Function at 0x14001f590
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 8]
sub rsp, 0x108
mov ecx, dword [0x140078f0c]
lea rax, [0x140078b48]
xor edi, edi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
mov r13, r9
lea rax, [0x140076790]
mov ebx, edi
mov r8d, edi
nop
cmp dword [rax - 0x50], ecx
ja 0x14001f62c
lea rbx, [rax - 0x50]
cmp dword [rax], ecx
ja 0x14001f62c
mov rbx, rax
cmp dword [rax + 0x50], ecx
ja 0x14001f62c
lea rbx, [rax + 0x50]
cmp dword [rax + 0xa0], ecx
ja 0x14001f62c
lea rbx, [rax + 0xa0]
cmp dword [rax + 0xf0], ecx
ja 0x14001f62c
lea rbx, [rax + 0xf0]
cmp dword [rax + 0x140], ecx
ja 0x14001f62c
lea rbx, [rax + 0x140]
add r8, 0x1e0
add rax, 0x1e0
cmp r8, 0x3c0
jb 0x14001f5d0
test rbx, rbx
je 0x14001f9c2
mov rax, qword [rbx + 0x10]
lea rdx, str.ServicesActive
mov qword [rsp + 0x40], rax
mov r8d, 1
mov rax, qword [rbx + 0x20]
xor ecx, ecx
mov qword [rsp + reloc.WLDAP32.dll_Ordinal_304], rsi
mov qword [rsp + 0x100], r15
mov r15d, edi
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14001f9be
mov qword [rsp + 0x138], r12
lea rdx, str.KeyIso
mov r12d, 4
mov qword [rsp + 0x148], r14
mov r8d, r12d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x14001f6d5
lea rax, [rbp + 0x50]
xor edx, edx
lea r9d, [r12 + 0x20]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, r14
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15d, r15d
je 0x14001f98f
cmp dword [rbp - 0x2c], r12d
jb 0x14001f98f
mov r8d, dword [rbp - 0x14]
xor edx, edx
mov ecx, 0x438
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14001f98f
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14001f98f
mov edx, 8
mov dword [rax], 1
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsi + 8], rax
test rax, rax
je 0x14001f986
mov qword [rax], r14
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], edi
test r13, r13
je 0x14001f798
mov rdx, r13
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea r8, [rsp + 0x60]
mov rcx, rsi
lea rdx, [0x140009160]
call fcn.140008830
test eax, eax
js 0x14001f93b
mov eax, dword [rsp + 0x70]
jmp 0x14001f7b0
lea r8, [rbp - 0x70]
mov rcx, rsi
lea rdx, [0x1400091b0]
call fcn.140008830
not eax
shr eax, 0x1f
test eax, eax
je 0x14001f93b
movups xmm0, xmmword [rbp - 0x70]
mov eax, dword [rbp - 0x60]
lea r8, [rbp - 0x50]
movsxd r15, dword [rbx + 0x28]
lea rcx, [rsp + 0x40]
mov r14d, dword [rbx + 0x18]
mov edx, dword [rbx + 8]
mov ebx, edi
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
psrldq xmm0, 8
movq qword [rsp + 0x38], xmm0
mov qword [rsp + 0x30], rdi
call fcn.140013760
test eax, eax
je 0x14001f93b
mov rdx, qword [rsp + 0x38]
mov r10, r15
add r10, qword [rbp - 0x38]
mov qword [rsp + 0x30], r10
mov ecx, dword [rdx]
test ecx, ecx
je 0x14001f837
cmp ecx, 1
jne 0x14001f93b
mov rcx, qword [rdx + 8]
lea r8, [rsp + 0x60]
mov r9d, 0x30
mov rdx, r10
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x14001f84b
mov r8d, 0x30
lea rdx, [rsp + 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp rax, 0x30
mov ecx, edi
sete cl
test ecx, ecx
je 0x14001f93b
mov ecx, dword [rbp - 0x7c]
mov eax, ecx
and eax, 0xf
mov r8d, ecx
dec eax
and r8d, 0xffffff00
cmp eax, 2
jbe 0x14001f888
and ecx, 0xf0
dec ecx
cmp ecx, 0x3e
ja 0x14001f8db
mov r12d, Ordinal_69
mov rdx, qword [rsp + 0x38]
or r8d, r12d
mov ecx, dword [rdx]
test ecx, ecx
je 0x14001f8c2
cmp ecx, 1
jne 0x14001f93b
mov rcx, qword [rdx + 8]
lea rax, [rbp + 0x50]
mov rdx, qword [rsp + 0x30]
mov r9d, r8d
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x14001f8d4
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x50]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14001f93b
mov ebx, dword [rbp + 0x50]
mov r8, r14
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140013350
mov edi, eax
test ebx, ebx
je 0x14001f93b
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rdx]
test ecx, ecx
je 0x14001f926
cmp ecx, 1
jne 0x14001f93b
mov rcx, qword [rdx + 8]
lea rax, [rbp + 0x40]
mov rdx, qword [rsp + 0x30]
mov r9d, ebx
mov r8, r14
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x14001f93b
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x40]
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [rsi]
sub ecx, 1
je 0x14001f97c
sub ecx, 1
je 0x14001f953
sub ecx, 1
je 0x14001f97c
cmp ecx, 3
jne 0x14001f986
jmp 0x14001f97c
mov rax, qword [rsi + 8]
test rax, rax
je 0x14001f986
mov rbx, qword [rax]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001f96e
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001f97c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x148]
mov eax, edi
mov r12, qword [rsp + 0x138]
mov rsi, qword [rsp + reloc.WLDAP32.dll_Ordinal_304]
mov r15, qword [rsp + 0x100]
add rsp, 0x108
pop r13
pop rdi
pop rbx
pop rbp
ret
mov eax, edi
jmp 0x14001f9a1
mov eax, edi
add rsp, 0x108
pop r13
pop rdi
pop rbx
pop rbp
ret