Function at 0x140019070
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x14
mov eax, dword [r14 + rdi]
mov edx, 0x10
test al, 1
jne 0x14000bead
or eax, 1
mov dword [r14 + rdi], eax
lea rcx, [rdi + rdx]
call fcn.14000afb0
nop
lea rbx, [rdi + rdx]
lea rbp, [0x1402e2d20]
cmp byte [rbx + 1], 0
je 0x14000bef5
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
mov rcx, rbp
call fcn.140011f70
mov rax, qword [0x1402e2d20]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140013b60
movzx edx, al
mov rcx, rbp
call fcn.1400139a0
mov rcx, rbp
call fcn.140010e30
mov eax, dword [r14 + rdi]
test al, 1
jne 0x14000bf0d
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000afb0
nop
cmp byte [rbx + 1], 0
je 0x14000bf4a
lea rdx, str.Start_Minifilter
mov rcx, rbp
call fcn.140011f70
mov rax, qword [0x1402e2d20]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140013b60
movzx edx, al
mov rcx, rbp
call fcn.1400139a0
mov rcx, rbp
call fcn.140010e30
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x140019070
push rbx
sub rsp, 0x140
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14001919a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 1
lea rcx, [rsp + 0x20]
cmp eax, 0x420
jne 0x140019100
call fcn.140005bf0
xor eax, eax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x30]
call fcn.140008650
lea rcx, [rsp + 0x30]
call fcn.14000c0d0
nop
lea rcx, [rsp + 0x20]
call fcn.14000b0b0
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
call fcn.140005bf0
xor eax, eax
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x128], rax
mov word [rsp + 0x118], ax
cmp ebx, 2
jne 0x14001915a
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x30]
call fcn.140008650
lea rcx, [rsp + 0x30]
call fcn.14000c0d0
nop
lea rcx, [rsp + 0x20]
call fcn.14000b0b0
lea eax, [rbx + 0x6c]
add rsp, 0x140
pop rbx
ret
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x30]
call fcn.140008650
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14001ba90
lea rcx, [rsp + 0x30]
call fcn.14000c0d0
nop
lea rcx, [rsp + 0x20]
call fcn.14000b0b0
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x14
mov eax, dword [rcx + rdx]
mov r8d, 0x10
test al, 1
jne 0x1400191c8
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [rdx + r8]
call fcn.14000afb0
nop
cmp byte [rdx + r8 + 1], 0
je 0x14001920e
lea rdx, str.Service_started_successfully.
lea rbx, [0x1402e2d20]
mov rcx, rbx
call fcn.140011f70
mov rax, qword [0x1402e2d20]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140013b60
movzx edx, al
mov rcx, rbx
call fcn.1400139a0
mov rcx, rbx
call fcn.140010e30
xor eax, eax
add rsp, 0x140
pop rbx
ret