Function at 0x1400025c4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rcx, str.advapi32.dll
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, rbx
mov rbp, rax
je 0x14000287f
lea rdx, str.OpenSCManagerA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenServiceA
mov rcx, rbp
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ChangeServiceConfigA
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CloseServiceHandle
mov rcx, rbp
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfigA
mov rcx, rbp
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceConfig2A
mov rcx, rbp
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ControlService
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumServicesStatusA
mov rcx, rbp
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumServicesStatusExA
mov rcx, rbp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StartServiceA
mov rcx, rbp
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.QueryServiceStatus
mov rcx, rbp
mov qword [rsp + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, qword [rsp + 0x98]
cmp r9, rbx
je 0x140002876
cmp rdi, rbx
je 0x140002876
cmp rsi, rbx
je 0x140002876
cmp r13, rbx
je 0x140002876
cmp r14, rbx
je 0x140002876
cmp r15, rbx
je 0x140002876
cmp qword [rsp + 0xa0], rbx
je 0x140002876
cmp qword [rsp + 0xa8], rbx
je 0x140002876
cmp rax, rbx
je 0x140002876
lea r8d, [rbx + 4]
lea rdx, str.ServicesActive
xor ecx, ecx
call r9
cmp rax, rbx
mov rdi, rax
je 0x140002876
cmp r12, rbx
mov dword [rsp + 0xa8], ebx
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0x98], ebx
je 0x140002870
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0xa8]
lea r14d, [rbx + 3]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa0]
lea r15d, [rbx + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x98]
mov r9d, r14d
mov qword [rsp + 0x30], rax
mov r8d, r15d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call r12
mov esi, dword [rsp + 0x98]
cmp esi, ebx
jbe 0x140002870
mov rcx, qword [0x1400265c8]
cmp rcx, rbx
je 0x1400027e3
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov esi, dword [rsp + 0x98]
mov qword [0x1400265c8], rbx
mov ecx, esi
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0xa0]
mov r9d, r14d
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x98]
mov r8d, r15d
mov qword [rsp + 0x30], rcx
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [0x1400265c8], rax
mov qword [rsp + 0x20], rax
call r12
cmp eax, ebx
je 0x140002858
mov eax, dword [rsp + 0xa0]
lea rcx, [0x1400265b0]
mov dword [0x1400265d0], eax
call fcn.14000247c
mov ebx, 1
jmp 0x140002870
mov rcx, qword [0x1400265c8]
cmp rcx, rbx
je 0x140002870
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [0x1400265c8], rbx
mov rcx, rdi
call r13
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret