Function at 0x1000045f0
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
mov ebp, edx
mov rsi, rcx
xor r13d, r13d
mov dword [rax + 8], 0x24
mov rcx, qword [0x10001e150]
lea rdi, [0x10001e150]
lea r14d, [r12 + 4]
lea r15d, [r12 + 0x10]
cmp rcx, rdi
je 0x100004656
test byte [rcx + 0x1c], r15b
je 0x100004656
cmp byte [rcx + 0x19], r14b
jb 0x100004656
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0xb]
lea r8, [0x1000020c0]
call fcn.100004278
lea rcx, [rsp + 0xb0]
call qword [sym.imp.API_MS_Win_Core_Profile_L1_1_0.dll_QueryPerformanceFrequency]
mov r11, qword [rsp + 0xb0]
mov edx, r14d
xor ecx, ecx
mov qword [section.RT_BSS], r11
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x1000046c5
mov rcx, qword [0x10001e150]
cmp rcx, rdi
je 0x100004970
test byte [rcx + 0x1c], r15b
je 0x100004970
cmp byte [rcx + 0x19], r14b
jb 0x100004970
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0xc
mov r9d, eax
call fcn.10000437c
jmp 0x100004970
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea ebx, [r9 + 1]
mov edx, ebx
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateEventW]
mov qword [rsi + 0x70], rax
test rax, rax
jne 0x1000046fb
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x100004970
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_CreateEventW]
mov qword [rsi + 0x78], rax
test rax, rax
je 0x1000046e2
xor r9d, r9d
lea r8, [0x1000021b0]
lea rcx, [0x1000021d8]
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
mov edi, eax
mov rcx, qword [0x10001e150]
lea rax, [0x10001e150]
cmp rcx, rax
je 0x100004768
test byte [rcx + 0x1c], r15b
je 0x100004768
cmp byte [rcx + 0x19], r14b
jb 0x100004768
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0xd
mov r9d, edi
call fcn.10000437c
test edi, edi
jne 0x10000493f
lea rax, [0x1000045b8]
lea r9d, [rdi + 0x21]
lea rcx, [0x100001fa0]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x4d2
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
mov edi, eax
mov rcx, qword [0x10001e150]
lea rax, [0x10001e150]
cmp rcx, rax
je 0x1000047d3
test byte [rcx + 0x1c], r15b
je 0x1000047d3
cmp byte [rcx + 0x19], r14b
jb 0x1000047d3
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0xe
mov r9d, edi
call fcn.10000437c
test edi, edi
jne 0x10000493f
mov r8d, ebx
xor edx, edx
xor ecx, ecx
mov dword [0x10001ead4], ebx
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x10000483f
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x10001e150]
lea rdi, [0x10001e150]
cmp rcx, rdi
je 0x100004954
test byte [rcx + 0x1c], r15b
je 0x100004954
cmp byte [rcx + 0x19], r14b
jb 0x100004954
lea edx, [r12 + 0xf]
jmp 0x100004a7a
lea rdx, [0x1000021e8]
mov r8d, r14d
mov rcx, rax
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov r13, rax
test rax, rax
jne 0x1000048a1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x10001e150]
lea rdi, [0x10001e150]
cmp rcx, rdi
je 0x100004954
test byte [rcx + 0x1c], r15b
je 0x100004954
cmp byte [rcx + 0x19], r14b
jb 0x100004954
mov edx, r15d
jmp 0x100004a7a
mov rcx, qword [0x10001e150]
lea rdi, [0x10001e150]
cmp rcx, rdi
je 0x1000048d5
test byte [rcx + 0x1c], r15b
je 0x1000048d5
cmp byte [rcx + 0x19], r14b
jb 0x1000048d5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0x11
call fcn.100004278
lea rax, [rsp + 0xa0]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1000049d1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x10001e150]
lea rax, [0x10001e150]
cmp rcx, rax
je 0x10000493f
test byte [rcx + 0x1c], r15b
je 0x10000493f
cmp byte [rcx + 0x19], r14b
jb 0x10000493f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0x12
mov r9d, edi
call fcn.10000437c
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
lea rdi, [0x10001e150]
test r12, r12
je 0x100004962
mov rcx, r12
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
test r13, r13
je 0x100004970
mov rcx, r13
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
mov rcx, qword [rsi + 0x78]
mov dword [rsi + 0x68], ebx
test rcx, rcx
je 0x100004982
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_SetEvent]
test ebx, ebx
jns 0x1000049b7
mov rcx, qword [0x10001e150]
cmp rcx, rdi
je 0x1000049b7
bt dword [rcx + 0x1c], 0x12
jae 0x1000049b7
cmp byte [rcx + 0x19], 2
jb 0x1000049b7
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0x18
mov r9d, ebx
call fcn.10000437c
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rsp + 0x34], ebx
je 0x100004b04
cmp dword [rsp + 0x34], 3
je 0x100004b04
mov rcx, qword [0x10001e150]
cmp rcx, rdi
je 0x100004a18
test byte [rcx + 0x1c], r15b
je 0x100004a18
cmp byte [rcx + 0x19], r14b
jb 0x100004a18
mov r9d, dword [rsp + 0x4c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0x13
call fcn.10000437c
mov r8d, dword [rsp + 0x4c]
xor edx, edx
mov ecx, 0x100000
mov dword [rsi + 0x88], r8d
call qword [sym.imp.API_MS_Win_Core_Synch_L1_1_0.dll_OpenProcess]
mov qword [rsi + 0x80], rax
test rax, rax
jne 0x100004a92
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x10001e150]
cmp rcx, rdi
je 0x100004954
test byte [rcx + 0x1c], r15b
je 0x100004954
cmp byte [rcx + 0x19], r14b
jb 0x100004954
mov edx, 0x15
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
call fcn.10000437c
jmp 0x100004954
mov r9d, 0x3020
mov r8d, 2
mov edx, r14d
mov rcx, rsi
call fcn.100005448
mov ebx, eax
test eax, eax
js 0x100004954
xor eax, eax
mov edx, ebp
mov rcx, rsi
mov dword [0x10001eac0], eax
mov dword [0x10001eac4], eax
mov dword [0x10001eac8], eax
call fcn.100005954
mov ebx, eax
mov rcx, qword [0x10001e150]
cmp rcx, rdi
je 0x100004954
test byte [rcx + 0x1c], r15b
je 0x100004954
cmp byte [rcx + 0x19], r14b
jb 0x100004954
mov edx, 0x17
mov r9d, eax
jmp 0x100004a7d
mov rcx, qword [0x10001e150]
cmp rcx, rdi
je 0x100004b31
test byte [rcx + 0x1c], r15b
je 0x100004b31
cmp byte [rcx + 0x19], r14b
jb 0x100004b31
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020c0]
mov edx, 0x14
call fcn.100004278
mov ebx, 0x80004005
jmp 0x100004954