Function at 0x14002aff0
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x264
mov eax, dword [r14 + rdi]
mov edx, 0x260
test al, 1
jne 0x1400273cd
or eax, 1
mov dword [r14 + rdi], eax
lea rcx, [rdi + rdx]
call fcn.14000f490
nop
lea rbx, [rdi + rdx]
lea rbp, [0x1401d8ef0]
cmp byte [rbx + 1], 0
je 0x140027415
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
mov rcx, rbp
call fcn.1400157b0
mov rax, qword [0x1401d8ef0]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140017280
movzx edx, al
mov rcx, rbp
call fcn.140017120
mov rcx, rbp
call fcn.140014f70
mov eax, dword [r14 + rdi]
test al, 1
jne 0x14002742d
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000f490
nop
cmp byte [rbx + 1], 0
je 0x14002746a
lea rdx, str.Start_Minifilter
mov rcx, rbp
call fcn.1400157b0
mov rax, qword [0x1401d8ef0]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140017280
movzx edx, al
mov rcx, rbp
call fcn.140017120
mov rcx, rbp
call fcn.140014f70
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x14002aff0
push rbx
sub rsp, 0x140
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14002b11a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 1
lea rcx, [rsp + 0x20]
cmp eax, 0x420
jne 0x14002b080
call fcn.140018940
xor eax, eax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x30]
call fcn.140019950
lea rcx, [rsp + 0x30]
call fcn.140018b30
nop
lea rcx, [rsp + 0x20]
call fcn.140017b70
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
call fcn.140018940
xor eax, eax
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x128], rax
mov word [rsp + 0x118], ax
cmp ebx, 2
jne 0x14002b0da
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x30]
call fcn.140019950
lea rcx, [rsp + 0x30]
call fcn.140018b30
nop
lea rcx, [rsp + 0x20]
call fcn.140017b70
lea eax, [rbx + 0x6c]
add rsp, 0x140
pop rbx
ret
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x30]
call fcn.140019950
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14002a6c0
lea rcx, [rsp + 0x30]
call fcn.140018b30
nop
lea rcx, [rsp + 0x20]
call fcn.140017b70
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x264
mov eax, dword [rcx + rdx]
mov r8d, 0x260
test al, 1
jne 0x14002b148
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [rdx + r8]
call fcn.14000f490
nop
cmp byte [rdx + r8 + 1], 0
je 0x14002b18e
lea rdx, str.Service_started_successfully.
lea rbx, [0x1401d8ef0]
mov rcx, rbx
call fcn.1400157b0
mov rax, qword [0x1401d8ef0]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140017280
movzx edx, al
mov rcx, rbx
call fcn.140017120
mov rcx, rbx
call fcn.140014f70
xor eax, eax
add rsp, 0x140
pop rbx
ret