Function at 0x140008380
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rdx + 0x10]
mov edx, 0x10
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x1400083e6
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
test eax, eax
je 0x1400083dc
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
nop dword [rax]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400083fb
movzx ebx, ax
or ebx, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_start
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x48]
mov r8d, ebx
mov rcx, rdi
mov rdx, qword [rax + 8]
call fcn.1400018e0
test al, al
je 0x1400085bf
cmp byte [rsp + 0x48], 0
je 0x1400086b8
mov rcx, qword [rsi + 0x10]
mov edx, 1
mov rcx, qword [rcx + 8]
call fcn.14007ace0
mov ebx, eax
test eax, eax
js 0x140008470
mov bl, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rsi + 0x10]
lea rdx, str.start
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x1400084b2
cmp ebx, 0xc0000005
je 0x1400084b2
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x1400084c4
movzx eax, bx
jmp 0x1400084bd
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax]
test eax, eax
jne 0x1400084d0
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x1400084da
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x14000855f
lfence
lfence
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x14000851a
mov rax, qword [rax + 8]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140008528
mov r9, qword [rbx + 8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400085a5
lfence
call fcn.1400fbcc0
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, 0x10
test rsi, rsi
je 0x140008592
mov r9, rsi
lea r8, [0x1401efb68]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rsi + 0x10]
lea rdx, str.start
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword ds:[rax + 8]
cmp ebx, 0xc0000022
je 0x140008603
cmp ebx, 0xc0000005
je 0x140008603
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000860f
movzx eax, bx
jmp 0x14000860b
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140008618
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14000861f
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x14000868f
mov r9, qword [rax + 8]
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140008659
mov qword [rsp + 0x28], r9
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r9, rsi
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140008665
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400086b8
call fcn.1400fbcc0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, 0x10
test rsi, rsi
je 0x1400086a5
mov r9, rsi
lea r8, [0x1401efb68]
jmp 0x1400086b3
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret