Function at 0x4896c0
Capabilities:
Create service
Delete service
Query service configuration
Query service status
Start service
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rbx, rcx
mov ecx, 0x20
call fcn.0086bb00
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
movdqa xmm0, xmmword [0x00891540]
mov rsi, rax
mov byte [rax], 0
mov qword [rax + 0x18], 0
mov qword [rbx], rax
movups xmmword [rax + 8], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx]
cmp qword [rax + 0x10], 0
je 0x489cc0
pxor xmm0, xmm0
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor r8d, r8d
movaps xmmword [rsp + 0x70], xmm0
mov eax, 0x104
lea rbp, [rsp + 0x70]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x80], 0
jmp 0x48979b
jae 0x48976b
lea rax, [rdx + rax*2]
cmp rax, r8
je 0x48976b
mov qword [rsp + 0x78], rax
mov r8, rax
sub r8, rdx
xor ecx, ecx
sar r8, 1
call rdi
call rsi
mov r12d, eax
cmp eax, 0x7a
jne 0x4897c8
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov ecx, 0x104
mov rax, r8
sub rax, rdx
cmp r8, rdx
cmove rax, rcx
mov rcx, r8
sub rcx, rdx
sar rcx, 1
cmp rax, rcx
jbe 0x489758
sub rax, rcx
mov rcx, rbp
mov rdx, rax
call fcn.00833ad0
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
jmp 0x48976b
test eax, eax
jne 0x489bf0
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
lea r12, [rax - 2]
cmp rdi, r12
je 0x489840
mov rax, r12
jmp 0x489802
cmp dx, 0x5c
je 0x48980b
sub rax, 2
mov r12, rax
cmp rdi, rax
je 0x489840
movzx edx, word [rax]
cmp dx, 0x2f
jne 0x4897f0
xor r9d, r9d
lea rbp, [rsp + 0xe0]
mov word [rax + 2], r9w
mov qword [rsp + 0xd0], rbp
test rdi, rdi
jne 0x489c60
lea rcx, [0x00891260]
call fcn.0086ef90
nop dword [rax + rax]
lea rbp, [rsp + 0xe0]
mov rcx, r12
mov qword [rsp + 0xd0], rbp
call sub.msvcrt.dll_wcslen
lea rax, [r12 + rax*2]
sub rax, r12
mov rdx, rax
mov rdi, rax
sar rdx, 1
mov qword [rsp + 0xb0], rdx
cmp rdx, 7
ja 0x489ab8
mov rcx, qword [rsp + 0xd0]
cmp rdx, 1
jne 0x489aa8
movzx eax, word [r12]
mov word [rcx], ax
xor r8d, r8d
mov qword [rsp + 0xd8], rdx
mov word [rcx + rdx*2], r8w
lea rcx, str.WinRing0x64.sys
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xd8]
cmp r8, rax
ja 0x489ee5
lea r12, [rsp + 0xd0]
lea rdx, str.WinRing0x64.sys
mov rcx, r12
call fcn.008394e0
lea r13, [rsp + 0xc0]
lea rdx, [rax + 0x10]
mov qword [rsp + 0xb0], r13
mov rcx, qword [rax]
cmp rcx, rdx
je 0x489b38
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0xb8], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0xd0]
xor edx, edx
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rbp
je 0x489948
call fcn.0086bab0
mov rdi, qword [rbx]
mov r8d, 0xf01ff
lea rdx, str.WinRing0_1_2_0
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rdi + 0x18], rax
mov rdi, qword [rbx]
cmp qword [rdi + 0x18], 0
je 0x4899e0
call fcn.0048aa20
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_existse_0m
mov ecx, 4
call fcn.0040e900
mov rax, qword [rbx]
lea rdx, [rsp + 0x90]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rdi, qword [rbx]
test eax, eax
jne 0x489c18
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x4899b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x489cb4
cmp byte [rdi], 0
je 0x489c78
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
mov rdi, qword [rbx]
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rbp, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0xc0000000
lea rcx, str..WinRing0_1_2_0
mov dword [rsp + 0x20], 3
call rbp
mov qword [rdi + 8], rax
mov rdi, qword [rbx]
cmp qword [rdi + 8], 0xffffffffffffffff
jne 0x489b10
cmp byte [rdi], 0
je 0x489b50
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, str..WinRing0_1_2_0
mov dword [rsp + 0x20], 3
call rbp
mov qword [rdi + 8], rax
mov rax, qword [rbx]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x489cf2
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
je 0x489a80
call fcn.0086bab0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x489a90
call fcn.0086bab0
nop
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdx, rdx
je 0x489894
jmp 0x489aeb
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xd0]
xor r8d, r8d
call fcn.00839650
mov qword [rsp + 0xd0], rax
mov rcx, rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xe0], rax
mov rdx, r12
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xd0]
jmp 0x489894
call fcn.0048aa20
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_exists__but_with_a_different_service_namee_0m
mov ecx, 4
call fcn.0040e900
mov rax, qword [rbx]
mov byte [rax], 1
jmp 0x489a6e
movdqu xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
jmp 0x489919
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rdi + 0x10]
lea r8, str.WinRing0_1_2_0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov r9d, 0xf01ff
mov rdx, r8
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rdi + 0x18], rax
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x489dbe
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x489d17
mov rdi, qword [rbx]
jmp 0x489a2f
call fcn.0048aa20
mov r8, rax
mov r9d, r12d
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_get_path_to_driver__error__ue_0m
call fcn.0040e900
jmp 0x489a80
mov rcx, qword [rdi + 0x18]
mov r9, r12
mov rdi, qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
xor edx, edx
mov dword [rsp + 0xd0], 0
xor r8d, r8d
call rdi
call rsi
cmp eax, 0x7a
je 0x489e01
cmp dword [rsp + 0x94], 4
mov rdi, qword [rbx]
jne 0x4899a9
mov byte [rdi], 1
jmp 0x4899e0
mov rcx, rdi
mov r12, rdi
call sub.msvcrt.dll_wcslen
lea rax, [rdi + rax*2]
jmp 0x48985c
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rdi + 0x18]
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x489d87
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
test ebp, ebp
je 0x489a6e
mov rdi, qword [rbx]
jmp 0x4899e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x489de3
call fcn.0048aa20
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_open_service_control_manager__error__ue_0m
mov r8, rax
call fcn.0040e900
jmp 0x489a90
call rsi
mov ebx, eax
call fcn.0048aa20
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_connect_to_WinRing0_driver__error__ue_0m
call fcn.0040e900
jmp 0x489a6e
call rsi
mov edi, eax
cmp eax, 0x420
je 0x489be3
cmp eax, 2
je 0x489e59
call fcn.0048aa20
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver__error__ue_0m
call fcn.0040e900
mov rbx, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x489d5e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x489a6e
cmp byte [rbx], 0
je 0x489e9e
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbx + 0x18], 0
jmp 0x489a6e
call rsi
mov ebx, eax
call fcn.0048aa20
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.0040e900
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rdi + 0x18], 0
jmp 0x489a6e
call rsi
mov ebx, eax
call fcn.0048aa20
mov r8, rax
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_install_WinRing0_driver__error__ue_0m
call fcn.0040e900
jmp 0x489a6e
call fcn.0048aa20
lea rdx, str._s_e_1_33mto_access_MSR_registers_Administrator_privileges_required.e_0m
mov ecx, 4
mov r8, rax
call fcn.0040e900
jmp 0x489a90
mov r15d, dword [rsp + 0xd0]
mov rbp, r15
test r15, r15
je 0x489e99
mov rcx, r15
call fcn.0086bb00
mov r8, r15
xor edx, edx
mov rcx, rax
mov r14, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbx]
mov r9, r12
mov r8d, ebp
mov rdx, r14
mov rcx, qword [rax + 0x18]
call rdi
test eax, eax
jne 0x489e77
test r14, r14
je 0x489c43
mov rcx, r14
call fcn.0086bab0
jmp 0x489c43
call fcn.0048aa20
mov r8, rax
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver:_e_0me_1_31m_WinRing0x64.sys_not_found_e_0m
mov ecx, 3
call fcn.0040e900
jmp 0x489d4b
mov rdi, qword [r14 + 0x10]
call fcn.0048aa20
mov r8, rax
mov r9, rdi
mov ecx, 6
lea rdx, str._s_e_0_33mservice_path:_e_0me_1_33m__s_e_0m
call fcn.0040e900
jmp 0x489e43
xor r14d, r14d
jmp 0x489e2d
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x489ec3
mov rcx, qword [rbx + 0x18]
jmp 0x489d74
call rsi
mov esi, eax
call fcn.0048aa20
mov r8, rax
mov r9d, esi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.0040e900
jmp 0x489eba
lea rcx, [0x008912b0]
call fcn.0086f080
mov rcx, qword [rsp + 0xd0]
mov r12, rax
cmp rcx, rbp
je 0x489f06
call fcn.0086bab0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x489f15
call fcn.0086bab0
mov rcx, r12
call fcn.00704b70
mov r12, rax
test r14, r14
je 0x489f2d
mov rcx, r14
call fcn.0086bab0
mov rcx, qword [rsp + 0xb0]
cmp rcx, r13
jne 0x489f01
jmp 0x489f06