Function at 0x1007330
Capabilities:
Modify service

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x110
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
lea rax, [rsp + 0x60]
mov qword [r11 + 0x10], rax
lea rbp, [0x01001db0]
mov qword [rsp + 0x60], rbp
lea r12, [0x01001a00]
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 0x30c
mov dword [rsp + 0x74], 0x4000
xor esi, esi
mov dword [rsp + 0x78], esi
mov word [r11 - 0x58], si
mov byte [r11 - 0x56], sil
mov byte [r11 - 0x55], 1
mov qword [r11 - 0xa8], rsi
mov qword [r11 - 0xa0], rsi
mov qword [r11 - 0x98], rsi
mov qword [r11 - 0x90], rsi
mov qword [r11 - 0x88], rsi
mov qword [r11 - 0x80], rsi
mov qword [r11 - 0x78], rsi
mov qword [r11 - 0x70], rsi
mov qword [r11 - 0x68], rsi
mov qword [r11 - 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [r11 + 0x18], rax
mov dword [r11 - 0x50], esi
lea rcx, [0x01001d60]
mov qword [r11 - 0x48], rcx
mov rax, qword [rsp + 0x68]
mov qword [r11 - 0x40], rax
mov r8d, dword [rsp + 0x70]
mov dword [r11 - 0x38], r8d
mov eax, dword [rsp + 0x74]
mov dword [r11 - 0x34], eax
mov r9d, dword [rsp + 0x78]
mov dword [r11 - 0x30], r9d
cmp dword [0x010237e0], esi
je 0x1007462
cmp dword [0x01023800], esi
je 0x1007462
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x60]
lea rcx, [0x010237e0]
call fcn.0100f6a0
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f420
mov edx, dword [rsp + 0xf8]
lea rcx, [0x010237e0]
call fcn.0100f900
nop
cmp byte [rsp + 0xd3], 0
je 0x100749b
lea rbx, [rsp + 0x80]
mov edi, 0xa
nop
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x1007491
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx], rsi
add rbx, 8
sub rdi, 1
jne 0x1007480
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x1007577
lea rax, [rsp + 0x60]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 0x317
mov dword [rsp + 0x74], 0x4000
mov dword [rsp + 0x78], esi
mov word [rsp + 0xd0], bx
mov byte [rsp + 0xd2], bl
mov byte [rsp + 0xd3], 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100755b
movzx eax, ax
or eax, 0x80070000
lea r9, [0x01001d38]
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.010108a0
mov r8d, 2
lea rdx, [0x01001b98]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1007663
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x138], r11
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 0x327
mov dword [rsp + 0x74], 0x4000
mov dword [rsp + 0x78], esi
mov word [rsp + 0xd0], di
mov byte [rsp + 0xd2], dil
mov byte [rsp + 0xd3], 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007647
movzx eax, ax
or eax, 0x80070000
lea r9, [0x01001d20]
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.010108a0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
mov r8d, 2
or edx, r9d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x1007779
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x138], r11
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], 0x340
mov dword [rsp + 0x74], 0x4000
mov dword [rsp + 0x78], esi
mov word [rsp + 0xd0], 0
mov byte [rsp + 0xd2], 0
mov byte [rsp + 0xd3], 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100775d
movzx eax, ax
or eax, 0x80070000
lea r9, [0x01001cf8]
mov r8d, eax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xd8]
call fcn.010108a0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp dword [0x010237e0], 0
je 0x1007806
cmp dword [0x01023800], 0
je 0x1007806
mov dword [rsp + 0x30], esi
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xf8]
xor r8d, r8d
lea rdx, [0x01001570]
lea rcx, [0x010237e0]
call fcn.0100f6a0
mov r8d, dword [rsp + 0xd8]
lea rdx, [0x01001578]
lea rcx, [0x010237e0]
call fcn.0100f420
mov edx, dword [rsp + 0xf8]
lea rcx, [0x010237e0]
call fcn.0100f900
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret