Function at 0x140007120
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
movzx r14d, byte [0x140085a9d]
mov r15, qword [0x1400862e0]
xor r12d, r12d
mov qword [rsp + 0x48], r12
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
lea edx, [r12 + 2]
lea rcx, [rsp + 0x60]
call fcn.14003e3cc
mov dword [rsp + 0x40], r12d
mov byte [rbp - 0x50], 1
cmp byte [0x140085acc], r12b
jne 0x1400071c0
xor edx, edx
call fcn.140011dd0
mov byte [0x140085acb], al
lea edx, [r12 + 2]
call fcn.140011dd0
mov byte [0x140085acc], 1
cmp byte [0x140085acb], 0
je 0x1400073fb
xor edx, edx
xor ecx, ecx
mov r8d, 0x20001
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140007252
mov r8d, 0x84
lea rdx, str.Schedule
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14000720e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140007252
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x140007252
cmp dword [rsp + 0x24], 4
je 0x1400073fb
lea rdx, str.Schedule
call fcn.14002e060
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x25]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400072e5
mov r8d, 0xf01ff
lea rdx, str.Schedule
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400072dc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400072d3
mov eax, dword [rsp + 0x24]
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x1400072d3
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14b, r14b
jne 0x1400073fb
xor edx, edx
xor ecx, ecx
mov r8d, 0x20001
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140007373
mov r8d, 0x84
lea rdx, str.Schedule
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14000732f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140007373
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x140007373
cmp dword [rsp + 0x24], 4
je 0x1400073fb
mov word [rbp - 0x40], r12w
mov r9d, 0x3ff
lea r8, [rbp - 0x40]
mov edx, 0x2ff
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1400073de
cmp byte [0x14007fca8], al
je 0x1400073b0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], 0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp - 0x40]
mov edx, 0x2ff
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x1400073de
mov word [rbp - 0x40], r12w
mov r9d, InitCommonControls
lea r8, [0x14006d5e8]
lea rdx, [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor bl, bl
jmp 0x1400073fd
mov bl, 1
lea rcx, [rsp + 0x60]
call fcn.14003e3c8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140007470
mov rdx, qword [rsp + 0x50]
call fcn.14000ebe0
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
sub rcx, r8
movabs rax, 0x4924924924924925
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x38
mov rax, r8
cmp rdx, 0x1000
jb 0x140007468
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000748f
mov rcx, r8
call fcn.14003eed0
movzx eax, bl
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14004b3fc
int3