Function at 0x140011497
Capabilities:
Create service
Delete service
Query service status
Stop service

Disassembly:
jmp 0x140017f10
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x70]
lea rdi, [rsp + 0x70]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14003a040]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x1400430ec]
call fcn.1400117c1
nop
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140017f83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:_Failed_to_open_Service_Control_Manager._Error_code:__lu_n
call fcn.140011393
nop
jmp 0x140018184
lea rax, str.ExampleService
mov qword [rbp + 0x28], rax
lea rax, str._C:WindowsSystem32_notepad.exe_
mov qword [rbp + 0x48], rax
mov r8d, 0xf01ff
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x1400180db
mov rdx, qword [rbp + 0x28]
lea rcx, str.Service__S_already_exists._Attempting_to_delete_it..._n
call fcn.140011393
nop
lea rax, [rbp + 0xc4]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x88]
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14001806e
cmp dword [rbp + 0x8c], 1
je 0x14001805d
cmp dword [rbp + 0x8c], 3
je 0x14001805d
lea r8, [rbp + 0x88]
mov edx, 1
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140018041
mov rdx, qword [rbp + 0x28]
lea rcx, str.Service__S_stopped_successfully._n
call fcn.140011393
nop
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x14001805b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x28]
lea rcx, str.Service__S_could_not_be_stopped._Error_code:__lu_n
call fcn.140011393
nop
jmp 0x14001806e
mov rdx, qword [rbp + 0x28]
lea rcx, str.Service__S_is_not_running__safe_to_delete._n
call fcn.140011393
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14001809b
mov rdx, qword [rbp + 0x28]
lea rcx, str.Success:_Existing_service__S_deleted._n
call fcn.140011393
nop
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1400180d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x28]
lea rcx, str.Error:_Failed_to_delete_existing_service__S._Error_code:__lu_n
call fcn.140011393
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x140018184
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
je 0x14001815f
mov rdx, qword [rbp + 0x28]
lea rcx, str.Service__S_created_successfully._n
call fcn.140011393
nop
jmp 0x140018179
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x28]
lea rcx, str.Error:_Failed_to_create_service__S._Error_code:__lu_n
call fcn.140011393
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rbp - 0x70]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400116b3
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.1400113c0
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret