Function at 0x140098cb0
Capabilities:
Create service
Delete service
Query service configuration
Query service status
Start service
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
mov rbp, rcx
mov ecx, 0x20
call fcn.1402797d0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
movdqu xmm0, xmmword [0x14029a780]
mov rbx, rax
mov byte [rax], 0
mov qword [rax + 0x18], 0
mov qword [rbp], rax
movups xmmword [rax + 8], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbx + 0x10], rax
mov rax, qword [rbp]
cmp qword [rax + 0x10], 0
je 0x1400992f0
pxor xmm0, xmm0
mov r13, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r12d, r12d
xor ebx, ebx
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
movups xmmword [rsp + 0x80], xmm0
lea r14, [rsp + 0x80]
mov qword [rsp + 0x90], 0
jmp 0x140098da1
mov rdx, r12
sub rdx, rbx
mov rax, rdx
sar rax, 1
mov r8, rax
cmp rax, rdx
jb 0x140099160
cmp rdx, rax
jae 0x140098d90
add rdx, rdx
lea rax, [rbx + rdx]
cmp rax, r12
je 0x140098d90
mov qword [rsp + 0x88], rax
sar rdx, 1
mov r12, rax
mov r8, rdx
nop word [rax + rax]
mov rdx, rbx
xor ecx, ecx
call r13
call rdi
mov esi, eax
cmp eax, 0x7a
jne 0x140098dd0
cmp rbx, r12
jne 0x140098d50
mov edx, 0x104
mov rcx, r14
call fcn.140243840
mov r12, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r8, r12
sub r8, rbx
sar r8, 1
jmp 0x140098d90
test eax, eax
jne 0x140099208
lea rax, [r12 - 2]
cmp rax, rbx
jne 0x140098dff
jmp 0x140099507
cmp dx, 0x2f
je 0x140098e08
sub rax, 2
cmp rbx, rax
je 0x140098e10
movzx edx, word [rax]
cmp dx, 0x5c
jne 0x140098df0
xor r9d, r9d
mov word [rax + 2], r9w
lea r12, [rsp + 0xf0]
mov qword [rsp + 0xe0], r12
test rbx, rbx
je 0x14009959b
mov rcx, rbx
call sub.msvcrt.dll_wcslen
lea r13, [rax + rax]
mov r14, r13
sar r14, 1
mov qword [rsp + 0xc0], r14
mov rdx, r14
cmp r13, 0xe
ja 0x140099170
mov rcx, qword [rsp + 0xe0]
cmp r14, 1
jne 0x140099248
movzx eax, word [rbx]
lea r15, [rsp + 0xe0]
mov word [rcx], ax
mov eax, 2
xor r8d, r8d
mov qword [rsp + 0xe8], rdx
lea r13, str.WinRing0x64.sys
mov word [rcx + rax], r8w
mov rcx, r13
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xe8]
cmp rax, r8
jb 0x14009958f
mov rdx, r13
mov rcx, r15
call fcn.14024b690
lea r14, [rsp + 0xd0]
lea r8, [rax + 0x10]
mov rcx, qword [rax + 8]
mov qword [rsp + 0xc0], r14
mov rdx, qword [rax]
cmp rdx, r8
je 0x140099258
mov qword [rsp + 0xc0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xc8], rcx
xor edx, edx
mov qword [rax], r8
mov rcx, qword [rsp + 0xe0]
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, r12
je 0x140098f20
call fcn.140279780
mov r12, qword [rbp]
mov r8d, 0xf01ff
lea rdx, str.WinRing0_1_2_0
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [r12 + 0x18], rax
mov r12, qword [rbp]
cmp qword [r12 + 0x18], 0
je 0x140099003
call fcn.14009a290
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_existse_0m
mov ecx, 4
call fcn.140011290
mov rax, qword [rbp]
lea rdx, [rsp + 0xa0]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov r13, qword [rbp]
test eax, eax
je 0x140098fc9
mov rcx, qword [r13 + 0x18]
mov r12, qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov r9, r15
xor edx, edx
mov dword [rsp + 0xe0], 0
xor r8d, r8d
call r12
call rdi
cmp eax, 0x7a
je 0x14009937d
mov r12, qword [rbp]
cmp dword [rsp + 0xa4], 4
mov r13, r12
je 0x1400991f8
mov rcx, qword [r13 + 8]
cmp rcx, 0xffffffffffffffff
je 0x140098fd9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x1400992e0
cmp byte [r13], 0
je 0x1400992a0
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [r13 + 0x18], 0
mov r12, qword [rbp]
lea r13, str..WinRing0_1_2_0
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, 0xc0000000
mov rcx, r13
mov dword [rsp + 0x20], 3
call rsi
mov qword [r12 + 8], rax
mov r12, qword [rbp]
cmp qword [r12 + 8], 0xffffffffffffffff
jne 0x1400991d0
cmp byte [r12], 0
jne 0x1400990f4
mov rax, qword [rsp + 0xc0]
lea r8, str.WinRing0_1_2_0
mov rcx, qword [r12 + 0x10]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], 0
mov rdx, r8
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [r12 + 0x18], rax
mov rax, qword [rbp]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400994e2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x14009940d
mov r12, qword [rbp]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rsi
mov qword [r12 + 8], rax
mov rax, qword [rbp]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x140099330
mov rcx, qword [rsp + 0xc0]
cmp rcx, r14
je 0x140099143
call fcn.140279780
mov rcx, rbx
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140279780
sub rdx, rax
jmp 0x140098dab
lea r15, [rsp + 0xe0]
lea rdx, [rsp + 0xc0]
xor r8d, r8d
mov rcx, r15
call fcn.14024b7e0
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0xe0], rax
mov rcx, rax
mov qword [rsp + 0xf0], rdx
test r14, r14
je 0x1400991c6
mov rdx, rbx
mov r8, r13
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xe0]
lea rax, [rdx + rdx]
jmp 0x140098e75
call fcn.14009a290
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_exists__but_with_a_different_service_namee_0m
mov ecx, 4
call fcn.140011290
mov rax, qword [rbp]
mov byte [rax], 1
jmp 0x140099131
mov byte [r12], 1
jmp 0x140099003
call fcn.14009a290
mov r8, rax
mov r9d, esi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_get_path_to_driver__error__ue_0m
call fcn.140011290
test rbx, rbx
jne 0x140099143
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0xe0]
jmp 0x1400991a6
lea rcx, [rcx + rcx + 2]
mov r10, r14
mov rdx, r8
cmp ecx, 8
jae 0x140099355
xor r9d, r9d
test cl, 4
je 0x140099280
mov r9d, dword [rdx]
mov dword [r10], r9d
mov r9d, 4
and ecx, 2
je 0x14009928f
movzx edx, word [rdx + r9]
mov word [r10 + r9], dx
mov rcx, qword [rax + 8]
jmp 0x140098ef5
mov r8, r15
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [r13 + 0x18]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14009947f
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [r13 + 0x18], 0
test esi, esi
je 0x140099131
nop dword [rax]
mov r12, qword [rbp]
jmp 0x140099003
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x1400994b6
call fcn.14009a290
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_open_service_control_manager__error__ue_0m
mov r8, rax
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140011290
call rdi
mov esi, eax
call fcn.14009a290
mov r8, rax
mov r9d, esi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_connect_to_WinRing0_driver__error__ue_0m
call fcn.140011290
jmp 0x140099131
mov r11d, ecx
xor edx, edx
and r11d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r10, qword [r8 + r9]
mov qword [r14 + r9], r10
cmp edx, r11d
jb 0x14009935e
lea r10, [r14 + rdx]
add rdx, r8
jmp 0x14009926c
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x74], eax
test rax, rax
je 0x140099408
mov rcx, rax
mov qword [rsp + 0x78], rax
call fcn.1402797d0
mov r8, qword [rsp + 0x78]
mov byte [rax], 0
mov r13, rax
mov esi, 1
sub r8, 1
je 0x1400993bf
lea rcx, [rax + 1]
xor edx, edx
call sub.msvcrt.dll_memset
mov esi, dword [rsp + 0x74]
mov rax, qword [rbp]
mov r9, r15
mov r8d, esi
mov rdx, r13
mov rcx, qword [rax + 0x18]
call r12
test eax, eax
je 0x14009951c
mov rsi, qword [r13 + 0x10]
call fcn.14009a290
mov r8, rax
mov r9, rsi
mov ecx, 6
lea rdx, str._s_e_0_33mservice_path:_e_0me_1_33m__s_e_0m
call fcn.140011290
mov rcx, r13
call fcn.140279780
jmp 0x140098fb4
xor r13d, r13d
jmp 0x1400993bf
call rdi
mov r12d, eax
cmp eax, 0x420
je 0x1400990f0
cmp eax, 2
je 0x14009952a
call fcn.14009a290
mov r8, rax
mov r9d, r12d
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver__error__ue_0m
call fcn.140011290
mov rsi, qword [rbp]
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
je 0x140099456
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140099131
cmp byte [rsi], 0
je 0x140099548
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsi + 0x18], 0
jmp 0x140099131
call rdi
mov esi, eax
call fcn.14009a290
mov r8, rax
mov r9d, esi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.140011290
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [r13 + 0x18], 0
jmp 0x140099131
call fcn.14009a290
lea rdx, str._s_e_1_33mto_access_MSR_registers_Administrator_privileges_required.e_0m
mov ecx, 4
mov r8, rax
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140011290
call rdi
mov esi, eax
call fcn.14009a290
mov r8, rax
mov r9d, esi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_install_WinRing0_driver__error__ue_0m
call fcn.140011290
jmp 0x140099131
lea r12, [rsp + 0xf0]
mov qword [rsp + 0xe0], r12
jmp 0x140098e29
test r13, r13
je 0x140098fb4
jmp 0x1400993fb
call fcn.14009a290
mov r8, rax
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver:_e_0me_1_31m_WinRing0x64.sys_not_found_e_0m
mov ecx, 3
call fcn.140011290
jmp 0x140099442
mov r8, r15
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14009956d
mov rcx, qword [rsi + 0x18]
jmp 0x14009946c
call rdi
mov edi, eax
call fcn.14009a290
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.140011290
jmp 0x140099564
lea rcx, [0x14029a4f8]
call fcn.14027d3a0
lea rcx, [0x14029a4a0]
call fcn.14027d2b0
mov rbx, rax
test r13, r13
jne 0x1400995e0
lea rcx, [rsp + 0xc0]
call fcn.140248ff0
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400995ce
call fcn.140279780
mov rcx, rbx
call fcn.1401157b0
mov rbx, rax
jmp 0x1400995bc
mov rcx, r13
call fcn.140279780
jmp 0x1400995af