Function at 0x7ff74b03edc
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
mov rcx, qword [0x7ff74b58528]
lea rdx, str.RpcSS
mov r8d, 4
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x7ff74b1b5fe
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceStatusEx]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
test ebx, ebx
je 0x7ff74b1b64e
mov r8d, dword [rsp + 0x4c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x7ff74b58520], rax
test rax, rax
je 0x7ff74b1b67e
and qword [rsp + 0x80], 0
lea r8, [rsp + 0x80]
mov edx, 0x20008
mov rcx, rax
call qword [0x7ff74b58088]
test eax, eax
je 0x7ff74b1b6b1
mov rcx, qword [rsp + 0x80]
call fcn.7ff74b003d8
mov rcx, qword [rsp + 0x80]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
js 0x7ff74b04031
call fcn.7ff74b04458
mov ebx, eax
test eax, eax
js 0x7ff74b04031
mov rcx, qword [0x7ff74b58530]
and qword [rsp + 0x78], 0
xor ebx, ebx
test rcx, rcx
je 0x7ff74b04013
lea rdx, [rsp + 0x78]
call sub.API_MS_Win_Security_SDDL_L1_1_0.dll_ConvertSidToStringSidW
test eax, eax
je 0x7ff74b1b6f0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x78]
mov ecx, eax
mov edi, eax
call fcn.7ff74b042d4
mov ebx, eax
test eax, eax
js 0x7ff74b04013
mov rdx, qword [rsp + 0x78]
mov ecx, edi
call fcn.7ff74b04050
mov ebx, eax
test eax, eax
js 0x7ff74b1b708
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x7ff74b58318]
test ebx, ebx
cmovns eax, dword [rsp + 0x4c]
mov dword [0x7ff74b58318], eax
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp dword [0x7ff74b582c8], edi
je 0x7ff74b1b63c
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1b63c
test byte [rcx + 0x1c], 1
je 0x7ff74b1b63c
lea edx, [rdi + 0x1a]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51830]
mov r9d, eax
call fcn.7ff74b25ec4
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x7ff74b04033
call sub.KERNEL32.dll_GetLastError
cmp dword [0x7ff74b582c8], 0
mov ebx, eax
je 0x7ff74b1b63c
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1b63c
test byte [rcx + 0x1c], 1
je 0x7ff74b1b63c
mov edx, 0x1b
jmp 0x7ff74b1b629
call sub.KERNEL32.dll_GetLastError
cmp dword [0x7ff74b582c8], 0
mov ebx, eax
je 0x7ff74b1b63c
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1b63c
test byte [rcx + 0x1c], 1
je 0x7ff74b1b63c
mov edx, 0x1c
jmp 0x7ff74b1b629
call sub.KERNEL32.dll_GetLastError
cmp dword [0x7ff74b582c8], 0
mov ebx, eax
je 0x7ff74b1b63c
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1b63c
test byte [rcx + 0x1c], 1
je 0x7ff74b1b63c
mov edx, 0x1d
jmp 0x7ff74b1b629
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x7ff74b04013
mov rcx, qword [0x7ff74b58588]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x7ff74b58588], 0
jmp 0x7ff74b04013