Function at 0x1400133c0
Capabilities:
Modify service
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor r12d, r12d
lea r14, [0x14002ee04]
mov rdi, r8
mov rsi, rdx
mov r15d, r12d
test r8, r8
je 0x140013840
cmp word [r8], r12w
je 0x140013840
lea ecx, [r12 + 5]
call fcn.140011340
mov r13, rax
test rax, rax
jne 0x140013440
lea ecx, [rax + 2]
call fcn.14001c1d0
mov rcx, rax
mov edx, 0x400001fb
call fcn.140002950
lea eax, [r12 + 1]
jmp 0x14001391f
movzx edx, word [rdi]
mov rbp, r12
mov rcx, rdi
test dx, dx
je 0x14001366b
inc r15d
mov rax, rcx
cmp dx, 0x2b
cmovne rax, rbp
mov rbp, rax
test dx, dx
je 0x14001347a
nop dword [rax + rax]
add rcx, 2
cmp word [rcx], r12w
jne 0x140013470
movzx edx, word [rcx + 2]
add rcx, 2
test dx, dx
jne 0x140013452
test rax, rax
je 0x14001366b
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlServiceGroupOrder
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400134f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
lea r8, str.SYSTEMCurrentControlSetControlServiceGroupOrder
mov r9, rbx
lea rdx, str._s:__s_n
call fcn.140007920
mov eax, 2
jmp 0x14001391f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, str.List
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001360a
mov ebx, dword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
jne 0x140013574
lea ecx, [rax + 2]
call fcn.14001c1d0
mov rcx, rax
lea r9, str.set_service_dependencies__
lea r8, str.groups
mov edx, 0xc00001fa
call fcn.140002950
lea eax, [rbp + 3]
jmp 0x14001391f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
lea rdx, str.List
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140013660
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, str.List
lea r8, str.SYSTEMCurrentControlSetControlServiceGroupOrder
lea rdx, str._s_s:__s
call fcn.140007920
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x14001391f
cmp eax, 2
je 0x140013660
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea r9, str.List
lea r8, str.SYSTEMCurrentControlSetControlServiceGroupOrder
lea rdx, str._s_s:__s
call fcn.140007920
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x14001391f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, r15d
shl ebx, 8
add ebx, 2
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movzx ecx, word [rdi]
mov r14, rax
test cx, cx
je 0x14001381b
nop dword [rax]
cmp cx, 0x2b
jne 0x140013794
cmp word [rdi + 2], 0
je 0x1400136e9
cmp word [rbp], 0
mov rbx, rbp
je 0x1400136e9
nop dword [rax + rax]
lea rdx, [rdi + 2]
mov rcx, rbx
call fcn.14000a0a0
test eax, eax
jne 0x14001374c
cmp word [rbx], ax
je 0x1400136df
add rbx, 2
cmp word [rbx], 0
jne 0x1400136d5
add rbx, 2
cmp word [rbx], 0
jne 0x1400136c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbp, rbp
je 0x140013716
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x433
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
lea rdx, str._s:__s
mov r9, rbx
mov r8, rdi
call fcn.140007920
mov eax, 5
jmp 0x14001391f
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140013753
add r8, r8
lea rcx, [rdi + 2]
mov rdx, rbx
call fcn.140019060
lea r9, [0x14002ecd8]
mov qword [rsp + 0x20], rdi
mov edx, 0x100
lea rcx, [rsp + 0x80]
mov r8, 0xffffffffffffffff
call fcn.140001d80
jmp 0x1400137be
lea r9, [rsp + 0x80]
mov dword [rsp + 0x20], 0x100
mov r8d, 4
mov rdx, rdi
mov rcx, r13
call fcn.140010fa0
test rax, rax
je 0x1400138c9
lea rax, [rsp + 0x80]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400137d0
inc rbx
lea rcx, [r14 + r12*2]
lea rdx, [rsp + 0x80]
lea r8, [rbx + rbx]
call fcn.140019060
add r12, rbx
cmp word [rdi], 0
je 0x14001380a
nop dword [rax + rax]
add rdi, 2
cmp word [rdi], 0
jne 0x140013800
movzx ecx, word [rdi + 2]
add rdi, 2
test cx, cx
jne 0x1400136a0
test rbp, rbp
je 0x140013834
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov edx, 0xffffffff
mov qword [rsp + 0x48], r12
mov r9d, edx
mov qword [rsp + 0x40], r12
mov r8d, edx
mov qword [rsp + 0x38], r14
mov rcx, rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140013904
test r15d, r15d
je 0x140013898
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov r8, rbx
mov edx, 0x4000020b
call fcn.140002950
mov eax, 0xffffffff
jmp 0x14001391f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbp, rbp
je 0x1400138f6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140013716
test r15d, r15d
je 0x14001391d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400180d0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret