Function at 0x1400651d0
Capabilities:
Modify service
Query service status
Set registry value
Stop service

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
xor eax, eax
lea r8, [rbp + 0xe0]
mov dword [rbp + 0x80], eax
lea rdx, [rbp - 0x60]
xorps xmm0, xmm0
xor r15d, r15d
movups xmmword [rbp + 0x60], xmm0
movabs rax, 0x20a92a914da339b8
movabs rcx, 0xdce5ad77c45a0526
mov qword [rbp - 0x60], rax
movabs r13, 0x63f567d419f060eb
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp - 8], rcx
movabs rax, 0x6e9fbaa375692bb9
mov qword [rbp - 0x58], rax
movabs r12, 0x1dccecd101b59cc
movdqa xmm0, xmmword [rbp - 0x60]
movabs rax, 0x32a30cfa60bdb253
mov qword [rbp - 0x50], rax
movabs r14, 0x46c65f960fcfc63d
movabs rax, 0x35f3284b88b0e162
mov qword [rbp + 0x58], rcx
mov qword [rbp - 0x48], rax
movabs rsi, 0x599c5a3fe6dfa23e
movdqa xmm1, xmmword [rbp - 0x50]
movabs rax, 0xedc616fbdfc3f023
mov qword [rbp - 0x40], rax
mov rcx, 0xffffffff80000002
movabs rax, 0xe9db27e07d032350
mov qword [rbp], r13
mov qword [rbp - 0x38], rax
movabs rax, 0xb1cdb205864ab1bd
mov qword [rbp - 0x30], rax
movabs rax, 0x7a665b5445f7fb0f
mov qword [rbp - 0x28], rax
movabs rax, 0x898ab3bef82d2d5d
mov qword [rbp - 0x20], rax
movabs rax, 0x7144d0043b760f40
mov qword [rbp - 0x18], rax
movabs rax, 0xbfc8211d05393ba0
mov qword [rbp - 0x10], rax
movabs rax, 0x83a97f88aca6a37f
mov qword [rbp + 0x20], rax
movabs rax, 0x9bbe408113626e70
mov qword [rbp + 0x28], rax
movabs rax, 0x91b4c06aeb2ffce1
mov qword [rbp + 0x30], rax
movabs rax, 0x1f0b3e3324999a42
mov qword [rbp + 0x38], rax
movabs rax, 0xececd6cca8715933
mov qword [rbp + 0x40], rax
movabs rax, 0x1c25a2656b1e6c34
mov qword [rbp + 0x48], rax
movabs rax, 0xbfc8216e775c4fc5
mov qword [rbp + 0x50], rax
mov qword [rbp + 8], r12
pxor xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [rbp - 0x40]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [rbp - 0x20]
pxor xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], rsi
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [rbp - 0x30]
pxor xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [rbp - 0x10]
pxor xmm1, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x10], xmm1
mov qword [rbp + 0xe0], r15
mov dword [rbp + 0xd0], r15d
mov dword [rbp + 0xd8], r15d
movdqa xmmword [rbp - 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
movabs rax, 0x11a502b87b910eae
mov qword [rsp + 0x60], rax
movabs rax, 0x73b9a6ae647e3fa9
mov rcx, qword [rbp + 0xe0]
lea r9d, [r15 + 4]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], r14
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x78], rsi
xor r8d, r8d
movdqa xmm1, xmmword [rsp + 0x70]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r12
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rsp + 0x60]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rsi
pxor xmm1, xmmword [rbp - 0x70]
mov dword [rsp + 0x28], 4
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xe0]
lea r9d, [r15 + 4]
mov qword [rsp + 0x78], rsi
lea rdx, [rsp + 0x60]
movabs rax, 0x46c65f960fcfb458
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x70], rax
movabs rdi, 0x16a602b87b910eae
movdqa xmm1, xmmword [rsp + 0x70]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x60], rdi
movabs rbx, 0x69bfbaa876693cbc
mov qword [rsp + 0x68], rbx
xor r8d, r8d
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp - 0x78], r12
pxor xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rsi
pxor xmm1, xmmword [rbp - 0x70]
mov dword [rsp + 0x28], 4
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xe0]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x60], rdi
lea r9d, [r15 + 4]
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x60]
movdqa xmm0, xmmword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rsi
movdqa xmm1, xmmword [rsp + 0x70]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r12
pxor xmm0, xmmword [rbp - 0x80]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rsi
pxor xmm1, xmmword [rbp - 0x70]
mov dword [rsp + 0x28], 4
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14006564e
mov qword [rbp - 0x78], r12
lea rdx, [rbp - 0x80]
movabs rcx, 0x639b0eb5548319b8
mov qword [rsp + 0x60], r13
mov qword [rbp - 0x80], rcx
mov r8d, 0xf01ff
movdqa xmm0, xmmword [rbp - 0x80]
mov rcx, rax
mov qword [rsp + 0x68], r12
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x80], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14006564e
mov qword [rsp + 0x50], r15
lea r8d, [r15 + 4]
mov qword [rsp + 0x48], r15
mov edx, 0xffffffff
mov qword [rsp + 0x40], r15
mov r9d, edx
mov qword [rsp + 0x38], r15
mov rcx, rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x14006564e
lea rax, [rbp + 0xd8]
xor edx, edx
lea r9d, [r15 + 0x24]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp dword [rbp + 0x64], 4
jne 0x14006564a
lea r8, [rbp + 0x60]
mov rcx, rbx
lea edx, [r15 + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14006564e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x140065650
xor al, al
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret