, 1
cmp rax, rcx
jbe 0x489398
sub rax, rcx
mov rcx, rbp
mov rdx, rax
call fcn.00833ad0
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
jmp 0x4893ab
test eax, eax
jne 0x489830
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
lea r12, [rax - 2]
cmp rdi, r12
je 0x489480
mov rax, r12
jmp 0x489442
cmp dx, 0x5c
je 0x48944b
sub rax, 2
mov r12, rax
cmp rdi, rax
je 0x489480
movzx edx, word [rax]
cmp dx, 0x2f
jne 0x489430
xor r9d, r9d
lea rbp, [rsp + 0xe0]
mov word [rax + 2], r9w
mov qword [rsp + 0xd0], rbp
test rdi, rdi
jne 0x4898a0
lea rcx, [0x008912e0]
call fcn.0086ef70
nop dword [rax + rax]
lea rbp, [rsp + 0xe0]
mov rcx, r12
mov qword [rsp + 0xd0], rbp
call sub.msvcrt.dll_wcslen
lea rax, [r12 + rax*2]
sub rax, r12
mov rdx, rax
mov rdi, rax
sar rdx, 1
mov qword [rsp + 0xb0], rdx
cmp rdx, 7
ja 0x4896f8
mov rcx, qword [rsp + 0xd0]
cmp rdx, 1
jne 0x4896e8
movzx eax, word [r12]
mov word [rcx], ax
xor r8d, r8d
mov qword [rsp + 0xd8], rdx
mov word [rcx + rdx*2], r8w
lea rcx, str.WinRing0x64.sys
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xd8]
cmp r8, rax
ja 0x489b25
lea r12, [rsp + 0xd0]
lea rdx, str.WinRing0x64.sys
mov rcx, r12
call fcn.008394e0
lea r13, [rsp + 0xc0]
lea rdx, [rax + 0x10]
mov qword [rsp + 0xb0], r13
mov rcx, qword [rax]
cmp rcx, rdx
je 0x489778
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0xb8], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0xd0]
xor edx, edx
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rbp
je 0x489588
call fcn.0086bab0
mov rdi, qword [rbx]
mov r8d, 0xf01ff
lea rdx, str.WinRing0_1_2_0
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rdi + 0x18], rax
mov rdi, qword [rbx]
cmp qword [rdi + 0x18], 0
je 0x489620
call fcn.0048a660
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_existse_0m
mov ecx, 4
call fcn.0040e900
mov rax, qword [rbx]
lea rdx, [rsp + 0x90]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rdi, qword [rbx]
test eax, eax
jne 0x489858
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x4895f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x4898f4
cmp byte [rdi], 0
je 0x4898b8
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
mov rdi, qword [rbx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rbp, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0xc0000000
lea rcx, str..WinRing0_1_2_0
mov dword [rsp + 0x20], 3
call rbp
mov qword [rdi + 8], rax
mov rdi, qword [rbx]
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x489750
cmp byte [rdi], 0
je 0x489790
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, str..WinRing0_1_2_0
mov dword [rsp + 0x20], 3
call rbp
mov qword [rdi + 8], rax
mov rax, qword [rbx]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x489932
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x4896c0
call fcn.0086bab0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x4896d0
call fcn.0086bab0
nop
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x4894d4
jmp 0x48972b
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xd0]
xor r8d, r8d
call fcn.00839650
mov qword [rsp + 0xd0], rax
mov rcx, rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xe0], rax
mov rdx, r12
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xd0]
jmp 0x4894d4
call fcn.0048a660
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_exists__but_with_a_different_service_namee_0m
mov ecx, 4
call fcn.0040e900
mov rax, qword [rbx]
mov byte [rax], 1
jmp 0x4896ae
movdqu xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
jmp 0x489559
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rdi + 0x10]
lea r8, str.WinRing0_1_2_0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov r9d, 0xf01ff
mov rdx, r8
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rdi + 0x18], rax
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x4899fe
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x489957
mov rdi, qword [rbx]
jmp 0x48966f
call fcn.0048a660
mov r8, rax
mov r9d, r12d
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_get_path_to_driver__error__ue_0m
call fcn.0040e900
jmp 0x4896c0
mov rcx, qword [rdi + 0x18]
mov r9, r12
mov rdi, qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
xor edx, edx
mov dword [rsp + 0xd0], 0
xor r8d, r8d
call rdi
call rsi
cmp eax, 0x7a
je 0x489a41
cmp dword [rsp + 0x94], 4
mov rdi, qword [rbx]
jne 0x4895e9
mov byte [rdi], 1
jmp 0x489620
mov rcx, rdi
mov r12, rdi
call sub.msvcrt.dll_wcslen
lea rax, [rdi + rax*2]
jmp 0x48949c
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rdi + 0x18]
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4899c7
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
test ebp, ebp
je 0x4896ae
mov rdi, qword [rbx]
jmp 0x489620
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x489a23
call fcn.0048a660
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_open_service_control_manager__error__ue_0m
mov r8, rax
call fcn.0040e900
jmp 0x4896d0
call rsi
mov ebx, eax
call fcn.0048a660
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_connect_to_WinRing0_driver__error__ue_0m
call fcn.0040e900
jmp 0x4896ae
call rsi
mov edi, eax
cmp eax, 0x420
je 0x489823
cmp eax, 2
je 0x489a99
call fcn.0048a660
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver__error__ue_0m
call fcn.0040e900
mov rbx, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x48999e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x4896ae
cmp byte [rbx], 0
je 0x489ade
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbx + 0x18], 0
jmp 0x4896ae
call rsi
mov ebx, eax
call fcn.0048a660
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.0040e900
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
jmp 0x4896ae
call rsi
mov ebx, eax
call fcn.0048a660
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_install_WinRing0_driver__error__ue_0m
call fcn.0040e900
jmp 0x4896ae
call fcn.0048a660
lea rdx, str._s_e_1_33mto_access_MSR_registers_Administrator_privileges_required.e_0m
mov ecx, 4
mov r8, rax
call fcn.0040e900
jmp 0x4896d0
mov r15d, dword [rsp + 0xd0]
mov rbp, r15
test r15, r15
je 0x489ad9
mov rcx, r15
call fcn.0086bb00
mov r8, r15
xor edx, edx
mov rcx, rax
mov r14, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbx]
mov r9, r12
mov r8d, ebp
mov rdx, r14
mov rcx, qword [rax + 0x18]
call rdi
test eax, eax
jne 0x489ab7
test r14, r14
je 0x489883
mov rcx, r14
call fcn.0086bab0
jmp 0x489883
call fcn.0048a660
mov r8, rax
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver:_e_0me_1_31m_WinRing0x64.sys_not_found_e_0m
mov ecx, 3
call fcn.0040e900
jmp 0x48998b
mov rdi, qword [r14 + 0x10]
call fcn.0048a660
mov r8, rax
mov r9, rdi
mov ecx, 6
lea rdx, str._s_e_0_33mservice_path:_e_0me_1_33m__s_e_0m
call fcn.0040e900
jmp 0x489a83
xor r14d, r14d
jmp 0x489a6d
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x489b03
mov rcx, qword [rbx + 0x18]
jmp 0x4899b4
call rsi
mov esi, eax
call fcn.0048a660
mov r8, rax
mov r9d, esi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.0040e900
jmp 0x489afa
lea rcx, [0x00891330]
call fcn.0086f060
mov rcx, qword [rsp + 0xd0]
mov r12, rax
cmp rcx, rbp
je 0x489b46
call fcn.0086bab0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x489b55
call fcn.0086bab0
mov rcx, r12
call fcn.00704b70
mov r12, rax
test r14, r14
je 0x489b6d
mov rcx, r14
call fcn.0086bab0
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
jne 0x489b41
jmp 0x489b46