Function at 0x140005520
Capabilities:
Query service status

Disassembly:
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1b8], rbx
mov rax, qword [0x14027ef78]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test al, 1
jne 0x14000557f
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.140004bb0
nop
cmp byte [r8 + rdx + 1], 0
je 0x1400055a6
lea rdx, str.unsigned_long___cdecl_ServicesInfoCommand::Execute_int_wchar_t____
lea rcx, [0x1402868a0]
call fcn.14000e600
lea rcx, [0x1402868a0]
call fcn.14000e9f0
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x188]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x160]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140005678
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
lea rcx, [rsp + 0x40]
call fcn.140005ff0
xor eax, eax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], ax
lea rdx, str.Cannot_query_service_state_0x
lea rcx, [rsp + 0x50]
call fcn.1400104d0
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
and dword [rsp + rdx + 0x68], 0xfffff9ff
or dword [rsp + rdx + 0x68], 0x800
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.1400170a0
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
and dword [rsp + rcx + 0x68], 0xfffff3ff
or dword [rsp + rcx + 0x68], 0x200
lea rcx, [rsp + 0x50]
call fcn.140006820
nop
lea rcx, [rsp + 0x40]
call fcn.140004cc0
test edi, edi
je 0x140005678
mov eax, edi
jmp 0x1400057d2
movups xmm0, xmmword [rsp + 0x160]
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x170]
movups xmmword [rbx + 0x20], xmm1
mov eax, dword [rsp + 0x180]
mov dword [rbx + 0x30], eax
lea rdx, str.Service_status:
lea rcx, [0x1402868a0]
call fcn.14000e600
mov edx, dword [rsp + 0x17c]
lea rcx, [0x1402868a0]
call fcn.140006de0
mov rcx, rax
lea rdx, [0x140222e1c]
call fcn.14000e600
mov eax, dword [rsp + 0x164]
dec eax
cmp eax, 6
ja case.default.0x1400056ee
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x57f4]
add rcx, rdx
jmp rcx
lea rdx, str.SERVICE_STOPPED
jmp 0x140005740
lea rdx, str.SERVICE_START_PENDING
jmp 0x140005740
lea rdx, str.SERVICE_STOP_PENDING
jmp 0x140005740
lea rdx, str.SERVICE_RUNNING
jmp 0x140005740
lea rdx, str.SERVICE_CONTINUE_PENDING
jmp 0x140005740
lea rdx, str.SERVICE_PAUSE_PENDING
jmp 0x140005740
lea rdx, str.SERVICE_PAUSED
lea rcx, [0x1402868a0]
call fcn.14000e600
lea rdx, str.Unknown
lea rcx, [0x1402868a0]
call fcn.14000e600
lea rcx, [0x1402868a0]
call fcn.14000e9f0
mov rcx, qword [rbx + 8]
call fcn.140014f10
mov edi, eax
mov dword [rbx + 0x34], eax
mov edx, eax
test eax, eax
je 0x1400057b5
sub edx, 1
je 0x1400057ac
sub edx, 1
je 0x1400057a3
lea rcx, [0x1402868a0]
cmp edx, 1
je 0x14000579a
lea rdx, str.Service_is_set_to_INVALID_STATE:
call fcn.14000e600
mov rcx, rax
mov edx, edi
call fcn.140006de0
jmp 0x1400057c8
lea rdx, str.Service_is_set_to_DEMAND_START
jmp 0x1400057c3
lea rdx, str.Service_is_set_to_AUTO_START
jmp 0x1400057bc
lea rdx, str.Service_is_set_to_System_START
jmp 0x1400057bc
lea rdx, str.Service_is_set_to_BOOT_START
lea rcx, [0x1402868a0]
call fcn.14000e600
mov rcx, rax
call fcn.14000e9f0
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14017e000
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x1a0
pop rdi
ret