Function at 0x14000602c
Capabilities:
Accept command line arguments
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r14
sub rsp, 0xb0
mov rax, qword [0x14002bed8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
call qword [sym.imp.wbemcomn.dll_public:_static_int___cdecl_CStaticCritSec::anyFailure_void_]
nop dword [rax + rax]
test eax, eax
je 0x14000608e
lea eax, [r14 + 7]
jmp 0x140006497
lea rcx, [0x14002c580]
call fcn.1400070a8
mov ebx, eax
test eax, eax
js 0x140006495
mov eax, dword [0x14001fed4]
mov dword [rsp + 0xa0], eax
movzx eax, word [0x14001fed8]
mov word [rsp + 0xa4], ax
lea rcx, [0x14002c580]
call fcn.140006dc0
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x140006495
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
lea rdx, [rsp + 0xa0]
mov rcx, rax
call fcn.140005e00
mov rsi, rax
mov edi, r14d
or r12d, 0xffffffff
test rsi, rsi
je 0x1400061dc
test edi, edi
je 0x14000646a
mov dword [rsp + 0x28], r12d
lea rax, str.UnregServer
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, rsi
mov edx, r14d
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000616a
call fcn.140007988
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1400061c2
mov r8d, r14d
xor edx, edx
mov rcx, qword [0x14002c5d0]
call fcn.140009410
xor ecx, ecx
call fcn.140005ec0
jmp 0x1400061c2
mov dword [rsp + 0x28], r12d
lea rax, str.RegServer
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, rsi
mov edx, r14d
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x1400061c4
call fcn.140007538
mov ebx, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1400061c2
mov ecx, r14d
call fcn.140005ec0
mov r8d, r12d
xor edx, edx
mov rcx, qword [0x14002c5d0]
call fcn.140009410
xor edi, edi
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call fcn.140005e00
mov rsi, rax
jmp 0x140006100
test edi, edi
je 0x14000646a
lea rcx, [0x14002c580]
call fcn.140006d38
test eax, eax
jne 0x140006465
lea rdx, [0x14002c658]
lea rcx, [rsp + 0x38]
call fcn.140006820
and qword [0x14002c630], 0
mov dword [0x14002c638], 0x10
mov dword [0x14002c63c], r14d
mov dword [0x14002c640], r14d
xorps xmm0, xmm0
movups xmmword [0x14002c644], xmm0
lea rcx, [rsp + 0x38]
call fcn.140006aa4
lea rdi, vtable.__SmartServiceHANDLE.0
mov qword [rsp + 0x50], rdi
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000642c
mov qword [rsp + 0x40], rdi
mov r8d, 5
lea r14, str.WmiApSrv
mov rdx, r14
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400063f3
xor edi, edi
mov qword [rsp + 0x38], rdi
and dword [rsp + 0x34], edi
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfigW]
nop dword [rax + rax]
test eax, eax
jne 0x14000632a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x7a
jne 0x14000632a
mov edx, dword [rsp + 0x34]
lea ecx, [rdi + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14000632a
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceConfigW]
nop dword [rax + rax]
test eax, eax
je 0x14000632a
xor ecx, ecx
cmp dword [rdi + 4], 3
sete cl
mov dword [0x14002c610], ecx
jmp 0x140006341
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
je 0x1400063d6
cmp dword [rsp + 0x84], 4
je 0x1400063cf
mov qword [rsp + 0x60], r14
lea rax, [0x140007c80]
mov qword [rsp + 0x68], rax
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
test eax, eax
jne 0x140006420
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov ecx, eax
jle 0x1400063c4
mov ecx, ebx
test ecx, ecx
js 0x140006414
mov ebx, 0x80070015
jmp 0x140006420
mov ebx, 0x800700b7
jmp 0x140006420
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140006420
movzx ebx, ax
or ebx, 0x80070000
jmp 0x140006420
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov ecx, eax
jle 0x140006410
mov ecx, ebx
test ecx, ecx
jns 0x14000641b
test eax, eax
cmovle ebx, eax
jmp 0x140006420
mov ebx, 0x80004005
lea rcx, [rsp + 0x40]
call fcn.1400059ac
jmp 0x140006459
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov ecx, eax
jle 0x140006449
mov ecx, ebx
test ecx, ecx
jns 0x140006454
test eax, eax
cmovle ebx, eax
jmp 0x140006459
mov ebx, 0x80004005
lea rcx, [rsp + 0x50]
call fcn.1400059ac
jmp 0x14000646a
mov ebx, 0x800700b7
test ebx, ebx
js 0x140006495
lea rdx, [0x14002c658]
lea rcx, [rsp + 0x38]
call fcn.140006820
lea rcx, [rsp + 0x38]
call fcn.140006aa4
mov ebx, dword [0x14002c644]
jmp 0x140006495
mov eax, ebx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140002010
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret