Function at 0x140001490
Capabilities:
Enumerate process modules
Enumerate threads
Query service status
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8b0]
sub rsp, 0x9b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x8a0], rax
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x800
call sub.VCRUNTIME140.dll_memset
xor edi, edi
lea rcx, [rbp + 0x7a0]
xor edx, edx
mov dword [rsp + 0x68], edi
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov qword [rsp + 0x70], rdi
xor eax, eax
mov dword [rsp + 0x6c], edi
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
call fcn.140001070
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
jne 0x14000154b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Faild_to_get_a_pointer_to_ntdll_NtQueryInformationThread_function_ERROR____d___n
call fcn.140001010
jmp 0x14000155a
mov rdx, r12
lea rcx, str.Ok_NtQueryInformationThread_function_pointer_is__p___n
call fcn.140001010
xor edx, edx
mov dword [rsp + 0x30], 0x1c
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 0xf01ff
lea rdx, [0x140003470]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
xor ecx, ecx
lea r8, [rsp + 0x78]
mov dword [rbp - 0x68], ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x6c]
mov r9d, 0x24
mov qword [rsp + 0x20], rcx
xor edx, edx
mov rcx, rax
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov r13d, dword [rbp - 0x6c]
xor edx, edx
mov r8d, r13d
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x1400015e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Faild_to_get_serviceProcessHandle_ERROR____d___n
call fcn.140001010
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140001611
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Faild_to_get_snapshotHandle_ERROR____d___n
call fcn.140001010
lea r9, [rsp + 0x68]
mov r8d, 0x800
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
jne 0x140001641
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.failed_to_enumerate_modules_ERROR__d_n
call fcn.140001010
mov esi, dword [rsp + 0x68]
mov rbx, rdi
shr rsi, 3
test rsi, rsi
je 0x1400016ed
nop word [rax + rax]
mov rdi, qword [rbp + rbx*8 - 0x60]
lea r8, [rbp + 0x7a0]
mov rdx, rdi
mov r9d, 0x100
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea rdx, [rbp + 0x7a0]
xor eax, eax
lea r8, str.wevtsvc.dll
nop
movzx ecx, word [rdx + rax*2]
cmp cx, word [r8 + rax*2]
jne 0x1400016df
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r8 + rax*2 + 2]
jne 0x1400016df
add rax, 2
cmp rax, 0xc
jne 0x140001690
mov r8, rdi
lea rdx, [rbp + 0x7a0]
lea rcx, str.Windows_EvwwwentLog_module__S_at__p_n_n
call fcn.140001010
mov r9d, 0x18
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
inc rbx
cmp rbx, rsi
jb 0x140001660
xor edi, edi
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Thread32First]
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x14000179c
cmp dword [rsp + 0x3c], r13d
jne 0x140001786
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r9d, 8
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x70]
mov rcx, rax
mov rbx, rax
lea edx, [r9 + 1]
call r12
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x50]
cmp r8, rdx
jb 0x140001786
mov ecx, dword [rsp + 0x58]
add rcx, rdx
cmp r8, rcx
ja 0x140001786
mov edx, dword [rsp + 0x38]
lea rcx, str.Suspending_EvewwwntLog_thread__d_with_start_address__p_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001711
xor eax, eax
mov rcx, qword [rbp + 0x8a0]
xor rcx, rsp
call fcn.140001ae0
lea r11, [rsp + 0x9b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret