Function at 0x140036480
Capabilities:
Query service status
Start service

Disassembly:
mov rax, rsp
push rsi
push r14
sub rsp, 0x88
mov qword [rax + 8], rbx
or r14d, 0xffffffff
mov qword [rax - 0x20], r12
mov rbx, r8
xor r12d, r12d
mov rsi, rcx
mov qword [rax + 0x20], r12
mov qword [rax - 0x60], r12
mov qword [rax - 0x68], r12
test r8, r8
je 0x1400364b6
mov dword [r8], r12d
lea rcx, [rsp + 0xb8]
call fcn.140039440
mov rdx, qword [rsp + 0xb8]
test rdx, rdx
je 0x1400364da
lea rcx, [rsp + 0x30]
call fcn.140039930
cmp qword [0x14026c550], r12
mov qword [rsp + 0x70], r15
je 0x140036718
lea rcx, [rsp + 0x98]
mov rdx, rsi
sub rcx, 8
call fcn.140025830
mov rcx, qword [0x14026c550]
mov r8d, 0xf01ff
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rax
call fcn.140170a90
mov r15, rax
test rax, rax
je 0x140036718
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x80], rdi
call fcn.1400398b0
mov r8, qword [rsp + 0x30]
mov edx, eax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
jne 0x1400365ec
mov rax, qword gs:[0x58]
mov edi, 0x2fe0
add rdi, qword [rax]
mov rax, qword [rdi]
test rax, rax
jne 0x14003657b
call fcn.140174cc4
cmp dword [rax], 0x420
jne 0x1400365a8
cmp dword [0x14027149c], 6
jl 0x1400365a0
mov r8, rsi
lea rdx, str.service__s_already_running
mov ecx, 0x670006
call fcn.140028e10
mov r14d, r12d
jmp 0x1400366e7
test rbx, rbx
je 0x1400365be
mov rax, qword [rdi]
test rax, rax
jne 0x1400365ba
call fcn.140174cc4
mov eax, dword [rax]
mov dword [rbx], eax
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x38]
call fcn.140039810
mov r8, rsi
lea rdx, str.failed_start_service__s__s:__m
mov ecx, 0x670003
mov r9, qword [rax]
call fcn.140028e10
jmp 0x1400366e7
lea rax, [rsp + 0xb0]
mov r9d, 0x24
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
jne 0x140036638
mov r8, rsi
lea rdx, str.failed_query_service_status__s:__m
mov ecx, 0x670003
call fcn.140028e10
test eax, eax
jne 0x1400366e7
mov eax, dword [rsp + 0x44]
mov ebx, r12d
mov qword [rsp + 0xa8], rbp
mov edi, r12d
mov ebp, dword [rsp + 0x54]
cmp eax, 4
je 0x1400366dc
cmp ebx, 0xea60
jge 0x1400366d7
cmp edi, 0x1d4c0
jge 0x1400366d7
lea rax, [rsp + 0xb0]
mov r9d, 0x24
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movsxd rcx, eax
call fcn.140170a40
test rax, rax
jne 0x1400366af
mov r8, rsi
lea rdx, str.failed_query_service_status__s:__m
mov ecx, 0x670003
call fcn.140028e10
test eax, eax
jne 0x1400366df
mov eax, dword [rsp + 0x54]
cmp eax, ebp
jbe 0x1400366bc
mov ebx, r12d
mov ebp, eax
mov ecx, 0x64
call fcn.14002a920
mov eax, dword [rsp + 0x44]
add ebx, 0x64
add edi, 0x64
cmp eax, 4
jne 0x140036657
jmp 0x1400366dc
cmp eax, 4
jne 0x1400366df
mov r14d, r12d
mov rbp, qword [rsp + 0xa8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movsxd rcx, eax
call fcn.140170a40
mov rdi, qword [rsp + 0x80]
test rax, rax
jne 0x14003672c
lea rdx, str.Failed_close_service_handle:__m
mov ecx, 0x670003
call fcn.140028e10
jmp 0x14003672c
mov r8, rsi
lea rdx, str.service__s_doesnt_exist
mov ecx, 0x670005
call fcn.140028e10
lea rcx, [rsp + 0xb8]
call fcn.140039600
mov rcx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14003675a
call fcn.140174cec
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x30]
call fcn.1400398d0
mov r12, qword [rsp + 0x78]
test r14d, r14d
je 0x140036782
mov r8, rsi
lea rdx, str.error_starting_service__s
mov ecx, 0x670003
call fcn.140028e10
mov eax, r14d
add rsp, 0x88
pop r14
pop rsi
ret