Function at 0x1400064a0
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x14004d190]
mov rdx, qword [0x14004d198]
xor edi, edi
mov rsi, rcx
cmp rbx, rdx
jae 0x140006476
test edi, edi
jne 0x140006476
mov rax, qword [rbx]
test rax, rax
je 0x14000646d
mov rax, qword [rax + 0x20]
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x14000646d
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov rdx, qword [0x14004d198]
mov edi, eax
add rbx, 8
cmp rbx, rdx
jb 0x140006447
cmp byte [rsi + 0x60], 0
je 0x140006485
mov ecx, dword [rsi + 0x5c]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret
mov rax, rsp
mov qword [rax + 8], rcx
push r14
sub rsp, 0x70
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140006577
mov r8d, 2
lea rdx, [0x14004d2a8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
xor edi, edi
test rax, rax
je 0x14000656c
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, str.LocalSystem
mov qword [rsp + 0x40], rax
lea rax, str.SENS
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, str.ProfSvc_Group
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
or r8d, r9d
or edx, r9d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140006563
lea r8, str.Failed_to_change_the_service_config
lea rdx, [0x140033930]
mov rcx, rbx
call fcn.1400059d0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006579
xor edi, edi
mov rcx, rbx
call fcn.140009010
mov rcx, qword [rbx + 0x2a0]
test rcx, rcx
je 0x1400065ac
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbx + 0x2a0]
test rcx, rcx
je 0x1400065ac
mov qword [rbx + 0x2a0], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400065f0
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400065d7
mov qword [rbx + 0x12a8], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x12a8]
test rcx, rcx
je 0x1400065f0
mov qword [rbx + 0x12a8], rdi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call fcn.140008e30
lea rcx, [rbx + 0x298]
call fcn.140013780
nop
jmp 0x14000660f
mov rcx, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp 0x140006420
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1400067c0
test eax, eax
jne 0x14000878a
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x14000878c
nop dword [rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x140008750
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x1400064a0
js 0x140008799
mov rcx, rbx
add rsp, 0x50
pop rbx
jmp 0x1400064a0
add rsp, 0x50
pop rbx
ret