Function at 0x1400128e0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140012bba
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14001292b
mov rdx, qword [rbx]
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140012bb1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
nop dword [rax]
test eax, eax
je 0x140012ba8
cmp dword [rsp + 0x3c], 4
jne 0x140012ba8
mov ebp, dword ds:[rsp + 0x54]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, vtable.._AVcProcInfo__1__PrintSuspendedThreadsForService__YAXAEBV__basic_string__WU__char_traits__W_std__V__allocator__W_2__std___Z_.0
mov qword [rsp + 0x38], rax
xor esi, esi
mov edi, esi
mov qword [rsp + 0x40], rsi
mov ebx, 0x3e8
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x50], rsi
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
test rax, rax
je 0x140012a62
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140012a62
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140012a62
mov dword [rsp + 0x30], esi
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
mov ecx, 5
mov rax, r14
call qword [0x140057e20]
mov ebx, eax
cmp eax, 0xc0000004
jne 0x140012a6a
mov ebx, dword [rsp + 0x30]
add ebx, 0xfa0
mov dword [rsp + 0x48], ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x140012a05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x140012a95
lea rdx, str.Error_capturing_processes:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
nop dword [rax]
call fcn.14000ada0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
jmp 0x140012b86
test rdi, rdi
je 0x140012b73
mov rbx, rdi
cmp dword [rdi + 0x50], ebp
je 0x140012ab8
mov eax, dword [rbx]
test eax, eax
je 0x140012b73
add rbx, rax
cmp dword [rbx + 0x50], ebp
jne 0x140012aa6
cmp dword ds:[rbx + 4], 0
jbe 0x140012b97
mov eax, esi
lea rbp, [rax + rax*4]
shl rbp, 4
add rbp, 0x100
add rbp, rbx
jne 0x140012b02
lea rdx, str.The_thread_does_not_exist.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000d280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140012b66
cmp dword [rbp + 0x44], 5
jne 0x140012b66
cmp dword [rbp + 0x48], 5
jne 0x140012b66
lea rdx, str.Thread_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.1400064a0
mov rdx, qword [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, str._is_suspended_with_WaitReason:
call fcn.1400064a0
mov edx, dword [rbp + 0x48]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
inc esi
cmp esi, dword [rbx + 4]
jb 0x140012ac6
jmp 0x140012b97
lea rdx, str.The_process_does_not_exist.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000d280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
test rdi, rdi
je 0x140012c0f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140012c0f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, 0x18
mov rsi, rbx
lea rdx, [0x140059f40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
mov r8, qword ds:[rbx + 0x10]
cmp qword [rbx + rdi], 7
jbe 0x140012be5
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140008ee0
lea rdx, str._is_not_running.
mov rcx, rax
call fcn.1400064a0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140050f40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret