Function at 0x140012e00
Capabilities:
Create process on windows
Resume thread

Disassembly:
push rbx
mov eax, 0x10130
call fcn.140024ca0
sub rsp, rax
mov rax, qword [0x140030f90]
xor rax, rsp
mov qword [rsp + 0x10110], rax
cmp qword [rcx + 0x70520], 0
mov rbx, rcx
mov byte [rcx + 0x7053c], 0
je 0x140012e3c
xor eax, eax
jmp 0x140013382
inc dword [rcx + 0x705e4]
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
mov qword [rsp + 0x10148], rbp
mov qword [rsp + 0x10158], rdi
call fcn.140018830
xor eax, eax
lea rdx, [rsp + 0x80]
mov rcx, rbx
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.14000dd40
test eax, eax
je 0x140012ece
mov edi, 1
lea r8, [rbx + 2]
xor r9d, r9d
movzx ecx, di
mov edx, 0xc00003ec
call fcn.1400025f0
mov rcx, rbx
call fcn.14000edf0
lea edx, [rdi + 1]
movzx r9d, dil
movzx r8d, dil
mov rcx, rbx
call fcn.140011450
jmp 0x140013372
lea rax, [rbx + 0x28428]
mov qword [rsp + 0x10150], rsi
mov qword [rsp + 0x10128], r12
mov qword [rsp + 0x28], rax
lea r12, [rbx + 0x1842a]
lea r9, str.__s___s
lea rcx, [rsp + 0x110]
or r8, 0xffffffffffffffff
mov edx, 0x8000
mov qword [rsp + 0x20], r12
call fcn.140018170
test eax, eax
jns 0x140012f5e
mov edi, 1
lea r9, str.start_service
lea r8, str.command_line
xor esi, esi
mov edx, 0xc00003eb
movzx ecx, di
mov qword [rsp + 0x20], rsi
call fcn.1400025f0
mov rcx, rbx
call fcn.14000edf0
lea edx, [rdi + 1]
movzx r9d, dil
movzx r8d, dil
mov rcx, rbx
call fcn.140011450
jmp 0x140013362
mov rcx, rbx
mov qword [rsp + 0x10120], r13
call fcn.140011640
mov rcx, qword [rbx + 0x70518]
lea rdx, [rbx + 0x704f8]
mov ebp, 2
mov dword [rbx + 0x70500], 0x45
mov dword [rbx + 0x704fc], ebp
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor esi, esi
mov dword [rsp + 0x50], esi
lea edi, [rbp - 1]
cmp byte [rbx + 0x7053d], sil
je 0x14001329f
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.140009600
test eax, eax
je 0x140013008
lea r8, [rbx + 2]
xor r9d, r9d
mov edx, 0xc000041b
movzx ecx, di
call fcn.1400025f0
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, [rsp + 0x80]
call fcn.140008830
mov rcx, rbx
call fcn.14000edf0
lea edx, [rbp + 2]
movzx r9d, dil
movzx r8d, dil
mov rcx, rbx
call fcn.140011450
jmp 0x14001335a
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rax, [rsp + 0x50]
mov byte [rsp + 0x30], sil
lea r9, [0x140026c20]
lea r8, str.Start
lea rcx, [0x140062158]
mov rdx, rbx
mov dword [rsp + 0x28], 0x4e20
mov qword [rsp + 0x20], rax
call fcn.1400070a0
cmp eax, 0x63
jne 0x1400130be
lea r9, [0x1400272a8]
lea edx, [rax - 0x53]
lea rcx, [rsp + 0xf0]
or r8, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call fcn.140018170
lea rax, [rsp + 0xf0]
lea r11, [rbx + 2]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea r9, [0x140026c20]
lea r8, str.Start
mov edx, 0x40000437
movzx ecx, di
mov qword [rsp + 0x20], r11
call fcn.1400025f0
mov rcx, rbx
call fcn.14000edf0
movzx r9d, dil
movzx r8d, dil
mov edx, 5
mov rcx, rbx
call fcn.140011450
jmp 0x14001335a
mov rcx, rbx
call fcn.14000ed90
xor r11b, r11b
