Function at 0x140136230
Capabilities:
Create service
Delete service
Query service configuration
Query service status
Start service
Stop service

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
mov rbp, rcx
mov ecx, 0x20
call fcn.1403f2fd0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
movdqu xmm0, xmmword [0x1404625a0]
mov rbx, rax
mov byte [rax], 0
mov qword [rax + 0x18], 0
mov qword [rbp], rax
movups xmmword [rax + 8], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbx + 0x10], rax
mov rax, qword [rbp]
cmp qword [rax + 0x10], 0
je 0x140136880
mov qword [rsp + 0xa0], 0
mov r12, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
xor esi, esi
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r13, [rsp + 0x90]
jmp 0x1401362fa
mov rdx, rbx
sub rdx, rsi
mov rax, rdx
sar rax, 1
mov r8, rax
cmp rax, rdx
jb 0x140136750
cmp rdx, rax
jae 0x1401362e8
lea r8, [rdx + rdx]
lea rbx, [rsi + r8]
sar r8, 1
mov rdx, rsi
xor ecx, ecx
call r12
call rdi
mov r15d, eax
cmp eax, 0x7a
jne 0x140136340
cmp rsi, rbx
jne 0x1401362c0
mov edx, 0x104
mov rcx, r13
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rbx
call fcn.1403b8de0
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r8, rbx
sub r8, rsi
sar r8, 1
jmp 0x1401362e8
test eax, eax
jne 0x1401367a8
sub rbx, 2
cmp rbx, rsi
jne 0x14013636f
jmp 0x140136ab5
cmp ax, 0x2f
je 0x140136378
sub rbx, 2
cmp rsi, rbx
je 0x140136380
movzx eax, word [rbx]
cmp ax, 0x5c
jne 0x140136360
xor r9d, r9d
mov word [rbx + 2], r9w
lea r13, [rsp + 0x100]
mov qword [rsp + 0xf0], r13
test rsi, rsi
je 0x140136b81
mov rcx, rsi
call sub.msvcrt.dll_wcslen
lea rbx, [rax + rax]
mov r14, rbx
sar r14, 1
mov qword [rsp + 0xd0], r14
mov rdx, r14
cmp rbx, 0xe
ja 0x1401366e8
mov rcx, qword [rsp + 0xf0]
cmp r14, 1
jne 0x140136760
movzx eax, word [rsi]
lea r12, [rsp + 0xf0]
mov word [rcx], ax
mov eax, 2
xor r8d, r8d
mov qword [rsp + 0xf8], rdx
lea rbx, str.WinRing0x64.sys
mov word [rcx + rax], r8w
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r8, rax
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0xf8]
cmp rax, r8
jb 0x140136ba4
mov rdx, rbx
mov rcx, r12
call fcn.1403c2000
lea rbx, [rsp + 0xe0]
lea rcx, [rax + 0x10]
mov qword [rsp + 0xd0], rbx
mov rdx, qword [rax]
cmp rdx, rcx
je 0x1401367e8
mov qword [rsp + 0xd0], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xe0], rdx
mov rdx, qword [rax + 8]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xf0]
mov qword [rax + 8], 0
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov word [rax + 0x10], dx
cmp rcx, r13
je 0x140136490
call fcn.1403f2f80
mov r14, qword [rbp]
lea r13, str.WinRing0_1_2_0
mov r8d, 0xf01ff
mov rdx, r13
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r11, qword [rbp]
mov qword [r14 + 0x18], rax
cmp qword [r11 + 0x18], 0
je 0x14013656f
call fcn.1401379b0
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_existse_0m
mov ecx, 4
call fcn.140012100
mov rax, qword [rbp]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140136532
mov rax, qword [rbp]
mov r14, qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov r9, r12
xor edx, edx
mov dword [rsp + 0xf0], 0
xor r8d, r8d
mov rcx, qword [rax + 0x18]
call r14
call rdi
cmp eax, 0x7a
je 0x14013690d
cmp dword [rsp + 0xb4], 4
je 0x140136798
mov r14, qword [rbp]
mov rcx, qword [r14 + 8]
cmp rcx, 0xffffffffffffffff
je 0x140136546
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x140136870
cmp byte [r14], 0
je 0x140136830
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [r14 + 0x18], 0
mov r11, qword [rbp]
mov qword [rsp + 0x78], r11
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea r15, str..WinRing0_1_2_0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r14, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], 0
mov rcx, r15
mov dword [rsp + 0x20], 3
call r14
mov r11, qword [rsp + 0x78]
mov r10, qword [rbp]
mov qword [r11 + 8], rax
cmp qword [r10 + 8], 0xffffffffffffffff
jne 0x140136770
cmp byte [r10], 0
jne 0x140136670
mov rax, qword [rsp + 0xd0]
mov rcx, qword [r10 + 0x10]
mov rdx, r13
mov qword [rsp + 0x78], r10
mov qword [rsp + 0x60], 0
mov r9d, 0xf01ff
lea r8, str.WinRing0_1_2_0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r10, qword [rsp + 0x78]
mov qword [r10 + 0x18], rax
mov rax, qword [rbp]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140136a90
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1401369ba
mov r10, qword [rbp]
mov qword [rsp + 0x78], r10
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
mov rcx, r15
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r14
mov r10, qword [rsp + 0x78]
mov qword [r10 + 8], rax
mov rax, qword [rbp]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x1401368c0
mov rcx, qword [rsp + 0xd0]
cmp rcx, rbx
je 0x1401366c9
call fcn.1403f2f80
mov rcx, rsi
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1403f2f80
lea r12, [rsp + 0xf0]
lea rdx, [rsp + 0xd0]
xor r8d, r8d
mov rcx, r12
call fcn.1403c2180
mov rdx, qword [rsp + 0xd0]
mov qword [rsp + 0xf0], rax
mov rcx, rax
mov qword [rsp + 0x100], rdx
test r14, r14
je 0x14013673e
mov rdx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xf0]
lea rax, [rdx + rdx]
jmp 0x1401363e5
sub rdx, rax
jmp 0x140136304
lea r12, [rsp + 0xf0]
jmp 0x14013671e
call fcn.1401379b0
mov r8, rax
lea rdx, str._s_e_0_33mservice_e_0me_1_33mWinRing0_1_2_0e_0me_0_33m_already_exists__but_with_a_different_service_namee_0m
mov ecx, 4
call fcn.140012100
mov rax, qword [rbp]
mov byte [rax], 1
jmp 0x1401366b7
mov r11, qword [rbp]
mov byte [r11], 1
jmp 0x14013656f
call fcn.1401379b0
mov r8, rax
mov r9d, r15d
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_get_path_to_driver__error__ue_0m
call fcn.140012100
test rsi, rsi
jne 0x1401366c9
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rax + 8]
mov r9, rbx
lea r8, [rdx + rdx + 2]
mov rdx, rcx
cmp r8d, 8
jae 0x1401368e5
xor r11d, r11d
test r8b, 4
jne 0x14013699e
and r8d, 2
je 0x140136461
movzx edx, word [rdx + r11]
mov word [r9 + r11], dx
jmp 0x140136461
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [r14 + 0x18]
mov r15d, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x140136a2d
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [r14 + 0x18], 0
test r15d, r15d
je 0x1401366b7
nop
mov r11, qword [rbp]
jmp 0x14013656f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
je 0x140136a64
call fcn.1401379b0
mov r9d, ebx
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_open_service_control_manager__error__ue_0m
mov r8, rax
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140012100
call rdi
mov edi, eax
call fcn.1401379b0
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_connect_to_WinRing0_driver__error__ue_0m
call fcn.140012100
jmp 0x1401366b7
mov r11d, r8d
xor edx, edx
and r11d, 0xfffffff8
mov r9d, edx
add edx, 8
mov r14, qword [rcx + r9]
mov qword [rbx + r9], r14
cmp edx, r11d
jb 0x1401368ee
lea r9, [rbx + rdx]
add rdx, rcx
jmp 0x140136801
mov r8d, dword [rsp + 0xf0]
mov dword [rsp + 0x8c], r8d
test r8, r8
je 0x1401369af
mov rcx, r8
mov qword [rsp + 0x80], r8
call fcn.1403f2fd0
mov r8, qword [rsp + 0x80]
mov byte [rax], 0
mov r15d, 1
mov qword [rsp + 0x78], rax
sub r8, 1
je 0x140136965
lea rcx, [rax + 1]
xor edx, edx
call sub.msvcrt.dll_memset
mov r15d, dword [rsp + 0x8c]
mov rax, qword [rbp]
mov rdx, qword [rsp + 0x78]
mov r9, r12
mov r8d, r15d
mov rcx, qword [rax + 0x18]
call r14
test eax, eax
jne 0x140136aca
cmp qword [rsp + 0x78], 0
je 0x140136524
mov rcx, qword [rsp + 0x78]
call fcn.1403f2f80
jmp 0x140136524
mov r11d, dword [rdx]
mov dword [r9], r11d
mov r11d, 4
jmp 0x14013680e
mov qword [rsp + 0x78], 0
jmp 0x140136965
call rdi
mov r13d, eax
cmp eax, 0x420
je 0x14013666c
cmp eax, 2
je 0x140136af4
call fcn.1401379b0
mov r8, rax
mov r9d, r13d
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver__error__ue_0m
call fcn.140012100
mov rbp, qword [rbp]
mov rcx, qword [rbp + 8]
cmp rcx, 0xffffffffffffffff
je 0x140136a03
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1401366b7
cmp byte [rbp], 0
je 0x140136b12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp + 0x18], 0
jmp 0x1401366b7
call rdi
mov edi, eax
call fcn.1401379b0
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.140012100
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [r14 + 0x18], 0
jmp 0x1401366b7
call fcn.1401379b0
lea rdx, str._s_e_1_33mto_access_MSR_registers_Administrator_privileges_required.e_0m
mov ecx, 4
mov r8, rax
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140012100
call rdi
mov edi, eax
call fcn.1401379b0
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_install_WinRing0_driver__error__ue_0m
call fcn.140012100
jmp 0x1401366b7
lea r13, [rsp + 0x100]
mov qword [rsp + 0xf0], r13
jmp 0x140136399
mov rax, qword [rsp + 0x78]
mov r14, qword [rax + 0x10]
call fcn.1401379b0
mov r8, rax
mov r9, r14
mov ecx, 6
lea rdx, str._s_e_0_33mservice_path:_e_0me_1_33m__s_e_0m
call fcn.140012100
jmp 0x14013698f
call fcn.1401379b0
mov r8, rax
lea rdx, str._s_e_0_31mfailed_to_start_WinRing0_driver:_e_0me_1_31m_WinRing0x64.sys_not_found_e_0m
mov ecx, 3
call fcn.140012100
jmp 0x1401369ef
mov r8, r12
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x140136b37
mov rcx, qword [rbp + 0x18]
jmp 0x140136a1a
call rdi
mov edi, eax
call fcn.1401379b0
mov r8, rax
mov r9d, edi
mov ecx, 3
lea rdx, str._s_e_0_31mfailed_to_remove_WinRing0_driver__error__ue_0m
call fcn.140012100
jmp 0x140136b2e
lea rcx, [rsp + 0xd0]
call fcn.1403bf3a0
mov rcx, rsi
call fcn.1403f2f80
mov rcx, rbx
call fcn.140219c30
lea rcx, [0x1404622c0]
call fcn.1403f7bf0
mov rsi, qword [rsp + 0x90]
mov rbx, rax
test rsi, rsi
jne 0x140136b71
jmp 0x140136b79
lea rcx, [0x140462318]
call fcn.1403f7ce0
mov rbx, rax
jmp 0x140136b64