Function at 0x140002630
Capabilities:
Delete service
Query or enumerate registry value
Query service configuration
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x9f0
mov rax, qword [0x140021f60]
xor rax, rsp
mov qword [rsp + 0x9e0], rax
lea rcx, [rsp + 0x1e1]
xor edx, edx
mov r8d, 0x7ff
mov byte [rsp + 0x1e0], 0
call fcn.140007260
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbp, rax
test rax, rax
jne 0x1400026a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14000622c
lea rdx, str.OpenSCManager:__d_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.140006508
jmp 0x140002910
lea rdx, str.fortknox_drv
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0xa08], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x1400026f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14000622c
lea rdx, str.OpenService:__d_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.140006508
jmp 0x140002908
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x1e0]
mov r8d, 0x800
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x140002739
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14000622c
lea rdx, str.QueryServiceConfig_tcpip_:__d_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.140006508
jmp 0x140002908
mov ebx, dword [rsp + 0x200]
lea r8, [rsp + 0x38]
lea rdx, str.SYSTEMCurrentControlSetControlGroupOrderList
mov rcx, 0xffffffff80000002
mov qword [rsp + 0xa00], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test eax, eax
je 0x140002784
call fcn.14000622c
lea rdx, str.RegOpenKey:__d_n
mov r8d, esi
lea rcx, [rax + 0x60]
call fcn.140006508
jmp 0x140002900
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.PNP_TDI
xor r8d, r8d
mov dword [rsp + 0x30], 0x190
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test eax, eax
je 0x1400027dd
call fcn.14000622c
lea rdx, str.RegQueryValueEx:__d_n
mov r8d, esi
lea rcx, [rax + 0x60]
call fcn.140006508
jmp 0x140002900
mov ecx, dword [rsp + 0x30]
mov r9d, 1
shr ecx, 2
mov dword [rsp + 0x30], ecx
cmp ecx, r9d
jbe 0x140002839
mov eax, r9d
cmp dword [rsp + rax*4 + 0x50], ebx
je 0x140002806
inc r9d
cmp r9d, ecx
jb 0x1400027f3
jmp 0x140002839
sub ecx, r9d
lea eax, [r9 + 1]
lea rdx, [rsp + 0x50]
lea r8d, [rcx - 1]
lea rdx, [rdx + rax*4]
mov eax, r9d
lea rcx, [rsp + 0x50]
shl r8, 2
lea rcx, [rcx + rax*4]
call fcn.140005b00
mov ecx, dword [rsp + 0x30]
dec ecx
mov dword [rsp + 0x30], ecx
mov r9d, dword [rsp + 0x40]
lea eax, [rcx - 1]
lea rdx, str.PNP_TDI
mov dword [rsp + 0x50], eax
lea eax, [rcx*4]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test eax, eax
je 0x14000288f
call fcn.14000622c
lea rdx, str.RegSetValueEx:__d_n
mov r8d, ebx
lea rcx, [rax + 0x60]
call fcn.140006508
jmp 0x140002900
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400028e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
je 0x1400028d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14000622c
lea rdx, str.DeleteService:__d_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.140006508
jmp 0x140002900
lea rcx, str.Restart_Windows_to_changes_has_effect_n
call fcn.140006988
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.success_n
call fcn.140006988
mov rsi, qword [rsp + 0xa00]
mov rdi, qword [rsp + 0xa08]
mov rcx, qword [rsp + 0x9e0]
xor rcx, rsp
call fcn.140007230
mov rbx, qword [rsp + 0xa10]
add rsp, 0x9f0
pop rbp
ret