Function at 0x7ff74afbd00
Capabilities:
Query service status
Start service

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xe0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], rsi
mov qword [rbp + 0xf0], rdi
mov rax, qword [0x7ff74b58340]
xor rax, rbp
mov qword [rbp + 0xa0], rax
xor ebx, ebx
mov qword [rbp + 8], r9
mov dword [rbp + 4], r8d
mov qword [rbp + 0x10], rdx
mov r14, rcx
mov r13, rbx
mov r12d, ebx
cmp qword [rcx + 0x10], rbx
je 0x7ff74b209bc
mov dword [r9], ebx
mov rax, qword [rcx + 0x10]
mov rcx, qword [0x7ff74b58528]
mov rdx, qword [rax + 8]
mov r8d, 0xa0000000
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov r15, rax
cmp rax, rbx
je 0x7ff74b209c6
mov rax, qword [r14 + 0x10]
cmp rax, rbx
je 0x7ff74b20a21
mov rcx, qword [rax + 0x10]
jmp 0x7ff74afbd9a
cmp rcx, rbx
jne 0x7ff74afe0c7
lea r8, [rbp + 0x20]
cmp r12d, ebx
mov edx, r12d
cmovbe r8, rbx
mov rcx, r15
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_StartServiceW]
mov r12d, eax
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp r12d, ebx
je 0x7ff74afbec5
lea rax, [rbp]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
mov dword [rbp], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceStatusEx]
mov r12d, eax
cmp eax, ebx
jne 0x7ff74afbec5
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x7ff74afbec5
mov r9d, dword [rbp]
mov rdi, rbx
cmp r9d, ebx
je 0x7ff74b20b26
cmp r9, qword [0x7ff74b585e0]
ja 0x7ff74b20b26
mov rax, qword [0x7ff74b585e8]
lea rcx, [r9 + rax + 8]
cmp rcx, r9
jb 0x7ff74b20b26
call fcn.7ff74ae6340
cmp eax, ebx
je 0x7ff74b20b22
mov r9d, dword [rbp]
lea eax, [r9 + 8]
mov ecx, eax
add rax, 0xf
cmp rax, rcx
jbe 0x7ff74b20b13
and rax, 0xfffffffffffffff0
call fcn.7ff74ae3a20
sub rsp, rax
lea rdi, [rsp + 0x30]
cmp rdi, rbx
je 0x7ff74b20b26
mov dword [rdi], 0x6b637453
add rdi, 8
je 0x7ff74b20b22
mov r9d, dword [rbp]
jmp 0x7ff74afbe89
lea rax, [rbp]
mov r8, rdi
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceStatusEx]
mov r12d, eax
cmp eax, ebx
je 0x7ff74afbeb0
mov rcx, qword [rbp + 8]
mov eax, dword [rdi + 0x1c]
mov dword [rcx], eax
cmp rdi, rbx
je 0x7ff74afbec5
lea rcx, [rdi - 8]
cmp dword [rcx], 0x70616548
je 0x7ff74b20b5f
mov rcx, r15
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
mov rcx, qword [0x7ff74b584e0]
mov r8, r13
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp r12d, ebx
je 0x7ff74b0d187
xor eax, eax
jmp 0x7ff74afbeed
mov rcx, qword [rbp + 0xa0]
xor rcx, rbp
call fcn.7ff74ae3090
mov rbx, qword [rbp + 0xe0]
mov rsi, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xf0]
lea rsp, [rbp + 0xb0]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov esi, ebx
cmp rax, rbx
je 0x7ff74b20a29
mov rcx, qword [rax + 0x10]
jmp 0x7ff74afe0d8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
inc eax
movsxd rdi, eax
lea r8, [rdi + rdi]
call qword [0x7ff74b58358]
mov r13, rax
cmp rax, rbx
je 0x7ff74b20a31
mov rax, qword [r14 + 0x10]
cmp rax, rbx
je 0x7ff74b20a44
mov r8, qword [rax + 0x10]
jmp 0x7ff74afe115
mov rdx, rdi
mov rcx, r13
call fcn.7ff74af051c
mov r11, rbx
lea rdx, [rbp + 0x20]
cmp r12d, 0x10
jae 0x7ff74b20a4c
cmp word [r13 + r11*2], bx
jne 0x7ff74b20a99
cmp word [r13 + r11*2], bx
je 0x7ff74afbda3
jmp 0x7ff74b20ab9
movzx edi, si
or edi, 0x80070000
cmp esi, ebx
cmovle edi, esi
cmp esi, 0x420
je 0x7ff74b0d1a9
cmp esi, 0x422
jne 0x7ff74b20b6b
mov eax, edi
jmp 0x7ff74afbeed
mov eax, 0x80070057
jmp 0x7ff74afbeed
call sub.KERNEL32.dll_GetLastError
mov edi, eax
cmp dword [0x7ff74b582c8], ebx
je 0x7ff74b20a0f
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b20a0f
test byte [rcx + 0x1c], 1
je 0x7ff74b20a0f
mov r9, qword [r14 + 0x10]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51720]
mov r9, qword [r9 + 8]
mov edx, 0x10
mov dword [rsp + 0x20], edi
call fcn.7ff74b298f0
movzx eax, di
or eax, 0x80070000
cmp edi, ebx
cmovle eax, edi
jmp 0x7ff74afbeed
mov rcx, rbx
jmp 0x7ff74afbd9a
mov rcx, rbx
jmp 0x7ff74afe0d8
mov rcx, r15
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
mov eax, 0x8007000e
jmp 0x7ff74afbeed
mov r8, rbx
jmp 0x7ff74afe115
cmp dword [0x7ff74b582c8], ebx
je 0x7ff74b209bc
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b209bc
test byte [rcx + 0x1c], 1
je 0x7ff74b209bc
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51720]
mov edx, 0x11
mov r9d, 0x80070057
call fcn.7ff74b25ec4
jmp 0x7ff74b209bc
cmp word [r13 + r11*2], 0x20
je 0x7ff74b20aaf
cmp word [r13 + r11*2], 9
jne 0x7ff74afe13d
inc esi
inc r11
jmp 0x7ff74afe131
mov eax, esi
inc r12d
lea rcx, [r13 + rax*2]
mov qword [rdx], rcx
add rdx, 8
jmp 0x7ff74b20ae3
cmp word [r13 + r11*2], 0x20
je 0x7ff74b20aeb
cmp word [r13 + r11*2], 9
je 0x7ff74b20aeb
inc esi
inc r11
cmp word [r13 + r11*2], bx
jne 0x7ff74b20acc
cmp word [r13 + r11*2], bx
je 0x7ff74afbda3
mov word [r13 + r11*2], bx
inc r11
inc esi
cmp word [r13 + r11*2], bx
je 0x7ff74afbda3
jmp 0x7ff74afe127
movabs rax, 0xffffffffffffff0
jmp 0x7ff74afbe59
mov r9d, dword [rbp]
lea eax, [r9 + 8]
cmp eax, r9d
jb 0x7ff74b20b51
mov ecx, eax
call qword [0x7ff74b585f0]
mov rdi, rax
cmp rax, rbx
je 0x7ff74afbec5
mov dword [rax], 0x70616548
mov r9d, dword [rbp]
add rdi, 8
cmp rdi, rbx
jne 0x7ff74afbe89
jmp 0x7ff74afbec5
call qword [0x7ff74b585f8]
nop
jmp 0x7ff74afbec5
mov r9, qword [r14 + 0x10]
cmp r9, rbx
je 0x7ff74b20b78
mov rbx, qword [r9 + 0x10]
mov r9, qword [r9 + 8]
mov r8, qword [rbp + 0x10]
mov edx, dword [rbp + 4]
mov rcx, r14
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
call fcn.7ff74b3dd10
nop
jmp 0x7ff74b0d1a9