Function at 0x140008820
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0x1c8]
call fcn.1400341d0
nop
lea rax, vtable.WindowsRegistryApi.0
mov qword [rsp + 0x1b8], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x298], xmm0
movups xmmword [rsp + 0x2a8], xmm0
movups xmmword [rsp + 0x2b8], xmm0
mov qword [rsp + 0x2c8], rax
lea rdx, [rdi + 0x298]
lea r8, [rsp + 0x1b8]
lea rcx, [rsp + 0x298]
call fcn.1400373b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x260], xmm0
movups xmmword [rsp + 0x270], xmm0
movups xmmword [rsp + 0x280], xmm0
mov qword [rsp + 0x290], rax
lea rdx, [rdi + 0x2b8]
lea r8, [rsp + 0x1b8]
lea rcx, [rsp + 0x260]
call fcn.1400373b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x228], xmm0
movups xmmword [rsp + 0x238], xmm0
movups xmmword [rsp + 0x248], xmm0
mov qword [rsp + 0x258], rax
lea rdx, [rdi + 0x2d8]
lea r8, [rsp + 0x1b8]
lea rcx, [rsp + 0x228]
call fcn.1400373b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
mov qword [rsp + 0x220], rax
lea rdx, [rdi + 0x2f8]
lea r8, [rsp + 0x1b8]
lea rcx, [rsp + 0x1f0]
call fcn.1400373b0
nop
movdqa xmm0, xmmword [0x14015a780]
movdqu xmmword [rsp + 0x1e0], xmm0
xor r13d, r13d
mov word [rsp + 0x1d0], r13w
lea r8d, [r13 + 0x1c]
lea rdx, str.HfcDisableProcessRestartAtom
lea rcx, [rsp + 0x1d0]
call fcn.140009900
nop
lea rax, vtable.DismApi.0
mov qword [rsp + 0x1c0], rax
mov rax, qword [rdi + 0x270]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x228]
lea r8, [rsp + 0x260]
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x2d0]
call fcn.140033560
nop
mov rbx, qword [rdi + 0x270]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x2d0]
call fcn.140033a10
mov rsi, rax
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r13w
lea r8d, [r13 + 0xf]
lea rdx, str.Initial_state:
lea rcx, [rsp + 0xb0]
call fcn.140009900
nop
mov r9, rsi
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0xd0]
call fcn.14000a120
nop
mov rax, qword [rbx]
lea r8, [rsp + 0xd0]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x1400341b6.0]
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140008afa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008af5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093bc
call fcn.1400e9ac4
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r13w
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x140008b60
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093c2
call fcn.1400e9ac4
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 8
jb 0x140008ba8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093c8
call fcn.1400e9ac4
lea rdx, [0x140000000]
lea rbx, str.Executing_step_for_state:
mov eax, dword [rsp + 0x2d0]
nop dword [rax]
mov r15d, eax
cmp eax, 8
ja case.default.0x140008bd8
cdqe
mov ecx, dword [rdx + rax*4 + 0x940c]
add rcx, rdx
jmp rcx
mov rcx, qword [rdi + 0x270]
mov rax, qword [rcx]
lea r8, str.Hfc_correct_state_detected._Disabling_service.
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [case.0x1400341b6.0]
mov r14d, r13d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140008c96
lea rdx, [rdi + 0x278]
cmp qword [rdx + 0x18], 8
jb 0x140008c27
mov rdx, qword [rdx]
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140008c84
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov edx, 0xffffffff
mov r9d, edx
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov r14d, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14d, r14d
jne 0x140008eed
mov rcx, qword [rdi + 0x270]
mov rax, qword [rcx]
lea r8, str.Error_while_disabling_service.
xor edx, edx
mov rax, qword [rax + 0x18]
call qword [case.0x1400341b6.0]
jmp 0x140008eed
mov rcx, qword [rdi + 0x270]
mov rax, qword [rcx]
lea r8, str.Error_state_encountered.
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [case.0x1400341b6.0]
jmp 0x140008eed
mov r12, qword [rdi + 0x270]
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x2d0]
call fcn.140033a10
mov rsi, rax
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
sub rcx, rdx
lfence
cmp rcx, 0x1a
jb 0x140008da7
lea rax, [rdx + 0x1a]
mov qword [rsi + 0x10], rax
mov r14, rsi
cmp qword [rsi + 0x18], 8
jb 0x140008d26
mov r14, qword [rsi]
lea rax, [0x14015677c]
cmp rax, r14
jbe 0x140008d57
lea rax, [r14 + rdx*2]
cmp rbx, rax
ja 0x140008d57
cmp r14, rbx
ja 0x140008d45
mov rbx, r13
jmp 0x140008d5c
mov rbx, r14
lea rax, str.Executing_step_for_state:
sub rbx, rax
sar rbx, 1
jmp 0x140008d5c
mov ebx, 0x1a
lea rcx, [r14 + 0x34]
lea r8, [rdx*2 + 2]
mov rdx, r14
call fcn.1400ebd70
add rbx, rbx
mov r8, rbx
lea rdx, str.Executing_step_for_state:
mov rcx, r14
call fcn.1400ebd70
lea rcx, [r14 + rbx]
mov r8d, 0x34
sub r8, rbx
lea rdx, str.Executing_step_for_state:
add rdx, 0x34
add rdx, rbx
call fcn.1400ebd70
jmp 0x140008dca
mov qword [rsp + 0x28], 0x1a
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
mov rcx, rsi
call fcn.14000a300
mov rsi, rax
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r13
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 7
mov word [rsi], r13w
mov rax, qword [r12]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, r12
mov rax, qword [rax + 0x10]
call qword [case.0x1400341b6.0]
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x140008e5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ce
call fcn.1400e9ac4
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rsp + 0x190]
cmp rdx, 8
jb 0x140008ebe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008eb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093d4
call fcn.1400e9ac4
lea rcx, [rsp + 0x2d0]
call fcn.140033730
jmp 0x140008eed
mov rcx, qword [rdi + 0x270]
mov rax, qword [rcx]
lea r8, str.Unknown_system_state
mov edx, 1
mov rax, qword [rax + 0x20]
call qword [case.0x1400341b6.0]
cmp byte [rdi + 0x268], 0
jne 0x140008f14
mov eax, dword [rsp + 0x2d0]
cmp r15d, eax
lea rdx, [0x140000000]
lea rbx, str.Executing_step_for_state:
jne 0x140008bc0
mov rbx, qword [rdi + 0x270]
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x2d0]
call fcn.140033a10
mov rdi, rax
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], r13w
mov r8d, 0x25
lea rdx, str.Disable_process_stopped._Last_state:
lea rcx, [rsp + 0x110]
call fcn.140009900
nop
mov r9, rdi
lea r8, [rsp + 0x110]
lea rcx, [rsp + 0xf0]
call fcn.14000a120
nop
mov rax, qword [rbx]
lea r8, [rsp + 0xf0]
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x1400341b6.0]
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 8
jb 0x140008fe7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093da
call fcn.1400e9ac4
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], r13w
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x14000904d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009047
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093e0
call fcn.1400e9ac4
nop
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 8
jb 0x140009095
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009090
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093e6
call fcn.1400e9ac4
mov byte [rsp + 0x60], 1
lea rcx, [rsp + 0x2d0]
call fcn.140009430
nop
lea rax, vtable.DismApi.0
mov qword [rsp + 0x1c0], rax
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 8
jb 0x1400090ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093ec
call fcn.1400e9ac4
movdqa xmm0, xmmword [0x14015a780]
movdqu xmmword [rsp + 0x1e0], xmm0
mov word [rsp + 0x1d0], r13w
lea rdi, vtable.RegistryDataStore.0
mov qword [rsp + 0x1f0], rdi
mov rdx, qword [rsp + 0x220]
cmp rdx, 8
jb 0x140009170
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000916b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093f2
call fcn.1400e9ac4
movdqa xmm0, xmmword [0x14015a780]
movdqu xmmword [rsp + 0x218], xmm0
mov word [rsp + 0x208], r13w
mov rcx, qword [rsp + 0x200]
test rcx, rcx
je 0x1400091a9
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0x38]
call qword [case.0x1400341b6.0]
lea rbx, vtable.PersistentDataStore.0
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x228], rdi
mov rdx, qword [rsp + 0x258]
cmp rdx, 8
jb 0x140009208
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009203
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093f8
call fcn.1400e9ac4
movdqa xmm0, xmmword [0x14015a780]
movdqu xmmword [rsp + 0x250], xmm0
mov word [rsp + 0x240], r13w
mov rcx, qword [rsp + 0x238]
test rcx, rcx
je 0x140009241
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0x38]
call qword [case.0x1400341b6.0]
mov qword [rsp + 0x228], rbx
mov qword [rsp + 0x260], rdi
mov rdx, qword [rsp + 0x290]
cmp rdx, 8
jb 0x140009299
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x278]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400093fe
call fcn.1400e9ac4
movdqa xmm0, xmmword [0x14015a780]
movdqu xmmword [rsp + 0x288], xmm0
mov word [rsp + 0x278], r13w
mov rcx, qword [rsp + 0x270]
test rcx, rcx
je 0x1400092d2
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0x38]
call qword [case.0x1400341b6.0]
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x298], rdi
mov rdx, qword [rsp + 0x2c8]
cmp rdx, 8
jb 0x14000932a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009325
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009404
call fcn.1400e9ac4
movdqa xmm0, xmmword [0x14015a780]
movdqu xmmword [rsp + 0x2c0], xmm0
mov word [rsp + 0x2b0], r13w
mov rcx, qword [rsp + 0x2a8]
test rcx, rcx
je 0x140009363
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0x38]
call qword [case.0x1400341b6.0]
mov qword [rsp + 0x298], rbx
lea rax, vtable.WindowsRegistryApi.0
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x1c8]
call fcn.140034370
nop
movzx eax, byte [rsp + 0x60]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400e9aa0
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
nop
call fcn.1400f88c4
int3