Function at 0x140002e78
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov rax, qword [0x1400748d8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
call fcn.14003ac80
xor r13d, r13d
test eax, eax
jne 0x140002eeb
mov rcx, qword [str.___a_]
lea rsi, str.___a_
cmp rcx, rsi
je 0x140002ee1
test byte [rcx + 0x1c], 1
je 0x140002ee1
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x18]
lea r8, [0x14004b0f8]
call fcn.140002150
mov edi, 0x80070032
jmp 0x1400033ef
mov edx, 1
mov qword [rbp - 0x49], r13
lea rcx, [rbp - 0x49]
call fcn.140038d8c
mov edi, eax
test eax, eax
jns 0x140002f15
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x1400033ef
jmp 0x1400033e9
lea rbx, str.WdFilter
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.140002840
lea rsi, str.___a_
mov r15d, 4
lea r12, [0x14004b0f8]
lea rcx, str.WinDefend
test al, al
jne 0x14000316a
mov rdx, rcx
lea rcx, [rbp - 0x49]
call fcn.140002840
test al, al
je 0x140003003
mov r8, rbx
mov qword [rbp - 0x29], r13
mov rbx, qword [rbp - 0x49]
lea r9d, [r15 + 0x29]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.140038df0
mov rdi, qword [rbp - 0x29]
test eax, eax
js 0x140002fe4
lea r8, str.WdFilter
mov rdx, rbx
mov rcx, rdi
call fcn.140002568
test eax, eax
js 0x140002fe4
mov rcx, rdi
call fcn.1400394d8
test eax, eax
js 0x140002fe4
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x140002fcd
test byte [rcx + 0x1c], r15b
je 0x140002fcd
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x15]
lea r9, str.WdFilter
mov r8, r12
call fcn.1400022ac
test rdi, rdi
je 0x14000316a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000316a
test rdi, rdi
je 0x140002ff2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x49]
call fcn.14000296c
test eax, eax
js 0x14000316a
lea rcx, [rbp - 0x49]
call fcn.140002c10
test eax, eax
js 0x14000316a
lea rdx, [rbp - 0x39]
mov qword [rbp - 0x39], r13
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
mov rcx, qword [rbp - 0x39]
test eax, eax
js 0x14000315f
xor eax, eax
mov dword [rbp - 0x21], 1
lea rdx, [rbp - 0x21]
mov qword [rbp - 0x1d], rax
call qword [sym.imp.mpclient.dll_MpGetTPStateInfo]
test eax, eax
js 0x14000315b
mov r9d, dword [rbp - 0x1d]
mov eax, r9d
and al, 3
cmp al, 1
jne 0x140003093
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x14000315b
test byte [rcx + 0x1c], al
je 0x14000315b
mov rcx, qword [rcx + 0x10]
mov edx, 0x1a
mov r8, r12
mov dword [rsp + 0x20], 0x8007139f
call fcn.140002268
jmp 0x14000315b
lea rdx, [rbp - 0x51]
mov qword [rbp - 0x51], r13
lea rcx, str.Real_Time_Protection
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov rcx, qword [rbp - 0x51]
test eax, eax
js 0x140003150
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], r13
lea rbx, str.DisableDriverUnload
mov dword [rbp - 0x59], r13d
mov rdx, rbx
mov dword [rbp - 0x29], r13d
lea r9, [rbp - 0x31]
mov dword [rbp - 0x31], r15d
lea r8, [rbp - 0x59]
mov qword [rsp + 0x20], rax
call qword [sym.imp.mpclient.dll_MpConfigGetValue]
test eax, eax
js 0x14000314c
cmp dword [rbp - 0x59], 1
ja 0x14000314c
mov eax, dword [rbp - 0x31]
neg eax
sbb ecx, ecx
and ecx, dword [rbp - 0x29]
mov dword [rbp - 0x41], ecx
je 0x140003126
mov rcx, qword [rbp - 0x51]
lea rax, [rbp - 0x41]
mov r9d, r15d
mov qword [rsp + 0x20], rax
mov r8d, 1
mov dword [rbp - 0x41], r13d
mov rdx, rbx
call qword [sym.imp.mpclient.dll_MpConfigSetValue]
test eax, eax
js 0x14000314c
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x14000314c
test byte [rcx + 0x1c], r15b
je 0x14000314c
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
mov r9, rbx
mov r8, r12
call fcn.1400022ac
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14000315b
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14000316a
call qword [sym.imp.mpclient.dll_MpHandleClose]
lea rax, str.WdNisDrv
mov qword [rbp + 0x17], rax
lea r15, [rbp + 0x17]
lea rax, str.WdNisSvc
mov qword [rbp + 0x1f], rax
lea rax, str.WinDefend
mov qword [rbp + 0x27], rax
lea rax, str.WdFilter
mov qword [rbp + 0x2f], rax
lea rax, str.WdBoot
mov qword [rbp + 0x37], rax
mov r8, qword [r15]
lea rcx, [rbp - 0x51]
mov rdx, qword [rbp - 0x49]
mov r9d, 0x2f
mov qword [rbp - 0x51], r13
call fcn.140038df0
mov edi, eax
test eax, eax
jns 0x14000320b
cmp eax, 0x80070424
jne 0x1400033c4
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x1400031f6
test byte [rcx + 0x1c], 4
je 0x1400031f6
mov r9, qword [r15]
mov edx, 0x1c
mov rcx, qword [rcx + 0x10]
mov r8, r12
call fcn.1400022ac
mov rcx, qword [rbp - 0x51]
mov edi, r13d
test rcx, rcx
je 0x1400033b2
jmp 0x1400033ac
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x11]
xorps xmm0, xmm0
xor eax, eax
mov rdx, rbx
mov dword [rbp + 0xf], eax
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
call fcn.140038f10
mov edi, eax
test eax, eax
js 0x1400033cf
cmp dword [rbp - 0xd], 1
je 0x140003293
mov r8, qword [r15]
mov rcx, rbx
mov rdx, qword [rbp - 0x49]
call fcn.140002568
mov edi, eax
test eax, eax
js 0x1400033cf
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x140003281
test byte [rcx + 0x1c], 4
je 0x140003281
mov eax, dword [rbp + 0xb]
mov edx, 0x1d
mov r9, qword [r15]
mov r8, r12
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], eax
call fcn.14000230c
mov rcx, rbx
call fcn.1400394d8
mov edi, eax
test eax, eax
js 0x1400033cf
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x1400032b9
test byte [rcx + 0x1c], 4
je 0x1400032b9
mov r9, qword [r15]
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
mov r8, r12
call fcn.1400022ac
mov eax, dword [rbp - 0x11]
test al, 0x30
je 0x1400033a4
xor edx, edx
mov ecx, 0x60003
call fcn.14003ab78
test eax, eax
js 0x14000337e
mov r9d, 4
mov dword [rbp - 0x41], r13d
lea rax, [rbp - 0x41]
mov dword [rbp - 0x59], r13d
lea r8, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea edx, [r9 + 8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
je 0x140003309
mov edi, r13d
jmp 0x140003318
call fcn.140038cd4
mov edi, eax
test eax, eax
js 0x1400033cf
cmp dword [rbp - 0x59], r13d
je 0x140003365
lea r8, [rbp - 0x59]
mov dword [rbp - 0x59], r13d
mov edx, 0xc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x14000333d
mov edi, r13d
jmp 0x14000334c
call fcn.140038cd4
mov edi, eax
test eax, eax
js 0x1400033cf
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x1400033a4
test byte [rcx + 0x1c], 4
je 0x1400033a4
mov edx, 0x1f
jmp 0x140003395
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x1400033a4
test byte [rcx + 0x1c], 4
je 0x1400033a4
mov edx, 0x20
jmp 0x140003395
mov rcx, qword [str.___a_]
cmp rcx, rsi
je 0x1400033a4
test byte [rcx + 0x1c], 4
je 0x1400033a4
mov edx, 0x21
mov r9, qword [r15]
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400022ac
test rbx, rbx
je 0x1400033b2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add r15, 8
lea rax, [rbp + 0x3f]
cmp r15, rax
je 0x1400033dd
jmp 0x1400031a5
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400033dd
jmp 0x1400033d7
test rbx, rbx
je 0x1400033dd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x1400033ef
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140040760
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop rbp
ret