Function at 0x140002e60
Capabilities:
Create service

Disassembly:
mov r8, rdx
mov edx, ecx
jmp 0x140009590
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r12, r8
mov r15d, edx
xor r14d, r14d
lea rcx, [rsp + 0x70]
call fcn.140004ec0
nop
mov rsi, qword [rsp + 0x70]
lea rdx, str.install
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r9, qword [rsp + 0x70]
mov rbx, qword [r9]
cmp rbx, r9
je 0x14000965e
mov r11, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x70]
nop dword [rax]
nop word [rax + rax]
lea r8, [rbp - 0x70]
cmp r11, 8
cmovae r8, rdi
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x14000962b
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
cmp rdx, r10
jne 0x140009656
test rdx, rdx
je 0x14000965e
sub r8, rcx
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp word [rcx], ax
jne 0x140009656
add rcx, 2
sub rdx, 1
je 0x14000965e
jmp 0x140009640
mov rbx, qword [rbx]
cmp rbx, r9
jne 0x140009610
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000969e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009699
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ed6
call fcn.14000dd90
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
cmp rbx, rsi
jne 0x140009a9b
mov rsi, qword [rsp + 0x70]
lea rdx, str.update
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r9, qword [rsp + 0x70]
mov rbx, qword [r9]
cmp rbx, r9
je 0x14000973e
mov r11, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x70]
nop word [rax + rax]
lea r8, [rbp - 0x70]
cmp r11, 8
cmovae r8, rdi
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x14000970b
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
cmp rdx, r10
jne 0x140009736
test rdx, rdx
je 0x14000973e
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx + r8]
cmp word [rcx], ax
jne 0x140009736
add rcx, 2
sub rdx, 1
je 0x14000973e
jmp 0x140009720
mov rbx, qword [rbx]
cmp rbx, r9
jne 0x1400096f0
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000977e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009779
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009edc
call fcn.14000dd90
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
cmp rbx, rsi
jne 0x140009a9b
mov rsi, qword [rsp + 0x70]
lea rdx, str.uninstall
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r9, qword [rsp + 0x70]
mov rbx, qword [r9]
cmp rbx, r9
je 0x14000981e
mov r11, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x70]
nop word [rax + rax]
lea r8, [rbp - 0x70]
cmp r11, 8
cmovae r8, rdi
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x1400097eb
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
cmp rdx, r10
jne 0x140009816
test rdx, rdx
je 0x14000981e
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx + r8]
cmp word [rcx], ax
jne 0x140009816
add rcx, 2
sub rdx, 1
je 0x14000981e
jmp 0x140009800
mov rbx, qword [rbx]
cmp rbx, r9
jne 0x1400097d0
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000985e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009859
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ee2
call fcn.14000dd90
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
cmp rbx, rsi
jne 0x140009a9b
mov rsi, qword [rsp + 0x70]
lea rdx, str.console
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r9, qword [rsp + 0x70]
mov rbx, qword [r9]
cmp rbx, r9
je 0x1400098fe
mov r11, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x70]
nop word [rax + rax]
lea r8, [rbp - 0x70]
cmp r11, 8
cmovae r8, rdi
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x1400098cb
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
cmp rdx, r10
jne 0x1400098f6
test rdx, rdx
je 0x1400098fe
sub r8, rcx
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp word [rcx], ax
jne 0x1400098f6
add rcx, 2
sub rdx, 1
je 0x1400098fe
jmp 0x1400098e0
mov rbx, qword [rbx]
cmp rbx, r9
jne 0x1400098b0
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000993e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009939
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ee8
call fcn.14000dd90
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
cmp rbx, rsi
jne 0x140009a9b
mov rsi, qword [rsp + 0x70]
lea rdx, str.start
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r9, qword [rsp + 0x70]
mov rbx, qword [r9]
cmp rbx, r9
je 0x1400099de
mov r11, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x70]
nop word [rax + rax]
lea r8, [rbp - 0x70]
cmp r11, 8
cmovae r8, rdi
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x1400099ab
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
cmp rdx, r10
jne 0x1400099d6
test rdx, rdx
je 0x1400099de
sub r8, rcx
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp word [rcx], ax
jne 0x1400099d6
add rcx, 2
sub rdx, 1
je 0x1400099de
jmp 0x1400099c0
mov rbx, qword [rbx]
cmp rbx, r9
jne 0x140009990
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140009a1e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009eee
call fcn.14000dd90
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
cmp rbx, rsi
jne 0x140009a9b
lea rcx, str.Parameters:_n
call fcn.140008ec0
lea rcx, str._t_install_tto_install_the_service._n
call fcn.140008ec0
lea rcx, str._t_uninstall_tto_remove_the_service._n
call fcn.140008ec0
lea rcx, str._t_console_tto_run_console_instead_service._n
call fcn.140008ec0
lea rcx, str._t_start_t_tto_start_service__sc.exe_start__service_name__._n
call fcn.140008ec0
call fcn.140004430
test eax, eax
jne 0x140009e99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Service_failed_to_run_w_err_0x_08lx_n
call fcn.140008ec0
mov ecx, 0x2710
jmp 0x140009e92
mov rsi, qword [rsp + 0x70]
lea rdx, str.install
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r9, qword [rsp + 0x70]
mov rbx, qword [r9]
cmp rbx, r9
je 0x140009b1e
mov r11, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x70]
nop word [rax + rax]
lea r8, [rbp - 0x70]
cmp r11, 8
cmovae r8, rdi
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x140009aeb
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
cmp rdx, r10
jne 0x140009b16
test rdx, rdx
je 0x140009b1e
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx + r8]
cmp word [rcx], ax
jne 0x140009b16
add rcx, 2
sub rdx, 1
je 0x140009b1e
jmp 0x140009b00
mov rbx, qword [rbx]
cmp rbx, r9
jne 0x140009ad0
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140009b5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ef4
call fcn.14000dd90
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
cmp rbx, rsi
je 0x140009ce5
lea rcx, str.install_n
call fcn.140008f20
lea rcx, [0x14004c2b0]
mov rax, qword [0x14004c2b0]
call qword [rax + 0x40]
mov esi, eax
mov rdi, qword [0x14004e310]
mov r14, qword [0x14004e308]
mov r15, qword [0x14004e300]
mov r12d, dword [0x14004e2f8]
mov r13, qword [0x14004e2f0]
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140009bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err__d_n
call fcn.140008f20
xor r14d, r14d
jmp 0x140009e8d
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140009c1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err__d_n
call fcn.140008f20
xor r14d, r14d
jmp 0x140009e8d
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r15
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0x10
lea r9d, [r14 + 4]
mov r8, r13
lea rdx, [0x14004c2f0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x140009cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err__d_n
call fcn.140008f20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err__d_n
call fcn.140008f20
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140009e8d
mov edx, esi
lea rcx, [0x14004c2f0]
call fcn.14000a8b0
lea rdx, [0x14004c2f0]
lea rcx, str._s_is_installed._n
call fcn.140008ec0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140009e8d
mov rsi, qword [rsp + 0x70]
lea rdx, str.update
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r9, qword [rsp + 0x70]
mov rbx, qword [r9]
cmp rbx, r9
je 0x140009d6e
mov r11, qword [rbp - 0x58]
mov r10, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x70]
nop dword [rax]
nop dword [rax + rax]
lea r8, [rbp - 0x70]
cmp r11, 8
cmovae r8, rdi
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x140009d3b
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
cmp rdx, r10
jne 0x140009d66
test rdx, rdx
je 0x140009d6e
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx + r8]
cmp word [rcx], ax
jne 0x140009d66
add rcx, 2
sub rdx, 1
je 0x140009d6e
jmp 0x140009d50
mov rbx, qword [rbx]
cmp rbx, r9
jne 0x140009d20
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140009dae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009da9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ed0
call fcn.14000dd90
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
cmp rbx, rsi
je 0x140009df4
lea rcx, str.update_n
call fcn.140008f20
lea rcx, [0x14004c2b0]
mov rax, qword [0x14004c2b0]
call qword [rax + 0x40]
mov edx, eax
lea rcx, [0x14004c2f0]
call fcn.14000a8b0
jmp 0x140009e8d
mov rbx, qword [rsp + 0x70]
lea rdx, str.uninstall
lea rcx, [rbp - 0x70]
call fcn.140008040
nop
mov r8, qword [rsp + 0x70]
lea r9, [rbp - 0x70]
mov rdx, qword [r8]
lea rcx, [rbp - 0x78]
call fcn.1400077e0
nop
lea rcx, [rbp - 0x70]
call fcn.140002f10
cmp qword [rbp - 0x78], rbx
je 0x140009e42
lea rcx, str.uninstall_n
call fcn.140008f20
call fcn.1400059a0
jmp 0x140009e8d
lea rdx, str.console
lea rcx, [rsp + 0x70]
call fcn.140005220
test al, al
je 0x140009e67
mov r8, r12
mov edx, r15d
call fcn.140009320
mov r14d, eax
jmp 0x140009e99
lea rdx, str.start
lea rcx, [rsp + 0x70]
call fcn.140005220
test al, al
je 0x140009e99
lea rcx, str.start_n
call fcn.140008f20
call fcn.140005b40
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rsp + 0x70]
call fcn.140006160
mov eax, r14d
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14000dd70
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140014204
nop
call fcn.140014204
nop
call fcn.140014204
nop
call fcn.140014204
nop
call fcn.140014204
nop
call fcn.140014204
nop
call fcn.140014204
int3