Function at 0x140008770
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140046180]
mov rdx, qword [0x140046188]
xor edi, edi
mov rsi, rcx
cmp rbx, rdx
jae 0x140006526
test edi, edi
jne 0x140006526
mov rax, qword [rbx]
test rax, rax
je 0x14000651d
mov rax, qword [rax + 0x20]
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x14000651d
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rdx, qword [0x140046188]
mov edi, eax
add rbx, 8
cmp rbx, rdx
jb 0x1400064f7
cmp byte [rsi + 0x60], 0
je 0x140006535
mov ecx, dword [rsi + 0x5c]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov rax, rsp
mov qword [rax + 8], rcx
push r14
sub rsp, 0x70
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140006627
mov r8d, 2
lea rdx, [0x140046298]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
xor edi, edi
test rax, rax
je 0x14000661c
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, str.LocalSystem
mov qword [rsp + 0x40], rax
lea rax, str.SENS
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, str.ProfSvc_Group
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
or r8d, r9d
or edx, r9d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140006613
lea r8, str.Failed_to_change_the_service_config
lea rdx, [0x14002e990]
mov rcx, rbx
call fcn.140005a80
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006629
xor edi, edi
mov rcx, rbx
call fcn.140009070
mov rcx, qword [rbx + 0x2a0]
test rcx, rcx
je 0x14000665c
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbx + 0x2a0]
test rcx, rcx
je 0x14000665c
mov qword [rbx + 0x2a0], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400066a0
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x140006687
mov qword [rbx + 0x12a8], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400066a0
mov qword [rbx + 0x12a8], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rbx + 0x298]
call fcn.14000f130
nop
jmp 0x1400066b7
mov rcx, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp 0x1400064d0
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.140006870
test eax, eax
jne 0x1400087da
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x1400087dc
nop dword [rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x1400087a0
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x140006550
js 0x1400087e9
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x140006550
add rsp, 0x50
pop rbx
ret