Function at 0x14007f5f8
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x1400e5470]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_OpenSCManagerA]
xor r13d, r13d
mov r14, rax
test rax, rax
jne 0x14007f695
cmp dword [0x1400e3100], 5
jbe 0x14007f68e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x49], eax
lea rax, [rbp - 0x49]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400c7adb]
xor r8d, r8d
mov dword [rsp + 0x20], 3
lea rcx, [0x1400e3100]
call fcn.140001118
xor al, al
jmp 0x14007f8b5
mov r15d, r13d
lea rsi, str._b_v_
mov ebx, 4
mov rdx, qword [rsi]
mov r8d, ebx
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14007f70c
cmp dword [0x1400e3100], 5
jbe 0x14007f899
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x49], eax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rbx
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400c7a7e]
xor r8d, r8d
mov dword [rsp + 0x20], 3
lea rcx, [0x1400e3100]
call fcn.140001118
jmp 0x14007f899
xor edx, edx
lea rcx, [rbp + 7]
lea r8d, [rdx + 0x24]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbp - 0x3d]
mov r9d, 0x24
lea r8, [rbp + 7]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x14007f848
mov ecx, dword [rbp + 0x23]
call fcn.14007f8e4
test al, al
jne 0x14007f7cc
cmp dword [0x1400e3100], 5
jbe 0x14007f890
mov eax, dword [rbp + 0x23]
lea rdx, [0x1400b040c]
mov rcx, qword [rsi]
mov dword [rbp - 0x45], eax
lea rax, [rbp - 0x45]
mov qword [rbp - 0x19], rax
mov rax, r13
mov qword [rbp - 0x11], rbx
test rcx, rcx
je 0x14007f78f
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14007f785
lea eax, [rax*2 + 2]
mov qword [rbp - 9], rdx
mov dword [rbp - 1], eax
mov dword [rbp + 3], r13d
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400c7b63]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea rcx, [0x1400e3100]
call fcn.140001118
jmp 0x14007f890
cmp dword [0x1400e3100], 5
jbe 0x14007f890
mov eax, dword [rbp + 0x23]
lea rdx, [0x1400b040c]
mov rcx, qword [rsi]
mov dword [rbp - 0x45], eax
lea rax, [rbp - 0x45]
mov qword [rbp - 0x19], rax
mov rax, r13
mov qword [rbp - 0x11], rbx
test rcx, rcx
je 0x14007f80e
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14007f804
lea eax, [rax*2 + 2]
mov qword [rbp - 9], rdx
mov dword [rbp - 1], eax
mov dword [rbp + 3], r13d
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400c79e5]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea rcx, [0x1400e3100]
call fcn.140001118
jmp 0x14007f890
cmp dword [0x1400e3100], 5
jbe 0x14007f890
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x41], eax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rbx
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400c7b38]
xor r8d, r8d
mov dword [rsp + 0x20], 3
lea rcx, [0x1400e3100]
call fcn.140001118
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
inc r15d
add rsi, 8
cmp r15d, 1
jb 0x14007f6a4
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14009ae70
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret