Function at 0x1400012a0
Capabilities:
Query service status

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov r12, r9
mov r13, r8
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
mov dword [r11 - 0x48], eax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], al
mov byte [r8], al
mov byte [r9], al
movups xmmword [rsp + 0xf8], xmm0
movdqa xmm1, xmmword [0x140004550]
movdqu xmmword [r11 - 0x80], xmm1
mov byte [rsp + 0xf8], al
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140001657
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xe8], xmm1
mov r15, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140001357
mov r15, qword [rsi]
mov rsi, qword [rsi + 0x10]
movabs r14, 0x7ffffffffffffffe
cmp rsi, r14
ja 0x1400016bb
cmp rsi, 7
ja 0x14000139a
mov qword [rsp + 0xe8], rsi
mov eax, 7
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0xd8], xmm0
jmp 0x140001455
mov rax, rsi
or rax, 7
cmp rax, r14
jbe 0x1400013cc
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x14000141d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400016c0
jmp 0x1400013fb
mov r14, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400016c5
add rcx, rcx
jne 0x1400013b4
xor eax, eax
jmp 0x140001422
mov rcx, rax
call fcn.140002860
mov rcx, rax
test rax, rax
je 0x140001599
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001422
call fcn.140002860
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], r14
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0xf0]
lea rdx, [rsp + 0xd8]
cmp rax, 7
cmova rdx, qword [rsp + 0xd8]
mov r8d, 0xf003f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400016cb
mov byte [r13], 1
lea rax, [rsp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x120]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000179c
cmp dword [rsp + 0x124], 4
je 0x140001514
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400022c0
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400014e7
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140002670
lea rdx, str._installed_but_not_running._
mov rcx, rax
call fcn.1400022c0
lea rdx, [0x1400024a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001555
mov byte [r12], 1
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140001526
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002670
lea rdx, str._installed_and_running
mov rcx, rax
call fcn.1400022c0
lea rdx, [0x1400024a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov byte [rsp + 0x30], 1
mov rdx, qword [rsp + 0xf0]
cmp rdx, 7
jbe 0x1400015a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000289c
movdqa xmm0, xmmword [0x140004540]
movdqu xmmword [rsp + 0xe8], xmm0
xor eax, eax
mov word [rsp + 0xd8], ax
jmp 0x1400015d1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400015e9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rsp + 0x110]
cmp rdx, 0xf
jbe 0x14000162f
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000162a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000162a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000289c
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.140002840
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0xf8]
call fcn.140001aa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140001280
nop
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.140001a80
nop
lea rcx, [rsp + 0x68]
call fcn.140001ab0
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x90]
call fcn.1400011c0
lea rdx, [0x140005278]
lea rcx, [rsp + 0x90]
call sub.VCRUNTIME140.dll__CxxThrowException
call fcn.1400011a0
call fcn.140001100
call fcn.140001100
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x48]
cmp eax, 0x424
je 0x14000174c
mov r8, rbx
lea rdx, str.Could_not_open
call fcn.140001fa0
nop
lea r8, str._service:_Error
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140002250
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.140001b10
lea rcx, [rsp + 0x68]
call fcn.140001ab0
nop
lea rcx, [rsp + 0x48]
call fcn.140001ab0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140001280
nop
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.140001a80
nop
jmp 0x140001764
mov rdx, rbx
call fcn.140002100
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.140001b10
lea rcx, [rsp + 0x48]
call fcn.140001ab0
mov byte [rsp + 0x30], 1
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xa8]
call fcn.1400011c0
lea rdx, [0x140005278]
lea rcx, [rsp + 0xa8]
call sub.VCRUNTIME140.dll__CxxThrowException
mov r8, rbx
lea rdx, str.Could_not_get
lea rcx, [rsp + 0x68]
call fcn.140001fa0
nop
lea r8, str.status:_Error
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002250
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.140001b10
lea rcx, [rsp + 0x48]
call fcn.140001ab0
nop
lea rcx, [rsp + 0x68]
call fcn.140001ab0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140001280
nop
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.140001a80
nop
lea rcx, [rsp + 0x48]
call fcn.140001ab0
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xc0]
call fcn.1400011c0
lea rdx, [0x140005278]
lea rcx, [rsp + 0xc0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3