Function at 0x140092180
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x5c8
mov qword [rsp + 0x280], 0
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x50]
lea rcx, [0x14012607c]
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x56]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fa
rep stosb byte [rdi], al
mov r8d, 0x80000000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400921fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
jmp 0x1400924cd
lea r9, [rsp + 0x50]
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x200
lea rcx, [rsp + 0x290]
call fcn.1400940c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x290]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x490], eax
cmp dword [rsp + 0x490], 0
je 0x140092264
call fcn.140091c30
movzx eax, al
mov dword [rsp + 0x270], eax
jmp 0x14009227a
mov dword [rsp + 0x270], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x270], 0
je 0x1400923a0
mov r8d, setsockopt
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
je 0x140092381
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rsp + 0x278], eax
cmp dword [rsp + 0x278], 0
je 0x1400922e6
cmp dword [rsp + 0x254], 4
je 0x140092365
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140092365
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
cmp dword [rsp + 0x274], 0x420
je 0x140092365
cmp dword [rsp + 0x274], 0xb7
je 0x140092365
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rsp + 0x48], 0
je 0x140092344
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400927bd
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x280], 0
jmp 0x14009239b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400924cd
cmp dword [rsp + 0x490], 0
je 0x1400923bb
call fcn.140091c30
movzx eax, al
mov dword [rsp + 0x270], eax
jmp 0x1400923c6
mov dword [rsp + 0x270], 1
cmp dword [rsp + 0x270], 0
je 0x1400924cd
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
je 0x1400924b3
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rsp + 0x278], eax
cmp dword [rsp + 0x278], 0
je 0x140092432
cmp dword [rsp + 0x254], 4
je 0x140092497
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140092497
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
cmp dword [rsp + 0x274], 0x420
je 0x140092497
cmp dword [rsp + 0x274], 0xb7
je 0x140092497
cmp qword [rsp + 0x48], 0
je 0x140092483
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400927bd
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x280], 0
jmp 0x1400924cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rsp + 0x48], 0
je 0x1400924e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, 0x178
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x498], rax
cmp qword [rsp + 0x498], 0
jne 0x14009252d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400927bd
mov rax, qword [rsp + 0x498]
mov dword [rax + 0x48], 1
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, eax
and rax, 0xffff
movzx eax, ax
cmp eax, 4
jne 0x1400925cf
mov rcx, qword [rsp + 0x5e0]
call fcn.1400cf910
mov qword [rsp + 0x5b0], rax
lea rcx, [0x1401260b0]
call fcn.1400cf910
mov rcx, qword [rsp + 0x5b0]
cmp rcx, rax
jbe 0x1400925b8
lea rcx, [0x1401260c0]
call fcn.1400cf910
mov rcx, qword [rsp + 0x5e0]
add rcx, rax
mov rax, rcx
mov r9, rax
lea r8, str.._s
mov edx, 0x104
lea rcx, [rsp + 0x4a0]
call fcn.1400940c0
jmp 0x1400925cd
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x4a0]
call fcn.1400cb010
jmp 0x14009264a
mov rcx, qword [rsp + 0x5e0]
call fcn.1400cf910
mov qword [rsp + 0x5b8], rax
lea rcx, [0x1401260d8]
call fcn.1400cf910
mov rcx, qword [rsp + 0x5b8]
cmp rcx, rax
jbe 0x140092635
lea rcx, [0x1401260e8]
call fcn.1400cf910
mov rcx, qword [rsp + 0x5e0]
add rcx, rax
mov rax, rcx
mov r9, rax
lea r8, str..Global_s
mov edx, 0x104
lea rcx, [rsp + 0x4a0]
call fcn.1400940c0
jmp 0x14009264a
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x4a0]
call fcn.1400cb010
mov rax, qword [rsp + 0x498]
add rax, 8
mov r8d, 0x40
xor edx, edx
mov rcx, rax
call fcn.1400cb010
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rsp + 0x498]
mov qword [rcx], rax
mov rax, qword [rsp + 0x498]
cmp qword [rax], 0xffffffffffffffff
je 0x140092773
mov rcx, qword [rsp + 0x498]
call fcn.140091b50
movzx eax, al
test eax, eax
jne 0x140092729
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov rax, qword [rsp + 0x498]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400927bd
mov rcx, qword [rsp + 0x498]
call fcn.140091a80
mov rax, qword [rsp + 0x498]
mov dword [rax + 0x170], 0
mov rax, qword [rsp + 0x498]
add rax, 0x5c
mov r8, qword [rsp + 0x5e0]
mov edx, 0x10c
mov rcx, rax
call fcn.140093e70
mov rax, qword [rsp + 0x498]
jmp 0x1400927bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x5c8
pop rdi
pop rsi
ret