Function at 0x684dc270
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
test byte [0x684eb2d0], 8
jne 0x684dc368
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.advapi32.dll_OpenSCManagerW]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x684dc398
mov dword [esp + 8], 0x14
mov dword [esp + 4], str.RpcSs
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_OpenServiceW]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x684dc340
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_StartServiceW]
sub esp, 0xc
mov edx, eax
test eax, eax
jne 0x684dc3e0
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x420
je 0x684dc3e0
test byte [0x684eb2d0], 2
jne 0x684dc4f0
mov dword [ebp - 0x4c], edx
mov dword [esp], ebx
mov ebx, dword [sym.imp.advapi32.dll_CloseServiceHandle]
call ebx
sub esp, 4
mov dword [esp], esi
call ebx
mov edx, dword [ebp - 0x4c]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x684eb2d0], 2
jne 0x684dc4c0
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor edx, edx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x684f226d
mov dword [esp + 8], str.start_rpcss
mov dword [esp + 4], 0x684eb2d0
mov dword [esp], 3
call fcn.684dbd80
jmp 0x684dc286
xor edx, edx
test byte [0x684eb2d0], 2
je 0x684dc334
mov dword [esp + 0xc], str.Failed_to_open_service_manager_n
mov dword [esp + 8], str.start_rpcss
mov dword [esp + 4], 0x684eb2d0
mov dword [esp], 1
mov dword [ebp - 0x4c], edx
call fcn.684dbd80
mov edx, dword [ebp - 0x4c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
mov eax, edx
pop edi
pop ebp
ret
mov edi, dword [sym.imp.kernel32.dll_GetTickCount64]
call edi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], edi
mov esi, eax
mov edi, edx
jmp 0x684dc43b
cmp dword [ebp - 0x38], 4
je 0x684dc520
mov eax, dword [ebp - 0x4c]
call eax
mov ecx, 0x7530
sub eax, esi
sbb edx, edi
cmp ecx, eax
mov ecx, 0
sbb ecx, edx
jb 0x684dc530
mov dword [esp], 0x64
call dword [sym.imp.kernel32.dll_Sleep]
mov eax, dword [ebp - 0x38]
sub esp, 4
cmp eax, 2
jne 0x684dc540
lea eax, [ebp - 0x40]
mov dword [esp + 0xc], 0x24
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_QueryServiceStatusEx]
sub esp, 0x14
test eax, eax
jne 0x684dc3f8
mov edx, eax
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
cmp eax, 4
je 0x684dc318
test byte [0x684eb2d0], 4
je 0x684dc318
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RpcSs_failed_to_start__lu_n
mov dword [esp + 8], str.start_rpcss
mov dword [esp + 4], 0x684eb2d0
mov dword [esp], 2
mov dword [ebp - 0x4c], edx
call fcn.684dbd80
mov edx, dword [ebp - 0x4c]
jmp 0x684dc318
mov dword [esp + 0xc], str.Failed_to_open_RpcSs_service_n
mov dword [esp + 8], str.start_rpcss
mov dword [esp + 4], 0x684eb2d0
mov dword [esp], 1
call fcn.684dbd80
jmp 0x684dc34d
mov dword [esp + 0xc], str.Failed_to_start_RpcSs_service_n
mov dword [esp + 8], str.start_rpcss
mov dword [esp + 4], 0x684eb2d0
mov dword [esp], 1
mov dword [ebp - 0x4c], edx
call fcn.684dbd80
mov edx, dword [ebp - 0x4c]
jmp 0x684dc318
mov esi, dword [ebp - 0x50]
mov edx, 1
jmp 0x684dc318
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
xor edx, edx
jmp 0x684dc471
mov esi, dword [ebp - 0x50]
xor edx, edx
jmp 0x684dc471