Function at 0x1401ccb70
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14039a678]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rcx
mov qword [rbp + 0x28], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], eax
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1401ccc25
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov ebx, 7
mov qword [rsp + 0x60], rbx
lea r8d, [rax + 0x45]
lea rdx, str._Utility__RestartSoftwareManager__OpenSCManager_failed_w_err_0x_08lx_n
lea rcx, [rsp + 0x48]
call fcn.1400e83c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.14017f3e0
jmp 0x1401cce09
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401ccc32
mov rdx, qword [rdi]
mov r8d, 0xf01ff
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1401ccc8f
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov ebx, 7
mov qword [rbp - 0x80], rbx
lea r8d, [rax + 0x43]
lea rdx, str._Utility__RestartSoftwareManager__OpenService_failed_w_err_0x_08lx_n
lea rcx, [rsp + 0x68]
call fcn.1400e83c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14017f3e0
mov rcx, r14
jmp 0x1401cce02
lea rdx, [rbp + 0xb0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
movabs r14, 0x7ffffffffffffffe
mov rax, r14
cmp dword [rbp + 0xb4], 4
jne 0x1401cce69
mov r13, qword [rdi + 0x10]
sub rax, r13
cmp rax, 0x2a
jb 0x1401cd363
mov qword [rsp + 0x30], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401cccde
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
xor esi, esi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
lea r12, [r13 + 0x2a]
mov ebx, 7
lea r15, [rbp + 0x50]
cmp r12, rbx
jbe 0x1401ccd2d
mov rbx, r12
or rbx, 7
cmp rbx, r14
jbe 0x1401cce41
mov rbx, r14
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400d1570
mov r15, rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], rbx
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r15], xmm0
movaps xmm1, xmmword [0x1402b3cd0]
movups xmmword [r15 + 0x10], xmm1
movaps xmm0, xmmword [0x1402b3ce0]
movups xmmword [r15 + 0x20], xmm0
movaps xmm1, xmmword [0x1402b3cf0]
movups xmmword [r15 + 0x30], xmm1
movaps xmm0, xmmword [0x1402b3d00]
movups xmmword [r15 + 0x40], xmm0
mov eax, dword [0x1402b3d10]
mov dword [r15 + 0x50], eax
lea rcx, [r15 + 0x54]
lea r8, [r13*2]
mov rdx, qword [rsp + 0x30]
call fcn.14021bb20
mov word [r15 + r12*2], si
lea r8, str._is_running
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140132360
mov rcx, rax
call fcn.14017ee40
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1401ccdf2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ccded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401cd369
call fcn.1401e3784
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, rdi
call fcn.140103e20
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1401e3ce0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs r15, 0x7fffffffffffffff
cmp rcx, r15
ja 0x1401cd33f
jmp 0x1401ccd1b
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rcx
sub rax, rcx
cmp rax, 0x2a
jb 0x1401cd36f
mov qword [rsp + 0x30], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401cce93
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
xor esi, esi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
add rcx, 0x2a
mov qword [rsp + 0x28], rcx
mov ebx, 7
mov r13d, ebx
lea r12, [rbp + 0x30]
lea eax, [rsi + 0xa]
movabs r15, 0x7fffffffffffffff
cmp rcx, rbx
jbe 0x1401ccef4
mov r13, rcx
or r13, rbx
cmp r13, r14
jbe 0x1401cd144
mov r13, r14
mov rcx, r15
lfence
add rcx, rcx
call fcn.1400d1570
mov r12, rax
mov qword [rbp + 0x30], rax
mov rcx, qword [rsp + 0x28]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], r13
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r12], xmm0
movaps xmm1, xmmword [0x1402b3cd0]
movups xmmword [r12 + 0x10], xmm1
movaps xmm0, xmmword [0x1402b3ce0]
movups xmmword [r12 + 0x20], xmm0
movaps xmm1, xmmword [0x1402b3cf0]
movups xmmword [r12 + 0x30], xmm1
movaps xmm0, xmmword [0x1402b3d00]
movups xmmword [r12 + 0x40], xmm0
mov eax, dword [0x1402b3d10]
mov dword [r12 + 0x50], eax
lea rcx, [r12 + 0x54]
mov r8, qword [rsp + 0x20]
add r8, r8
mov rdx, qword [rsp + 0x30]
call fcn.14021bb20
mov rax, qword [rsp + 0x28]
mov word [r12 + rax*2], si
lea r8, str._is_not_running__restart_now.
