Function at 0x140006590
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140046180]
mov rdx, qword [0x140046188]
xor edi, edi
mov rsi, rcx
cmp rbx, rdx
jae 0x140006566
test edi, edi
jne 0x140006566
mov rax, qword [rbx]
test rax, rax
je 0x14000655d
mov rax, qword [rax + 0x20]
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x14000655d
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rdx, qword [0x140046188]
mov edi, eax
add rbx, 8
cmp rbx, rdx
jb 0x140006537
cmp byte [rsi + 0x60], 0
je 0x140006575
mov ecx, dword [rsi + 0x5c]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov rax, rsp
mov qword [rax + 8], rcx
push r14
sub rsp, 0x70
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140006667
mov r8d, 2
lea rdx, [0x140046298]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
xor edi, edi
test rax, rax
je 0x14000665c
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, str.LocalSystem
mov qword [rsp + 0x40], rax
lea rax, str.SENS
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, str.ProfSvc_Group
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
or r8d, r9d
or edx, r9d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140006653
lea r8, str.Failed_to_change_the_service_config
lea rdx, [0x14002e8a0]
mov rcx, rbx
call fcn.140005ac0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006669
xor edi, edi
mov rcx, rbx
call fcn.1400090a0
mov rcx, qword [rbx + 0x2a0]
test rcx, rcx
je 0x14000669c
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbx + 0x2a0]
test rcx, rcx
je 0x14000669c
mov qword [rbx + 0x2a0], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400066e0
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400066c7
mov qword [rbx + 0x12a8], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400066e0
mov qword [rbx + 0x12a8], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, [rbx + 0x298]
call fcn.14000f120
nop
jmp 0x1400066f7
mov rcx, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp 0x140006510
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400068b0
test eax, eax
jne 0x14000880a
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x14000880c
nop dword [rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x1400087d0
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x140006590
js 0x140008819
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x140006590
add rsp, 0x50
pop rbx
ret