Function at 0x140005950
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140154060]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1400059f9
mov r8d, 4
lea rdx, str.Snake
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1400059b9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400059f9
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_41
lea r8, [rbp + 0x1f]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x1400059f9
cmp dword [rbp + 0x23], 4
je 0x140005c59
xor ebx, ebx
mov qword [rbp - 9], rbx
mov qword [rbp + 7], rbx
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], bl
lea r8d, [rbx + 0xe]
lea rdx, str.C:hookdrv.sys
lea rcx, [rbp - 9]
call fcn.140008c40
nop
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rdx, qword [rbp - 9]
mov r8, qword [rbp + 7]
add r8, rdx
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rdx, qword [rbp - 9]
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], bl
cmp rdx, r8
je 0x140005a6b
sub r8, rdx
lea rcx, [rbp - 0x29]
call fcn.140008c40
nop
mov qword [rbp - 0x49], rbx
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov r8d, 5
lea rdx, str.Snake
lea rcx, [rbp - 0x49]
call fcn.140008c40
nop
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov r8, qword [rbp - 0x39]
add r8, rdx
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x59], rbx
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x51], rax
mov byte [rbp - 0x69], 0
cmp rdx, r8
je 0x140005ae3
sub r8, rdx
lea rcx, [rbp - 0x69]
call fcn.140008c40
mov rax, qword [rbp - 0x51]
lea rdx, [rbp - 0x69]
cmp rax, 0x10
cmovae rdx, qword [rbp - 0x69]
call fcn.140076420
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x1f]
call fcn.140007c80
mov edx, 0x3f8
mov rcx, rax
call fcn.140004ad0
lea rdx, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae rdx, qword [rbp - 0x69]
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rcx, qword [rbp - 0x29]
call fcn.140005580
nop
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x140005b6f
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x69], 0
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x140005bbd
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005bb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140005c0b
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140005c59
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4470
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c4450
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret