Function at 0x14000c7e0
Capabilities:
Start service

Disassembly:
mov dword ss:[rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x58
mov r12, rcx
mov ebp, r8d
lea rax, str.EnableServiceProgressDialog
mov qword [rsp + 0x40], 0x36
xor dil, dil
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x30], dil
mov r13, rdx
mov sil, 1
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test ebp, ebp
je 0x14000c97a
test eax, eax
je 0x14000c989
test ebp, ebp
je 0x14000c851
mov rcx, r13
mov edx, ebp
nop
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14000c840
test byte [0x1402c02b0], sil
jne 0x14000c8f2
lock bts qword [0x1402c02b0], 0x1f
setb al
test al, al
jne 0x14000c8db
mov rdx, qword [0x1402ca958]
mov ecx, 0x40
call sym.SystemInformer.exe_PhCreateObject
xor ecx, ecx
mov r8, rax
mov word [rax], cx
mov eax, 1
lock xadd dword [0x1402ca950], eax
movzx edx, al
lea rax, [0x14000c6a0]
mov qword [r8 + 8], rax
lea rax, str.ServiceProgressObjectType
mov qword [r8 + 0x10], rax
lea rax, [0x1402cece0]
mov dword [r8 + 4], ecx
lea rcx, [0x1402c02b0]
mov qword [rax + rdx*8], r8
mov byte [r8 + 2], dl
mov qword [0x1402cac40], r8
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x14000c8f2
test byte [0x1402c02b0], sil
jne 0x14000c8f2
xor edx, edx
lea rcx, [0x1402c02b0]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rdx, qword [0x1402cac40]
mov ecx, 0x60
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
lea r9, str.Starting_a_service_might_prevent_the_system_from_functioning_properly.
xorps xmm0, xmm0
mov ecx, ebp
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
and byte [rbx + 0x45], 0xfe
mov qword [rax + 8], r12
lea rax, str.start
mov qword [rbx + 0x18], rax
lea rax, [0x14000c740]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x20], r9
mov dword [rbx + 0x58], 1
call sym.SystemInformer.exe_PhCreateList
mov r8d, ebp
mov qword [rbx + 0x38], rax
mov rdx, r13
mov rcx, rax
call sym.SystemInformer.exe_PhAddItemsList
mov rdx, rbx
lea rcx, [0x14000c3c0]
call sym.SystemInformer.exe_PhCreateThread2
xor al, al
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rax, str.EnableWarnings
mov qword [rsp + 0x40], 0x1c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x14000c9e4
lea rax, str.the_selected_services
mov byte [rsp + 0x20], dil
cmp ebp, 1
lea r8, str.the_selected_service
lea r9, str.Starting_a_service_might_prevent_the_system_from_functioning_properly.
mov rcx, r12
cmovne r8, rax
lea rdx, str.start
call sym.SystemInformer.exe_PhShowConfirmMessage
nop dword [rax]
test al, al
je 0x14000c97a
xor ebx, ebx
mov dword [rsp + 0x38], ebx
test ebp, ebp
je 0x14000cf8b
mov qword [rsp + 0x90], r14
lea r14, [0x14023a10c]
mov qword [rsp + 0x50], r15
lea r15, [0x1402386c8]
nop dword [rax]
mov rax, qword [r13]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000ca23
mov r8, qword [rcx + 8]
jmp 0x14000ca26
mov r8, rbx
mov edx, 0x10
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_PhOpenService
mov ebp, eax
test eax, eax
js 0x14000ca8f
mov rbx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000cabc
cmp dword [0x1402bff40], 0xffffffff
jae 0x14000ca6e
mov rax, qword gs:[0x30]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rax + 0x68]
jmp 0x14000ca74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebp, eax
test eax, eax
jns 0x14000cabc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
xor sil, sil
mov byte [rsp + 0xa8], sil
test dil, dil
jne 0x14000ce49
mov rax, qword [r13]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000cacd
mov r14, qword [rcx + 8]
jmp 0x14000cad0
mov rcx, rbx
mov sil, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000cf57
mov r14, rbx
lea r8, str.Unable_to_start
xorps xmm1, xmm1
mov rax, r8
mov rcx, r8
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000cb0d
movdqu xmm0, xmmword ds:[rax]
pcmpeqw xmm0, xmm1
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
mov dword [rsp + 0x34], ecx
je 0x14000cb09
mov eax, ecx
shr rax, 1
jmp 0x14000cb4a
add rax, 0x10
movdqu xmm0, xmmword [rax]
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rsp + 0x34], edx
jne 0x14000cb3c
movdqu xmm0, xmmword [rax + 0x10]
add rax, 0x10
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rsp + 0x34], edx
je 0x14000cb22
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rsi, r14
lea r15, [rax + rax]
and rsi, 0xfffffffffffffff1
mov ecx, r14d
and ecx, 0xf
je 0x14000cb7f
movdqu xmm0, xmmword [rsi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x34], ecx
je 0x14000cb7b
mov esi, ecx
shr rsi, 1
jmp 0x14000cbc8
add rsi, 0x10
movdqu xmm0, xmmword [rsi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x34], ecx
jne 0x14000cbba
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rsi + 0x10]
add rsi, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x34], ecx
je 0x14000cba0
sub rsi, r14
mov eax, ecx
sar rsi, 1
shr rax, 1
add rsi, rax
mov rdx, qword [0x1402ca978]
add rsi, rsi
lea rbx, [rsi + r15]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
lea rdx, str.Unable_to_start
xor ecx, ecx
mov r8, r15
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], cx
mov rcx, qword [rdi + 8]
call fcn.14020a640
mov rcx, qword [rdi + 8]
mov r8, rsi
add rcx, r15
mov rdx, r14
call fcn.14020a640
mov rcx, rdi
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x31]
mov r8d, ebp
mov rcx, r12
mov rdx, qword [rax + 8]
call fcn.140001ae0
nop dword [rax]
test al, al
je 0x14000ce33
cmp byte [rsp + 0x31], 0
je 0x14000ce17
mov rax, qword ds:[r13]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000cc69
mov rcx, qword [rcx + 8]
mov edx, 1
call fcn.1400a3ca0
mov ebx, eax
test eax, eax
js 0x14000cc8d
mov sil, 1
lea r14, [0x14023a10c]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cf52
mov rax, qword [r13]
lea rdx, str.start
lea rcx, str.Unable_to__s__s.
mov r8, qword [rax + 0x10]
mov r8, qword [r8 + 8]
call fcn.140001a60
mov rdi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x14000cced
nop dword [rax + rax]
cmp ebx, 0xc0000005
je 0x14000cced
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000ccdb
movzx eax, bx
jmp 0x14000ccf8
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000ccfc
mov eax, ebx
jmp 0x14000ccf8
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14000cd08
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14000cd12
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
mov rbx, rax
mov rcx, r12
mov r8d, 0xfffe
test rdi, rdi
je 0x14000cd6a
test rax, rax
je 0x14000cd31
mov edx, 0x21
jmp 0x14000cd7b
lea r14, [0x14023a10c]
mov qword [rsp + 0x28], rdi
lea r9, [0x1402386c8]
mov qword [rsp + 0x20], r14
mov edx, 9
call sym.SystemInformer.exe_PhShowMessage2
movzx esi, byte ds:[rsp + 0xa8]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cf52
mov edx, 9
test rbx, rbx
je 0x14000cdde
lea rdi, [0x1402386c8]
mov r10d, 8
lea r9, [0x14023a10c]
mov rax, rbx
lfence
mov rax, qword [r10 + rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, rdi
call sym.SystemInformer.exe_PhShowMessage2
lfence
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cdc5
lfence
call fcn.140141ca0
movzx esi, byte [rsp + 0xa8]
lea r14, [0x14023a10c]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cf52
lea rax, [0x1402386c8]
mov qword ss:[rsp + 0x28], rax
lea r14, [0x14023a10c]
lea r9, str.Unable_to_perform_the_operation.
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhShowMessage2
movzx esi, byte [rsp + 0xa8]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cf52
movzx esi, byte [rsp + 0xa8]
lea r14, [0x14023a10c]
mov dil, 1
mov byte [rsp + 0x30], dil
jmp 0x14000cf57
movzx esi, byte [rsp + 0xa8]
lea r14, [0x14023a10c]
lea r15, [0x1402386c8]
mov rax, qword [r13]
lea rdx, str.start
lea rcx, str.Unable_to__s__s.
mov r8, qword [rax + 0x10]
mov r8, qword [r8 + 8]
call fcn.140001a60
mov rdi, qword [rax + 8]
cmp ebp, 0xc0000022
je 0x14000cea2
cmp ebp, 0xc0000005
je 0x14000cea2
mov eax, ebp
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000ce8f
movzx eax, bp
jmp 0x14000ceaa
mov eax, ebp
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000ceae
mov eax, ebp
jmp 0x14000ceaa
mov ecx, ebp
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14000ceb7
mov ecx, ebp
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14000cebe
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
mov rbx, rax
mov rcx, r12
mov r8d, 0xfffe
test rdi, rdi
je 0x14000cee5
test rax, rax
je 0x14000cedb
mov edx, 0x21
jmp 0x14000cef2
mov qword [rsp + 0x28], rdi
mov r9, r15
jmp 0x14000cf3c
test rbx, rbx
je 0x14000cf30
mov edx, 9
mov rdi, r15
mov r10d, 8
mov rax, rbx
mov r9, r14
mov r9, rdi
mov rax, qword [r10 + rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhShowMessage2
mov edi, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cf4d
call fcn.140141ca0
jmp 0x14000cf4d
mov qword [rsp + 0x28], r15
lea r9, str.Unable_to_perform_the_operation.
mov edx, 9
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhShowMessage2
mov edi, eax
cmp edi, 1
jne 0x14000cf7e
movzx edi, byte [rsp + 0x30]
mov edx, dword [rsp + 0x38]
lea r15, [0x1402386c8]
inc edx
add r13, 8
mov ebx, 0
mov dword [rsp + 0x38], edx
cmp edx, dword [rsp + 0xa0]
jb 0x14000ca10
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
movzx eax, sil
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret