Function at 0x140022cc0
Capabilities:
Create service
Delete service
Query service status
Stop service

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x328]
sub rsp, 0x428
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [0x140232230]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov r15, r9
mov r14, r8
mov rsi, rdx
mov r13, rcx
mov qword [rbp - 0x30], rcx
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0xe0], 7
xor eax, eax
mov qword [rbp + 0xd8], rax
mov word [rbp + 0xc8], ax
lea r8d, [rax + 0x27]
lea rdx, str._driver___load_3______Entering_routine.
lea rcx, [rbp + 0xc8]
call fcn.14000dc20
nop
mov r8d, 6
lea rdx, [rbp + 0xc8]
call fcn.140078560
cmp byte [r13 + 0x70], 0
je 0x140022d8f
lea rax, str.driver_already_loaded
mov qword [rbp - 0x30], rax
xor r8d, r8d
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xa8]
call fcn.1401670ac
lea rdx, [0x14022de08]
lea rcx, [rbp + 0xa8]
call fcn.140170da8
int3
cmp qword [r15 + 0x18], 8
jb 0x140022d9b
mov rax, qword [r15]
jmp 0x140022d9e
mov rax, r15
mov qword [rsp + 0x70], rax
cmp qword [r14 + 0x18], 8
jb 0x140022daf
mov rax, qword [r14]
jmp 0x140022db2
mov rax, r14
mov qword [rsp + 0x78], rax
cmp qword [rsi + 0x18], 8
jb 0x140022dc3
mov rax, qword [rsi]
jmp 0x140022dc6
mov rax, rsi
mov qword [rbp - 0x28], rax
lea rdx, str._driver___load_3______loading_driver___name:___1____file:___2____devfile:___3__
lea rcx, [rbp + 0x110]
call fcn.140021a10
mov rbx, rax
cmp byte [rax + 0x44], 0
je 0x140022dee
mov rcx, rax
call fcn.140009270
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.14001a440
inc dword [rbx + 0x3c]
mov edx, dword [rbx + 0x3c]
cmp qword [rbx + 0x30], 0
je 0x140022e62
mov r10d, dword [rbx + 0x40]
cmp edx, r10d
jge 0x140022e62
mov r9, qword [rbx + 0x18]
movsxd rcx, edx
test edx, edx
jns 0x140022e3e
mov rax, rcx
neg rax
je 0x140022e3e
or rax, 0xffffffffffffffff
sub rax, rcx
shr rax, 5
lea rax, [rax*4 + 4]
mov r8, r9
sub r8, rax
jmp 0x140022e49
mov rax, rcx
shr rax, 5
lea r8, [r9 + rax*4]
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [r8], eax
je 0x140022e62
inc edx
mov dword [rbx + 0x3c], edx
cmp edx, r10d
jl 0x140022e14
cmp byte [rbx + 0x44], 0
je 0x140022e70
mov rcx, rbx
call fcn.140009270
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.14001a440
inc dword [rbx + 0x3c]
mov edx, dword [rbx + 0x3c]
cmp qword [rbx + 0x30], 0
je 0x140022ee5
mov r10d, dword [rbx + 0x40]
cmp edx, r10d
jge 0x140022ee5
mov r9, qword [rbx + 0x18]
movsxd rcx, edx
test edx, edx
jns 0x140022ec1
mov rax, rcx
neg rax
je 0x140022ec1
or rax, 0xffffffffffffffff
sub rax, rcx
shr rax, 5
lea rax, [rax*4 + 4]
mov r8, r9
sub r8, rax
jmp 0x140022ecc
mov rax, rcx
shr rax, 5
lea r8, [r9 + rax*4]
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [r8], eax
je 0x140022ee5
inc edx
mov dword [rbx + 0x3c], edx
cmp edx, r10d
jl 0x140022e97
cmp byte [rbx + 0x44], 0
je 0x140022ef3
mov rcx, rbx
call fcn.140009270
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.14001a440
inc dword [rbx + 0x3c]
mov edx, dword [rbx + 0x3c]
cmp qword [rbx + 0x30], 0
je 0x140022f6e
mov r10d, dword [rbx + 0x40]
cmp edx, r10d
jge 0x140022f6e
mov r9, qword [rbx + 0x18]
nop word [rax + rax]
movsxd rcx, edx
test edx, edx
jns 0x140022f4a
mov rax, rcx
neg rax
je 0x140022f4a
or rax, 0xffffffffffffffff
sub rax, rcx
shr rax, 5
lea rax, [rax*4 + 4]
mov r8, r9
sub r8, rax
jmp 0x140022f55
mov rax, rcx
shr rax, 5
lea r8, [r9 + rax*4]
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [r8], eax
je 0x140022f6e
inc edx
mov dword [rbx + 0x3c], edx
cmp edx, r10d
jl 0x140022f20
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.14000dbe0
nop
lea rcx, [rbp + 0x110]
call fcn.1400090e0
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0xe0], 7
xor ebx, ebx
mov qword [rbp + 0xd8], rbx
mov word [rbp + 0xc8], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xc8]
call fcn.14000e0c0
nop
lea r8d, [rbx + 5]
lea rdx, [rbp + 0xc8]
call fcn.140078560
nop
cmp qword [rbp + 0xa0], 8
jb 0x140022ff3
mov rcx, qword [rbp + 0x88]
call fcn.1401669a0
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], rbx
mov word [rbp + 0x88], bx
lea rdi, [r13 + 0x10]
cmp rdi, rsi
je 0x140023027
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.14000e0c0
lea rsi, [r13 + 0x30]
cmp rsi, r14
je 0x140023042
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call fcn.14000e0c0
lea rcx, [r13 + 0x50]
cmp rcx, r15
je 0x14002305a
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r15
call fcn.14000e0c0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x1400230b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, str.OpenSCManager
mov qword [rbp - 0x68], rax
xor eax, eax
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], ebx
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
cmp qword [rsi + 0x18], 8
jb 0x1400230c0
mov rax, qword [rsi]
jmp 0x1400230c3
mov rax, rsi
cmp qword [rdi + 0x18], 8
jb 0x1400230cf
mov r8, qword [rdi]
jmp 0x1400230d2
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400230de
mov rdx, qword [rdi]
jmp 0x1400230e1
mov rdx, rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
test rax, rax
jne 0x1400240c3
lea rax, [rbp + 0x88]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp + 0xa0], 7
xor r13d, r13d
mov qword [rbp + 0x98], r13
mov word [rbp + 0x88], r13w
lea r8d, [r14 + 0x29]
lea rdx, str.driver_not_currently_installed_as_service
lea rcx, [rbp + 0x88]
call fcn.14000dc20
nop
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], r13
mov word [rbp + 0xa8], r13w
lea r8d, [r14 + 0x12]
lea rdx, str._driver___load_3__
lea rcx, [rbp + 0xa8]
call fcn.14000dc20
nop
mov r9d, ebx
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0xa8]
call fcn.140078b90
mov ebx, r13d
cmp qword [rdi + 0x18], 8
jb 0x1400231de
mov rdx, qword [rdi]
jmp 0x1400231e1
mov rdx, rdi
mov r8d, 0xf01ff
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
jne 0x1400232d7
lea rax, [rbp + 0x88]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], r13
mov word [rbp + 0x88], r13w
lea r8d, [r14 + 0xf]
lea rdx, str.opening_service
lea rcx, [rbp + 0x88]
call fcn.14000dc20
nop
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], r13
mov word [rbp + 0xa8], r13w
lea r8d, [r14 + 0x12]
lea rdx, str._driver___load_3__
lea rcx, [rbp + 0xa8]
call fcn.14000dc20
nop
mov r9d, ebx
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0xa8]
call fcn.140078b90
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, str.OpenService
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x58], ebx
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
lea r9, [rbp - 0x28]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140023ff5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x7a
jne 0x140023ff5
mov ebx, dword [rbp - 0x28]
mov ecx, ebx
call fcn.140167bc0
mov r15, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14002340d
lea rax, [rbp + 0x88]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], r13
mov word [rbp + 0x88], r13w
lea r8d, [r15 + 0x28]
lea rdx, str.allocating_memory_for_QueryServiceConfig
lea rcx, [rbp + 0x88]
call fcn.14000dc20
nop
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], r13
mov word [rbp + 0xa8], r13w
lea r8d, [r15 + 0x12]
