Function at 0x140008780
Capabilities:
Create service
Inspect section memory permissions

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x5a0
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov rax, qword [rsp + 0x5e0]
mov qword [r11 - 0x10], rbx
mov qword [r11 - 0x18], rbp
mov ebx, r9d
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x38], r14
mov r14, rcx
mov rcx, qword [rsp + 0x5f0]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0x90], rcx
mov r12, r8
mov rbp, rdx
lea r9, [0x140062e94]
xor dil, dil
test r8, r8
lea rcx, str.ConfigureService:__S__S__S_n
cmovne r9, r8
mov r8, rdx
mov rdx, r14
mov dword [rsp + 0x7c], ebx
mov qword [rsp + 0x88], rax
call fcn.1400154e0
mov rcx, qword [rsp + 0x5f8]
xor esi, esi
test rcx, rcx
je 0x140008843
lea rdx, [rsp + 0x230]
sub rdx, rcx
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rdx + rcx - 2], ax
jne 0x140008830
jmp 0x14000887a
mov rcx, rsi
lea rdx, [0x140062e58]
nop
movzx eax, word [rcx + rdx]
add rcx, 2
test ax, ax
mov word [rsp + rcx + 0x22e], ax
jne 0x140008850
lea rcx, [rsp + 0x230]
mov r8, r14
mov edx, 0xc8
call fcn.140038380
lea rdx, [rsp + 0x3c0]
mov rcx, r14
sub rdx, r14
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rdx + rcx - 2], ax
jne 0x140008890
lea rdx, str.SYSTEMCurrentControlSetServices
mov rcx, 0xffffffff80000002
call fcn.1400393b0
test rax, rax
mov qword [rsp + 0x80], rax
je 0x14000a0c3
lea rdx, [rsp + 0x3c0]
mov rcx, rax
mov qword [rsp + 0x578], r13
mov qword [rsp + 0x568], r15
call fcn.1400393b0
mov r13d, dword [rsp + 0x5d0]
test rax, rax
mov r15, rax
je 0x14000895e
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x140008b75
lea rdx, [rsp + 0x3c0]
mov r8d, 0x80000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140008944
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140008b75
lea rcx, str.ConfigureService:_Service_key_exists__but_service_is_not_installed_n
call fcn.1400154e0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140008b75
lea rcx, str.Open_service_key_failed:_adding_service_to_SCM_n
call fcn.1400154e0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rsi, rax
je 0x140008a96
mov r15d, dword [rsp + 0x5d8]
xor eax, eax
lea r8, [rsp + 0x230]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x3c0]
mov r9d, 0x20000000
mov rcx, rsi
mov dword [rsp + 0x28], r13d
mov edi, eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140008a81
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateServiceW_failed__u_n
mov edx, eax
mov ebx, eax
call fcn.1400154e0
cmp ebx, 0x436
jne 0x140008a8a
cmp edi, 0xa
jge 0x140008a8a
lea r8, [0x140062d68]
lea rcx, [rsp + 0x230]
mov edx, 0xc8
call fcn.140038380
mov ebx, dword [rsp + 0x7c]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r15d
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x3c0]
mov r9d, 0x20000000
mov rcx, rsi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], ebx
add edi, 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
je 0x1400089e4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor dil, dil
xor esi, esi
lea rcx, str..WGUARDNT
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008b09
mov qword [rsp + 0x30], rsi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008b09
mov rbx, rsi
jmp 0x140008b40
test rbx, rbx
je 0x140008b40
cmp rbx, 0xffffffffffffffff
je 0x140008b40
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x3c0]
call fcn.1400395b0
test rbx, rbx
mov r15, rax
je 0x140008b6c
cmp rbx, 0xffffffffffffffff
je 0x140008b6c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x14000a095
mov byte [rsp + 0x75], 1
mov edi, esi
nop
mov qword [rsp + 0x30], rsi
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008bf1
mov qword [rsp + 0x30], rsi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008bf1
mov rbx, rsi
jmp 0x140008c28
test rbx, rbx
je 0x140008c28
cmp rbx, 0xffffffffffffffff
je 0x140008c28
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea r8, [rsp + 0x230]
lea rdx, str.DisplayName
mov rcx, r15
call fcn.14003b380
test al, al
jne 0x140008c96
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140008c82
cmp edi, 0xa
jge 0x140008c82
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140008b80
cmp rbx, 0xffffffffffffffff
je 0x140008b80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008b80
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_DisplayName__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x140008caa
cmp rbx, 0xffffffffffffffff
je 0x140008caa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x140009177
test r12, r12
je 0x140008f55
cmp word [r12], 0x22
je 0x140008e13
lea rcx, str.__s_
mov rdx, r12
call fcn.140039300
xor r12d, r12d
mov rsi, rax
mov edi, r12d
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008d51
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008d51
mov rbx, r12
jmp 0x140008d89
test rbx, rbx
je 0x140008d89
cmp rbx, 0xffffffffffffffff
je 0x140008d89
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.ImagePath
mov r8, rsi
mov rcx, r15
call fcn.14003b3e0
test al, al
jne 0x140008df2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140008dde
cmp edi, 0xa
jge 0x140008dde
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140008ce0
cmp rbx, 0xffffffffffffffff
je 0x140008ce0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008ce0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Warning:_unable_to_set_ImagePath__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x140008e06
cmp rbx, 0xffffffffffffffff
je 0x140008e06
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140038240
jmp 0x14000917a
mov edi, esi
nop
nop
nop
mov qword [rsp + 0x30], rsi
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008e91
mov qword [rsp + 0x30], rsi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140008e91
mov rbx, rsi
jmp 0x140008ec8
test rbx, rbx
je 0x140008ec8
cmp rbx, 0xffffffffffffffff
je 0x140008ec8
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.ImagePath
mov r8, r12
mov rcx, r15
call fcn.14003b3e0
test al, al
jne 0x140008f31
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140008f1d
cmp edi, 0xa
jge 0x140008f1d
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140008e20
cmp rbx, 0xffffffffffffffff
je 0x140008e20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008e20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Warning:_unable_to_set_ImagePath__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x140009172
cmp rbx, 0xffffffffffffffff
je 0x14000916d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
jmp 0x14000917a
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8d, 0xc8
call fcn.14004c980
lea r8, [rsp + 0xa0]
lea rdx, str.ImagePath
mov r9d, 0xc8
mov rcx, r15
call fcn.14003b4f0
cmp word [rsp + 0xa0], 0x5c
je 0x140008f9d
cmp word [rsp + 0xa2], 0x3a
jne 0x140009007
lea rcx, [rsp + 0xa0]
call fcn.140036f20
lea rcx, str.SystemRoot
mov rbx, rax
call fcn.140036f20
xor r12d, r12d
mov r11, rax
mov rcx, r12
movzx edx, word [r11]
test dx, dx
je 0x140008feb
movzx eax, word [rbx]
add r11, 2
add rbx, 2
cmp ax, dx
jne 0x14000917a
add rcx, 1
cmp rcx, 0xb
jb 0x140008fc2
jmp 0x14000900a
cmp rcx, 0xb
jae 0x14000900a
cmp word [rbx], r12w
jne 0x14000917a
cmp word [r11], r12w
jne 0x14000917a
jmp 0x14000900a
xor r12d, r12d
lea r8, str.system32drivers_
lea rcx, [rsp + 0xa0]
mov edx, 0xc8
call fcn.140038320
lea rcx, [rsp + 0xa0]
mov r8, rbp
mov edx, 0xc8
call fcn.140038380
mov edi, r12d
nop
nop
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400090b1
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400090b1
mov rbx, r12
jmp 0x1400090e9
test rbx, rbx
je 0x1400090e9
cmp rbx, 0xffffffffffffffff
je 0x1400090e9
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea r8, [rsp + 0xa0]
lea rdx, str.ImagePath
mov rcx, r15
call fcn.14003b380
test al, al
jne 0x140009157
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140009143
cmp edi, 0xa
jge 0x140009143
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140009040
cmp rbx, 0xffffffffffffffff
je 0x140009040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009040
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Warning:_unable_to_set_ImagePath__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x14000917a
cmp rbx, 0xffffffffffffffff
je 0x14000917a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000917a
xor r12d, r12d
jmp 0x14000917a
xor r12d, r12d
jmp 0x14000917a
xor r12d, r12d
mov ebp, dword [rsp + 0x7c]
mov edi, r12d
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400091f2
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400091f2
mov rbx, r12
jmp 0x14000922a
test rbx, rbx
je 0x14000922a
cmp rbx, 0xffffffffffffffff
je 0x14000922a
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.Type
mov r8d, ebp
mov rcx, r15
call fcn.14003b350
test al, al
jne 0x140009293
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000927f
cmp edi, 0xa
jge 0x14000927f
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140009181
cmp rbx, 0xffffffffffffffff
je 0x140009181
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009181
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_Type__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x1400092a7
cmp rbx, 0xffffffffffffffff
je 0x1400092a7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x74]
lea rdx, str.DeleteFlag
mov rcx, r15
mov byte [rsp + 0x74], 0
call fcn.14003b490
lea r8, [rsp + 0x78]
lea rdx, str.Start
mov rcx, r15
mov dword [rsp + 0x78], 3
call fcn.14003b440
test al, al
jne 0x140009303
mov edx, r13d
mov rcx, r14
call fcn.1400084f0
test al, al
jne 0x140009303
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.WARNING__ConfigureService:_unable_to_set_Start__u_n
mov edx, eax
call fcn.1400154e0
cmp byte [rsp + 0x74], 0
jne 0x140009318
mov eax, dword [rsp + 0x78]
cmp eax, r13d
jle 0x14000933b
cmp eax, 4
je 0x14000933b
mov edx, r13d
mov rcx, r14
call fcn.1400084f0
test al, al
jne 0x14000933b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.WARNING__ConfigureService:_failed_to_set_Start__u_n
mov edx, eax
call fcn.1400154e0
mov esi, dword [rsp + 0x5d8]
mov edi, r12d
nop
nop
nop
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400093c1
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400093c1
mov rbx, r12
jmp 0x1400093f9
test rbx, rbx
je 0x1400093f9
cmp rbx, 0xffffffffffffffff
je 0x1400093f9
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.ErrorControl
mov r8d, esi
mov rcx, r15
call fcn.14003b350
test al, al
jne 0x140009462
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000944e
cmp edi, 0xa
jge 0x14000944e
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140009350
cmp rbx, 0xffffffffffffffff
je 0x140009350
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009350
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_ErrorControl__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x140009476
cmp rbx, 0xffffffffffffffff
je 0x140009476
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x1400095c3
mov edi, r12d
nop
nop
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009501
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009501
mov rbx, r12
jmp 0x140009539
test rbx, rbx
je 0x140009539
cmp rbx, 0xffffffffffffffff
je 0x140009539
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.Group
mov r8, rsi
mov rcx, r15
call fcn.14003b380
test al, al
jne 0x1400095a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000958e
cmp edi, 0xa
jge 0x14000958e
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140009490
cmp rbx, 0xffffffffffffffff
je 0x140009490
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009490
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_Group__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x14000968f
cmp rbx, 0xffffffffffffffff
je 0x14000968f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000968f
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009634
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009634
mov rbx, r12
jmp 0x14000966c
test rbx, rbx
je 0x14000966c
cmp rbx, 0xffffffffffffffff
je 0x14000966c
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.Group
mov rcx, r15
call fcn.140039810
test rbx, rbx
je 0x14000968f
cmp rbx, 0xffffffffffffffff
je 0x14000968f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x5e8]
test esi, esi
je 0x1400097d4
mov edi, r12d
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009712
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009712
mov rbx, r12
jmp 0x14000974a
test rbx, rbx
je 0x14000974a
cmp rbx, 0xffffffffffffffff
je 0x14000974a
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, [0x140062b00]
mov r8d, esi
mov rcx, r15
call fcn.14003b350
test al, al
jne 0x1400097b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14000979f
cmp edi, 0xa
jge 0x14000979f
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x1400096a1
cmp rbx, 0xffffffffffffffff
je 0x1400096a1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400096a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_Tag__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x1400098a0
cmp rbx, 0xffffffffffffffff
je 0x1400098a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400098a0
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009845
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009845
mov rbx, r12
jmp 0x14000987d
test rbx, rbx
je 0x14000987d
cmp rbx, 0xffffffffffffffff
je 0x14000987d
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, [0x140062b00]
mov rcx, r15
call fcn.140039810
test rbx, rbx
je 0x1400098a0
cmp rbx, 0xffffffffffffffff
je 0x1400098a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x90]
test rsi, rsi
je 0x1400099f3
mov edi, r12d
nop
nop
nop
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009931
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009931
mov rbx, r12
jmp 0x140009969
test rbx, rbx
je 0x140009969
cmp rbx, 0xffffffffffffffff
je 0x140009969
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.DependOnService
mov r8, rsi
mov rcx, r15
call fcn.140006bc0
test al, al
jne 0x1400099d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400099be
cmp edi, 0xa
jge 0x1400099be
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x1400098c0
cmp rbx, 0xffffffffffffffff
je 0x1400098c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400098c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_DependOnService__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x140009abf
cmp rbx, 0xffffffffffffffff
je 0x140009abf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009abf
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009a64
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009a64
mov rbx, r12
jmp 0x140009a9c
test rbx, rbx
je 0x140009a9c
cmp rbx, 0xffffffffffffffff
je 0x140009a9c
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.DependOnService
mov rcx, r15
call fcn.140039810
test rbx, rbx
je 0x140009abf
cmp rbx, 0xffffffffffffffff
je 0x140009abf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x88]
test rsi, rsi
je 0x140009c13
mov edi, r12d
nop
nop
nop
nop
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009b51
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009b51
mov rbx, r12
jmp 0x140009b89
test rbx, rbx
je 0x140009b89
cmp rbx, 0xffffffffffffffff
je 0x140009b89
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.Description
mov r8, rsi
mov rcx, r15
call fcn.14003b380
test al, al
jne 0x140009bf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140009bde
cmp edi, 0xa
jge 0x140009bde
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140009ae0
cmp rbx, 0xffffffffffffffff
je 0x140009ae0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_Description__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x140009cdf
cmp rbx, 0xffffffffffffffff
je 0x140009cdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009cdf
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009c84
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009c84
mov rbx, r12
jmp 0x140009cbc
test rbx, rbx
je 0x140009cbc
cmp rbx, 0xffffffffffffffff
je 0x140009cbc
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.Description
mov rcx, r15
call fcn.140039810
test rbx, rbx
je 0x140009cdf
cmp rbx, 0xffffffffffffffff
je 0x140009cdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009d50
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009d50
mov rbx, r12
jmp 0x140009d88
test rbx, rbx
je 0x140009d88
cmp rbx, 0xffffffffffffffff
je 0x140009d88
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.DependOnGroup
mov rcx, r15
call fcn.140039810
test rbx, rbx
je 0x140009dab
cmp rbx, 0xffffffffffffffff
je 0x140009dab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, 0x10
je 0x140009e8d
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009e25
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009e25
mov rbx, r12
jmp 0x140009e5d
test rbx, rbx
je 0x140009e5d
cmp rbx, 0xffffffffffffffff
je 0x140009e5d
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.ObjectName
mov rcx, r15
call fcn.140039810
test rbx, rbx
je 0x140009fba
cmp rbx, 0xffffffffffffffff
je 0x140009fba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009fba
mov edi, r12d
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009f01
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x140009f01
mov rbx, r12
jmp 0x140009f39
test rbx, rbx
je 0x140009f39
cmp rbx, 0xffffffffffffffff
je 0x140009f39
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea r8, str.LocalSystem
lea rdx, str.ObjectName
mov rcx, r15
call fcn.14003b380
test al, al
jne 0x140009fa6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140009f92
cmp edi, 0xa
jge 0x140009f92
mov ecx, 0x3e8
add edi, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140009e90
cmp rbx, 0xffffffffffffffff
je 0x140009e90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009e90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ConfigureService:_Warning:_unable_to_set_ObjectName__u_n
mov edx, eax
call fcn.1400154e0
test rbx, rbx
je 0x140009fba
cmp rbx, 0xffffffffffffffff
je 0x140009fba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000a02b
mov qword [rsp + 0x30], r12
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000a02b
mov rbx, r12
jmp 0x14000a063
test rbx, rbx
je 0x14000a063
cmp rbx, 0xffffffffffffffff
je 0x14000a063
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, str.DeleteFlag
mov rcx, r15
call fcn.140039810
test rbx, rbx
je 0x14000a086
cmp rbx, 0xffffffffffffffff
je 0x14000a086
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.140039380
movzx edi, byte [rsp + 0x75]
jmp 0x14000a0a1
lea rcx, str.ConfigureService:_Failed_to_get_serviceRegKey
call fcn.1400154e0
mov rcx, qword [rsp + 0x80]
call fcn.140039380
test dil, dil
mov r15, qword [rsp + 0x568]
mov r13, qword [rsp + 0x578]
jne 0x14000a0cf
lea rcx, str.ERROR:_ConfigureService:_ConfigureService:_Unable_to_update_registry._n
call fcn.1400154e0
movzx edx, byte [rsp + 0x608]
mov r14, qword [rsp + 0x570]
mov r12, qword [rsp + 0x580]
test dl, dl
mov rsi, qword [rsp + 0x588]
mov rbp, qword [rsp + 0x590]
mov rbx, qword [rsp + 0x598]
je 0x14000a113
lea rcx, [rsp + 0x3c0]
call fcn.140024b70
mov dil, al
lea rcx, str.ConfigureService:_exit_d_n
movzx edx, dil
call fcn.1400154e0
mov al, dil
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x5a0
pop rdi
ret