Function at 0x140035f00
Capabilities:
Query service status
Resolve function by parsing pe exports
Start service

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x758
mov rax, qword [0x1400dd078]
xor rax, rsp
mov qword [rsp + 0x740], rax
mov dword [rsp + 0x50], 0
mov byte [rsp + 0x20], 0
mov r8d, 4
lea rdx, [0x1400c6590]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140036009
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov edx, 1
lea rcx, [rsp + 0x370]
call fcn.14003aba0
nop
lea rdx, [0x1400c6570]
lea rcx, [rsp + 0x370]
call fcn.14001d2a0
mov qword [rsp + 0x58], rax
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
call fcn.140005ba0
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x370]
call fcn.14003aac0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x128]
call fcn.14002d0f0
lea rdx, [0x1400da9c8]
lea rcx, [rsp + 0x128]
call fcn.140065380
nop
lea rcx, [rsp + 0x660]
call fcn.140019710
lea rcx, [rsp + 0x370]
call fcn.14002d320
jmp 0x14003650c
mov rcx, qword [rsp + 0x768]
call fcn.1400196d0
mov r8d, 0x14
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003616e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
mov edx, 1
lea rcx, [rsp + 0x460]
call fcn.14003aba0
nop
lea rdx, [0x1400c6640]
lea rcx, [rsp + 0x460]
call fcn.14001d2a0
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x768]
call fcn.1400196d0
mov rdx, rax
lea rcx, [rsp + 0x680]
call fcn.1400426d0
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.140017ba0
lea rdx, [0x1400c6658]
mov rcx, rax
call fcn.14001d2a0
mov qword [rsp + 0x90], rax
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x90]
call fcn.140005ba0
nop
lea rcx, [rsp + 0x680]
call fcn.140019710
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x460]
call fcn.14003aac0
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x140]
call fcn.14002d0f0
lea rdx, [0x1400da9c8]
lea rcx, [rsp + 0x140]
call fcn.140065380
nop
lea rcx, [rsp + 0x6a0]
call fcn.140019710
lea rcx, [rsp + 0x460]
call fcn.14002d320
jmp 0x140036501
lea rax, str._service
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x110]
call fcn.1400392b0
nop
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x110]
call fcn.140039110
xor edx, edx
lea rcx, [rsp + 0x110]
call fcn.1400390b0
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x110]
call fcn.1400390e0
mov dword [rsp + 0x38], eax
mov r8, qword [rsp + 0xb0]
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140036326
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
mov edx, 1
lea rcx, [rsp + 0x550]
call fcn.14003aba0
nop
lea rdx, str.StartServiceW_failed_for
lea rcx, [rsp + 0x550]
call fcn.14001d2a0
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0x768]
call fcn.1400196d0
mov rdx, rax
lea rcx, [rsp + 0x6c0]
call fcn.1400426d0
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
call fcn.140017ba0
lea rdx, [0x1400c6610]
mov rcx, rax
call fcn.14001d2a0
mov qword [rsp + 0xd8], rax
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0xd8]
call fcn.140005ba0
nop
lea rcx, [rsp + 0x6c0]
call fcn.140019710
lea rdx, [rsp + 0x6e0]
lea rcx, [rsp + 0x550]
call fcn.14003aac0
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x158]
call fcn.14002d0f0
lea rdx, [0x1400da9c8]
lea rcx, [rsp + 0x158]
call fcn.140065380
nop
lea rcx, [rsp + 0x6e0]
call fcn.140019710
lea rcx, [rsp + 0x550]
call fcn.14002d320
jmp 0x1400364e8
cmp dword [rsp + 0x770], 0
je 0x1400364e3
mov eax, dword [rsp + 0x770]
cdq
mov ecx, 0x1f4
idiv ecx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x24], 0
jmp 0x14003635b
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x24], eax
jge 0x1400364dc
lfence
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x640]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400364cb
mov edx, 1
lea rcx, [rsp + 0x170]
call fcn.14003aba0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x720]
call fcn.140016240
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x170]
call fcn.14003aa90
nop
lea rcx, [rsp + 0x720]
call fcn.140019710
lea rdx, str.QueryServiceStatus_failed_with_error
lea rcx, [rsp + 0x170]
call fcn.14001d2a0
mov qword [rsp + 0x100], rax
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x100]
call fcn.140005ba0
call fcn.14001c880
mov rcx, rax
call fcn.140011b70
mov r8d, 2
mov rdx, rax
lea rcx, [rsp + 0x260]
call fcn.140017560
nop
jmp 0x140036452
mov byte [rsp + 0x368], 1
movzx eax, byte [rsp + 0x368]
test eax, eax
jne 0x14003649f
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x170]
call fcn.14003aac0
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x260]
call fcn.14003d6b0
lea rcx, [rsp + 0x700]
call fcn.140019710
jmp 0x14003644a
lea rcx, [rsp + 0x260]
call fcn.1400162f0
nop
lea rcx, [rsp + 0x170]
call fcn.14002d320
jmp 0x1400364dc
cmp dword [rsp + 0x644], 4
jne 0x1400364d7
jmp 0x1400364dc
jmp 0x140036351
mov byte [rsp + 0x20], 1
jmp 0x1400364e8
mov byte [rsp + 0x20], 1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x110]
call fcn.140039290
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x740]
xor rcx, rsp
call fcn.1400620b0
add rsp, 0x758
ret