Function at 0x1400048a0
Capabilities:
Print debug messages
Query service status
Start service

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov r8d, 0x13
lea rdx, str.__starting_:Spooler
lea rcx, [r11 - 0x50]
call fcn.14000a5a0
nop
cmp byte [0x140078a81], 0
je 0x140004980
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.140009d00
nop
mov r8d, 1
lea rdx, [0x14006bbcc]
lea rcx, [rsp + 0x48]
call fcn.14000a720
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004980
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000497a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b43
call fcn.140013ee4
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400049bd
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b49
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov r8d, 7
lea rdx, str.Spooler
lea rcx, [rsp + 0x28]
call fcn.14000a5a0
nop
lea rcx, [rsp + 0x28]
call fcn.140004480
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004a30
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b3d
call fcn.140013ee4
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbp, rax
test rax, rax
je 0x140004b13
xor esi, esi
lea r14, [0x14007aa30]
mov ecx, esi
imul rdx, rcx, 0x104
add rdx, r14
mov r8d, 0xf01ff
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x140004b0a
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140004afc
cmp dword [rsp + 0x4c], 4
je 0x140004adb
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140004afc
cmp dword [rsp + 0x4c], 4
je 0x140004adb
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x1e
jb 0x140004ab0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc esi
cmp esi, 0x100
jae 0x140004b13
jmp 0x140004a53
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
jmp 0x140004b0d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140013980
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
int3