Function at 0x14000c780
Capabilities:
Start service

Disassembly:
mov dword ss:[rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x58
mov r12, rcx
mov ebp, r8d
lea rax, str.EnableServiceProgressDialog
mov qword [rsp + 0x40], 0x36
xor dil, dil
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x30], dil
mov r13, rdx
mov sil, 1
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test ebp, ebp
je 0x14000c91a
test eax, eax
je 0x14000c929
test ebp, ebp
je 0x14000c7f1
mov rcx, r13
mov edx, ebp
nop
mov rax, qword [rcx]
lock inc dword [rax - 8]
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14000c7e0
test byte [0x1402c02b0], sil
jne 0x14000c892
lock bts qword [0x1402c02b0], 0x1f
setb al
test al, al
jne 0x14000c87b
mov rdx, qword [0x1402ca978]
mov ecx, 0x40
call sym.SystemInformer.exe_PhCreateObject
xor ecx, ecx
mov r8, rax
mov word [rax], cx
mov eax, 1
lock xadd dword [0x1402ca970], eax
movzx edx, al
lea rax, [0x14000c640]
mov qword [r8 + 8], rax
lea rax, str.ServiceProgressObjectType
mov qword [r8 + 0x10], rax
lea rax, [0x1402ced00]
mov dword [r8 + 4], ecx
lea rcx, [0x1402c02b0]
mov qword [rax + rdx*8], r8
mov byte [r8 + 2], dl
mov qword [0x1402cac60], r8
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x14000c892
test byte [0x1402c02b0], sil
jne 0x14000c892
xor edx, edx
lea rcx, [0x1402c02b0]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rdx, qword [0x1402cac60]
mov ecx, 0x60
call sym.SystemInformer.exe_PhCreateObject
mov rbx, rax
lea r9, str.Starting_a_service_might_prevent_the_system_from_functioning_properly.
xorps xmm0, xmm0
mov ecx, ebp
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
and byte [rbx + 0x45], 0xfe
mov qword [rax + 8], r12
lea rax, str.start
mov qword [rbx + 0x18], rax
lea rax, [0x14000c6e0]
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x20], r9
mov dword [rbx + 0x58], 1
call sym.SystemInformer.exe_PhCreateList
mov r8d, ebp
mov qword [rbx + 0x38], rax
mov rdx, r13
mov rcx, rax
call sym.SystemInformer.exe_PhAddItemsList
mov rdx, rbx
lea rcx, [0x14000c360]
call sym.SystemInformer.exe_PhCreateThread2
xor al, al
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rax, str.EnableWarnings
mov qword [rsp + 0x40], 0x1c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x14000c984
lea rax, str.the_selected_services
mov byte [rsp + 0x20], dil
cmp ebp, 1
lea r8, str.the_selected_service
lea r9, str.Starting_a_service_might_prevent_the_system_from_functioning_properly.
mov rcx, r12
cmovne r8, rax
lea rdx, str.start
call sym.SystemInformer.exe_PhShowConfirmMessage
nop dword [rax]
test al, al
je 0x14000c91a
xor ebx, ebx
mov dword [rsp + 0x38], ebx
test ebp, ebp
je 0x14000cf2b
mov qword [rsp + 0x90], r14
lea r14, [0x14023a10c]
mov qword [rsp + 0x50], r15
lea r15, [0x1402386c8]
nop dword [rax]
mov rax, qword [r13]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000c9c3
mov r8, qword [rcx + 8]
jmp 0x14000c9c6
mov r8, rbx
mov edx, 0x10
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_PhOpenService
mov ebp, eax
test eax, eax
js 0x14000ca2f
mov rbx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14000ca5c
cmp dword [0x1402bff40], 0xffffffff
jae 0x14000ca0e
mov rax, qword gs:[0x30]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rax + 0x68]
jmp 0x14000ca14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov ebp, eax
test eax, eax
jns 0x14000ca5c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
xor sil, sil
mov byte [rsp + 0xa8], sil
test dil, dil
jne 0x14000cde9
mov rax, qword [r13]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000ca6d
mov r14, qword [rcx + 8]
jmp 0x14000ca70
mov rcx, rbx
mov sil, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000cef7
mov r14, rbx
lea r8, str.Unable_to_start
xorps xmm1, xmm1
mov rax, r8
mov rcx, r8
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000caad
movdqu xmm0, xmmword ds:[rax]
pcmpeqw xmm0, xmm1
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
mov dword [rsp + 0x34], ecx
je 0x14000caa9
mov eax, ecx
shr rax, 1
jmp 0x14000caea
add rax, 0x10
movdqu xmm0, xmmword [rax]
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rsp + 0x34], edx
jne 0x14000cadc
movdqu xmm0, xmmword [rax + 0x10]
add rax, 0x10
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rsp + 0x34], edx
je 0x14000cac2
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rsi, r14
lea r15, [rax + rax]
and rsi, 0xfffffffffffffff1
mov ecx, r14d
and ecx, 0xf
je 0x14000cb1f
movdqu xmm0, xmmword [rsi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x34], ecx
je 0x14000cb1b
mov esi, ecx
shr rsi, 1
jmp 0x14000cb68
add rsi, 0x10
movdqu xmm0, xmmword [rsi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x34], ecx
jne 0x14000cb5a
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rsi + 0x10]
add rsi, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x34], ecx
je 0x14000cb40
sub rsi, r14
mov eax, ecx
sar rsi, 1
shr rax, 1
add rsi, rax
mov rdx, qword [0x1402ca998]
add rsi, rsi
lea rbx, [rsi + r15]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov rdi, rax
lea rdx, str.Unable_to_start
xor ecx, ecx
mov r8, r15
mov qword [rax], rbx
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + rbx], cx
mov rcx, qword [rdi + 8]
call fcn.14020af00
mov rcx, qword [rdi + 8]
mov r8, rsi
add rcx, r15
mov rdx, r14
call fcn.14020af00
mov rcx, rdi
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x31]
mov r8d, ebp
mov rcx, r12
mov rdx, qword [rax + 8]
call fcn.140001ae0
nop dword [rax]
test al, al
je 0x14000cdd3
cmp byte [rsp + 0x31], 0
je 0x14000cdb7
mov rax, qword ds:[r13]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000cc09
mov rcx, qword [rcx + 8]
mov edx, 1
call fcn.1400a3cc0
mov ebx, eax
test eax, eax
js 0x14000cc2d
mov sil, 1
lea r14, [0x14023a10c]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cef2
mov rax, qword [r13]
lea rdx, str.start
lea rcx, str.Unable_to__s__s.
mov r8, qword [rax + 0x10]
mov r8, qword [r8 + 8]
call fcn.140001a60
mov rdi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x14000cc8d
nop dword [rax + rax]
cmp ebx, 0xc0000005
je 0x14000cc8d
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000cc7b
movzx eax, bx
jmp 0x14000cc98
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000cc9c
mov eax, ebx
jmp 0x14000cc98
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14000cca8
lfence
mov ecx, ebx
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14000ccb2
lfence
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
mov rbx, rax
mov rcx, r12
mov r8d, 0xfffe
test rdi, rdi
je 0x14000cd0a
test rax, rax
je 0x14000ccd1
mov edx, 0x21
jmp 0x14000cd1b
lea r14, [0x14023a10c]
mov qword [rsp + 0x28], rdi
lea r9, [0x1402386c8]
mov qword [rsp + 0x20], r14
mov edx, 9
call sym.SystemInformer.exe_PhShowMessage2
movzx esi, byte ds:[rsp + 0xa8]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cef2
mov edx, 9
test rbx, rbx
je 0x14000cd7e
lea rdi, [0x1402386c8]
mov r10d, 8
lea r9, [0x14023a10c]
mov rax, rbx
lfence
mov rax, qword [r10 + rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, rdi
call sym.SystemInformer.exe_PhShowMessage2
lfence
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000cd65
lfence
call fcn.140141ea0
movzx esi, byte [rsp + 0xa8]
lea r14, [0x14023a10c]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cef2
lea rax, [0x1402386c8]
mov qword ss:[rsp + 0x28], rax
lea r14, [0x14023a10c]
lea r9, str.Unable_to_perform_the_operation.
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhShowMessage2
movzx esi, byte [rsp + 0xa8]
call sym.SystemInformer.exe_PhUiDisconnectFromPhSvc
jmp 0x14000cef2
movzx esi, byte [rsp + 0xa8]
lea r14, [0x14023a10c]
mov dil, 1
mov byte [rsp + 0x30], dil
jmp 0x14000cef7
movzx esi, byte [rsp + 0xa8]
lea r14, [0x14023a10c]
lea r15, [0x1402386c8]
mov rax, qword [r13]
lea rdx, str.start
lea rcx, str.Unable_to__s__s.
mov r8, qword [rax + 0x10]
mov r8, qword [r8 + 8]
call fcn.140001a60
mov rdi, qword [rax + 8]
cmp ebp, 0xc0000022
je 0x14000ce42
cmp ebp, 0xc0000005
je 0x14000ce42
mov eax, ebp
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000ce2f
movzx eax, bp
jmp 0x14000ce4a
mov eax, ebp
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000ce4e
mov eax, ebp
jmp 0x14000ce4a
mov ecx, ebp
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14000ce57
mov ecx, ebp
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x14000ce5e
mov ecx, eax
call sym.SystemInformer.exe_PhGetWin32Message
mov rbx, rax
mov rcx, r12
mov r8d, 0xfffe
test rdi, rdi
je 0x14000ce85
test rax, rax
je 0x14000ce7b
mov edx, 0x21
jmp 0x14000ce92
mov qword [rsp + 0x28], rdi
mov r9, r15
jmp 0x14000cedc
test rbx, rbx
je 0x14000ced0
mov edx, 9
mov rdi, r15
mov r10d, 8
mov rax, rbx
mov r9, r14
mov r9, rdi
mov rax, qword [r10 + rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhShowMessage2
mov edi, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000ceed
call fcn.140141ea0
jmp 0x14000ceed
mov qword [rsp + 0x28], r15
lea r9, str.Unable_to_perform_the_operation.
mov edx, 9
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhShowMessage2
mov edi, eax
cmp edi, 1
jne 0x14000cf1e
movzx edi, byte [rsp + 0x30]
mov edx, dword [rsp + 0x38]
lea r15, [0x1402386c8]
inc edx
add r13, 8
mov ebx, 0
mov dword [rsp + 0x38], edx
cmp edx, dword [rsp + 0xa0]
jb 0x14000c9b0
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x50]
movzx eax, sil
add rsp, 0x58
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret