Function at 0x140012b40
Capabilities:
Modify service

Disassembly:
push rbx
push rdi
sub rsp, 0x2c8
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, qword [rcx + 8]
mov rdi, rcx
test rbx, rbx
jne 0x140012b6f
xor al, al
jmp 0x140012f83
mov qword [rsp + 0x2e8], rbp
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x2f0], rsi
xor ebp, ebp
mov qword [rsp + 0x2f8], r12
xor edx, edx
mov qword [rsp + 0x2c0], r13
mov r8d, 0x208
mov qword [rsp + 0x2b8], r14
mov esi, ebp
mov qword [rsp + 0x2b0], r15
mov r14d, ebp
mov r15d, ebp
mov dword [rsp + 0x80], ebp
mov r12b, 1
call fcn.1400220d0
lea r9, [rsp + 0x80]
mov qword [rsp + 0x68], rbp
xor r8d, r8d
mov qword [rsp + 0x70], rbp
xor edx, edx
mov qword [rsp + 0x78], rbp
mov rcx, rbx
mov r13d, 0xffffffff
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140012c16
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140012c56
mov esi, dword [rsp + 0x80]
xor ecx, ecx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x80]
mov r8d, esi
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140012c7a
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea r8, str.check_control_config_failed_has_size
lea rdx, [rdi + 0xa3c]
call fcn.140006510
jmp 0x140012f33
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea r8, str.check_control_config_failed_no_size
lea rdx, [rdi + 0xa3c]
call fcn.140006510
jmp 0x140012f4f
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x80]
mov ebx, 1
mov qword [rsp + 0x20], rax
mov edx, ebx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
jne 0x140012cc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140012d08
mov esi, dword [rsp + 0x80]
xor ecx, ecx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
mov rcx, qword [rdi + 8]
lea rax, [rsp + 0x80]
mov r9d, esi
mov qword [rsp + 0x20], rax
mov r8, r15
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
jne 0x140012d2c
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea r8, str.check_twice_control_config_failed_has_size
lea rdx, [rdi + 0xa3c]
call fcn.140006510
jmp 0x140012f33
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea r8, str.check_twice_control_config_failed_no_size
lea rdx, [rdi + 0xa3c]
call fcn.140006510
jmp 0x140012f33
mov ecx, dword [rdi + 0x10]
lea rsi, [rdi + 0x62c]
cmp ecx, dword [r14]
setne al
cmovne r13d, ecx
cmp dword [r14 + 4], 2
mov ecx, 0xffffffff
movzx ebp, al
mov eax, 2
cmove eax, ecx
cmovne ebp, ebx
cmp word [rsi], 0x25
mov dword [rsp + 0x60], eax
jne 0x140012e3f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp rbx, rcx
jae 0x140012e3f
lea rax, [rdi + 0x62e]
cmp word [rax], 0x25
je 0x140012d99
inc rbx
add rax, 2
cmp rbx, rcx
jb 0x140012d82
jmp 0x140012e3f
test rbx, rbx
je 0x140012e3f
mov r8, rbx
lea rcx, str._SystemRoot__
mov rdx, rsi
call fcn.14002a950
test eax, eax
jne 0x140012dce
lea rcx, str._SystemRoot__
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.C:Windows_s
jmp 0x140012e24
mov r8, rbx
lea rcx, str._ProgramFiles__
mov rdx, rsi
call fcn.14002a950
test eax, eax
jne 0x140012dfa
lea rcx, str._ProgramFiles__
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str._C:Program_Files_s_
jmp 0x140012e24
mov r8, rbx
lea rcx, str._ProgramFiles_x86___
mov rdx, rsi
call fcn.14002a950
test eax, eax
jne 0x140012e3f
lea rcx, str._ProgramFiles_x86___
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str._C:Program_Files__x86__s_
movsxd rcx, eax
add rcx, 0x316
lea r8, [rdi + rcx*2]
lea rcx, [rsp + 0x90]
call fcn.140001d30
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x140012e62
mov rdx, rsi
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [r14 + 0x10]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140012e7d
mov bpl, 1
jmp 0x140012e82
mov rsi, qword [rsp + 0x68]
mov rdx, qword [r14 + 0x30]
lea rbx, [rdi + 0x14]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140012e9c
mov bpl, 1
jmp 0x140012ea1
mov rbx, qword [rsp + 0x70]
mov rdx, qword [r14 + 0x38]
test rdx, rdx
je 0x140012ec4
lea rcx, str.AsusROGLSLService_Download_ROGLSLoader
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140012ec4
lea rax, str.AsusROGLSLService_Download_ROGLSLoader
jmp 0x140012ece
test bpl, bpl
je 0x140012f30
mov rax, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x60]
mov r9d, 0xffffffff
mov rcx, qword [rdi + 8]
mov edx, r13d
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140012f30
xor edx, edx
xor ecx, ecx
call fcn.140003ed0
mov rcx, rax
lea r8, str.control_dont_change_config
lea rdx, [rdi + 0xa3c]
call fcn.140006510
jmp 0x140012f33
xor r12b, r12b
test r14, r14
je 0x140012f41
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
je 0x140012f4f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, qword [rsp + 0x2b0]
movzx eax, r12b
mov r12, qword [rsp + 0x2f8]
mov r14, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2c0]
mov rsi, qword [rsp + 0x2f0]
mov rbp, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14001f550
add rsp, 0x2c8
pop rdi
pop rbx
ret