Function at 0x4b1f40
Capabilities:
Create service
Delete service
Query service configuration
Query service status
Start service
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm6
mov r8d, 0xf003f
mov qword [rsp + 0x170], rcx
mov edi, edx
xor ecx, ecx
xor edx, edx
mov byte [rsp + 0x8f], 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [0x00780a18], rax
test rax, rax
je 0x4b2700
lea rbp, [rsp + 0x90]
pxor xmm0, xmm0
mov edx, 0x104
mov qword [rsp + 0xa0], 0
mov rcx, rbp
movaps xmmword [rsp + 0x90], xmm0
call fcn.00690080
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4b1ffd
cmp rdx, rax
jae 0x4b1fef
add rdx, rdx
lea rax, [r9 + rdx]
cmp rcx, rax
je 0x4b1fef
mov qword [rsp + 0x98], rax
sar rdx, 1
mov r8, rdx
mov rdx, r9
xor ecx, ecx
call rsi
call rbx
cmp eax, 0x7a
jne 0x4b2048
mov rcx, qword [rsp + 0x98]
mov r9, qword [rsp + 0x90]
mov rdx, rcx
sub rdx, r9
mov rax, rdx
sar rax, 1
mov r8, rax
cmp rdx, rax
jbe 0x4b1fd0
sub rdx, rax
mov rcx, rbp
call fcn.00690080
mov r9, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
sub r8, r9
sar r8, 1
jmp 0x4b1fef
test eax, eax
jne 0x4b26b0
mov rax, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
cmp rax, r12
jne 0x4b207f
jmp 0x4b2090
cmp dx, 0x2f
je 0x4b2088
sub rax, 2
cmp r12, rax
je 0x4b2090
movzx edx, word [rax]
cmp dx, 0x5c
jne 0x4b2070
xor r10d, r10d
mov word [rax + 2], r10w
lea rbp, [rsp + 0x100]
lea r14, [rsp + 0xf0]
mov qword [rsp + 0xf0], rbp
test r12, r12
jne 0x4b20c0
lea rcx, [0x007184d0]
call fcn.006c82e0
nop dword [rax]
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rsi, [rax + rax]
mov rdx, rsi
sar rdx, 1
mov qword [rsp + 0xd0], rdx
cmp rdx, 7
ja 0x4b2440
mov rcx, qword [rsp + 0xf0]
cmp rdx, 1
jne 0x4b2650
movzx eax, word [r12]
mov word [rcx], ax
xor r9d, r9d
mov qword [rsp + 0xf8], rdx
mov word [rcx + rsi], r9w
lea rcx, str.WinRing0x64.sys
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp r8, rax
ja 0x4b28ac
lea rdx, str.WinRing0x64.sys
mov rcx, r14
call fcn.00695c60
mov rcx, qword [0x00780a18]
mov r8d, 0xf01ff
lea rdx, str.WinRing0_1_2_0
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [0x00780a10], rax
test rax, rax
je 0x4b24c4
lea r8, str.e_43_1me_1_37m_msr_e_0m
lea rdx, str.e_0m_se_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_is_already_existse_0m
mov ecx, 4
call fcn.00405880
lea r15, [rsp + 0xb0]
mov rcx, qword [0x00780a10]
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4b2498
mov rsi, qword [0x0072b240]
mov r8d, dword [rsi]
test r8d, r8d
jne 0x4b2730
cmp dword [rsp + 0xb4], 4
jne 0x4b2498
mov byte [0x00780a38], 1
nop dword [rax]
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], pe_nt_image_headers64
lea rcx, str..WinRing0_1_2_0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
test rax, rax
je 0x4b27e2
mov rcx, qword [rsp + 0xf0]
cmp rcx, rbp
je 0x4b2227
call fcn.006c5c20
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x4b2239
call fcn.006c5c20
test r12, r12
je 0x4b26dd
test dil, dil
je 0x4b2628
mov rax, qword [rsp + 0x170]
mov r10, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0x78], rax
cmp rax, r10
je 0x4b2628
mov rsi, qword [0x0072b240]
movdqa xmm6, xmmword [0x00718870]
mov rdi, r10
lea r13, [rsp + 0xd0]
lea r15, [rsp + 0xb0]
lea rbp, str.e_43_1me_1_37m_msr_e_0m
jmp 0x4b22a7
add rdi, 0x18
cmp qword [rsp + 0x78], rdi
je 0x4b2380
mov ebx, dword [rdi]
mov r9d, 4
mov qword [rsp + 0x30], r14
mov r8, r15
mov dword [rsp + 0x28], 8
mov edx, 0x9c402084
mov rcx, r12
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xf0], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4b25b0
mov rax, qword [rsp + 0xd0]
mov edx, dword [rsi]
mov dword [rsp + 0xf0], ebx
mov qword [rsp + 0x100], 0xffffffffffffffff
mov qword [rsp + 0xf8], rax
test edx, edx
jne 0x4b25e6
test ebx, ebx
je 0x4b2298
mov rdx, qword [0x00780a28]
cmp rdx, qword [0x00780a30]
je 0x4b2638
movdqa xmm1, xmmword [rsp + 0xf0]
add rdx, 0x18
add rdi, 0x18
movups xmmword [rdx - 0x18], xmm1
mov rax, qword [rsp + 0x100]
mov qword [rdx - 8], rax
mov qword [0x00780a28], rdx
cmp qword [rsp + 0x78], rdi
jne 0x4b22a7
nop dword [rax]
mov ecx, 0x20
lea rsi, [0x00718850]
mov qword [rsp + 0xd0], 0
call fcn.006c5c70
lea rdx, [rsp + 0x8f]
xor r8d, r8d
mov rcx, r13
mov qword [rax], rsi
mov rsi, qword [rsp + 0x170]
mov qword [rax + 0x18], rdx
mov rdx, r14
mov qword [rax + 8], r12
mov qword [rax + 0x10], rsi
mov qword [rsp + 0xf0], rax
call fcn.00688980
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x4b23e5
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, r13
call fcn.006889e0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004b1d10
mov rcx, qword [0x00780a18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsp + 0xd0], 0
movzx r12d, byte [rsp + 0x8f]
jne 0x4b28c6
movaps xmm6, xmmword [rsp + 0x110]
mov eax, r12d
add rsp, 0x128
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r13, [rsp + 0xd0]
xor r8d, r8d
mov rcx, r14
mov rdx, r13
call fcn.00695dd0
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov r8, rsi
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xf0]
lea rsi, [rdx + rdx]
jmp 0x4b20fe
mov rcx, qword [0x00780a10]
movzx eax, byte [0x00780a38]
test rcx, rcx
je 0x4b24cb
test al, al
je 0x4b2660
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [0x00780a10], 0
movzx eax, byte [0x00780a38]
test al, al
jne 0x4b21d8
mov rax, qword [rsp + 0xf0]
lea r8, str.WinRing0_1_2_0
mov qword [rsp + 0x60], 0
mov r9d, 0xf01ff
mov qword [rsp + 0x58], 0
mov rcx, qword [0x00780a18]
mov rdx, r8
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [0x00780a10], rax
mov rcx, rax
test rax, rax
je 0x4b27c0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x4b21d8
call rbx
cmp eax, 0x420
je 0x4b21d8
cmp eax, 2
je 0x4b2804
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_e_0m
mov ecx, 3
lea rdx, str.e_0m_se_0_31mfailed_to_start_WinRing0_driver__error__u
call fcn.00405880
call fcn.004b1d10
xor r12d, r12d
jmp 0x4b2215
mov ecx, 4
mov r9d, ebx
mov r8, rbp
lea rdx, str.e_0m_se_1_33mcannot_read_MSR_0x_08x
call fcn.00405880
mov ecx, dword [rsi]
movups xmmword [rsp + 0xf8], xmm6
mov dword [rsp + 0xf0], 0
test ecx, ecx
je 0x4b2298
xor eax, eax
mov rdx, qword [rdi + 8]
mov r8, rbp
mov ecx, 6
xor rdx, rax
and rdx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rax
xor rdx, rax
mov qword [rsp + 0x28], rdx
mov r9d, dword [rdi]
lea rdx, str.e_0m_se_1_36m0x_08xe_0me_0_36m:0x_016llxe_0me_1_36m____0x_016llxe_0m
call fcn.00405880
mov ebx, dword [rsp + 0xf0]
jmp 0x4b232e
lea r13, [rsp + 0xd0]
jmp 0x4b2380
mov r8, r14
lea rcx, [0x00780a20]
call fcn.0068b7e0
jmp 0x4b2298
test rdx, rdx
je 0x4b20fe
jmp 0x4b2471
lea r8, [rsp + 0xd0]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [0x00780a10]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4b2837
mov rcx, qword [0x00780a10]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [0x00780a10], 0
test esi, esi
je 0x4b259e
jmp 0x4b24c4
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_e_0m
mov ecx, 3
lea rdx, str.e_0m_se_0_31mfailed_to_get_path_to_driver__error__u
call fcn.00405880
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x4b26dd
call fcn.006c5c20
call fcn.004b1d10
mov rcx, qword [0x00780a18]
xor r12d, r12d
test rcx, rcx
je 0x4b2420
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4b2420
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.e_43_1me_1_37m_msr_e_0m
mov r9d, eax
cmp eax, 5
je 0x4b2821
lea rdx, str.e_0m_se_0_31mfailed_to_open_service_control_manager__error__u
mov ecx, 3
call fcn.00405880
jmp 0x4b26dd
lea r13, [rsp + 0xd0]
mov rcx, qword [0x00780a10]
xor r8d, r8d
xor edx, edx
mov rsi, qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov r9, r13
call rsi
call rbx
cmp eax, 0x7a
jne 0x4b21bc
mov r15d, dword [rsp + 0xd0]
mov dword [rsp + 0x78], r15d
test r15, r15
je 0x4b2893
mov rcx, r15
call fcn.006c5c70
mov r12, rax
mov r8, r15
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x78]
mov r9, r13
mov rdx, r12
mov rcx, qword [0x00780a10]
call rsi
test eax, eax
jne 0x4b2871
test r12, r12
je 0x4b21bc
mov rcx, r12
call fcn.006c5c20
jmp 0x4b21bc
call rbx
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_e_0m
mov ecx, 3
lea rdx, str.e_0m_se_0_31mfailed_to_install_WinRing0_driver__error__u
call fcn.00405880
jmp 0x4b259e
call rbx
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_e_0m
mov ecx, 3
lea rdx, str.e_0m_se_0_31mfailed_to_connect_to_WinRing0_driver__error__u
call fcn.00405880
jmp 0x4b259e
lea r8, str.e_43_1me_1_37m_msr_e_0m
lea rdx, str.e_0m_se_0_31mfailed_to_start_WinRing0_driver:_e_0me_1_31m_WinRing0x64.sys_not_found_e_0m
mov ecx, 3
call fcn.00405880
jmp 0x4b2599
lea rdx, str.e_0m_se_1_33mto_write_MSR_registers_Administrator_privileges_required.
mov ecx, 4
call fcn.00405880
jmp 0x4b26dd
call rbx
mov r9d, eax
lea r8, str.e_43_1me_1_37m_msr_e_0m
mov ecx, 3
lea rdx, str.e_0m_se_0_31mfailed_to_remove_WinRing0_driver__error__u
call fcn.00405880
mov rcx, qword [0x00780a10]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [0x00780a10], 0
jmp 0x4b259e
mov r9, qword [r12 + 0x10]
lea r8, str.e_43_1me_1_37m_msr_e_0m
mov ecx, 6
lea rdx, str.e_0m_se_0_33mservice_path:_e_0me_1_33m__s_e_0m
call fcn.00405880
jmp 0x4b27a5
mov rcx, qword [0x00780a10]
mov r9, r13
xor r8d, r8d
xor edx, edx
call rsi
xor r12d, r12d
jmp 0x4b279d
lea rcx, [0x00718520]
call fcn.006c83d0
cmp qword [rsp + 0xd0], 0
mov rcx, rax
je 0x4b2909
call fcn.006c0b50
mov r12, rax
mov rcx, qword [rsp + 0xf0]
cmp rcx, rbp
je 0x4b28e0
call fcn.006c5c20
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x4b2924
call fcn.006c5c20
jmp 0x4b2924
call fcn.00523030
mov rcx, qword [rsp + 0xf0]
mov r12, rax
test rcx, rcx
je 0x4b2924
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, r12
call fcn.00523030
nop
nop
nop