Function at 0x1401b42d0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1403a1d18]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r13, r9
mov r12, r8
movzx r14d, dl
mov byte [rsp + 0x30], dl
mov r15, rcx
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x38], rbx
mov rdi, qword [rsp + 0xd8]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
call fcn.1401b28d0
cmp eax, 0x80004004
jne 0x1401b4599
lea rcx, str.Timed_out_while_waiting_for_NetCfgInstanceId__try_again_immediately..._n
call fcn.1401b1440
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, r13
mov r8, r12
movzx edx, r14b
mov rcx, r15
call fcn.1401b28d0
mov ebx, eax
cmp eax, 0x80004004
jne 0x1401b4599
lea rcx, str.Timed_out_again_while_waiting_for_NetCfgInstanceId__try_again_after_a_while..._n
call fcn.1401b1440
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x1401b4531
mov r8d, 0x80000000
lea rdx, str.NetSetupSvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1401b4508
xor ebx, ebx
lea r14, [0x140000000]
nop dword [rax + rax]
mov dword [rsp + 0x44], 4
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1401b44a8
mov eax, dword [rsp + 0x44]
dec eax
cmp eax, 6
ja case.default.0x1401b43f8
mov ecx, dword [r14 + rax*4 + 0x1b45c0]
add rcx, r14
jmp rcx
lea rdx, str.is_not_running
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
lea rdx, str.is_stopping
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
lea rdx, str.continue_is_pending
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
lea rdx, str.pause_is_pending
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
lea rdx, str.is_paused
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
lea rdx, str.is_running
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
lea rdx, str.is_starting
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
lea rdx, str.state_is_invalid
lea rcx, str.NetSetupSvc__s_n
call fcn.1401b1440
jmp 0x1401b44bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryServiceStatus_failed__0x_x__n
call fcn.1401b1440
cmp dword [rsp + 0x44], 1
je 0x1401b44d9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x3c
jl 0x1401b43c0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r12
movzx edx, byte [rsp + 0x30]
mov rcx, r15
call fcn.1401b28d0
mov ebx, eax
jmp 0x1401b451c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed___Rwc__n
call fcn.1401b1440
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebx, 0x80004004
je 0x1401b4545
mov eax, ebx
jmp 0x1401b4599
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed___Rwc_
call fcn.1401b1440
test rdi, rdi
je 0x1401b4594
mov qword [rsp + 0x38], 0
lea rdx, str.Querying_NetCfgInstanceId_failed__ERROR_FILE_NOT_FOUND_
lea rcx, [rsp + 0x38]
call fcn.1401b1090
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1401b4579
mov qword [rsp + 0x38], 0
jmp 0x1401b4586
mov rcx, qword [0x1402e1e70]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
lea rcx, [rsp + 0x38]
call fcn.1401b06b0
nop
mov eax, 0x80004005
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401af5e0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret