Function at 0x140020790
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 8]
sub rsp, 0x108
mov ecx, dword [0x140079f0c]
lea rax, [0x140079b48]
xor edi, edi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov r13, r9
lea rax, [0x140077790]
mov ebx, edi
mov r8d, edi
nop
cmp dword [rax - 0x50], ecx
ja 0x14002082c
lea rbx, [rax - 0x50]
cmp dword [rax], ecx
ja 0x14002082c
mov rbx, rax
cmp dword [rax + 0x50], ecx
ja 0x14002082c
lea rbx, [rax + 0x50]
cmp dword [rax + 0xa0], ecx
ja 0x14002082c
lea rbx, [rax + 0xa0]
cmp dword [rax + 0xf0], ecx
ja 0x14002082c
lea rbx, [rax + 0xf0]
cmp dword [rax + 0x140], ecx
ja 0x14002082c
lea rbx, [rax + 0x140]
add r8, 0x1e0
add rax, 0x1e0
cmp r8, 0x3c0
jb 0x1400207d0
test rbx, rbx
je 0x140020bc2
mov rax, qword [rbx + 0x10]
lea rdx, str.ServicesActive
mov qword [rsp + 0x40], rax
mov r8d, 1
mov rax, qword [rbx + 0x20]
xor ecx, ecx
mov qword [rsp + reloc.WLDAP32.dll_Ordinal_304], rsi
mov qword [rsp + 0x100], r15
mov r15d, edi
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140020bbe
mov qword [rsp + 0x138], r12
lea rdx, str.KeyIso
mov r12d, 4
mov qword [rsp + 0x148], r14
mov r8d, r12d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x1400208d5
lea rax, [rbp + 0x50]
xor edx, edx
lea r9d, [r12 + 0x20]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, r14
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15d, r15d
je 0x140020b8f
cmp dword [rbp - 0x2c], r12d
jb 0x140020b8f
mov r8d, dword [rbp - 0x14]
xor edx, edx
mov ecx, 0x438
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140020b8f
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140020b8f
mov edx, 8
mov dword [rax], 1
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi + 8], rax
test rax, rax
je 0x140020b86
mov qword [rax], r14
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], edi
test r13, r13
je 0x140020998
mov rdx, r13
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r8, [rsp + 0x60]
mov rcx, rsi
lea rdx, [0x140009160]
call fcn.140008830
test eax, eax
js 0x140020b3b
mov eax, dword [rsp + 0x70]
jmp 0x1400209b0
lea r8, [rbp - 0x70]
mov rcx, rsi
lea rdx, [0x1400091b0]
call fcn.140008830
not eax
shr eax, 0x1f
test eax, eax
je 0x140020b3b
movups xmm0, xmmword [rbp - 0x70]
mov eax, dword [rbp - 0x60]
lea r8, [rbp - 0x50]
movsxd r15, dword [rbx + 0x28]
lea rcx, [rsp + 0x40]
mov r14d, dword [rbx + 0x18]
mov edx, dword [rbx + 8]
mov ebx, edi
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
psrldq xmm0, 8
movq qword [rsp + 0x38], xmm0
mov qword [rsp + 0x30], rdi
call fcn.140014270
test eax, eax
je 0x140020b3b
mov rdx, qword [rsp + 0x38]
mov r10, r15
add r10, qword [rbp - 0x38]
mov qword [rsp + 0x30], r10
mov ecx, dword [rdx]
test ecx, ecx
je 0x140020a37
cmp ecx, 1
jne 0x140020b3b
mov rcx, qword [rdx + 8]
lea r8, [rsp + 0x60]
mov r9d, 0x30
mov rdx, r10
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x140020a4b
mov r8d, 0x30
lea rdx, [rsp + 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
mov ecx, edi
sete cl
test ecx, ecx
je 0x140020b3b
mov ecx, dword [rbp - 0x7c]
mov eax, ecx
and eax, 0xf
mov r8d, ecx
dec eax
and r8d, 0xffffff00
cmp eax, 2
jbe 0x140020a88
and ecx, 0xf0
dec ecx
cmp ecx, 0x3e
ja 0x140020adb
mov r12d, Ordinal_69
mov rdx, qword [rsp + 0x38]
or r8d, r12d
mov ecx, dword [rdx]
test ecx, ecx
je 0x140020ac2
cmp ecx, 1
jne 0x140020b3b
mov rcx, qword [rdx + 8]
lea rax, [rbp + 0x50]
mov rdx, qword [rsp + 0x30]
mov r9d, r8d
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x140020ad4
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x50]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140020b3b
mov ebx, dword [rbp + 0x50]
mov r8, r14
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140013e60
mov edi, eax
test ebx, ebx
je 0x140020b3b
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rdx]
test ecx, ecx
je 0x140020b26
cmp ecx, 1
jne 0x140020b3b
mov rcx, qword [rdx + 8]
lea rax, [rbp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r9d, ebx
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x140020b3b
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x40]
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [rsi]
sub ecx, 1
je 0x140020b7c
sub ecx, 1
je 0x140020b53
sub ecx, 1
je 0x140020b7c
cmp ecx, 3
jne 0x140020b86
jmp 0x140020b7c
mov rax, qword [rsi + 8]
test rax, rax
je 0x140020b86
mov rbx, qword [rax]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140020b6e
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140020b7c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x148]
mov eax, edi
mov r12, qword [rsp + 0x138]
mov rsi, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
mov r15, qword [rsp + 0x100]
add rsp, 0x108
pop r13
pop rdi
pop rbx
pop rbp
ret
mov eax, edi
jmp 0x140020ba1
mov eax, edi
add rsp, 0x108
pop r13
pop rdi
pop rbx
pop rbp
ret