Function at 0x1600c38f4
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov qword [rax - 0x118], 0xfffffffffffffffe
mov edi, r8d
mov r12, rcx
xor r14d, r14d
mov r15d, r14d
mov r8d, 0xf01ff
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.1600ccac0
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
jne 0x1600c39b8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rsi, qword [rsp + 0x1a8]
mov r9, r12
mov r8d, r15d
lea rdx, str.MSS:_Error_0x_X_occurred_while_obtaining_service_handle_for__ls_in_call__EnableOrDisableService.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rsi, str._EnableOrDisableService
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x20], 0x2a2
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
mov edi, dword [rsp + 0x1c0]
mov r13, r14
mov qword [rsp + 0x80], r14
mov dword [rsp + 0x78], r14d
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0x88], r14d
test r15d, r15d
jne 0x1600c3b5c
test edi, edi
je 0x1600c3c5c
mov dword [rsp + 0x1c8], r14d
lea r9, [rsp + 0x1c8]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfigW]
test eax, eax
jne 0x1600c3acc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
cmp eax, 0x7a
jne 0x1600c3a65
cmp dword [rsp + 0x1c8], r14d
je 0x1600c3a65
mov r15d, r14d
mov edx, dword [rsp + 0x1c8]
lea rcx, [rsp + 0x70]
call fcn.1600c2958
nop
mov r13, qword [rsp + 0x80]
jmp 0x1600c3acc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rsi, qword [rsp + 0x1a8]
mov r9, r12
mov r8d, r15d
lea rdx, str.MSS:_QueryServiceConfig_call_failed_with_error__0x_X_for_service__ls.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, str._EnableOrDisableService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x2c0
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
test r15d, r15d
jne 0x1600c3b5c
mov dword [rsp + 0x1c8], r14d
lea r9, [rsp + 0x1c8]
mov r8d, dword [rsp + 0x78]
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfigW]
test eax, eax
jne 0x1600c3c49
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov rsi, qword [rsp + 0x1a8]
mov r9, r12
mov r8d, r15d
lea rdx, str.MSS:_QueryServiceConfig_call_failed_with_error__0x_X_for_service__ls.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, str._EnableOrDisableService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x2ce
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
mov rcx, qword [rsp + 0x1b8]
cmp dword [rsp + 0x1c0], r14d
mov r8d, 4
jne 0x1600c3b77
mov r8d, dword [rcx]
test r15d, r15d
jne 0x1600c3c1e
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
or edx, 0xffffffff
mov r9d, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1600c3c1e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r15d, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x1a8]
mov r9, r12
mov r8d, r15d
lea rdx, str.MSS:_QueryServiceConfig_call_failed_with_error__0x_X_for_service__ls.
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, str._EnableOrDisableService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x2e8
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
nop
lea rcx, [rsp + 0x70]
call fcn.1600671c4
nop
lea rcx, [rsp + 0x68]
call fcn.1600c0874
mov eax, r15d
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, dword [r13 + 4]
mov rcx, qword [rsp + 0x1b8]
mov dword [rcx], eax
jmp 0x1600c3b64
mov rcx, qword [rsp + 0x1b8]
jmp 0x1600c3b74