Function at 0x140004a30
Capabilities:
Query service configuration

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x140048dc0]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x38], rdx
cmp byte [rcx + 0x54], 0
jne 0x140004a99
cmp qword [rdx + 0x20], 0x10
jb 0x140004a80
mov rcx, qword [rdx + 8]
call fcn.1400062d4
mov qword [rbx + 0x20], 0xf
xor esi, esi
mov qword [rbx + 0x18], rsi
mov byte [rbx + 8], sil
xor al, al
jmp 0x140004e80
mov qword [rsp + 0x48], 0xf
xor esi, esi
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x30], sil
lea r8d, [rsi + 0x1a]
lea rdx, str.Protexis_Licensing_Service
lea rcx, [rsp + 0x28]
call fcn.140002a30
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x58]
call fcn.140031560
nop
xor edx, edx
xor ecx, ecx
lea r8d, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r12, rax
test rax, rax
jne 0x140004b48
xor r8d, r8d
mov edx, 0xc0000019
lea rcx, [rsp + 0x58]
call fcn.140031a80
nop
cmp qword [rsp + 0x78], 0x10
jb 0x140004b0e
mov rcx, qword [rsp + 0x60]
call fcn.1400062d4
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
cmp qword [rbx + 0x20], 0x10
jb 0x140004b31
mov rcx, qword [rbx + 8]
call fcn.1400062d4
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], rsi
mov byte [rbx + 8], 0
xor al, al
jmp 0x140004e80
cmp qword [rdi + 0x20], 0x10
jb 0x140004b55
mov rdx, qword [rdi + 8]
jmp 0x140004b59
lea rdx, [rdi + 8]
mov r8d, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r13, rax
test rax, rax
jne 0x140004bd8
xor r8d, r8d
mov edx, 0xc0000020
lea rcx, [rsp + 0x58]
call fcn.140031a80
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp qword [rsp + 0x78], 0x10
jb 0x140004b9e
mov rcx, qword [rsp + 0x60]
call fcn.1400062d4
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
cmp qword [rbx + 0x20], 0x10
jb 0x140004bc1
mov rcx, qword [rbx + 8]
call fcn.1400062d4
mov qword [rbx + 0x20], 0xf
mov qword [rbx + 0x18], rsi
mov byte [rbx + 8], 0
xor al, al
jmp 0x140004e80
mov edx, 0x1000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
jne 0x140004c49
xor r8d, r8d
mov edx, 0xc0000030
lea rcx, [rsp + 0x58]
call fcn.140031a80
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp qword [rsp + 0x78], 0x10
jb 0x140004c27
mov rcx, qword [rsp + 0x60]
call fcn.1400062d4
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.140001260
xor al, al
jmp 0x140004e80
lea r9, [rsp + 0x20]
mov r8d, 0x1000
mov rdx, rax
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x140004cc6
xor r8d, r8d
mov edx, 0xc0000029
lea rcx, [rsp + 0x58]
call fcn.140031a80
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp qword [rsp + 0x78], 0x10
jb 0x140004ca4
mov rcx, qword [rsp + 0x60]
call fcn.1400062d4
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.140001260
xor al, al
jmp 0x140004e80
mov r8, qword [rbp + 0x10]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
mov rdx, rcx
mov rcx, r8
call fcn.140014f08
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], 0
mov rdx, qword [rbp + 0x10]
cmp byte [rdx], 0x22
jne 0x140004d2c
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
inc rdx
lea r8, [rcx - 3]
lea rcx, [rsp + 0x88]
call fcn.140002a30
jmp 0x140004d4b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x88]
call fcn.140002a30
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rbx + 0x18]
cmp qword [rbx + 0x20], 0x10
jb 0x140004d77
mov rdx, qword [rbx + 8]
jmp 0x140004d7b
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x90]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xa8]
cmp rbp, 0x10
cmovae rcx, r12
mov r8, rdi
mov r13, qword [rsp + 0xa0]
cmp r13, rdi
cmovb r8, r13
call fcn.140016410
movsxd rcx, eax
test eax, eax
jne 0x140004dc8
cmp r13, rdi
jb 0x140004e27
mov eax, esi
cmp r13, rdi
setne al
mov ecx, eax
test ecx, ecx
jne 0x140004e27
cmp rbp, 0x10
jb 0x140004dda
mov rcx, r12
call fcn.1400062d4
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], 0
cmp qword [rsp + 0x78], 0x10
jb 0x140004e08
mov rcx, qword [rsp + 0x60]
call fcn.1400062d4
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.140001260
mov al, 1
jmp 0x140004e80
cmp rbp, 0x10
jb 0x140004e35
mov rcx, r12
call fcn.1400062d4
mov qword [rsp + 0xa8], 0xf
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0x90], 0
cmp qword [rsp + 0x78], 0x10
jb 0x140004e63
mov rcx, qword [rsp + 0x60]
call fcn.1400062d4
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
mov rcx, rbx
call fcn.140001260
xor al, al
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400144f0
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret