Function at 0x4b8960
Capabilities:
Create service
Delete service
Query service configuration
Query service status
Start service
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rbx, rcx
mov ecx, 0x20
call fcn.008ae350
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
movdqa xmm0, xmmword [0x008d92c0]
mov rsi, rax
mov byte [rax], 0
mov qword [rax + 0x18], 0
mov qword [rbx], rax
movups xmmword [rax + 8], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx]
cmp qword [rax + 0x10], 0
je 0x4b8f60
pxor xmm0, xmm0
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor r8d, r8d
movaps xmmword [rsp + 0x70], xmm0
mov eax, 0x104
lea rbp, [rsp + 0x70]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x80], 0
jmp 0x4b8a3b
jae 0x4b8a0b
lea rax, [rdx + rax*2]
cmp rax, r8
je 0x4b8a0b
mov qword [rsp + 0x78], rax
mov r8, rax
sub r8, rdx
xor ecx, ecx
sar r8, 1
call rdi
call rsi
mov r12d, eax
cmp eax, 0x7a
jne 0x4b8a68
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov ecx, 0x104
mov rax, r8
sub rax, rdx
cmp r8, rdx
cmove rax, rcx
mov rcx, r8
sub rcx, rdx
sar rcx, 1
cmp rax, rcx
jbe 0x4b89f8
sub rax, rcx
mov rcx, rbp
mov rdx, rax
call fcn.00874b80
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
jmp 0x4b8a0b
test eax, eax
jne 0x4b8e90
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
lea r12, [rax - 2]
cmp rdi, r12
je 0x4b8ae0
mov rax, r12
jmp 0x4b8aa2
cmp dx, 0x5c
je 0x4b8aab
sub rax, 2
mov r12, rax
cmp rdi, rax
je 0x4b8ae0
movzx edx, word [rax]
cmp dx, 0x2f
jne 0x4b8a90
xor r9d, r9d
lea rbp, [rsp + 0xe0]
mov word [rax + 2], r9w
mov qword [rsp + 0xd0], rbp
test rdi, rdi
jne 0x4b8f00
lea rcx, [0x008d8fe0]
call fcn.008b1c30
nop dword [rax + rax]
lea rbp, [rsp + 0xe0]
mov rcx, r12
mov qword [rsp + 0xd0], rbp
call sub.msvcrt.dll_wcslen
lea rax, [r12 + rax*2]
sub rax, r12
mov rdx, rax
mov rdi, rax
sar rdx, 1
mov qword [rsp + 0xb0], rdx
cmp rdx, 7
ja 0x4b8d58
mov rcx, qword [rsp + 0xd0]
cmp rdx, 1
jne 0x4b8d48
movzx eax, word [r12]
mov word [rcx], ax
xor r8d, r8d
mov qword [rsp + 0xd8], rdx
mov word [rcx + rdx*2], r8w
lea rcx, str.WinRing0x64.sys
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xd8]
cmp r8, rax
ja 0x4b9185
lea r12, [rsp + 0xd0]
lea rdx, str.WinRing0x64.sys
mov rcx, r12
call fcn.0087a590
lea r13, [rsp + 0xc0]
lea rdx, [rax + 0x10]
mov qword [rsp + 0xb0], r13
mov rcx, qword [rax]
cmp rcx, rdx
je 0x4b8dd8
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0xb8], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0xd0]
xor edx, edx
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rbp
je 0x4b8be8
call fcn.008ae300
mov rdi, qword [rbx]
mov r8d, 0xf01ff
lea rdx, str.WinRing0_1_2_0
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rdi + 0x18], rax
mov rdi, qword [rbx]
cmp qword [rdi + 0x18], 0
je 0x4b8c80
call fcn.004b9cc0
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_existse_0m
mov ecx, 4
call fcn.0040eb80
mov rax, qword [rbx]
lea rdx, [rsp + 0x90]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rdi, qword [rbx]
test eax, eax
jne 0x4b8eb8
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x4b8c59
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x4b8f54
cmp byte [rdi], 0
je 0x4b8f18
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
mov rdi, qword [rbx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rbp, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0xc0000000
lea rcx, str..WinRing0_1_2_0
mov dword [rsp + 0x20], 3
call rbp
mov qword [rdi + 8], rax
mov rdi, qword [rbx]
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x4b8db0
cmp byte [rdi], 0
je 0x4b8df0
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, str..WinRing0_1_2_0
mov dword [rsp + 0x20], 3
call rbp
mov qword [rdi + 8], rax
mov rax, qword [rbx]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x4b8f92
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x4b8d20
call fcn.008ae300
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x4b8d30
call fcn.008ae300
nop
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x4b8b34
jmp 0x4b8d8b
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xd0]
xor r8d, r8d
call fcn.0087a700
mov qword [rsp + 0xd0], rax
mov rcx, rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xe0], rax
mov rdx, r12
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xd0]
jmp 0x4b8b34
call fcn.004b9cc0
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_exists__but_with_a_different_service_namee_0m
mov ecx, 4
call fcn.0040eb80
mov rax, qword [rbx]
mov byte [rax], 1
jmp 0x4b8d0e
movdqu xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
jmp 0x4b8bb9
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rdi + 0x10]
lea r8, str.WinRing0_1_2_0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov r9d, 0xf01ff
mov rdx, r8
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rdi + 0x18], rax
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x4b905e
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x4b8fb7
mov rdi, qword [rbx]
jmp 0x4b8ccf
call fcn.004b9cc0
mov r8, rax
mov r9d, r12d
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_get_path_to_driver__error__ue_0m
call fcn.0040eb80
jmp 0x4b8d20
mov rcx, qword [rdi + 0x18]
mov r9, r12
mov rdi, qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
xor edx, edx
mov dword [rsp + 0xd0], 0
xor r8d, r8d
call rdi
call rsi
cmp eax, 0x7a
je 0x4b90a1
cmp dword [rsp + 0x94], 4
mov rdi, qword [rbx]
jne 0x4b8c49
mov byte [rdi], 1
jmp 0x4b8c80
mov rcx, rdi
mov r12, rdi
call sub.msvcrt.dll_wcslen
lea rax, [rdi + rax*2]
jmp 0x4b8afc
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rdi + 0x18]
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4b9027
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
test ebp, ebp
je 0x4b8d0e
mov rdi, qword [rbx]
jmp 0x4b8c80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x4b9083
call fcn.004b9cc0
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_open_service_control_manager__error__ue_0m
mov r8, rax
call fcn.0040eb80
jmp 0x4b8d30
call rsi
mov ebx, eax
call fcn.004b9cc0
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_connect_to_WinRing0_driver__error__ue_0m
call fcn.0040eb80
jmp 0x4b8d0e
call rsi
mov edi, eax
cmp eax, 0x420
je 0x4b8e83
cmp eax, 2
je 0x4b90f9
call fcn.004b9cc0
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver__error__ue_0m
call fcn.0040eb80
mov rbx, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x4b8ffe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x4b8d0e
cmp byte [rbx], 0
je 0x4b913e
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbx + 0x18], 0
jmp 0x4b8d0e
call rsi
mov ebx, eax
call fcn.004b9cc0
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.0040eb80
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
jmp 0x4b8d0e
call rsi
mov ebx, eax
call fcn.004b9cc0
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_install_WinRing0_driver__error__ue_0m
call fcn.0040eb80
jmp 0x4b8d0e
call fcn.004b9cc0
lea rdx, str._s_e_1_33mto_access_MSR_registers_Administrator_privileges_required.e_0m
mov ecx, 4
mov r8, rax
call fcn.0040eb80
jmp 0x4b8d30
mov r15d, dword [rsp + 0xd0]
mov rbp, r15
test r15, r15
je 0x4b9139
mov rcx, r15
call fcn.008ae350
mov r8, r15
xor edx, edx
mov rcx, rax
mov r14, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbx]
mov r9, r12
mov r8d, ebp
mov rdx, r14
mov rcx, qword [rax + 0x18]
call rdi
test eax, eax
jne 0x4b9117
test r14, r14
je 0x4b8ee3
mov rcx, r14
call fcn.008ae300
jmp 0x4b8ee3
call fcn.004b9cc0
mov r8, rax
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver:_e_0me_1_31m_WinRing0x64.sys_not_found_e_0m
mov ecx, 3
call fcn.0040eb80
jmp 0x4b8feb
mov rdi, qword [r14 + 0x10]
call fcn.004b9cc0
mov r8, rax
mov r9, rdi
mov ecx, 6
lea rdx, str._s_e_0_33mservice_path:_e_0me_1_33m__s_e_0m
call fcn.0040eb80
jmp 0x4b90e3
xor r14d, r14d
jmp 0x4b90cd
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4b9163
mov rcx, qword [rbx + 0x18]
jmp 0x4b9014
call rsi
mov esi, eax
call fcn.004b9cc0
mov r8, rax
mov r9d, esi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.0040eb80
jmp 0x4b915a
lea rcx, [0x008d9030]
call fcn.008b1d20
mov rcx, qword [rsp + 0xd0]
mov r12, rax
cmp rcx, rbp
je 0x4b91a6
call fcn.008ae300
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x4b91b5
call fcn.008ae300
mov rcx, r12
call fcn.00738fd0
mov r12, rax
test r14, r14
je 0x4b91cd
mov rcx, r14
call fcn.008ae300
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
jne 0x4b91a1
jmp 0x4b91a6