lea rdx, str._driver___load_3__
lea rcx, [rbp + 0xa8]
call fcn.14000dc20
nop
mov r9d, ebx
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0xa8]
call fcn.140078b90
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, str.bad_allocation
mov qword [rsp + 0x70], rax
lea r8d, [r15 + 1]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xa8]
call fcn.1401670ac
nop
lea rax, vtable.std::bad_alloc.0
mov qword [rbp + 0xa8], rax
lea rdx, [0x14022ddd8]
lea rcx, [rbp + 0xa8]
call fcn.140170da8
int3
lea r9, [rbp - 0x28]
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140023510
lea rax, [rbp + 0x88]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], r13
mov word [rbp + 0x88], r13w
mov r8d, 0x21
lea rdx, str.second_call_to_QueryServiceConfig
lea rcx, [rbp + 0x88]
call fcn.14000dc20
nop
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], r13
mov word [rbp + 0xa8], r13w
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._driver___load_3__
lea rcx, [rbp + 0xa8]
call fcn.14000dc20
nop
mov r9d, ebx
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0xa8]
call fcn.140078b90
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, str.QueryServiceConfig
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x58], ebx
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
cmp qword [rsi + 0x18], 8
jb 0x14002351c
mov rdx, qword [rsi]
jmp 0x14002351f
mov rdx, rsi
lea r13, [r15 + 0x10]
mov rcx, qword [r13]
call fcn.1401676e0
test eax, eax
setne r15b
test r15b, r15b
je 0x1400237af
lea rcx, str.WINDIR
call fcn.140167c78
mov rbx, rax
test rax, rax
je 0x140023770
xor r15d, r15d
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], r15
mov word [rbp + 0x88], r15w
lea r8d, [r15 + 4]
lea rdx, [0x1401b8b78]
lea rcx, [rbp + 0x88]
call fcn.14000dc20
nop
cmp word [rbx], r15w
jne 0x1400235a1
mov r8d, r15d
jmp 0x1400235b0
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400235a5
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.14000c280
mov r8d, 1
lea rdx, [0x1401b8b84]
lea rcx, [rbp + 0x88]
call fcn.14000c280
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x88]
call fcn.14000d720
lea rdx, str._driver___load_3______comparing_against_driver_full_path:__1__
lea rcx, [rbp + 0x110]
call fcn.140021a10
mov rbx, rax
cmp byte [rax + 0x44], 0
je 0x140023612
mov rcx, rax
call fcn.140009270
lea rdx, [rbp + 0x88]
mov rcx, rbx
call fcn.14000caa0
inc dword [rbx + 0x3c]
mov edx, dword [rbx + 0x3c]
cmp qword [rbx + 0x30], 0
je 0x14002368e
mov r10d, dword [rbx + 0x40]
cmp edx, r10d
jge 0x14002368e
mov r9, qword [rbx + 0x18]
nop dword [rax + rax]
movsxd rcx, edx
test edx, edx
jns 0x14002366a
mov rax, rcx
neg rax
je 0x14002366a
or rax, 0xffffffffffffffff
sub rax, rcx
shr rax, 5
lea rax, [rax*4 + 4]
mov r8, r9
sub r8, rax
jmp 0x140023675
mov rax, rcx
shr rax, 5
lea r8, [r9 + rax*4]
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [r8], eax
je 0x14002368e
inc edx
mov dword [rbx + 0x3c], edx
cmp edx, r10d
jl 0x140023640
mov rdx, rbx
lea rcx, [rbp + 0xa8]
call fcn.14000dbe0
nop
lea rcx, [rbp + 0x110]
call fcn.1400090e0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x38], 7
xor ebx, ebx
mov qword [rbp - 0x40], rbx
mov word [rbp - 0x50], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0xa8]
lea rcx, [rbp - 0x50]
call fcn.14000e0c0
nop
lea r8d, [rbx + 5]
lea rdx, [rbp - 0x50]
call fcn.140078560
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae rdx, qword [rbp + 0x88]
mov rcx, qword [r13]
call fcn.1401676e0
test eax, eax
setne r15b
cmp qword [rbp + 0xc0], 8
jb 0x140023726
mov rcx, qword [rbp + 0xa8]
call fcn.1401669a0
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], rbx
mov word [rbp + 0xa8], bx
cmp qword [rbp + 0xa0], 8
jb 0x140023755
mov rcx, qword [rbp + 0x88]
call fcn.1401669a0
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], rbx
mov word [rbp + 0x88], bx
jmp 0x1400237af
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x38], 7
xor eax, eax
mov qword [rbp - 0x40], rax
mov word [rbp - 0x50], ax
lea r8d, [rax + 0x3c]
lea rdx, str._driver___load_3______WINDIR_environment_variable_not_found_
lea rcx, [rbp - 0x50]
call fcn.14000dc20
nop
mov r8d, 3
lea rdx, [rbp - 0x50]
call fcn.140078560
cmp qword [rsi + 0x18], 8
jb 0x1400237bb
mov rax, qword [rsi]
jmp 0x1400237be
mov rax, rsi
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_name:___1____file_name:___2__
lea rcx, [rbp + 0x110]
call fcn.140021a10
nop
mov rdx, r13
mov rcx, rax
call fcn.140019140
mov rbx, rax
cmp byte [rax + 0x44], 0
je 0x1400237f3
mov rcx, rax
call fcn.140009270
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.14001a440
inc dword [rbx + 0x3c]
mov edx, dword [rbx + 0x3c]
cmp qword [rbx + 0x30], 0
je 0x14002386e
mov r10d, dword [rbx + 0x40]
cmp edx, r10d
jge 0x14002386e
mov r9, qword [rbx + 0x18]
nop word [rax + rax]
movsxd rcx, edx
test edx, edx
jns 0x14002384a
mov rax, rcx
neg rax
je 0x14002384a
or rax, 0xffffffffffffffff
sub rax, rcx
shr rax, 5
lea rax, [rax*4 + 4]
mov r8, r9
sub r8, rax
jmp 0x140023855
mov rax, rcx
shr rax, 5
lea r8, [r9 + rax*4]
and ecx, 0x1f
mov eax, 1
shl eax, cl
test dword [r8], eax
je 0x14002386e
inc edx
mov dword [rbx + 0x3c], edx
cmp edx, r10d
jl 0x140023820
mov rdx, rbx
lea rcx, [rbp + 0xc8]
call fcn.14000dbe0
nop
lea rcx, [rbp + 0x110]
call fcn.1400090e0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x38], 7
xor eax, eax
mov qword [rbp - 0x40], rax
mov word [rbp - 0x50], ax
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0xc8]
lea rcx, [rbp - 0x50]
call fcn.14000e0c0
nop
mov r8d, 5
lea rdx, [rbp - 0x50]
call fcn.140078560
mov rcx, qword [rsp + 0x78]
call fcn.1401673d0
test r15b, r15b
je 0x140023fb9
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______paths_dont_match__removing_and_recreating_driver_service
lea rcx, [rbp - 0x50]
call fcn.14000dd70
nop
mov r8d, 3
mov rdx, rax
call fcn.140078560
mov r13, qword [rbp - 0x30]
cmp byte [r13], 0
jne 0x140023980
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______ERROR_trying_to_remove_driver_service
lea rcx, [rbp - 0x50]
call fcn.14000dd70
nop
mov r8d, 1
mov rdx, rax
call fcn.140078560
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, str.unremovable_service_mismatch
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xa8]
call fcn.1401670ac
lea rdx, [0x14022de08]
lea rcx, [rbp + 0xa8]
call fcn.140170da8
int3
lea rdx, [rbp + 0x88]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140023a36
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.ERROR_calling_QueryServiceStatus
lea rcx, [rbp - 0x50]
call fcn.14000dd70
mov rbx, rax
lea rdx, str._driver___load_3__
lea rcx, [rbp + 0xa8]
call fcn.14000dd70
nop
mov r9d, edi
mov r8, rbx
mov rdx, rax
call fcn.140078b90
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, [0x1401b8e98]
mov qword [rbp - 0x68], rax
xor eax, eax
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], edi
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
mov r9d, dword [rbp + 0x8c]
lea eax, [r9 - 1]
cmp eax, 6
ja case.default.0x140023a5b
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x24200]
add rcx, rdx
jmp rcx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_state:__SERVICE_STOPPED_
lea rcx, [rbp - 0x50]
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140023b95
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_state:__SERVICE_START_PENDING_
lea rcx, [rbp + 0xa8]
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140023b95
lea rax, [rbp + 8]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_state:__SERVICE_STOP_PENDING_
lea rcx, [rbp + 8]
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140023b95
lea rax, [rbp + 0x48]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_state:__SERVICE_RUNNING_
lea rcx, [rbp + 0x48]
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140023b95
lea rax, [rbp + 0x28]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_state:__SERVICE_CONTINUE_PENDING_
lea rcx, [rbp + 0x28]
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140023b95
lea rax, [rbp + 0x68]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_state:__SERVICE_PAUSE_PENDING_
lea rcx, [rbp + 0x68]
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140023b95
lea rax, [rbp - 0x20]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______service_state:__SERVICE_PAUSED_
lea rcx, [rbp - 0x20]
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140023b95
lea r8, str._driver___load_3_____ERROR:_Unknown_service_state:___d_
mov edx, 0x80
lea rcx, [rbp + 0x210]
call fcn.140167410
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x80]
call fcn.14000dd70
nop
mov r8d, 2
mov rdx, rax
call fcn.140078560
mov eax, dword [rbp + 0x8c]
dec eax
test eax, 0xfffffffd
je 0x140023c65
lea r8, [rbp + 0x88]
mov edx, 1
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140023c65
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.ERROR_stopping_driver_service
lea rcx, [rbp - 0x80]
call fcn.14000dd70
mov rbx, rax
lea rdx, str._driver___load_3__
lea rcx, [rbp - 0x20]
call fcn.14000dd70
nop
mov r9d, edi
mov r8, rbx
mov rdx, rax
call fcn.140078b90
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, [0x1401b92b8]
mov qword [rbp - 0x68], rax
xor eax, eax
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], edi
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
jne 0x140023d1f
cmp r15d, 0x430
je 0x140023d1f
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x78], rax
lea rdx, str.ERROR_deleting_driver_service
lea rcx, [rbp - 0x80]
call fcn.14000dd70
mov rbx, rax
lea rdx, str._driver___load_3__
lea rcx, [rbp - 0x20]
call fcn.14000dd70
nop
mov r9d, r15d
mov r8, rbx
mov rdx, rax
call fcn.140078b90
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, [0x1401b9308]
mov qword [rbp - 0x68], rax
xor eax, eax
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], r15d
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
cmp qword [rsi + 0x18], 8
jb 0x140023d2b
mov rax, qword [rsi]
jmp 0x140023d2e
mov rax, rsi
cmp qword [rdi + 0x18], 8
jb 0x140023d3a
mov r8, qword [rdi]
jmp 0x140023d3d
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140023d49
mov rdx, qword [rdi]
jmp 0x140023d4c
mov rdx, rdi
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
test rax, rax
jne 0x140023f8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x140023f02
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______Service_marked_for_delete__trying_closing_reopening_SCM
lea rcx, [rbp - 0x80]
call fcn.14000dd70
nop
lea r8d, [r15 + 3]
mov rdx, rax
call fcn.140078560
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x140023e8b
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.ERROR_while_re_opening_SCM
lea rcx, [rbp - 0x80]
call fcn.14000dd70
mov rbx, rax
lea rdx, str._driver___load_3__
lea rcx, [rbp - 0x20]
call fcn.14000dd70
nop
mov r9d, edi
mov r8, rbx
mov rdx, rax
call fcn.140078b90
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, str.OpenSCManager_2
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r15
mov dword [rbp - 0x58], edi
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
cmp qword [rsi + 0x18], 8
jb 0x140023e95
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 8
jb 0x140023ea1
mov r8, qword [rdi]
jmp 0x140023ea4
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140023eae
mov rdi, qword [rdi]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
test rax, rax
jne 0x140023f8f
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.ERROR_re_creating_driver_service
lea rcx, [rbp - 0x80]
call fcn.14000dd70
mov rbx, rax
lea rdx, str._driver___load_3__
lea rcx, [rbp - 0x20]
call fcn.14000dd70
nop
mov r9d, edi
mov r8, rbx
mov rdx, rax
call fcn.140078b90
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, str.CreateService
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r15
mov dword [rbp - 0x58], edi
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______finished_re_creating_driver_service
lea rcx, [rbp - 0x80]
call fcn.14000dd70
nop
mov r8d, 5
mov rdx, rax
call fcn.140078560
jmp 0x140023fc0
mov r13, qword [rbp - 0x30]
xor r15d, r15d
cmp qword [rbp + 0xe0], 8
jb 0x140023fd6
mov rcx, qword [rbp + 0xc8]
call fcn.1401669a0
mov qword [rbp + 0xe0], 7
mov qword [rbp + 0xd8], r15
mov word [rbp + 0xc8], r15w
jmp 0x1400240c3
lea rax, [rbp - 0x50]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r13
mov word [rbp - 0x50], r13w
mov r8d, 0x1a
lea rdx, str.calling_QueryServiceConfig
lea rcx, [rbp - 0x50]
call fcn.14000dc20
nop
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0x98], r13
mov word [rbp + 0x88], r13w
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._driver___load_3__
lea rcx, [rbp + 0x88]
call fcn.14000dc20
nop
mov r9d, ebx
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x88]
call fcn.140078b90
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp - 0x80]
call fcn.1401670f4
nop
lea rax, vtable.win32_error.0
mov qword [rbp - 0x80], rax
lea rax, str.QueryServiceConfig
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x58], ebx
lea rdx, [0x14022dc38]
lea rcx, [rbp - 0x80]
call fcn.140170da8
int3
lea rdx, [rbp + 0xe8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14002419d
mov eax, dword [rbp + 0xec]
lea rcx, [rbp - 0x80]
cmp eax, 4
jne 0x140024118
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______Driver_service_is_running
call fcn.14000dd70
nop
mov r8d, 4
mov rdx, rax
call fcn.140078560
mov byte [r13 + 0x71], 1
jmp 0x14002419d
cmp eax, 2
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
jne 0x14002413b
lea rdx, str._driver___load_3______Driver_service_is_starting
call fcn.14000dd70
nop
mov r8d, 5
jmp 0x140024195
lea rdx, str._driver___load_3______driver_service_not_running
call fcn.14000dd70
nop
mov r8d, 5
mov rdx, rax
call fcn.140078560
mov r9d, dword [rbp + 0xec]
lea r8, str._driver___load_3________service_state:___d_
mov edx, 0x80
lea rcx, [rbp + 0x110]
call fcn.140167410
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x80]
call fcn.14000dd70
nop
mov r8d, 3
mov rdx, rax
call fcn.140078560
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [r13 + 0x70], 1
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rdx, str._driver___load_3______Leaving_routine.
lea rcx, [rbp - 0x80]
call fcn.14000dd70
nop
mov r8d, 6
mov rdx, rax
call fcn.140078560
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140166980
add rsp, 0x428
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret