Function at 0x140001450
Capabilities:
Access the windows event log
Create service
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x660]
sub rsp, 0x760
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rbp + 0x650], rax
mov rsi, rdx
mov r14d, ecx
xor r15d, r15d
lea rcx, [rbp + 0x34]
xor edx, edx
mov dword [rbp + 0x30], r15d
mov r8d, 0x1fc
call fcn.140023ca0
lea rdx, str._ELAN_Service__Enter_wmain...
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x30]
xor ecx, ecx
call fcn.140001140
lea r12, str.ELAN_Service
xor ecx, ecx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
lea r13d, [r15 + 2]
mov rbx, rax
test rax, rax
je 0x140001529
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x30]
mov qword [rbp - 0x50], rax
lea edx, [r15 + 4]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov r9d, 0x36b0
mov word [rsp + 0x28], r13w
mov rcx, rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rax, [0x14002ec00]
mov qword [0x140038e28], r15
lea rbx, [0x140038e18]
mov qword [0x140038e10], rax
mov qword [0x140037ab0], rbx
lea rdi, [0x140038e10]
mov qword [0x140038e18], r15
mov qword [0x140038e30], 1
nop word [rax + rax]
mov r8, qword [rdi]
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea rcx, [0x1400013c0]
mov qword [rsp + 0x30], r15
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r8
lea rdi, [rdi + 8]
mov qword [rbp - 0x50], r15
mov r9d, 1
mov qword [rsp + 0x28], r15
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov qword [rbx + 0x20], r8
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001570
cmp r14d, 1
jle 0x1400018de
mov rdx, qword [rsi + 8]
mov ecx, 0xfffd
movzx eax, word [rdx]
sub ax, 0x2d
test cx, ax
jne 0x1400018de
add rdx, r13
lea rcx, str.install
call fcn.1400117c4
test eax, eax
jne 0x140001769
xor edx, edx
mov dword [rsp + 0x70], 0x22
mov r8d, 0x208
lea rcx, [rbp + 0x230]
call fcn.140023ca0
mov r8d, 0x104
lea rdx, [rbp + 0x440]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140001645
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.140001360
jmp 0x140001c32
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140001674
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140001360
jmp 0x140001c32
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rbp + 0x230]
call fcn.140012a28
lea r8, [rbp + 0x440]
mov edx, 0x104
lea rcx, [rbp + 0x230]
call fcn.140012a28
lea r8, [rsp + 0x70]
mov edx, 0x104
lea rcx, [rbp + 0x230]
call fcn.140012a28
mov qword [rsp + 0x60], r15
lea rax, [0x14002eb60]
mov qword [rsp + 0x58], r15
lea rdi, str.ELANTestService
mov qword [rsp + 0x50], rax
lea r8, str.ELAN_Test_Service
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x230]
mov qword [rsp + 0x40], r15
mov r9d, 4
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov dword [rsp + 0x30], 1
mov rcx, rbx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x140001743
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.140001360
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001c32
mov rdx, rdi
lea rcx, str._s_is_installed._n
call fcn.140001360
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001c32
mov rdx, qword [rsi + 8]
lea rcx, str.remove
add rdx, r13
call fcn.1400117c4
test eax, eax
jne 0x140001c32
xor eax, eax
xorps xmm0, xmm0
xor edx, edx
mov qword [rbp - 0x48], rax
xor ecx, ecx
mov dword [rbp - 0x40], eax
movups xmmword [rbp - 0x58], xmm0
lea r8d, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1400017c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.140001360
jmp 0x140001c32
lea rdi, str.ELANTestService
mov r8d, 0x10024
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140001806
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.140001360
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001c32
lea r8, [rbp - 0x58]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140001895
mov rdx, rdi
lea rcx, str.Stopping__s.
call fcn.140001360
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140001877
mov eax, dword [rbp - 0x54]
cmp eax, 3
jne 0x14000187a
lea rcx, [0x140032584]
call fcn.140001360
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140001847
mov eax, dword [rbp - 0x54]
lea rcx, [0x140032588]
mov rdx, rdi
cmp eax, 1
je 0x140001890
lea rcx, str._n_s_failed_to_stop._n
call fcn.140001360
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400018b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.140001360
jmp 0x1400018c7
mov rdx, rdi
lea rcx, str._s_is_removed._n
call fcn.140001360
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001c32
lea rcx, str.Parameters:_n
call fcn.140001360
lea rcx, str.__install__to_install_the_service._n
call fcn.140001360
lea rcx, str.__remove___to_remove_the_service._n
call fcn.140001360
lea rdx, str._ELAN_Service__Start_CServiceBase::Run_service_...
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x30]
xor ecx, ecx
call fcn.140001140
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x14000197a
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x30]
mov qword [rbp - 0x50], rax
xor r8d, r8d
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x38], rax
mov r9d, 0x36b0
mov dword [rsp + 0x30], r15d
mov rcx, rbx
mov word [rsp + 0x28], r13w
lea edx, [r8 + 4]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
xorps xmm0, xmm0
mov dword [rbp - 0x10], r15d
lea rsi, [0x140038e60]
movdqa xmmword [rbp - 0x20], xmm0
lea r14, vtable.CServiceBase.0
mov rcx, rsi
lea rdx, str._ELAN_Service__Enter_CServiceBase_Constructor...
mov qword [rbp - 0x30], r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140001a00
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov r9d, 0x36b0
mov word [rsp + 0x28], r13w
mov rcx, rbx
mov qword [rbp - 0x58], r12
lea edx, [r8 + 4]
mov qword [rbp - 0x50], rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rdi, str.ELANTestService
mov qword [rbp + 0x20], r15
lea rdx, str._ELAN_Service__Enter_CServiceBase::Run..
mov qword [rbp - 8], rdi
mov rcx, rsi
mov dword [rbp], 0x10
mov dword [rbp + 4], r13d
mov qword [rbp + 8], 0x85
mov qword [rbp + 0x10], r15
mov dword [rbp + 0x18], r15d
call qword [sym.imp.USER32.dll_wsprintfW]
xorps xmm0, xmm0
mov rdx, r12
xor ecx, ecx
movdqu xmmword [rsp + 0x78], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140001a9d
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov r9d, 0x36b0
mov word [rsp + 0x28], r13w
mov rcx, rbx
mov qword [rsp + 0x78], r12
lea edx, [r8 + 4]
mov qword [rbp - 0x80], rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x68], r15
mov qword [0x140039070], rax
lea rdx, str._ELAN_Service__return_StartServiceCtrlDispatcher_serviceTable_..
mov rax, qword [rbp - 8]
mov rcx, rsi
mov qword [rbp - 0x78], rax
lea rax, [0x140001f90]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], r15
call qword [sym.imp.USER32.dll_wsprintfW]
xorps xmm0, xmm0
mov rdx, r12
xor ecx, ecx
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140001b33
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov r9d, 0x36b0
mov word [rsp + 0x28], r13w
mov rcx, rbx
mov qword [rbp - 0x58], r12
lea edx, [r8 + 4]
mov qword [rbp - 0x50], rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rcx, [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140001bc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str._ELAN_Service__Service_failed_to_run_w_err_0x_08lx_n
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x30]
xor ecx, ecx
call fcn.140001140
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140001bc6
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x30]
mov qword [rbp - 0x50], rax
xor r8d, r8d
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x38], rax
mov r9d, 0x36b0
mov dword [rsp + 0x30], r15d
mov rcx, rbx
mov word [rsp + 0x28], r13w
lea edx, [r8 + 4]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rdx, str._ELAN_Service__Enter_CServiceBase_Destructor...
mov qword [rbp - 0x30], r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140001c32
mov qword [rsp + 0x40], r15
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov r9d, 0x36b0
mov word [rsp + 0x28], r13w
mov rcx, rbx
mov qword [rbp - 0x58], r12
lea edx, [r8 + 4]
mov qword [rbp - 0x50], rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea rdx, str._ELAN_Service__Eixt_wmain...
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x30]
xor ecx, ecx
call fcn.140001140
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140001caa
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x30]
mov qword [rbp - 0x50], rax
xor r8d, r8d
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r12
mov qword [rsp + 0x38], rax
mov r9d, 0x36b0
mov dword [rsp + 0x30], r15d
mov rcx, rbx
mov word [rsp + 0x28], r13w
lea edx, [r8 + 4]
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [0x140037ab0]
lea rdi, [0x140037ab0]
cmp rbx, rdi
je 0x140001ce4
test rbx, rbx
je 0x140001cdd
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001cd5
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rbx + 8], r15
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001cc2
mov qword [0x140037ab0], rdi
xor eax, eax
mov rcx, qword [rbp + 0x650]
xor rcx, rsp
call fcn.1400059a0
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret