Function at 0x140012550
Capabilities:
Query service status
Start service

Disassembly:
push rbp
push rsi
push r12
push r13
sub rsp, 0x288
mov rax, qword [0x140030f90]
xor rax, rsp
mov qword [rsp + 0x260], rax
cmp edx, 1
movzx r12d, r9b
mov rsi, r8
mov r13d, edx
mov ebp, ecx
jge 0x140012590
mov ecx, 1
call fcn.140009fb0
jmp 0x14001291b
mov qword [rsp + 0x2c8], rbx
mov ecx, 5
mov qword [rsp + 0x278], r14
mov r14, qword [r8]
call fcn.14000ee10
mov rbx, rax
test rax, rax
jne 0x1400125da
call fcn.140017f4c
mov edx, 0x400001fb
lea rcx, [rax + 0x60]
call fcn.1400026b0
xor esi, esi
test r12b, r12b
mov eax, 2
cmovne eax, esi
jmp 0x14001290b
mov qword [rsp + 0x280], rdi
mov r8d, 4
test ebp, ebp
je 0x14001261b
cmp ebp, 1
je 0x140012613
cmp ebp, 1
jbe 0x140012621
cmp ebp, 3
jbe 0x14001260b
cmp ebp, 0x80
jne 0x140012621
mov r8d, 0x104
jmp 0x140012621
mov r8d, 0x44
jmp 0x140012621
mov r8d, 0x24
jmp 0x140012621
mov r8d, 0x14
lea r9, [rsp + 0x60]
mov rdx, r14
mov rcx, rax
mov dword [rsp + 0x20], 0x100
call fcn.14000ee50
mov rdi, rax
test rax, rax
jne 0x14001265c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
test r12b, r12b
mov eax, 3
cmovne eax, esi
jmp 0x140012903
test ebp, ebp
jne 0x1400127d5
mov r8, rsi
mov edx, r13d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
cmp ebp, 0x3e5
jne 0x140012695
mov ebp, esi
jmp 0x14001269e
test r13d, r13d
je 0x14001278a
xor r9d, r9d
xor edx, edx
mov r8d, 0x20019
mov rcx, r14
mov dword [rsp + 0x30], esi
call fcn.14000cd00
mov rbx, rax
test rax, rax
je 0x1400126f0
lea r8, [rsp + 0x30]
lea rdx, str.AppThrottle
xor r9d, r9d
mov rcx, rax
call fcn.14000c0f0
mov ecx, dword [rsp + 0x30]
mov edx, 0x5dc
cmp eax, 1
cmovne ecx, edx
mov dword [rsp + 0x30], ecx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 1
mov rdx, rdi
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.14000e700
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x14001275e
xor ecx, ecx
call fcn.1400111a0
mov ecx, dword [rsp + 0x3c]
mov rdi, rax
call fcn.1400112b0
mov rbx, rax
call fcn.140017f4c
lea r8, [rsp + 0x60]
lea rcx, [rax + 0x60]
mov r9, rbx
mov edx, 0x40000227
mov qword [rsp + 0x20], rdi
call fcn.1400026b0
test r12b, r12b
sete sil
jmp 0x140012901
mov ecx, ebp
call fcn.140002430
xor ecx, ecx
mov r9, rax
call fcn.1400111a0
lea rdx, [rsp + 0x60]
lea rcx, str._s:__s:__s
mov r8, rax
call fcn.1400194c0
xor eax, eax
jmp 0x140012903
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebp
call fcn.140002430
xor ecx, ecx
mov rdi, rax
call fcn.1400111a0
mov rbx, rax
call fcn.140017f4c
lea r8, [rsp + 0x60]
lea rdx, str._s:__s:__s
lea rcx, [rax + 0x60]
mov r9, rbx
mov qword [rsp + 0x20], rdi
call fcn.140018cf0
test r12b, r12b
sete sil
jmp 0x140012901
cmp ebp, 4
jne 0x140012850
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x14001281b
mov ecx, dword [rsp + 0x3c]
call fcn.1400112b0
lea rcx, [0x140026e48]
mov rdx, rax
call fcn.1400194c0
xor esi, esi
test r12b, r12b
cmovne esi, dword [rsp + 0x3c]
jmp 0x140012901
mov ecx, eax
call fcn.140002430
mov rbx, rax
call fcn.140017f4c
lea r8, [rsp + 0x60]
lea rdx, str._s:__s_n
lea rcx, [rax + 0x60]
mov r9, rbx
call fcn.140018cf0
xor esi, esi
test r12b, r12b
sete sil
jmp 0x140012901
lea r8, [rsp + 0x38]
mov edx, ebp
mov rcx, rax
mov qword [rsp + 0x270], r15
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov r15d, dword [rsp + 0x3c]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov r13d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
cmp r13d, 0x3e5
jne 0x140012892
mov r13d, esi
jmp 0x14001289b
test r14d, r14d
je 0x140012969
lea r8, [rsp + 0x38]
mov r9d, r15d
mov rdx, rdi
mov ecx, ebp
call fcn.14000e7e0
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x140012939
mov ecx, ebp
call fcn.1400111a0
mov ecx, dword [rsp + 0x3c]
mov rdi, rax
call fcn.1400112b0
mov rbx, rax
call fcn.140017f4c
lea r8, [rsp + 0x60]
lea rcx, [rax + 0x60]
mov r9, rbx
mov edx, 0x40000227
mov qword [rsp + 0x20], rdi
call fcn.1400026b0
test r12b, r12b
sete sil
mov r15, qword [rsp + 0x270]
mov eax, esi
mov rdi, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2c8]
mov r14, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140018800
add rsp, 0x288
pop r13
pop r12
pop rsi
pop rbp
ret
mov ecx, r13d
call fcn.140002430
mov ecx, ebp
mov r9, rax
call fcn.1400111a0
lea rdx, [rsp + 0x60]
lea rcx, str._s:__s:__s
mov r8, rax
call fcn.1400194c0
test r12b, r12b
cmovne esi, dword [rsp + 0x3c]
jmp 0x1400128f9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, r13d
call fcn.140002430
mov ecx, ebp
mov rdi, rax
call fcn.1400111a0
mov rbx, rax
call fcn.140017f4c
lea r8, [rsp + 0x60]
lea rdx, str._s:__s:__s
lea rcx, [rax + 0x60]
mov r9, rbx
mov qword [rsp + 0x20], rdi
call fcn.140018cf0
cmp r13d, 0x426
jne 0x1400128f2
cmp ebp, 5
je 0x1400129c4
cmp ebp, 1
jne 0x1400128f2
test r12b, r12b
setne sil
jmp 0x1400128f9