Function at 0x140009690
Capabilities:
Accept command line arguments
Check if file exists
Create thread
Delete service
Modify service
Query service status
Stop service
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x64], ebx
cmp word [rcx], bx
jne 0x1400096c9
mov esi, ebx
jmp 0x140009e91
lea rdx, [rsp + 0x64]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rsi, rax
cmp word [rdi], bx
je 0x140009e91
mov rdx, rdi
lea rcx, str.Cmd_Line__s_n
call fcn.140009ed0
lea rdx, str._install
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000970d
call fcn.14000d940
jmp 0x140009e8c
lea rdx, [0x14003f25c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009730
call fcn.14000d940
call fcn.14000db30
jmp 0x140009e8c
lea rdx, str._remove
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009d8d
lea rdx, str._uninstall
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009d8d
lea rdx, [0x14003f290]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009d8d
lea rdx, str._start
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009726
lea rdx, str._auto
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009ce0
lea rdx, str._automatic
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009ce0
lea rdx, str._EventMonter
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009c97
lea rdx, [0x14003f2f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009c97
lea rdx, str._TerminateEventMonter
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009c63
lea rdx, str._TerminateEM
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009c63
lea rdx, str._PipeServer
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009ec1
lea rdx, [0x14003f360]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009ec1
mov rcx, qword [rsi]
lea rdx, str._ControlCode
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009c48
mov rcx, qword [rsi]
lea rdx, [0x14003f388]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009c48
mov rcx, qword [rsi]
lea rdx, [0x14003f390]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009a3f
mov rcx, qword [rsi + 8]
lea rdx, str.dark
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400098ba
mov ebx, SysAllocStringByteLen
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, str.bright
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400098e0
mov ebx, DllRegisterServer
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, [0x14003f3b8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009906
mov ebx, DllRegisterServer
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, [0x14003f3c0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000992c
mov ebx, DllRegisterServer
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, str.high
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009952
mov ebx, reloc.OLEAUT32.dll_SysAllocStringByteLen
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, str.auto
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009978
mov ebx, reloc.OLEAUT32.dll_DllRegisterServer
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, str.3mode
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000999e
mov ebx, 0x97
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, str.4mode
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400099c4
mov ebx, 0x98
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, [0x14003f408]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009e91
mov rcx, qword [rsi + 0x10]
lea rdx, str.auto
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009a33
mov rcx, qword [rsi + 0x18]
lea rdx, str.Start
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009a18
mov ebx, 0x99
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi + 0x18]
lea rdx, str.stop
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov ecx, 0x9a
cmove ebx, ecx
mov ecx, ebx
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi]
lea rdx, str._HID
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009abb
mov rcx, qword [rsi + 8]
lea rdx, str.internal
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009a85
lea rdx, [0x14004ab38]
lea rcx, str.HIDVID_17EFPID_6085MI_01Col03
call fcn.14000a910
call fcn.14000af00
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
lea rdx, str.external
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009e8c
lea rdx, [0x14004ab38]
lea rcx, str.HIDVID_17EFPID_6085MI_01Col03
call fcn.14000a910
call fcn.14000ae40
jmp 0x140009e8c
mov rcx, qword [rsi]
lea rdx, str._Pipe
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009be5
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x14004aba8]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140009b70
mov edx, 0xff
mov dword [rsp + 0x60], ebx
lea rcx, str.test
call fcn.1400195fc
mov rcx, qword [0x14004aba8]
lea r9, [rsp + 0x60]
lea rdx, str.test
mov qword [rsp + 0x20], rbx
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140009e8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 6
je 0x140009b51
cmp eax, 0x6d
je 0x140009b51
cmp eax, 0xe8
je 0x140009b51
cmp eax, 0xe9
jne 0x140009ae0
mov rcx, qword [0x14004aba8]
test rcx, rcx
je 0x140009b63
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004aba8], rbx
jmp 0x140009ae0
mov edx, 0x2710
lea rcx, str..pipecom.Lenovo.LPlatSvc.SvcToEm.Pipe
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x140009bc0
mov qword [rsp + 0x30], rbx
lea rcx, str..pipecom.Lenovo.LPlatSvc.SvcToEm.Pipe
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14004aba8], rax
cmp rax, 0xffffffffffffffff
jne 0x140009bcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140009e8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009ae0
mov rcx, qword [rsi]
lea rdx, str._Debug
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009c08
mov ecx, 0xf0
call fcn.14000da40
jmp 0x140009e8c
mov rcx, qword [rsi]
lea rdx, str._OSVer
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140009c2f
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
call fcn.14000ce20
jmp 0x140009e8c
mov ecx, dword [rsp + 0x64]
mov rdx, rsi
call sym.LPlatSvc.exe_EXP_ParseCommandLine
test eax, eax
je 0x140009e91
jmp 0x140009e8c
mov rcx, qword [rsi + 8]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400192c0
mov ecx, eax
call fcn.14000da40
jmp 0x140009e8c
lea rdx, [0x14003f598]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140009e8c
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf060
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140009e8c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x28], rax
lea r8, [0x140009f60]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14004abc0], rax
call fcn.14000de90
jmp 0x140009e8c
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140009dbd
mov r8d, 2
mov qword [rsp + 0xa8], rbp
lea rdx, [0x14003f598]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x140009d2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140009d77
mov qword [rsp + 0x50], rbx
mov edx, 0xffffffff
mov qword [rsp + 0x48], rbx
mov r9d, edx
mov qword [rsp + 0x40], rbx
mov r8d, 2
mov qword [rsp + 0x38], rbx
mov rcx, rbp
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140009d6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0xa8]
jmp 0x140009e8c
xor eax, eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], rax
mov r8d, 0xf003f
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x140009dc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140009e8c
mov rdx, rdi
lea rcx, str.Open_service_manager__Handle:_08x_n
call fcn.140009ed0
mov r8d, 0xf01ff
lea rdx, [0x14003f598]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140009e00
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140009e83
mov rdx, rbx
lea rcx, str.Open_service_manager__Handle:_08x_n
call fcn.140009ed0
lea r8, [rsp + 0x68]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140009e67
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140009e67
cmp dword [rsp + 0x6c], 3
jne 0x140009e67
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140009e43
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140009e7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400109a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14000c540
int3