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x38]
call fcn.140132360
mov rcx, rax
call fcn.14017f3e0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1401ccfc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ccfc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401cd375
call fcn.1401e3784
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 1
je 0x1401cd1c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp eax, 0x420
jne 0x1401cd17c
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rcx
mov rax, r14
sub rax, rcx
cmp rax, 0x2a
jb 0x1401cd37b
mov qword [rsp + 0x28], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401cd01f
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], rsi
lea r13, [rcx + 0x2a]
lea r12, [rbp + 0x70]
cmp r13, 7
jbe 0x1401cd067
mov rbx, r13
or rbx, 7
cmp rbx, r14
jbe 0x1401cd15d
mov rbx, r14
mov rcx, r15
lfence
add rcx, rcx
call fcn.1400d1570
mov r12, rax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], rbx
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r12], xmm0
movaps xmm1, xmmword [0x1402b3cd0]
movups xmmword [r12 + 0x10], xmm1
movaps xmm0, xmmword [0x1402b3ce0]
movups xmmword [r12 + 0x20], xmm0
movaps xmm1, xmmword [0x1402b3cf0]
movups xmmword [r12 + 0x30], xmm1
movaps xmm0, xmmword [0x1402b3d00]
movups xmmword [r12 + 0x40], xmm0
mov eax, dword [0x1402b3d10]
mov dword [r12 + 0x50], eax
lea rcx, [r12 + 0x54]
mov r8, qword [rsp + 0x20]
add r8, r8
mov rdx, qword [rsp + 0x28]
call fcn.14021bb20
mov word [r12 + r13*2], si
lea r8, str._is_already_running.
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x18]
call fcn.140132360
mov rcx, rax
call fcn.14017ee40
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1401ccdf2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ccded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401cd345
jmp 0x1401ccded
cmp r13, rax
cmovb r13, rax
lea rcx, [r13 + 1]
cmp rcx, r15
ja 0x1401cd34b
jmp 0x1401ccedd
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r15
ja 0x1401cd351
jmp 0x1401cd055
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rbx
mov r8d, 0x63
lea rdx, str._Utility__RestartSoftwareManager__ERROR:_Failed_to_send_start_control_to_service._Error_code0x_08x
lea rcx, [rbp - 0x78]
call fcn.1400e83c0
mov edx, r12d
lea rcx, [rbp - 0x78]
call fcn.14017f3e0
cmp r12d, 0xc1
jne 0x1401ccdf2
call fcn.1401c2e60
jmp 0x1401ccdf2
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rcx
mov rax, r14
sub rax, rcx
cmp rax, 0x2a
jb 0x1401cd339
mov qword [rsp + 0x28], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401cd1ee
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
lea r13, [rcx + 0x2a]
lea r12, [rbp + 0x90]
cmp r13, 7
jbe 0x1401cd23f
mov rbx, r13
or rbx, 7
cmp rbx, r14
jbe 0x1401cd31e
mov rbx, r14
mov rcx, r15
lfence
add rcx, rcx
call fcn.1400d1570
mov r12, rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], rbx
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r12], xmm0
movaps xmm1, xmmword [0x1402b3cd0]
movups xmmword [r12 + 0x10], xmm1
movaps xmm0, xmmword [0x1402b3ce0]
movups xmmword [r12 + 0x20], xmm0
movaps xmm1, xmmword [0x1402b3cf0]
movups xmmword [r12 + 0x30], xmm1
movaps xmm0, xmmword [0x1402b3d00]
movups xmmword [r12 + 0x40], xmm0
mov eax, dword [0x1402b3d10]
mov dword [r12 + 0x50], eax
lea rcx, [r12 + 0x54]
mov r8, qword [rsp + 0x20]
add r8, r8
mov rdx, qword [rsp + 0x28]
call fcn.14021bb20
mov word [r12 + r13*2], si
lea r8, str._StartService_successfully.
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 8]
call fcn.140132360
mov rcx, rax
call fcn.14017ee40
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x1401ccdf2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ccded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401cd357
jmp 0x1401ccded
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r15
ja 0x1401cd35d
jmp 0x1401cd22a
call fcn.1400e7e40
int3
call fcn.1400e7cb0
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400e7cb0
int3
call fcn.1400e7cb0
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400e7cb0
int3
call fcn.1400e7e40
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400e7e40
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400e7e40
int3