Function at 0x140012cc0
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x40
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
jne 0x140012cf8
lea rcx, str.Failed_to_open_service_manager._n
call fcn.14000fc00
add rsp, 0x40
pop r14
ret
mov r8d, 5
mov qword [rsp + 0x20], r15
lea rdx, str.sysmain
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r15, rax
test rax, rax
jne 0x140012d45
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, str.sysmain
lea rcx, str.Failed_to_open_service__s._n
call fcn.14000fc00
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop r14
ret
lea r9, ds:[rsp + 0x50]
mov dword [rsp + 0x50], 0
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x140012da6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140012da6
lea rdx, str.sysmain
lea rcx, str.Failed_to_query_service_config_size_for__s._n
call fcn.14000fc00
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop r14
ret
mov edx, dword [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x28], r13
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
test rax, rax
jne 0x140012dcd
lea rcx, str.Memory_allocation_failed_for_service_config._n
call fcn.14000fc00
jmp 0x140012e06
mov r8d, dword ds:[rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x140012e29
lea rdx, str.sysmain
lea rcx, str.Failed_to_query_service_config_for__s._n
call fcn.14000fc00
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop r14
ret
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbp, qword [r13 + 0x10]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
cmp byte [rbp], 0
je 0x140012eba
lea r12, [0x1400570a9]
movsx ecx, byte [rbp]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov ecx, 0x43
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
cmp ebx, eax
jne 0x140012ead
cmp byte [rbp + 1], 0
lea rsi, [rbp + 1]
mov rbx, r12
je 0x140012ead
sub rsi, r12
nop
movsx eax, byte [rbx]
test al, al
je 0x140012ed0
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
movsx ecx, byte [rsi + rbx]
mov edi, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
cmp eax, edi
jne 0x140012ea8
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140012e80
cmp byte [rbx], 0
je 0x140012ed0
inc rbp
cmp byte [rbp], 0
jne 0x140012e53
mov rbp, qword [r13 + 0x10]
mov r8, rbp
lea rdx, str.sysmain
lea rcx, str._s_Binary_Path_Manipulated:__s_n
call fcn.14000fc00
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop r14
ret