Function at 0x14016da64
Capabilities:
Get system information on windows
Start service

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x50
and qword [rbp - 0x30], 0
xor ebx, ebx
and qword [rbp + 0x48], 0
xor edx, edx
and qword [rbp + 0x30], 0
xor ecx, ecx
and qword [rbp + 0x50], 0
lea r8d, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rcx, qword [rbp + 0x30]
mov rdi, rax
test rcx, rcx
je 0x14016dab7
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x14016daf3
mov r8d, SafeArrayGetElement
mov qword [rbp + 0x30], rdi
lea rdx, str.TrustedInstaller
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, qword [rbp + 0x50]
mov rdi, rax
test rcx, rcx
je 0x14016dae8
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x14016daf3
mov qword [rbp + 0x48], rdi
jmp 0x14016db19
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14016db04
mov ebx, 0x80004005
jmp 0x14016db12
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x18], 0
lea rax, [rbp + 0x50]
mov r12d, 3
mov qword [rbp - 0x10], rax
lea r13, [0x140034c9c]
mov qword [rbp - 0x28], r12
xor r9d, r9d
mov qword [rbp - 0x20], r13
lea rdx, [rbp - 0x28]
mov ecx, 0xb9
lea edi, [r12 + 0x1d]
mov r8d, edi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x18], 0
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rbp - 0x10], rax
mov r8d, edi
mov qword [rbp - 0x28], r12
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x20], r13
mov ecx, 0xb9
call sub.ntdll.dll_NtQuerySystemInformation
test ebx, ebx
jns 0x14016db8f
mov edi, ebx
jmp 0x14016dc42
mov rcx, qword [rbp + 0x48]
lea r9, [rbp + 0x40]
mov edx, 9
call fcn.140160dfc
mov ebx, eax
mov edi, eax
test eax, eax
jns 0x14016dbb0
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x14016dc42
cmp dword [rbp + 0x40], 4
jne 0x14016dbcc
xor ebx, ebx
jmp 0x14016dc6b
mov rcx, qword [rbp + 0x48]
lea r8, [rbp - 0x30]
xor edx, edx
cmp qword [rbp - 0x30], rdx
setne dl
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14016dc16
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x14016dc16
test eax, eax
jne 0x14016dbff
mov ebx, 0x80004005
jmp 0x14016db88
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14016dc6b
jmp 0x14016db88
mov rcx, qword [rbp + 0x48]
lea r9, [rbp + 0x40]
mov edx, 8
call fcn.140160dfc
mov ebx, eax
mov edi, eax
test eax, eax
jns 0x14016dc37
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x14016dc59
mov ecx, edi
call fcn.140082a8c
cmp ebx, 0x800705b4
mov ecx, 0x80070426
cmove ebx, ecx
jmp 0x14016dc6b
cmp dword [rbp + 0x40], 4
je 0x14016dc6b
mov ecx, 0x80070426
mov ebx, ecx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x18], 0
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rbp - 0x28], r12
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x20], r13
mov ecx, 0xb9
mov qword [rbp - 0x10], rax
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret