Function at 0x14011f0a0
Capabilities:
Query service status

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14028c238]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r14, rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov byte [rdx], r15b
mov esi, 1
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
lea r8d, [r15 + 8]
lea rdx, str.wuauserv
lea rcx, [rsp + 0x48]
call fcn.1400c3720
nop
mov dword [rsp + 0x30], esi
mov dword [rbp + 0x30], 0x114
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x40], 2
je 0x14011f13f
lea edi, [rsi - 0xc]
jmp 0x14011f1eb
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14011f1e6
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14011f1c1
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rdi
test eax, eax
jne 0x14011f1a6
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14011f1e6
mov esi, dword [rbp - 0x6c]
mov dword [rsp + 0x38], esi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, r15d
jmp 0x14011f1d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, 0xffffffe5
mov dword [rsp + 0x30], edi
test edi, edi
js 0x14011f1ef
cmp esi, 4
jne 0x14011f1ef
mov bl, 1
jmp 0x14011f1f1
mov edi, 0xffffffe5
mov dword [rsp + 0x30], edi
xor bl, bl
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14011f20e
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400c3a10
test bl, bl
je 0x14011f21b
mov byte [r14], 1
jmp 0x14011f705
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.1400cb660
mov rbx, rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400cb660
nop
mov r8, rax
lea rdx, str._WUA__GetAgentState__CServiceUtils::GetServiceState_finished_with_rc_
lea rcx, [rbp - 0x30]
call fcn.1400cb580
nop
lea r8, str.__and_service_state_
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400cb5f0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400cb390
mov rsi, rax
call fcn.1400e04b0
mov rbx, rax
lea r12, [0x14029af20]
mov qword [rbp - 0x70], r12
mov rcx, r12
call fcn.14016ffac
test eax, eax
je 0x14011f29d
mov ecx, eax
call fcn.14016fae4
mov byte [rbp - 0x68], 1
cmp qword [rbx + 0x48], 0
je 0x14011f2de
mov dword [rsp + 0x38], 1
mov rdi, qword [rbx + 0x48]
test rdi, rdi
jne 0x14011f2bf
call fcn.14016f984
int3
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140005fb0]
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call rbx
jmp 0x14011f2ea
mov rdx, rsi
mov rcx, rbx
call fcn.1400dba60
nop
mov rcx, r12
call fcn.14016ffd0
test eax, eax
je 0x14011f2fe
mov ecx, eax
call fcn.14016fae4
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14011f31b
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400c3a10
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x14011f349
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.1400c3a10
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r15
mov word [rbp - 0x50], r15w
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x14011f374
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.1400c3a10
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
mov r8, qword [rbp + 8]
cmp r8, 8
jb 0x14011f39f
inc r8
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1400c3a10
mov qword [rbp + 8], 7
mov qword [rbp], r15
mov word [rbp - 0x10], r15w
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x14011f3cc
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.1400c3a10
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r15
mov word [rbp + 0x10], r15w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r15
mov word [rsp + 0x48], r15w
mov r8d, 5
lea rdx, [0x14023bab0]
lea rcx, [rsp + 0x48]
call fcn.1400c3720
nop
mov dword [rsp + 0x30], 2
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r15
mov word [rbp - 0x70], r15w
mov r8d, 0x2a
lea rdx, str.SYSTEMCurrentControlSetServiceswuauserv
lea rcx, [rbp - 0x70]
call fcn.1400c3720
nop
mov dword [rsp + 0x30], 6
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r15
mov word [rsp + 0x70], r15w
mov qword [rsp + 0x68], r15
mov byte [rsp + 0x20], 0
mov r9d, 9
lea r8, [rbp - 0x70]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x68]
call fcn.140145c20
test eax, eax
js 0x14011f4f8
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.140145f40
test eax, eax
js 0x14011f4f8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14011f4a8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r15
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x14011f4c4
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.1400c3a10
mov edi, r15d
mov dword [rsp + 0x30], r15d
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
mov r9d, 1
lea r8, [0x14023bc88]
mov rdx, qword [rbp + 0x20]
call fcn.1400ca4f0
test eax, eax
je 0x14011f530
mov bl, 1
jmp 0x14011f532
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14011f50d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r15
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x14011f529
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.1400c3a10
or edi, 0xffffffff
mov dword [rsp + 0x30], edi
xor bl, bl
mov r8, qword [rbp - 0x58]
cmp r8, 8
jb 0x14011f54c
inc r8
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.1400c3a10
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r15
mov word [rbp - 0x70], r15w
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14011f57a
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400c3a10
test bl, bl
je 0x14011f582
mov byte [r14], 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400cb660
nop
mov r8, rax
lea rdx, str._WUA__GetAgentState__COesisRegKey::RegUtil_ReadStringFromRegistry_finished_with_rc_
lea rcx, [rbp - 0x50]
call fcn.1400cb580
nop
lea r8, str.__and_service_start_type_
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400cb5f0
nop
lea r8, [rbp + 0x10]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1401027e0
mov r14, rax
call fcn.1400e04b0
mov rbx, rax
mov qword [rbp - 0x70], r12
mov rcx, r12
call fcn.14016ffac
test eax, eax
je 0x14011f5ec
mov ecx, eax
call fcn.14016fae4
mov byte [rbp - 0x68], 1
cmp qword [rbx + 0x48], 0
je 0x14011f62d
mov dword [rsp + 0x38], 1
mov rsi, qword [rbx + 0x48]
test rsi, rsi
jne 0x14011f60e
call fcn.14016f984
int3
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140005fb0]
lea r8, [rsp + 0x38]
mov rdx, r14
mov rcx, rsi
call rbx
jmp 0x14011f639
mov rdx, r14
mov rcx, rbx
call fcn.1400dba60
nop
mov rcx, r12
call fcn.14016ffd0
test eax, eax
je 0x14011f64d
mov ecx, eax
call fcn.14016fae4
nop
mov r8, qword [rbp + 8]
cmp r8, 8
jb 0x14011f667
inc r8
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1400c3a10
mov qword [rbp + 8], 7
mov qword [rbp], r15
mov word [rbp - 0x10], r15w
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x14011f692
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.1400c3a10
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov word [rbp - 0x30], r15w
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x14011f6bd
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.1400c3a10
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r15
mov word [rbp - 0x50], r15w
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x14011f6eb
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.1400c3a10
nop
mov r8, qword [rbp + 0x28]
cmp r8, 8
jb 0x14011f705
inc r8
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x10]
call fcn.1400c3a10
mov eax, edi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14016e480
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret