Function at 0x14002b830
Capabilities:
Check http status code
Enumerate processes
Query service status

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x540
mov rax, qword [0x140241cc0]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov r13, rcx
mov qword [rsp + 0x48], rcx
xor ebx, ebx
mov byte [rsp + 0x41], bl
mov byte [rsp + 0x40], bl
mov byte [rsp + 0x42], bl
mov byte [rsp + 0x43], bl
mov rdx, qword [0x14024d2d8]
movsd xmm0, qword [rdx + 0x1f8]
movsd qword [rsp + 0x180], xmm0
mov r8d, dword [rdx + 0x200]
movsd qword [rsp + 0x180], xmm0
mov dword [r11 - 0x3e0], r8d
mov rcx, qword [r11 - 0x3e8]
shr rcx, 0x20
mov eax, dword [rdx + 0x1f8]
lea rdx, str.running:_.__avb:_
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x1d8], reloc.WS2_32.dll_socket
mov dword [rsp + 0x150], eax
movabs rax, 0x1000000000000000
mov qword [r11 - 0x430], rax
mov dword [rsp + 0x154], ecx
movabs rax, 0x1000000000000004
mov qword [r11 - 0x428], rax
mov dword [r11 - 0x410], r8d
movabs rax, 0x1000000000000008
mov qword [r11 - 0x420], rax
mov qword [rsp + 0x180], 3
lea rax, [r11 - 0x430]
mov qword [rsp + 0x188], rax
movaps xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0xa0], xmm1
lea r8, [rsp + 0x50]
lea rdx, [r11 - 0x4c8]
lea rcx, [r11 - 0x4b8]
call fcn.140023580
nop
lea rdx, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 7
cmova rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xc0]
lea rcx, [r13 + 8]
call fcn.140023930
lea edx, [rbx + 0x3b]
lea rcx, [r13 + 8]
call fcn.140015d50
mov r12d, 0xfa
cmp qword [r13 + 0x18], r12
jbe 0x14002b9ff
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, r12d
cmovb r8, qword [r13 + 0x18]
lea rdx, [r13 + 8]
cmp qword [r13 + 0x20], 7
jbe 0x14002b9dc
mov rdx, qword [r13 + 8]
lea rcx, [rsp + 0x60]
call fcn.140025740
lea rdx, [rsp + 0x60]
lea rcx, [r13 + 8]
call fcn.14002a100
lea rcx, [rsp + 0x60]
call fcn.140025f00
nop
lea rcx, [rsp + 0xb0]
call fcn.140025f00
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
mov qword [rsp + 0x1e8], rax
test rax, rax
je 0x14002c09b
mov rdx, qword [0x14024d2d8]
add rdx, 0x48
lea rcx, [rsp + 0x4e0]
call fcn.140025a50
mov byte [rsp + 0x500], 1
mov rdx, qword [0x14024d2d8]
add rdx, 0x28
lea rcx, [rsp + 0x508]
call fcn.140025a50
mov byte [rsp + 0x528], 0
lea rdi, [rsp + 0x4e0]
lea rcx, [rsp + 0x530]
mov qword [rsp + 0x130], rdi
cmp rdi, rcx
je 0x14002c07c
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14002ba9c
mov rdx, qword [rdi]
mov r8d, 4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rsp + 0x1e0], rax
test rax, rax
je 0x14002c071
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x14002c071
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x138], xmm0
movups xmmword [rsp + 0x148], xmm0
mov dword [rsp + 0x158], eax
mov dword [rsp + 0x168], ebx
lea rax, [rsp + 0x168]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x138]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14002c071
cmp dword [rsp + 0x13c], 4
jne 0x14002bf86
mov r8d, dword [rsp + 0x154]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x1d0], rax
test rax, rax
je 0x14002bd92
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x190], 0
mov qword [rsp + 0x198], 0
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x198]
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x14002bd98
mov ebx, dword [rsp + 0x174]
shl rbx, 0x20
mov eax, dword [rsp + 0x170]
or rbx, rax
call fcn.140142df8
mov rcx, rax
movabs rax, 0x19db1ded53e8000
add rcx, rax
sub rcx, rbx
mov rax, qword [rsp + 0x130]
cmp byte [rax + 0x20], 0
je 0x14002bc35
movabs rax, 0xfffffa7fd71bc000
add rax, rcx
cmp rax, 0x989680
jae 0x14002bc12
xor al, al
jmp 0x14002bc2c
mov eax, 0xff
movabs rdx, 0x58028e44000
cmp rcx, rdx
mov edx, 1
cmovge eax, edx
test al, al
setg al
or byte [rsp + 0x41], al
movabs rax, 0x1ca213d840baf7d5
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, str.Service_uptime:_m
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], reloc.WS2_32.dll_send
mov dword [rsp + 0xf8], edx
movabs rax, 0x1000000000000000
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], 1
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x180], xmm0
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x1a0], xmm1
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x80]
call fcn.140023580
nop
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
lea rcx, [r13 + 8]
call fcn.140023930
mov edx, 0x3b
lea rcx, [r13 + 8]
call fcn.140015d50
cmp qword [r13 + 0x18], r12
jbe 0x14002bd83
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
xor eax, eax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov r8, r12
