Function at 0x140194be0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rdi
sub rsp, 0xb0
mov rbx, rdx
mov qword [rax + 8], rsi
mov qword [rax + 0x20], r13
lea rdx, str.STARTSERVICE
mov r13, rcx
lea rcx, [rbx + 0x6b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140194d4f
lea rcx, [rbx + 0x7d0]
mov qword [rsp + 0xa0], r15
xor r9d, r9d
lea r8, [rsp + 0xd8]
lea rdx, str.SERVICE
call fcn.1400ea100
mov r15, rax
test rax, rax
je 0x140194d47
mov qword [rsp + 0xe0], r12
lea r8, [rsp + 0xd8]
xor r9d, r9d
mov qword [rsp + 0xa8], r14
lea rdx, str.NAME
mov rcx, rax
call fcn.1400ea100
xor r9d, r9d
lea r8, [rsp + 0xd8]
lea rdx, str.DESC
mov rcx, r15
mov r12, rax
call fcn.1400ea100
xor r9d, r9d
lea r8, [rsp + 0xd8]
lea rdx, str.TYPE
mov rcx, r15
mov r14, rax
call fcn.1400ea100
xor r9d, r9d
lea r8, [rsp + 0xd8]
lea rdx, str.START
mov rcx, r15
mov rbp, rax
call fcn.1400ea100
mov rcx, r15
mov rdi, rax
call fcn.14024c3e8
test r12, r12
je 0x140194d10
test r14, r14
je 0x140194d08
test rbp, rbp
je 0x140194d08
test rdi, rdi
je 0x140194d08
lea rdx, [rbx + 0x9d4]
mov qword [rsp + 0x28], rdi
mov r9, r14
mov qword [rsp + 0x20], rbp
mov r8, r12
mov rcx, r13
call fcn.14019fc20
mov rcx, r12
call fcn.14024c3e8
mov r12, qword [rsp + 0xe0]
test r14, r14
je 0x140194d25
mov rcx, r14
call fcn.14024c3e8
mov r14, qword [rsp + 0xa8]
test rbp, rbp
je 0x140194d3a
mov rcx, rbp
call fcn.14024c3e8
test rdi, rdi
je 0x140194d47
mov rcx, rdi
call fcn.14024c3e8
mov r15, qword [rsp + 0xa0]
lea rdx, str.REGSVR32
lea rcx, [rbx + 0x6b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov r13, qword [rsp + 0xe8]
test eax, eax
jne 0x140194da4
lea rcx, [rbx + 0x9d4]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140194da4
lea rdx, str.DllRegisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140194d9b
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, str.EXECUTEASYNC
lea rcx, [rbx + 0x6b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea rbp, [0x140299514]
test eax, eax
jne 0x140194e08
mov rcx, qword [0x14037adb0]
lea rdx, [rbx + 0x9d4]
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
je 0x140194e08
lea r9, [rbx + 0x7d0]
mov dword [rsp + 0x28], 1
lea r8, [rbx + 0x9d4]
mov qword [rsp + 0x20], 0
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.EXECUTESYNC
lea rcx, [rbx + 0x6b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rsi, qword [rsp + 0xd0]
test eax, eax
jne 0x140194ebd
mov rcx, qword [0x14037adb0]
lea rdi, [rbx + 0x9d4]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xc0]
test eax, eax
je 0x140194ebd
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x70]
call fcn.140249b10
lea rax, [rbx + 0x7d0]
mov dword [rsp + 0x30], WSACleanup
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x34], 0x440
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x60], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x140194ebd
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140194ebd
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xb0
pop rdi
pop rbp
pop rbx
ret