Function at 0x1400d20c0
Capabilities:
Modify service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x298
movaps xmmword [rsp + 0x280], xmm6
mov rax, qword [0x14026c040]
xor rax, rsp
mov qword [rsp + 0x278], rax
movaps xmm6, xmmword [0x14023d9f0]
lea rsi, [rsp + 0xc0]
movaps xmmword [rsi + 0x40], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
movaps xmmword [rsi], xmm6
lea rax, str.brave_vpn_helper.exe
lea rdi, [rsp + 0x90]
mov qword [rdi], rax
mov qword [rdi + 8], 0x14
lea r14, [rsp + 0x110]
mov rdx, r14
mov r8, rdi
call fcn.14013ef30
mov rcx, rsi
mov rdx, r14
call fcn.1400e6e70
mov rcx, r14
call fcn.14013e3c0
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
xor eax, eax
lea rdi, [rsp + 0x260]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movaps xmmword [rdi], xmm0
lea r13, [rsp + 0x240]
mov qword [r13 + 0x10], rax
movaps xmmword [r13], xmm0
lea r15, [rsp + 0x78]
mov rcx, r15
call fcn.1400d0f10
mov rcx, r14
xor edx, edx
call fcn.1400e6e00
lea r12, [rsp + 0x60]
mov rcx, r12
call fcn.1400d1190
lea rbx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400d0c20
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x90]
mov rdx, rbx
mov r8, r12
mov r9d, 3
call fcn.1401abee0
cmp byte [rbx + 0x17], 0
jns 0x1400d21f2
mov rcx, qword [rsp + 0x48]
call fcn.140167ca8
cmp byte [rsp + 0x77], 0
jns 0x1400d2203
mov rcx, qword [rsp + 0x60]
call fcn.140167ca8
lea r15, [rsp + 0x110]
mov rcx, r15
call fcn.1400e7380
cmp byte [rsp + 0x8f], 0
jns 0x1400d2227
mov rcx, qword [rsp + 0x78]
call fcn.140167ca8
mov rcx, qword [rsp + 0x240]
test rcx, rcx
je 0x1400d2256
mov rax, qword [rsp + 0x248]
cmp rax, rcx
je 0x1400d2249
add rax, 0xfffffffffffffff0
jne 0x1400d223c
ud2
mov qword [rsp + 0x248], rcx
call fcn.140167ca8
mov rcx, qword [rsp + 0x260]
test rcx, rcx
je 0x1400d2285
mov rax, qword [rsp + 0x268]
cmp rax, rcx
je 0x1400d2278
add rax, 0xfffffffffffffff0
jne 0x1400d226b
jmp 0x1400d2247
mov qword [rsp + 0x268], rcx
call fcn.140167ca8
lea rsi, [rsp + 0x90]
mov rcx, rsi
mov dl, 1
call fcn.1401b2af0
xor ebp, ebp
mov rcx, rsi
xor edx, edx
call fcn.1401b2b00
mov rcx, rsi
call fcn.1401b2a90
test al, al
je 0x1400d240e
lea rcx, [rsp + 0x78]
call fcn.1400d1100
lea r14, [rsp + 0x60]
mov rcx, r14
call fcn.1400d0c20
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x1400d2460
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14013e120
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rsp + 0x77], 0
jns 0x1400d2307
mov r14, qword [rsp + 0x60]
mov rcx, rsi
mov rdx, r14
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x1400d250e
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14013e120
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, r14
call fcn.1400d0800
test al, al
jne 0x1400d25d8
lea rcx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
mov edx, 0x4f
call fcn.14013de20
test eax, eax
jle 0x1400d23cb
lea rdx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
lea rdi, [rsp + 0x110]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 0xffffffff
call fcn.1400e3120
lea rcx, [rsp + 0x120]
lea rdx, str.SetServiceFailureActions_failed:
mov r8d, 0x20
call fcn.14011f4a0
mov rbx, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov ecx, dword [rbx + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rbx + rax + 8], ecx
call fcn.1400d0600
mov rcx, rbx
mov edx, eax
call fcn.1400c2d60
mov rcx, rdi
call fcn.1400e3710
xor ebp, ebp
call fcn.14013e120
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.14013e120
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [rsp + 0x77], 0
jns 0x1400d23fa
mov rcx, qword [rsp + 0x60]
call fcn.140167ca8
cmp byte [rsp + 0x8f], 0
jns 0x1400d240e
mov rcx, qword [rsp + 0x78]
call fcn.140167ca8
lea rcx, [rsp + 0x90]
call fcn.1401abf80
lea rcx, [rsp + 0xc0]
call fcn.1400e7380
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
cmp rcx, qword [0x14026c040]
je 0x1400d2442
call fcn.140169190
int3
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x280]
add rsp, 0x298
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
mov edx, 0x4f
call fcn.14013de20
test eax, eax
jle 0x1400d2507
lea rdx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
lea rsi, [rsp + 0x110]
mov rcx, rsi
mov r8d, 0x73
mov r9d, 0xffffffff
call fcn.1400e3120
lea rcx, [rsp + 0x120]
lea rdx, str.::OpenSCManager_failed._service_name:
mov r8d, 0x26
call fcn.14011f4a0
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400dfe70
lea rdx, str.__error:
mov r8d, 9
mov rcx, rax
call fcn.14011f4a0
mov rdi, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov ecx, dword [rdi + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rdi + rax + 8], ecx
call fcn.1400d0600
mov rcx, rdi
mov edx, eax
call fcn.1400c2d60
mov rcx, rsi
call fcn.1400e3710
xor ebp, ebp
jmp 0x1400d23e9
lea rcx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
mov edx, 0x4f
call fcn.14013de20
test eax, eax
jle 0x1400d25b5
lea rdx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
lea rdi, [rsp + 0x110]
mov rcx, rdi
mov r8d, 0x7a
mov r9d, 0xffffffff
call fcn.1400e3120
lea rcx, [rsp + 0x120]
lea rdx, str.::OpenService_failed._service_name:
mov r8d, 0x24
call fcn.14011f4a0
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400dfe70
lea rdx, str.__error:
mov r8d, 9
mov rcx, rax
call fcn.14011f4a0
mov rbx, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov ecx, dword [rbx + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rbx + rax + 8], ecx
call fcn.1400d0600
mov rcx, rbx
mov edx, eax
call fcn.1400c2d60
mov rcx, rdi
call fcn.1400e3710
xor ebp, ebp
jmp 0x1400d23db
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x260]
call fcn.140131790
jmp 0x1400d2619
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
movaps xmmword [rsp + 0x260], xmm6
cmp byte [rsp + 0x8f], 0
js 0x1400d25bc
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x270], rax
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rsp + 0x260], xmm0
xor r12d, r12d
mov rcx, rdi
xor edx, edx
call fcn.140131930
mov dword [rsp + 0x48], 2
movzx eax, byte [rsp + 0x277]
test al, al
jns 0x1400d2649
mov eax, dword [rsp + 0x268]
mov rdi, qword [rsp + 0x260]
add eax, eax
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x120], r12
movabs rax, 0x100000014
mov qword [rsp + 0x110], rax
lea rax, [0x14024405c]
mov qword [rsp + 0x118], rax
mov eax, 1
mov dword [rsp + 0x120], eax
mov qword [rsp + 0x128], rbx
xorps xmm0, xmm0
lea r8, [rsp + 0x240]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], r12
mov dword [r8], eax
mov qword [r8 + 8], r15
mov rcx, r14
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov edi, eax
cmp byte [rsp + 0x277], 0
jns 0x1400d26d2
mov rcx, qword [rsp + 0x260]
call fcn.140167ca8
mov bpl, 1
test edi, edi
jne 0x1400d23cd
lea rcx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
mov edx, 0x4f
call fcn.14013de20
test eax, eax
jle 0x1400d23cb
lea rdx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
lea rdi, [rsp + 0x110]
mov rcx, rdi
mov r8d, 0x85
mov r9d, 0xffffffff
call fcn.1400e3120
lea rcx, [rsp + 0x120]
lea rdx, str.SetServiceTriggerForVPNConnection_failed:
mov r8d, 0x29
jmp 0x1400d2397