cmp qword [r13 + 0x18], r12
cmovb r8, qword [r13 + 0x18]
lea rdx, [r13 + 8]
cmp qword [r13 + 0x20], 7
jbe 0x14002bd57
mov rdx, qword [r13 + 8]
lea rcx, [rsp + 0xb0]
call fcn.140025740
lea rdx, [rsp + 0xb0]
lea rcx, [r13 + 8]
call fcn.14002a100
lea rcx, [rsp + 0xb0]
call fcn.140025f00
nop
lea rcx, [rsp + 0x80]
call fcn.140025f00
jmp 0x14002bd98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a0], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x180], rax
test rax, rax
je 0x14002bf48
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14002bf48
nop dword [rax + rax]
mov eax, dword [rsp + 0x2a8]
cmp dword [rsp + 0x154], eax
jne 0x14002bf2f
mov ecx, dword [rsp + 0x2bc]
cmp ecx, 0x190
seta al
or byte [rsp + 0x40], al
lea rax, str.threadcount:_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov dword [rsp + 0xd8], ecx
movabs rax, 0x2000000000000000
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xa0], 1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x1a0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xb0], xmm1
lea r8, [rsp + 0x1a0]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.140023580
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [r13 + 8]
call fcn.140023930
mov edx, 0x3b
lea rcx, [r13 + 8]
call fcn.140015d50
cmp qword [r13 + 0x18], r12
jbe 0x14002bf23
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov r8, r12
cmp qword [r13 + 0x18], r12
cmovb r8, qword [r13 + 0x18]
lea rdx, [r13 + 8]
cmp qword [r13 + 0x20], 7
jbe 0x14002bef7
mov rdx, qword [r13 + 8]
lea rcx, [rsp + 0x80]
call fcn.140025740
lea rdx, [rsp + 0x80]
lea rcx, [r13 + 8]
call fcn.14002a100
lea rcx, [rsp + 0x80]
call fcn.140025f00
nop
lea rcx, [rsp + 0x60]
call fcn.140025f00
jmp 0x14002bf48
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14002bde0
test rbx, rbx
je 0x14002bf57
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test rdi, rdi
je 0x14002bf65
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x130]
xor ebx, ebx
test rsi, rsi
je 0x14002bf7d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add rdi, 0x28
jmp 0x14002ba76
mov rcx, qword [rdi + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0xb
jb 0x14002c698
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14002bfae
mov r9, qword [rdi]
mov qword [rsp + 0x30], recvfrom
lea rax, str._uptime:_NR
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x80]
call fcn.140015aa0
nop
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rdx, qword [rsp + 0x80]
lea rcx, [r13 + 8]
mov r8, qword [rsp + 0x90]
call fcn.140023930
mov edx, 0x3b
lea rcx, [r13 + 8]
call fcn.140015d50
cmp qword [r13 + 0x18], r12
jbe 0x14002c064
lea rdx, [r13 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov r8, r12
cmp qword [rdx + 0x10], r12
cmovb r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14002c041
mov rdx, qword [rdx]
lea rcx, [rsp + 0x60]
call fcn.140025740
lea rcx, [r13 + 8]
lea rdx, [rsp + 0x60]
call fcn.14002a100
lea rcx, [rsp + 0x60]
call fcn.140025f00
nop
lea rcx, [rsp + 0x80]
call fcn.140025f00
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002bf6f
lea r9, [0x14002c700]
mov edx, 0x28
lea r8d, [rdx - 0x26]
lea rcx, [rsp + 0x4e0]
call fcn.140144600
jmp 0x14002c0a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test r14, r14
je 0x14002c0b1
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
jmp 0x14002c0be
mov r14d, 1
mov rcx, qword [0x14024d2d8]
call fcn.14004a6f0
mov esi, eax
mov rbx, qword [0x14024d2d8]
mov rcx, qword [rbx + 0x228]
mov qword [rsp + 0x198], rcx
mov rbx, qword [rbx + 0x240]
mov qword [rsp + 0x190], rbx
test rcx, rcx
je 0x14002c69e
test rbx, rbx
je 0x14002c69e
sub rbx, rcx
lea rax, str.vps:__s
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 9
mov qword [rsp + 0x58], rbx
movabs rax, 0x3000000000000000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xa0], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0xb0], xmm0
movaps xmm1, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x1a0], xmm1
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x60]
call fcn.140023580
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [r13 + 8]
call fcn.140023930
lea edx, [r14 + 0x3a]
lea rcx, [r13 + 8]
call fcn.140015d50
cmp qword [r13 + 0x18], r12
jbe 0x14002c21c
lea rdx, [r13 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
mov r8, r12
cmp qword [rdx + 0x10], r12
cmovb r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14002c1f0
mov rdx, qword [rdx]
lea rcx, [rsp + 0x80]
call fcn.140025740
lea rcx, [r13 + 8]
lea rdx, [rsp + 0x80]
call fcn.14002a100
lea rcx, [rsp + 0x80]
call fcn.140025f00
nop
lea rcx, [rsp + 0x60]
call fcn.140025f00
test esi, esi
jne 0x14002c240
cmp rbx, 0x93a80
je 0x14002c240
movzx eax, byte [rsp + 0x42]
cmovge eax, r14d
mov byte [rsp + 0x42], al
jmp 0x14002c258
movabs r15, 0x1ca213d840baf7d5
movabs rsi, 0x58028e44000
lea rax, str.properties_settingsCommon
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x1a
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xb0], xmm0
mov rdx, qword [0x14024d2d8]
add rdx, 0x138
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x1a0]
call fcn.140031d70
nop
mov qword [rsp + 0x130], 0
lea rdx, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 7
cmova rdx, qword [rsp + 0x1a0]
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
call fcn.1400a0540
test al, al
jne 0x14002c321
lea rdx, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 7
cmova rdx, qword [rsp + 0x1a0]
mov dword [rsp + 0x20], 0x200
lea r9, [rsp + 0x130]
call fcn.1400a0540
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x14002c492
imul rbx, rcx, 0x989680
lea rcx, [rsp + 0x1a0]
call fcn.140025f00
call fcn.140142df8
mov rdi, rax
sub rdi, rbx
mov rax, r15
imul rdi
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, str.hb:__m
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 8
mov dword [rsp + 0x58], edx
movabs rax, 0x1000000000000000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xa0], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0xb0], xmm0
movaps xmm1, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x1a0], xmm1
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x60]
call fcn.140023580
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [r13 + 8]
call fcn.140023930
mov edx, 0x3b
lea rcx, [r13 + 8]
call fcn.140015d50
cmp qword [r13 + 0x18], r12
jbe 0x14002c475
lea rdx, [r13 + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
mov r8, r12
cmp qword [rdx + 0x10], r12
cmovb r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14002c449
mov rdx, qword [rdx]
lea rcx, [rsp + 0x80]
call fcn.140025740
lea rcx, [r13 + 8]
lea rdx, [rsp + 0x80]
call fcn.14002a100
lea rcx, [rsp + 0x80]
call fcn.140025f00
nop
lea rcx, [rsp + 0x60]
call fcn.140025f00
cmp rdi, rsi
je 0x14002c4a0
jl 0x14002c4a0
mov byte [rsp + 0x43], 1
jmp 0x14002c4a0
lea rcx, [rsp + 0x1a0]
call fcn.140025f00
nop
jmp 0x14002c4ad
cmp byte [rsp + 0x40], 0
jne 0x14002c4d0
cmp byte [rsp + 0x41], 0
je 0x14002c4c9
cmp byte [rsp + 0x42], 0
jne 0x14002c4d0
cmp byte [rsp + 0x43], 0
jne 0x14002c4d0
xor dil, dil
jmp 0x14002c4d3
mov dil, 1
lea rax, str.final:___thread:___svc:__vps:__hb_sent:
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], gethostname
mov byte [rsp + 0x160], dil
movabs rax, 0x5000000000000000
mov qword [rsp + 0x138], rax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x161], al
movabs rax, 0x5000000000000001
mov qword [rsp + 0x140], rax
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x162], al
movabs rax, 0x5000000000000002
mov qword [rsp + 0x148], rax
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x163], al
movabs rax, 0x5000000000000003
mov qword [rsp + 0x150], rax
movzx eax, byte [rsp + 0x43]
mov byte [rsp + 0x164], al
movabs rax, 0x5000000000000004
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x50], 5
lea rax, [rsp + 0x138]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xb0], xmm0
movaps xmm1, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x1a0], xmm1
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x60]
call fcn.140023580
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [r13 + 8]
call fcn.140023930
mov edx, 0x3b
lea rcx, [r13 + 8]
call fcn.140015d50
cmp qword [r13 + 0x18], r12
jbe 0x14002c65d
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x90], xmm1
cmovb r12, qword [r13 + 0x18]
lea rdx, [r13 + 8]
cmp qword [r13 + 0x20], 7
jbe 0x14002c62e
mov rdx, qword [r13 + 8]
mov r8, r12
lea rcx, [rsp + 0x80]
call fcn.140025740
lea rdx, [rsp + 0x80]
lea rcx, [r13 + 8]
call fcn.14002a100
lea rcx, [rsp + 0x80]
call fcn.140025f00
nop
lea rcx, [rsp + 0x60]
call fcn.140025f00
movzx eax, dil
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140144310
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140025b80
nop
lea rax, str.Unable_to_get_information_about_VPS_release_time__installed:___latest:_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x4b
lea r9, [rsp + 0x190]
lea r8, [rsp + 0x198]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.14002e590
nop
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.14002efa0
lea rdx, [0x14023da00]
lea rcx, [rsp + 0x110]
call fcn.14015a550
int3