Function at 0x140004480
Capabilities:
Query service status
Start service

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400046d3
cmp qword [rbx + 0x18], 0x10
jb 0x1400044d3
mov rbx, qword [rbx]
mov r8d, 0xf01ff
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x1400046ca
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400046c1
cmp dword [rbp - 0x24], 4
jne 0x140004596
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, 0xa
lea rdx, str.__started.
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000457d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004578
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004773
call fcn.140013ee4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400046d5
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x1400046c1
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, 0x1e
lea rdx, str.__waiting_for_the_state_change
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140004619
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004614
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004779
call fcn.140013ee4
xor r14d, r14d
mov edi, r14d
nop
lea rdx, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400046c1
cmp dword [rbp - 0x24], 4
je 0x1400046f6
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov r8d, 3
lea rdx, [0x14006bf94]
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400046b6
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004767
call fcn.140013ee4
inc edi
cmp edi, 0x1e
jl 0x140004620
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140013980
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, 0xa
lea rdx, str.__started.
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000457d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004578
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000476d
jmp 0x140004578
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3