Function at 0x14008de60
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1401740a0]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov rsi, rdx
mov dword [rdx], 1
mov r8d, 1
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14008e159
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rbp - 0x70], 0x80728045
mov dword [rbp - 0x6c], 0x806f8072
mov dword [rbp - 0x68], 0x802c8072
mov dword [rbp - 0x64], 0x80638020
mov dword [rbp - 0x60], 0x806c8061
mov dword [rbp - 0x5c], 0x8069806c
mov dword [rbp - 0x58], 0x8067806e
mov dword [rbp - 0x54], 0x804f8020
mov dword [rbp - 0x50], 0x80658070
mov dword [rbp - 0x4c], 0x8053806e
mov dword [rbp - 0x48], 0x804d8043
mov dword [rbp - 0x44], 0x806e8061
mov dword [rbp - 0x40], 0x80678061
mov dword [rbp - 0x3c], 0x80728065
mov dword [rbp - 0x38], 0x803a8057
mov dword [rbp - 0x34], 0x807b8020
mov dword [rbp - 0x30], 0x8000807d
xor r14d, r14d
mov word [rbp - 0x2c], r14w
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.14001a400
nop
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
mov dword [rsp + 0x60], ebx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x40], 2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x40], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14008dfa0
mov qword [rsp + 0x48], rax
lea r8, [rbp]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140022420
nop
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea r12, [rbp + 0x10]
mov r13, qword [rbp + 0x28]
cmp r13, 8
setae byte [rsp + 0x30]
mov r15, qword [rbp + 0x10]
cmovae r12, r15
mov rbx, qword [rbp + 0x20]
cmp rbx, 8
jae 0x14008e00b
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], 7
mov esi, 7
jmp 0x14008e04d
mov rsi, rbx
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
cmova rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x70]
call fcn.140043b70
mov qword [rsp + 0x70], rax
lea r8, [rbx*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400f8070
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], rbx
lea rbx, [rsp + 0x70]
cmp rsi, 8
cmovae rbx, qword [rsp + 0x70]
call fcn.14003cbe0
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._BDREINIT__::_GetServiceState____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.14003f620
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14008e0c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e0bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6e1
call fcn.1400f5c2c
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
cmp byte [rsp + 0x30], 0
je 0x14008e111
lea rdx, [r13*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x14008e108
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6e7
mov rcx, r15
call fcn.1400f5c2c
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14008e151
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e14c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6ed
call fcn.1400f5c2c
xor sil, sil
jmp 0x14008e696
mov r8d, 4
lea r14, str.wersvc
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
setne byte [rsp + 0x31]
test rax, rax
jne 0x14008e3ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdx, [rbp + 0x30]
call fcn.14008e710
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x14008e1a9
mov rcx, qword [rax]
mov dword [rbp], esi
mov qword [rsp + 0x60], r14
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x20], xmm1
mov qword [rsp + 0x60], 0xc2
lea rax, [rbp + 0x10]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x60], rcx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14008e1f0
mov qword [rsp + 0x68], rax
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.140022420
nop
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea r12, [rbp - 0x20]
cmp qword [rbp - 8], 8
setae byte [rsp + 0x30]
mov r13, qword [rbp - 0x20]
cmovae r12, r13
mov rsi, qword [rbp - 0x10]
cmp rsi, 8
jae 0x14008e25a
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], 7
lea r15d, [r14 + 7]
jmp 0x14008e29c
mov r15, rsi
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rsp + 0x70]
call fcn.140043b70
mov qword [rsp + 0x70], rax
lea r8, [rsi*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400f8070
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x80], rsi
lea rsi, [rsp + 0x70]
cmp r15, 8
cmovae rsi, qword [rsp + 0x70]
call fcn.14003cbe0
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str._BDREINIT__::_GetServiceState____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.14003f620
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14008e311
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e30c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6f3
call fcn.1400f5c2c
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
cmp byte [rsp + 0x30], 0
je 0x14008e364
mov rdx, qword [rbp - 8]
lea rdx, [rdx*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14008e35b
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6f9
mov rcx, r13
call fcn.1400f5c2c
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14008e678
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6db
jmp 0x14008e673
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x70], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14008e67d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [rbp - 0x70], 0x80728045
mov dword [rbp - 0x6c], 0x806f8072
mov dword [rbp - 0x68], 0x802c8072
mov dword [rbp - 0x64], 0x80638020
mov dword [rbp - 0x60], 0x806c8061
mov dword [rbp - 0x5c], 0x8069806c
mov dword [rbp - 0x58], 0x8067806e
mov dword [rbp - 0x54], 0x80518020
mov dword [rbp - 0x50], 0x80658075
mov dword [rbp - 0x4c], 0x80798072
mov dword [rbp - 0x48], 0x80658053
mov dword [rbp - 0x44], 0x80768072
mov dword [rbp - 0x40], 0x80638069
mov dword [rbp - 0x3c], 0x80538065
mov dword [rbp - 0x38], 0x80618074
mov dword [rbp - 0x34], 0x80758074
mov dword [rbp - 0x30], 0x803a8073
mov dword [rbp - 0x2c], 0x807b8020
mov dword [rbp - 0x28], 0x8000807d
xor r14d, r14d
mov word [rbp - 0x24], r14w
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x10]
call fcn.14001a400
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
mov dword [rbp], esi
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
mov qword [rsp + 0x60], 2
lea rax, [rbp]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14008e4d0
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.140022420
nop
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r14
lea r12, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
setae byte [rsp + 0x30]
mov r13, qword [rbp + 0x30]
cmovae r12, r13
mov rsi, qword [rbp + 0x40]
cmp rsi, 8
jae 0x14008e538
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], 7
mov r15d, 7
jmp 0x14008e578
mov r15, rsi
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rbp - 0x20]
call fcn.140043b70
mov qword [rbp - 0x20], rax
lea r8, [rsi*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400f8070
mov qword [rbp - 8], r15
mov qword [rbp - 0x10], rsi
lea rsi, [rbp - 0x20]
cmp r15, 8
cmovae rsi, qword [rbp - 0x20]
call fcn.14003cbe0
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str._BDREINIT__::_GetServiceState____
lea edx, [r9 + 8]
mov rcx, rax
call fcn.14003f620
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14008e5ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e5e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6ff
call fcn.1400f5c2c
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
cmp byte [rsp + 0x30], 0
je 0x14008e63c
mov rdx, qword [rbp + 0x48]
lea rdx, [rdx*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14008e633
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e705
mov rcx, r13
call fcn.1400f5c2c
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14008e678
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008e6d5
call fcn.1400f5c2c
xor sil, sil
jmp 0x14008e685
mov eax, dword [rbp + 0x54]
mov dword [rsi], eax
mov sil, 1
cmp byte [rsp + 0x31], 0
je 0x14008e696
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rdi, rdi
je 0x14008e6a4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, sil
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.1400f5be0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400fcb20
nop
call fcn.1400fcb20
nop
call fcn.1400fcb20
nop
call fcn.1400fcb20
nop
call fcn.1400fcb20
nop
call fcn.1400fcb20
nop
call fcn.1400fcb20
nop
call fcn.1400fcb20
nop
call fcn.1400fcb20
int3