Function at 0x140027c70
Capabilities:
Start service

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x254
mov eax, dword [r14 + rdi]
mov edx, 0x250
test al, 1
jne 0x140017637
or eax, 1
mov dword [r14 + rdi], eax
mov ecx, edx
add rcx, rdi
call fcn.14000e570
nop
mov ebx, edx
add rbx, rdi
lea rbp, [0x1401c2020]
cmp byte [rbx + 1], 0
je 0x140017680
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
mov rcx, rbp
call fcn.14000f0f0
mov rax, qword [0x1401c2020]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.14000edc0
movzx edx, al
mov rcx, rbp
call fcn.14000ec70
mov rcx, rbp
call fcn.14000eb70
mov eax, dword [r14 + rdi]
test al, 1
jne 0x140017698
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000e570
nop
cmp byte [rbx + 1], 0
je 0x1400176d5
lea rdx, str.Start_Minifilter
mov rcx, rbp
call fcn.14000f0f0
mov rax, qword [0x1401c2020]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.14000edc0
movzx edx, al
mov rcx, rbp
call fcn.14000ec70
mov rcx, rbp
call fcn.14000eb70
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp 0x140027c70
push rbx
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
test eax, eax
jne 0x140027d6d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
cmp eax, 0x420
jne 0x140027cee
call fcn.1400178a0
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x40]
call fcn.140019000
lea rcx, [rsp + 0x40]
call fcn.1400180a0
nop
jmp 0x140027d5c
call fcn.1400178a0
xor eax, eax
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], rax
mov word [rsp + 0x128], ax
cmp ebx, 2
jne 0x140027d34
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x40]
call fcn.140019000
lea rcx, [rsp + 0x40]
call fcn.1400180a0
nop
jmp 0x140027d5c
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x40]
call fcn.140019000
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.14001c300
lea rcx, [rsp + 0x40]
call fcn.1400180a0
nop
lea rcx, [rsp + 0x30]
call fcn.140016dd0
mov eax, 0x6e
jmp 0x140027de5
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x254
mov eax, dword [rcx + rdx]
mov r8d, 0x250
test al, 1
jne 0x140027d9d
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000e570
nop
cmp byte [r8 + rdx + 1], 0
je 0x140027de3
lea rdx, str.Service_started_successfully.
lea rbx, [0x1401c2020]
mov rcx, rbx
call fcn.14000f0f0
mov rax, qword [0x1401c2020]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.14000edc0
movzx edx, al
mov rcx, rbx
call fcn.14000ec70
mov rcx, rbx
call fcn.14000eb70
xor eax, eax
add rsp, 0x150
pop rbx
ret