Function at 0x1400066c0
Capabilities:
Modify service
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
lea rdx, str.PcaSvc
lea rcx, [rsp + 0xe0]
call fcn.140004a30
nop
lea rdx, str.PlugPlay
lea rcx, [rsp + 0x100]
call fcn.140004a30
nop
lea rdx, [0x14000aed0]
lea rcx, [rsp + 0x120]
call fcn.140004a30
nop
lea rdx, str.DiagTrack
lea rcx, [rsp + 0x140]
call fcn.140004a30
nop
lea rdx, str.SysMain
lea rcx, [rsp + 0x160]
call fcn.140004a30
nop
lea rdx, [0x14000a9e8]
lea rcx, [rsp + 0x180]
call fcn.140004a30
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov ecx, 0xc0
call fcn.140008198
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rcx, [rax + 0xc0]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x88], rcx
lea r9, [rsp + 0x60]
mov r8, rax
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xe0]
call fcn.140007d50
mov qword [rsp + 0x68], rax
lea r9, [0x1400049c0]
lea edx, [r14 + 0x20]
lea r8d, [r14 + 6]
lea rcx, [rsp + 0xe0]
call fcn.140008208
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rcx, [rsp + 0x78]
call fcn.140006200
nop
mov rdx, rax
lea rcx, [rsp + 0x88]
call qword [sym.imp.MSVCP140.dll_public:_static_class_std::locale___cdecl_std::locale::global_class_std::locale_const____ptr64_]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140006839
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140006839
mov rcx, qword [rax]
mov r8, qword [rcx]
lea edx, [r14 + 1]
mov rcx, rax
call r8
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140006862
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140006862
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
mov rdx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov rax, qword [rdx]
movsxd rbx, dword [rax + 4]
add rbx, rdx
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::locale___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::imbue_class_std::locale_const____ptr64____ptr64]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400068c3
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400068c3
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400068ec
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400068ec
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
mov rcx, qword [rsp + 0x60]
mov rbx, rcx
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x78], rbx
cmp rbx, r15
je 0x140007064
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400069dc
cmp qword [rbx + 0x18], 7
jbe 0x140006940
mov rdx, qword [rbx]
mov rax, rdx
mov rcx, qword [rbx + 0x10]
lea r8, [rdx + rcx*2]
jmp 0x14000694b
mov rax, qword [rbx + 0x10]
lea r8, [rbx + rax*2]
mov rax, rbx
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140007320
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova rdx, qword [rsp + 0xa0]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x140006ae3
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1400069dc
inc rdx
mov rcx, qword [rsp + 0xa0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400069d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006b5b
call fcn.140008190
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14000add8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Desativado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14000ade8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
lea rdx, [0x14000af30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140007450
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140006a80
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140007b80
lea rdx, [0x14000af38]
mov rcx, rax
call fcn.140007450
lea rdx, [0x140007630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x140006ce0
cmp qword [rbx + 0x18], 7
jbe 0x140006c44
mov rdx, qword [rbx]
mov rax, rdx
mov rcx, qword [rbx + 0x10]
lea r8, [rdx + rcx*2]
jmp 0x140006c4f
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rdi
test eax, eax
jne 0x140006b06
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006990
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0xc4], 4
sete dil
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140006b67
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
test dil, dil
je 0x1400069dc
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14000add8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Ativado
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14000ade8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
lea rdx, [0x14000af30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140007450
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140006c14
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140007b80
lea rdx, [0x14000af10]
mov rcx, rax
call fcn.140007450
lea rdx, [0x140007630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140006fbd
mov rax, qword [rbx + 0x10]
lea r8, [rbx + rax*2]
mov rax, rbx
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140007320
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova rdx, qword [rsp + 0xa0]
mov r8d, 0x10
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x140006d51
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140006ce0
inc rdx
mov rcx, qword [rsp + 0xa0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140006cdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006dba
call fcn.140008190
call fcn.140006470
lea rdx, str._Falha_ao_encontrar
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140007450
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140006d05
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140007b80
lea rdx, str.__possivelmente_por_conta_do_Windows_Otimizado.
mov rcx, rax
call fcn.140007450
lea rdx, [0x140007630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x140006d43
add rbx, 0x20
mov rcx, qword [rsp + 0x60]
jmp 0x140006901
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, rdi
test eax, eax
jne 0x140006d71
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006c94
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140006dc6
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006dc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006dc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14000add8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Ativando
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14000ade8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007150
lea rdx, [0x14000af30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140007450
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140006e6a
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140007b80
lea rdx, str._est
mov rcx, rax
call fcn.140007450
lea rdx, [0x140007630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140006f64
cmp qword [rbx + 0x18], 7
jbe 0x140006ec8
mov rdx, qword [rbx]
mov rax, rdx
mov rcx, qword [rbx + 0x10]
lea r8, [rdx + rcx*2]
jmp 0x140006ed3
mov rax, qword [rbx + 0x10]
lea r8, [rbx + rax*2]
mov rax, rbx
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140007320
lea rdx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0xf
cmova rdx, qword [rsp + 0xa0]
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x140006fcb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140006f64
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000705d
call fcn.140008190
mov rcx, rbx
call fcn.140006500
call fcn.1400063e0
lea rdx, [0x14000af30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140007450
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140006f91
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140007b80
lea rdx, [0x14000af10]
mov rcx, rax
call fcn.140007450
lea rdx, [0x140007630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
add rbx, 0x20
mov rcx, qword [rsp + 0x60]
jmp 0x140006901
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov edx, 0xffffffff
mov r9d, edx
mov r8d, 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140006f64
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test rcx, rcx
je 0x1400070b1
mov rdx, qword [rsp + 0x68]
call fcn.1400079d0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400070ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008190
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140008170
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret