Function at 0x140013170
Capabilities:
Create process on windows
Resume thread

Disassembly:
push rdi
mov eax, 0x10150
call fcn.140020f60
sub rsp, rax
mov rax, qword [0x140029c30]
xor rax, rsp
mov qword [rsp + 0x10130], rax
cmp qword [rcx + 0x704f8], 0
mov rdi, rcx
mov byte [rcx + 0x70510], 0
mov byte [rcx + 0x70511], 1
je 0x1400131b3
xor eax, eax
jmp 0x14001366d
xor edx, edx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x10168], rbx
lea r8d, [rdx + 0x68]
mov qword [rsp + 0x10148], rsi
call fcn.1400174b0
xor eax, eax
lea rdx, [rsp + 0x80]
mov rcx, rdi
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call fcn.14000f1e0
test eax, eax
je 0x140013237
mov esi, 1
lea r8, [rdi + 2]
xor r9d, r9d
movzx ecx, si
mov edx, 0xc00003ec
call fcn.140007160
lea edx, [rsi + 1]
movzx r9d, sil
movzx r8d, sil
mov rcx, rdi
call fcn.1400120d0
jmp 0x14001365d
lea rax, [rdi + 0x28428]
lea rbx, [rdi + 0x1842a]
lea r9, str.__s___s
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x130]
or r8, 0xffffffffffffffff
mov edx, 0x8000
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10170], rbp
call fcn.140016e78
test eax, eax
jns 0x1400132b7
mov esi, 1
lea r9, str.start_service
lea r8, str.command_line
xor ebp, ebp
mov edx, 0xc00003eb
movzx ecx, si
mov qword [rsp + 0x20], rbp
call fcn.140007160
lea edx, [rsi + 1]
movzx r9d, sil
movzx r8d, sil
mov rcx, rdi
call fcn.1400120d0
jmp 0x140013655
mov rcx, rdi
call fcn.140012270
mov rcx, qword [rdi + 0x40410]
test rcx, rcx
je 0x1400132d0
call fcn.140006e30
mov rcx, qword [rdi + 0x40430]
test rcx, rcx
je 0x1400132e1
call fcn.140006dd0
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.14000bd80
test eax, eax
je 0x140013344
mov esi, 1
lea r8, [rdi + 2]
xor r9d, r9d
movzx ecx, si
mov edx, 0xc000041b
call fcn.140007160
cmp dword [rdi + 0x40440], 0
jne 0x14001331d
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, [rsp + 0x80]
call fcn.14000b470
movzx r9d, sil
movzx r8d, sil
mov edx, 4
mov rcx, rdi
call fcn.1400120d0
jmp 0x140013655
mov edx, dword [rdi + 0x4043c]
xor al, al
bt dword [rsp + 0xbc], 8
movzx ecx, al
mov esi, 1
cmovb ecx, esi
and edx, 0xc1e0
cmp qword [rdi + 0x40418], 0
je 0x140013373
or edx, 4
movzx ecx, cl
lea r8, [rsp + 0x58]
lea rax, [rdi + 0x30426]
mov qword [rsp + 0x48], r8
lea r8, [rsp + 0x80]
xor ebp, ebp
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x130]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001341e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
lea r8, [rdi + 2]
mov r9, rbx
mov edx, 0xc00003f2
movzx ecx, si
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.140007160
lea rcx, [rsp + 0x80]
call fcn.14000b470
mov rcx, qword [rdi + 0x70570]
call fcn.140006f60
lea edx, [rbp + 3]
movzx r9d, sil
movzx r8d, sil
mov rcx, rdi
call fcn.1400120d0
jmp 0x140013655
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x68]
lea rdx, [rdi + 0x70560]
mov qword [rdi + 0x704f8], rcx
mov dword [rdi + 0x70500], eax
mov qword [rsp + 0x10140], r12
call fcn.14000cd00
test eax, eax
je 0x14001345a
xor eax, eax
mov dword [rdi + 0x70560], eax
mov dword [rdi + 0x70564], eax
lea rcx, [rsp + 0x80]
call fcn.14000b470
cmp dword [rdi + 0x40440], ebp
jne 0x140013475
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [rdi + 0x70570]
call fcn.140006f60
mov ebx, 2
cmp qword [rdi + 0x40418], rbp
je 0x14001353a
mov rcx, qword [rdi + 0x704f8]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x1400134c1
mov rdx, qword [rsp + 0x70]
and rdx, qword [rdi + 0x40418]
mov qword [rsp + 0x50], rdx
jmp 0x1400134f8
mov rax, qword [rdi + 0x40418]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
lea r8, [rdi + 2]
mov edx, 0x8000042d
movzx ecx, si
mov r9, rax
mov qword [rsp + 0x20], rbp
call fcn.140007160
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x704f8]
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
jne 0x14001352f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
lea r8, [rdi + 2]
mov edx, 0xc000042e
movzx ecx, bx
mov r9, rax
mov qword [rsp + 0x20], rbp
call fcn.140007160
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r12d, dword [rdi + 0x704b4]
cmp r12d, 0x4e20
jbe 0x1400135d0
or r8, 0xffffffffffffffff
lea r9, [0x1400230e0]
lea rcx, [rsp + 0x110]
lea edx, [r8 + 0x11]
mov dword [rsp + 0x20], r12d
call fcn.140016e78
or r8, 0xffffffffffffffff
lea r9, [0x1400230e0]
lea rcx, [rsp + 0xf0]
lea edx, [r8 + 0x11]
mov dword [rsp + 0x20], 0x4e20
call fcn.140016e78
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
lea rax, str.NSSM
lea r8, [rdi + 2]
lea r9, [rsp + 0x110]
mov edx, 0x40000425
movzx ecx, bx
mov qword [rsp + 0x20], rax
call fcn.140007160
mov r12d, 0x4e20
mov rcx, qword [rdi + 0x704f8]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 0x704f0]
lea rdx, [rdi + 0x704d0]
mov ebx, eax
mov dword [rdi + 0x704d4], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp ebx, 0x102
jne 0x140013635
mov edx, dword [rdi + 0x704b4]
cmp edx, r12d
jbe 0x14001362f
mov rcx, qword [rdi + 0x704f8]
sub edx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x140013635
mov dword [rdi + 0x70514], ebp
jmp 0x140013635
mov dword [rdi + 0x70514], ebp
mov r12, qword [rsp + 0x10140]
cmp dword [rdi + 0x704b0], ebp
je 0x140013653
cmp dword [rdi + 0x70514], ebp
jne 0x140013653
mov dword [rdi + 0x70514], esi
xor eax, eax
mov rbp, qword [rsp + 0x10170]
mov rbx, qword [rsp + 0x10168]
mov rsi, qword [rsp + 0x10148]
mov rcx, qword [rsp + 0x10130]
xor rcx, rsp
call fcn.140017480
add rsp, 0x10150
pop rdi
ret