Function at 0x140083508
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x1400e7708]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_OpenSCManagerA]
xor r13d, r13d
mov r14, rax
test rax, rax
jne 0x1400835a5
cmp dword [0x1400e5150], 5
jbe 0x14008359e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x49], eax
lea rax, [rbp - 0x49]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400ce569]
xor r8d, r8d
mov dword [rsp + 0x20], 3
lea rcx, [0x1400e5150]
call fcn.14000117c
xor al, al
jmp 0x1400837c5
mov r15d, r13d
lea rsi, str.rpcss
mov ebx, 4
mov rdx, qword [rsi]
mov r8d, ebx
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14008361c
cmp dword [0x1400e5150], 5
jbe 0x1400837a9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x49], eax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rbx
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400ce50c]
xor r8d, r8d
mov dword [rsp + 0x20], 3
lea rcx, [0x1400e5150]
call fcn.14000117c
jmp 0x1400837a9
xor edx, edx
lea rcx, [rbp + 7]
lea r8d, [rdx + 0x24]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbp - 0x3d]
mov r9d, 0x24
lea r8, [rbp + 7]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_QueryServiceStatusEx]
test eax, eax
je 0x140083758
mov ecx, dword [rbp + 0x23]
call fcn.1400837f8
test al, al
jne 0x1400836dc
cmp dword [0x1400e5150], 5
jbe 0x1400837a0
mov eax, dword [rbp + 0x23]
lea rdx, [0x1400b6ba4]
mov rcx, qword [rsi]
mov dword [rbp - 0x45], eax
lea rax, [rbp - 0x45]
mov qword [rbp - 0x19], rax
mov rax, r13
mov qword [rbp - 0x11], rbx
test rcx, rcx
je 0x14008369f
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140083695
lea eax, [rax*2 + 2]
mov qword [rbp - 9], rdx
mov dword [rbp - 1], eax
mov dword [rbp + 3], r13d
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400ce5c6]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea rcx, [0x1400e5150]
call fcn.14000117c
jmp 0x1400837a0
cmp dword [0x1400e5150], 5
jbe 0x1400837a0
mov eax, dword [rbp + 0x23]
lea rdx, [0x1400b6ba4]
mov rcx, qword [rsi]
mov dword [rbp - 0x45], eax
lea rax, [rbp - 0x45]
mov qword [rbp - 0x19], rax
mov rax, r13
mov qword [rbp - 0x11], rbx
test rcx, rcx
je 0x14008371e
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140083714
lea eax, [rax*2 + 2]
mov qword [rbp - 9], rdx
mov dword [rbp - 1], eax
mov dword [rbp + 3], r13d
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400ce473]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea rcx, [0x1400e5150]
call fcn.14000117c
jmp 0x1400837a0
cmp dword [0x1400e5150], 5
jbe 0x1400837a0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x41], eax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rbx
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400ce601]
xor r8d, r8d
mov dword [rsp + 0x20], 3
lea rcx, [0x1400e5150]
call fcn.14000117c
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
inc r15d
add rsi, 8
cmp r15d, 1
jb 0x1400835b4
mov rcx, r14
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400a01e0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret