Function at 0x140015370
Capabilities:
Query service status
Start service

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x270
mov rax, qword [0x14002dda0]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp edx, 1
mov rbp, r8
mov r12d, edx
mov esi, ecx
jge 0x1400153aa
mov ecx, 1
call fcn.14000e260
jmp 0x140015716
mov qword [rsp + 0x2a8], rbx
mov ecx, 5
mov qword [rsp + 0x268], rdi
mov rdi, qword [r8]
call fcn.140012420
mov rbx, rax
test rax, rax
jne 0x1400153ea
call fcn.140019be0
mov edx, 0x400001fb
lea rcx, [rax + 0x60]
call fcn.140007250
lea eax, [rbx + 2]
jmp 0x140015706
mov r8d, 4
test esi, esi
je 0x140015423
cmp esi, 1
je 0x14001541b
cmp esi, 1
jbe 0x140015429
cmp esi, 3
jbe 0x140015413
cmp esi, 0x80
jne 0x140015429
mov r8d, 0x104
jmp 0x140015429
mov r8d, 0x44
jmp 0x140015429
mov r8d, 0x24
jmp 0x140015429
mov r8d, 0x14
lea r9, [rsp + 0x50]
mov rdx, rdi
mov rcx, rax
mov dword [rsp + 0x20], 0x100
call fcn.140012460
mov rdi, rax
test rax, rax
jne 0x14001545a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [rdi + 3]
jmp 0x140015706
test esi, esi
jne 0x140015571
mov r8, rbp
mov edx, r12d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebp, 0x3e5
jne 0x140015490
xor ebp, ebp
jmp 0x140015498
test esi, esi
je 0x140015528
lea r8, [rsp + 0x30]
mov r9d, 1
mov rdx, rdi
xor ecx, ecx
call fcn.140011df0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x1400154fc
xor ecx, ecx
call fcn.140014340
mov ecx, dword [rsp + 0x34]
mov rdi, rax
call fcn.140014450
mov rbx, rax
call fcn.140019be0
lea r8, [rsp + 0x50]
lea rcx, [rax + 0x60]
mov r9, rbx
mov edx, 0x40000227
mov qword [rsp + 0x20], rdi
call fcn.140007250
mov eax, 1
jmp 0x140015706
mov ecx, ebp
call fcn.140006fd0
xor ecx, ecx
mov r9, rax
call fcn.140014340
lea rdx, [rsp + 0x50]
lea rcx, str._s:__s:__s
mov r8, rax
call fcn.14001b75c
xor eax, eax
jmp 0x140015706
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebp
call fcn.140006fd0
xor ecx, ecx
mov rdi, rax
call fcn.140014340
mov rbx, rax
call fcn.140019be0
lea r8, [rsp + 0x50]
lea rdx, str._s:__s:__s
lea rcx, [rax + 0x60]
mov r9, rbx
mov qword [rsp + 0x20], rdi
call fcn.14001a97c
mov eax, 1
jmp 0x140015706
cmp esi, 4
jne 0x1400155e0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
test ebx, ebx
je 0x1400155af
mov ecx, dword [rsp + 0x34]
call fcn.140014450
lea rcx, [0x140025d48]
mov rdx, rax
call fcn.14001b75c
xor eax, eax
jmp 0x140015706
mov ecx, eax
call fcn.140006fd0
mov rbx, rax
call fcn.140019be0
lea r8, [rsp + 0x50]
lea rdx, str._s:__s_n
lea rcx, [rax + 0x60]
mov r9, rbx
call fcn.14001a97c
mov eax, 1
jmp 0x140015706
lea r8, [rsp + 0x30]
mov edx, esi
mov rcx, rax
mov qword [rsp + 0x260], r13
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov r13d, dword [rsp + 0x34]
mov r12d, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp ebp, 0x3e5
jne 0x14001561d
xor ebp, ebp
jmp 0x140015626
test r12d, r12d
je 0x1400156a8
lea r8, [rsp + 0x30]
mov r9d, r13d
mov rdx, rdi
mov ecx, esi
call fcn.140011df0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x14001567f
mov ecx, esi
call fcn.140014340
mov ecx, dword [rsp + 0x34]
mov rdi, rax
call fcn.140014450
mov rbx, rax
call fcn.140019be0
lea r8, [rsp + 0x50]
lea rcx, [rax + 0x60]
mov r9, rbx
mov edx, 0x40000227
mov qword [rsp + 0x20], rdi
call fcn.140007250
jmp 0x1400156f9
mov ecx, ebp
call fcn.140006fd0
mov ecx, esi
mov r9, rax
call fcn.140014340
lea rdx, [rsp + 0x50]
lea rcx, str._s:__s:__s
mov r8, rax
call fcn.14001b75c
xor eax, eax
jmp 0x1400156fe
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebp
call fcn.140006fd0
mov ecx, esi
mov rdi, rax
call fcn.140014340
mov rbx, rax
call fcn.140019be0
lea r8, [rsp + 0x50]
lea rdx, str._s:__s:__s
lea rcx, [rax + 0x60]
mov r9, rbx
mov qword [rsp + 0x20], rdi
call fcn.14001a97c
cmp ebp, 0x426
jne 0x1400156f9
cmp esi, 5
je 0x1400156a4
cmp esi, 1
je 0x1400156a4
mov eax, 1
mov r13, qword [rsp + 0x260]
mov rbx, qword [rsp + 0x2a8]
mov rdi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001a490
add rsp, 0x270
pop r12
pop rsi
pop rbp
ret