Function at 0x140038a00
Capabilities:
Query service status

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov rax, qword [0x1401339d8]
xor rax, rsp
mov qword [rbp + 0xf], rax
movzx eax, r9b
mov byte [rbp - 0x79], al
movzx r13d, r8b
mov qword [rbp - 0x59], rdx
mov r15, rcx
mov ebx, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
lea r9, str.Service_Name___s__Running_Status_To_be_checked___d__To_Get_version_Info_Status___d
lea r8, str.Utils::IsServicePresent
xor edx, edx
call fcn.14009cf00
xor edi, edi
mov ebx, edi
mov qword [rbp - 0x61], rbx
call fcn.140014190
cmp byte [rax + 0x64], dil
je 0x140038ac0
lea ecx, [rdi + 0x28]
call fcn.140095e50
mov rbx, rax
mov qword [rbp - 0x71], rax
test rax, rax
je 0x140038ab9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
call fcn.140014190
mov rdx, rax
lea r8, str.Utils::IsServicePresent
mov rcx, rbx
call fcn.140098570
mov rbx, rax
jmp 0x140038abc
mov rbx, rdi
mov qword [rbp - 0x61], rbx
mov qword [rbp - 0x71], rdi
mov qword [rbp - 0x69], rdi
mov r14, rdi
mov dword [rbp - 0x51], edi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], di
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x71]
mov rcx, r15
call fcn.140035a80
mov esi, eax
mov r12, qword [rbp - 0x69]
test eax, eax
jne 0x140038dce
test r13b, r13b
je 0x140038bb9
call fcn.140014190
mov rcx, rax
mov qword [rsp + 0x20], r15
lea r9, str._s_Service_is_installed._Querying_status..
lea r8, str.Utils::IsServicePresent
lea edx, [rsi + 3]
call fcn.14009cf00
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x24]
lea r8, [rbp - 0x29]
xor edx, edx
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x140038bb9
call fcn.140014190
mov rcx, rax
mov eax, dword [rbp - 0x25]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
lea r9, str._s_Service_status__0x_08lx
lea r8, str.Utils::IsServicePresent
lea edx, [rsi + 3]
call fcn.14009cf00
cmp dword [rbp - 0x25], 4
jne 0x140038b91
mov esi, edi
call fcn.140014190
lea r9, str._s_Service_is_running
mov edx, 3
jmp 0x140038ba5
mov esi, 1
call fcn.140014190
lea r9, str._s_Service_is_not_running
lea edx, [rsi + 4]
mov qword [rsp + 0x20], r15
lea r8, str.Utils::IsServicePresent
mov rcx, rax
call fcn.14009cf00
cmp byte [rbp - 0x79], 0
je 0x140038dce
lea r9, [rbp - 0x51]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfigW]
test eax, eax
jne 0x140038c69
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x140038e9c
mov edi, dword [rbp - 0x51]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x140038c69
lea r9, [rbp - 0x51]
mov r8d, edi
mov rdx, rax
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfigW]
test eax, eax
jne 0x140038c4a
lea esi, [rax + 2]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.QueryServiceConfig_failed_w_err_0x_08lx
lea r8, str.Utils::IsServicePresent
lea edx, [rsi + 3]
call fcn.14009cf00
jmp 0x140038dc3
mov rdx, qword [r14 + 0x10]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140038c55
lea rcx, [rbp - 0x49]
call fcn.140013240
mov r9, qword [rbp - 0x39]
test r9, r9
je 0x140038d3c
lea rax, [rbp - 0x49]
mov r10, qword [rbp - 0x49]
mov r11, qword [rbp - 0x31]
cmp r11, 8
cmovae rax, r10
lea rdi, [rax + r9*2]
lea rax, [rbp - 0x49]
cmovae rax, r10
lea r8, [rax + r9*2]
lea rax, [rbp - 0x49]
cmovae rax, r10
cmp rax, r8
je 0x140038ce9
cmp word [rax], 0x22
je 0x140038cb6
add rax, 2
cmp rax, r8
jne 0x140038ca7
cmp rax, r8
je 0x140038ce9
lea rcx, [rax + 2]
cmp rcx, r8
je 0x140038ce9
movzx edx, word [rcx]
cmp dx, 0x22
je 0x140038cd4
mov word [rax], dx
add rax, 2
add rcx, 2
cmp rcx, r8
jne 0x140038cc4
mov r11, qword [rbp - 0x31]
mov r9, qword [rbp - 0x39]
mov r10, qword [rbp - 0x49]
lea rcx, [rbp - 0x49]
cmp r11, 8
cmovae rcx, r10
mov rdx, rax
sub rdx, rcx
sar rdx, 1
sub rdi, rax
sar rdi, 1
mov rax, r9
sub rax, rdx
cmp rax, rdi
cmovb rdi, rax
lea rax, [rbp - 0x49]
cmp r11, 8
cmovae rax, r10
lea rcx, [rax + rdx*2]
sub r9, rdi
mov qword [rbp - 0x39], r9
sub r9, rdx
lea r8, [r9*2 + 2]
lea rdx, [rcx + rdi*2]
call fcn.1400a5110
lea rdi, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdi, qword [rbp - 0x49]
call fcn.140014190
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
lea r9, str._s_service_installed_path___s
lea r8, str.Utils::IsServicePresent
mov edx, 2
call fcn.14009cf00
xorps xmm0, xmm0
xor eax, eax
mov rdi, qword [rbp - 0x59]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
mov dword [rdi + 0x30], eax
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rdx, qword [rbp - 0x49]
lea rcx, [rbp - 0x29]
call fcn.1400372a0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
mov ecx, dword [rax + 0x30]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi + 0x20], xmm2
mov dword [rdi + 0x30], ecx
test r14, r14
je 0x140038dcc
mov rcx, r14
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor edi, edi
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x140038ddd
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test r12, r12
je 0x140038deb
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], esi
lea r9, str.Return_Value___d
lea r8, str.Utils::IsServicePresent
mov edx, 1
call fcn.14009cf00
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 8
jb 0x140038e50
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038e4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038ed0
call fcn.140095e90
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], 7
mov word [rbp - 0x49], di
test rbx, rbx
je 0x140038e7a
mov rcx, rbx
call fcn.140099040
mov edx, 0x28
mov rcx, rbx
call fcn.140095e90
mov eax, esi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400964b0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov esi, 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.140014190
mov rcx, rax
mov dword [rsp + 0x20], edi
lea r9, str.QueryServiceConfig_failed_w_err_0x_08lx
lea r8, str.Utils::IsServicePresent
lea edx, [rsi + 3]
call fcn.14009cf00
jmp 0x140038dcc
call fcn.1400b1720
int3