Function at 0x1400760d0
Capabilities:
Check if file exists
Query or enumerate registry value
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov r14, r9
mov r15, r8
mov rbx, rdx
mov r12, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rbp - 0x59], rax
test rax, rax
jne 0x140076140
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140416644]
mov rcx, r15
call fcn.140008c60
nop
lea rdi, [rsi - 1]
jmp 0x14007653a
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, qword [r12]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp - 0x49], rax
test rax, rax
jne 0x14007618d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14041664c]
mov rcx, r15
call fcn.140008c60
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdi, 0xffffffffffffffff
jmp 0x14007653a
lea rdx, [rbp - 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400761c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.04__d
mov rcx, r15
call fcn.140008c60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140076177
mov rcx, rdi
cmp dword [rbp + 3], 1
je 0x140076220
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400761ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140076219
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov al, 1
jmp 0x140076574
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rdi, 0xffffffffffffffff
test eax, eax
jne 0x14007658f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8d, eax
lea rdx, str.05__d
mov rcx, r15
call fcn.140008c60
cmp ebx, 2
jne 0x140076526
mov r13d, 1
mov dword [rbp - 0x65], r13d
mov dword [rbp - 0x69], 0x104
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400765ae
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
mov edx, 0xa0
lea rcx, [rbp - 0x21]
call fcn.1400177a0
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x1400762a8
mov rsi, qword [rax]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400765b9
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x71], rax
mov rdx, rsi
lea rcx, [rbp - 0x71]
call fcn.140007020
xor ecx, ecx
test al, al
jne 0x1400762fe
test rsi, rsi
jne 0x1400762e2
mov eax, ecx
jmp 0x1400762ee
mov rax, rdi
inc rax
cmp word [rsi + rax*2], cx
jne 0x1400762e5
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x71]
call fcn.140008250
nop
mov edx, WSACleanup
lea rcx, [rbp - 0x41]
call fcn.1400177a0
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x140076319
mov rsi, qword [rax]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400765c4
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x79], rax
mov rdx, rsi
lea rcx, [rbp - 0x79]
call fcn.140007020
test al, al
jne 0x14007636e
test rsi, rsi
jne 0x140076351
xor eax, eax
jmp 0x14007635e
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x140076354
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp - 0x79]
call fcn.140008250
nop
mov r8, r12
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x51]
call fcn.140078000
mov rsi, rax
sub r13d, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, 0x104
or ecx, r13d
jge 0x1400763a5
mov edx, 0x104
lea rcx, [rbp - 0x61]
call fcn.14000816c
mov rbx, qword [rbp - 0x61]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x65]
mov r8, qword [rbp - 0x71]
mov rdx, qword [rsi]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400763ec
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
nop
mov rdx, qword [rbp - 0x79]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007640a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14007644a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140076445
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400765cf
call fcn.140133e68
xor eax, eax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], ax
mov rdx, qword [rbp - 0x71]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007647a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x1400764ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400764b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400765d5
call fcn.140133e68
mov rbx, qword [rbp - 0x61]
test esi, esi
jne 0x140076509
mov r8, qword [r14]
test r8, r8
je 0x1400765a3
mov rax, rbx
sub r8, rbx
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400764e8
add rax, 2
test ecx, ecx
jne 0x1400764d4
mov r8d, 2
mov rcx, r15
test edx, edx
lea rdx, str.05__d_0
je 0x140076503
lea rdx, str.05__d_1
call fcn.140008c60
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140076522
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, qword [rbp - 0x59]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140076558
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140076572
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor al, al
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [rbx], 1
lea rdx, str.06_00
mov rcx, r15
call fcn.140008c60
jmp 0x140076526
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
call fcn.1401462a8
nop
call fcn.1401462a8
int3