Function at 0x1400016f0
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x388
cmp ecx, 1
jbe 0x140001ac8
mov rsi, qword [rdx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateEventW]
mov qword [section..bss], rax
test rax, rax
je 0x140001ab1
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.advapi32.dll_OpenSCManagerW]
mov qword [0x140007008], rax
test rax, rax
je 0x140001ab1
mov r8, rsi
lea rdx, [sym.service_handler]
lea rcx, section..data
call qword [sym.imp.advapi32.dll_RegisterServiceCtrlHandlerExW]
mov qword [0x140007010], rax
test rax, rax
je 0x140001ab1
lea r12, [rsp + 0x170]
mov edx, 0x104
lea r13, [rsp + 0x40]
lea rbx, [0x140004260]
lea rdi, [0x140004100]
mov rcx, r12
lea r14, [0x140003020]
lea r15, str.0123456789abcdefdevice_handler
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov rcx, r12
lea rdx, str.drivers
call qword [sym.imp.ntoskrnl.exe_wcscat]
mov rcx, r12
lea r12, [rbx + 0x18]
call qword [sym.imp.kernel32.dll_AddDllDirectory]
mov rbp, qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rdi
call rbp
test rax, rax
je 0x1400017f9
add rbx, 8
cmp rbx, r12
je 0x140001900
mov rdi, qword [rbx]
mov rcx, rdi
call rbp
test rax, rax
jne 0x1400017df
test byte [r14], 2
je 0x1400017df
lea rax, str._null_
test rdi, rdi
je 0x140001af7
mov rax, rdi
shr rax, 0x10
je 0x140001ff0
mov rdx, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x140001af7
cmp word [rdi], 0
je 0x14000206f
xor eax, eax
nop dword [rax + rax]
mov ecx, eax
add rax, 1
cmp word [rdi + rax*2], 0
jne 0x140001850
mov eax, 0x224c
lea rdx, [rsp + 0x42]
lea r8, [rsp + 0x162]
mov word [rsp + 0x40], ax
jmp 0x1400018be
cmp ax, 9
je 0x140001f10
cmp ax, 0xa
jne 0x140001f33
mov eax, 0x6e5c
add rdx, 2
mov word [rdx - 2], ax
nop dword [rax]
lea eax, [rcx - 1]
cmp rdx, r8
ja 0x140001ad0
test ecx, ecx
jle 0x140001ad0
mov ecx, eax
movzx eax, word [rdi]
add rdi, 2
cmp ax, 0xd
je 0x140001fa8
jbe 0x140001880
cmp ax, 0x22
je 0x140001f90
cmp ax, 0x5c
jne 0x140001f24
mov r9d, 0x5c5c
add rdx, 2
mov word [rdx - 2], r9w
jmp 0x1400018a8
xor edx, edx
xor ecx, ecx
lea r8, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_LdrLockLoaderLock]
lea rcx, [0x140004200]
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntdll.dll_LdrFindEntryForAddress]
test eax, eax
jne 0x1400019f2
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rdx + 8], rax
mov qword [rax], rdx
mov rax, qword [rsp + 0x30]
mov rdx, qword gs:[0x30]
mov qword [rax], 0
mov qword [rax + 8], 0
mov rax, qword [rdx + 0x60]
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
mov rax, qword [rsp + 0x30]
mov qword [rax], r8
mov rcx, qword [rdx + 0x60]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x18]
add rcx, 0x10
mov qword [rax + 8], rcx
mov qword [r8 + 8], rax
mov rcx, qword [rdx + 0x60]
mov rcx, qword [rcx + 0x18]
mov qword [rcx + 0x10], rax
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x10], 0
add rax, 0x10
mov qword [rax + 8], 0
mov rcx, qword [rdx + 0x60]
mov rcx, qword [rcx + 0x18]
mov r8, qword [rcx + 0x20]
mov qword [rax], r8
mov rcx, qword [rdx + 0x60]
mov rcx, qword [rcx + 0x18]
add rcx, 0x20
mov qword [rax + 8], rcx
mov qword [r8 + 8], rax
mov rdx, qword [rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov qword [rdx + 0x20], rax
xor ecx, ecx
mov rdx, qword [rsp + 0x38]
call qword [sym.imp.ntdll.dll_LdrUnlockLoaderLock]
test byte [0x140003020], 8
jne 0x140001c68
movabs rax, 0x400000030
mov rcx, qword [0x140007010]
mov rdx, r13
mov qword [rsp + 0x48], 5
mov qword [rsp + 0x40], rax
mov rbx, qword [sym.imp.advapi32.dll_SetServiceStatus]
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
call rbx
mov rcx, qword [section..bss]
call sym.wine_ntoskrnl_main_loop
test byte [0x140003020], 8
jne 0x140001b20
movabs rax, 0x100000030
mov rcx, qword [0x140007010]
mov rdx, r13
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
call rbx
mov rcx, qword [0x140007008]
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rcx, qword [section..bss]
call qword [sym.imp.kernel32.dll_CloseHandle]
nop
add rsp, 0x388
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rdx]
jmp 0x140001710
mov byte [rdx], 0x22
test eax, eax
jle 0x140002083
mov ecx, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], cx
mov byte [rax], 0
mov rcx, r13
call dbg.__wine_dbg_strdup
mov qword [rsp + 0x20], rax
lea r9, str.Failed_to_load__s_n
mov rdx, r14
mov ecx, 1
lea r8, [0x140004248]
call sym.wine_dbg_log.constprop.0
jmp 0x1400017df
lea rax, str._null_
test rsi, rsi
je 0x140001c39
mov rax, rsi
shr rax, 0x10
je 0x140001fd8
mov rdx, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x140001c39
cmp word [rsi], 0
je 0x140002050
xor eax, eax
nop dword [rax]
mov ecx, eax
add rax, 1
cmp word [rsi + rax*2], 0
jne 0x140001b70
mov r10d, 0x224c
lea rdx, [rsp + 0x42]
lea r9, str.0123456789abcdefdevice_handler
mov word [rsp + 0x40], r10w
lea r8, [rsp + 0x162]
jmp 0x140001bd6
cmp ax, 9
je 0x140001df8
cmp ax, 0xa
jne 0x140001e80
mov r15d, 0x6e5c
add rdx, 2
mov word [rdx - 2], r15w
nop dword [rax + rax]
lea eax, [rcx - 1]
test ecx, ecx
jle 0x140001c10
cmp rdx, r8
ja 0x140001c10
mov ecx, eax
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xd
je 0x140001db0
jbe 0x140001ba0
cmp ax, 0x22
je 0x140001ee0
cmp ax, 0x5c
jne 0x140001e71
mov edi, 0x5c5c
add rdx, 2
mov word [rdx - 2], di
jmp 0x140001bc8
mov byte [rdx], 0x22
test eax, eax
jle 0x140002066
mov r11d, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], r11w
mov byte [rax], 0
mov rcx, r13
call dbg.__wine_dbg_strdup
mov qword [rsp + 0x20], rax
lea r9, str.service_group__s_stopped_n
lea r8, [0x140004248]
mov ecx, 3
lea rdx, [0x140003020]
call sym.wine_dbg_log.constprop.0
jmp 0x140001a61
lea rax, str._null_
test rsi, rsi
je 0x140001d87
mov rax, rsi
shr rax, 0x10
je 0x140001fc0
mov rdx, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov r8d, eax
lea rax, str._invalid_
test r8d, r8d
jne 0x140001d87
cmp word [rsi], 0
je 0x140002033
xor eax, eax
nop dword [rax]
mov ecx, eax
add rax, 1
cmp word [rsi + rax*2], 0
jne 0x140001cb8
mov r8d, 0x224c
mov r9, rsi
lea rdx, [rsp + 0x42]
mov word [rsp + 0x40], r8w
lea r10, str.0123456789abcdefdevice_handler
lea r8, [rsp + 0x162]
jmp 0x140001d26
cmp ax, 9
je 0x140001de0
cmp ax, 0xa
jne 0x140001e1b
mov r12d, 0x6e5c
add rdx, 2
mov word [rdx - 2], r12w
nop dword [rax + rax]
lea eax, [rcx - 1]
cmp rdx, r8
ja 0x140001d60
test ecx, ecx
jle 0x140001d60
mov ecx, eax
movzx eax, word [r9]
add r9, 2
cmp ax, 0xd
je 0x140001dc8
jbe 0x140001cf0
cmp ax, 0x22
je 0x140001ef8
cmp ax, 0x5c
jne 0x140001e0c
mov r11d, 0x5c5c
add rdx, 2
mov word [rdx - 2], r11w
jmp 0x140001d18
mov byte [rdx], 0x22
test eax, eax
jle 0x140002047
mov ecx, 0x2e2e
mov byte [rdx + 3], 0x2e
lea rax, [rdx + 4]
mov word [rdx + 1], cx
mov byte [rax], 0
mov rcx, r13
call dbg.__wine_dbg_strdup
mov qword [rsp + 0x20], rax
lea r9, str.starting_service_group__s_n
lea r8, [0x140004248]
mov ecx, 3
lea rdx, [0x140003020]
call sym.wine_dbg_log.constprop.0
jmp 0x140001a0c
mov r14d, 0x725c
add rdx, 2
mov word [rdx - 2], r14w
jmp 0x140001bc8
mov ebp, 0x725c
add rdx, 2
mov word [rdx - 2], bp
jmp 0x140001d18
mov edi, 0x745c
add rdx, 2
mov word [rdx - 2], di
jmp 0x140001d18
mov r12d, 0x745c
add rdx, 2
mov word [rdx - 2], r12w
jmp 0x140001bc8
lea r11d, [rax - 0x20]
cmp r11w, 0x5e
jbe 0x140002018
mov r11d, eax
mov byte [rdx], 0x5c
add rdx, 5
shr r11w, 0xc
and r11d, 0xf
movzx r11d, byte [r10 + r11]
mov byte [rdx - 4], r11b
mov r11d, eax
shr r11w, 8
and r11d, 0xf
movzx r11d, byte [r10 + r11]
mov byte [rdx - 3], r11b
mov r11d, eax
and eax, 0xf
shr r11w, 4
movzx eax, byte [r10 + rax]
and r11d, 0xf
movzx r11d, byte [r10 + r11]
mov byte [rdx - 1], al
mov byte [rdx - 2], r11b
jmp 0x140001d18
lea r10d, [rax - 0x20]
cmp r10w, 0x5e
jbe 0x140002008
mov r10d, eax
mov byte [rdx], 0x5c
add rdx, 5
shr r10w, 0xc
and r10d, 0xf
movzx r10d, byte [r9 + r10]
mov byte [rdx - 4], r10b
mov r10d, eax
shr r10w, 8
and r10d, 0xf
movzx r10d, byte [r9 + r10]
mov byte [rdx - 3], r10b
mov r10d, eax
and eax, 0xf
shr r10w, 4
movzx eax, byte [r9 + rax]
and r10d, 0xf
movzx r10d, byte [r9 + r10]
mov byte [rdx - 1], al
mov byte [rdx - 2], r10b
jmp 0x140001bc8
mov ebp, 0x225c
add rdx, 2
mov word [rdx - 2], bp
jmp 0x140001bc8
mov ebx, 0x225c
add rdx, 2
mov word [rdx - 2], bx
jmp 0x140001d18
mov r11d, 0x745c
add rdx, 2
mov word [rdx - 2], r11w
jmp 0x1400018a8
lea r9d, [rax - 0x20]
cmp r9w, 0x5e
jbe 0x140002028
mov r9d, eax
mov byte [rdx], 0x5c
add rdx, 5
shr r9w, 0xc
and r9d, 0xf
movzx r9d, byte [r15 + r9]
mov byte [rdx - 4], r9b
mov r9d, eax
shr r9w, 8
and r9d, 0xf
movzx r9d, byte [r15 + r9]
mov byte [rdx - 3], r9b
mov r9d, eax
and eax, 0xf
shr r9w, 4
movzx eax, byte [r15 + rax]
and r9d, 0xf
movzx r9d, byte [r15 + r9]
mov byte [rdx - 1], al
mov byte [rdx - 2], r9b
jmp 0x1400018a8
mov r10d, 0x225c
add rdx, 2
mov word [rdx - 2], r10w
jmp 0x1400018a8
mov eax, 0x725c
add rdx, 2
mov word [rdx - 2], ax
jmp 0x1400018a8
movzx edx, si
lea rcx, str._04x
call sym.wine_dbg_sprintf.constprop.0
jmp 0x140001d87
movzx edx, si
lea rcx, str._04x
call sym.wine_dbg_sprintf.constprop.0
jmp 0x140001c39
movzx edx, di
lea rcx, str._04x
call sym.wine_dbg_sprintf.constprop.0
jmp 0x140001af7
mov byte [rdx], al
add rdx, 1
jmp 0x140001bc8
mov byte [rdx], al
add rdx, 1
jmp 0x140001d18
mov byte [rdx], al
add rdx, 1
jmp 0x1400018a8
mov ecx, 0x224c
mov byte [rsp + 0x42], 0x22
lea rdx, [rsp + 0x42]
mov word [rsp + 0x40], cx
lea rax, [rdx + 1]
jmp 0x140001d7c
mov r9d, 0x224c
mov byte [rsp + 0x42], 0x22
lea rdx, [rsp + 0x42]
mov word [rsp + 0x40], r9w
lea rax, [rdx + 1]
jmp 0x140001c2e
mov byte [rsp + 0x42], 0x22
mov edx, 0x224c
mov word [rsp + 0x40], dx
lea rdx, [rsp + 0x42]
lea rax, [rdx + 1]
jmp 0x140001aec