bt dword [rsp + 0xbc], 8
movzx ecx, r11b
cmovb ecx, edi
call fcn.14000ecd0
mov edx, eax
and edx, dword [rbx + 0x4043c]
cmp qword [rbx + 0x40418], rsi
je 0x1400130f2
or edx, 4
cmp dword [rbx + 0x40440], esi
jne 0x1400130fd
or edx, 0x10
movzx ecx, cl
lea r8, [rsp + 0x60]
lea rax, [rbx + 0x30426]
mov qword [rsp + 0x48], r8
lea r8, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x110]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400131a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
lea r8, [rbx + 2]
mov r9, r12
mov edx, 0xc00003f2
movzx ecx, di
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.1400025f0
lea rcx, [rsp + 0x80]
call fcn.140008830
mov rcx, rbx
call fcn.14000edf0
movzx r9d, dil
movzx r8d, dil
mov edx, 3
mov rcx, rbx
call fcn.140011450
jmp 0x14001335a
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x70]
inc dword [rbx + 0x705e8]
lea rdx, [rbx + 0x705c8]
mov qword [rbx + 0x70520], rcx
mov dword [rbx + 0x70528], eax
call fcn.14000aa00
test eax, eax
je 0x1400131de
xor eax, eax
mov dword [rbx + 0x705c8], eax
mov dword [rbx + 0x705cc], eax
lea rcx, [rsp + 0x80]
call fcn.140008830
cmp qword [rbx + 0x40418], rsi
je 0x14001329f
mov rcx, qword [rbx + 0x70520]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x140013226
mov rdx, qword [rsp + 0x78]
and rdx, qword [rbx + 0x40418]
mov qword [rsp + 0x58], rdx
jmp 0x14001325d
mov rax, qword [rbx + 0x40418]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
lea r8, [rbx + 2]
mov edx, 0x8000042d
movzx ecx, di
mov r9, rax
mov qword [rsp + 0x20], rsi
call fcn.1400025f0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x70520]
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
jne 0x140013294
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002430
lea r8, [rbx + 2]
mov edx, 0xc000042e
movzx ecx, bp
mov r9, rax
mov qword [rsp + 0x20], rsi
call fcn.1400025f0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call fcn.14000edf0
mov eax, dword [rbx + 0x704d4]
mov r8, qword [rbx + 0x70520]
mov rcx, qword [rbx + 0x70518]
mov dword [rsp + 0x28], eax
lea rax, str.start_service
lea r9, [rbx + 2]
lea rdx, [rbx + 0x704f8]
mov qword [rsp + 0x20], rax
call fcn.140011840
cmp eax, edi
jne 0x1400132e5
mov dword [rbx + 0x70540], esi
cmp byte [rbx + 0x7053d], sil
je 0x140013358
mov rcx, qword [rbx + 0x70518]
and dword [rbx + 0x70500], 0xfffffffd
lea rdx, [rbx + 0x704f8]
mov dword [rbx + 0x704fc], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [rbx + 0x70540], esi
jne 0x140013342
lea rax, [rsp + 0x50]
lea r9, str.Post
lea r8, str.Start
lea rcx, [0x140062158]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140007960
cmp dword [rbx + 0x704d0], esi
je 0x140013358
cmp dword [rbx + 0x70540], esi
jne 0x140013358
mov dword [rbx + 0x70540], edi
xor eax, eax
mov r13, qword [rsp + 0x10120]
mov rsi, qword [rsp + 0x10150]
mov r12, qword [rsp + 0x10128]
mov rbp, qword [rsp + 0x10148]
mov rdi, qword [rsp + 0x10158]
mov rcx, qword [rsp + 0x10110]
xor rcx, rsp
call fcn.140018800
add rsp, 0x10130
pop rbx
ret