Function at 0x14006b6f0
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x5c8
mov qword [rsp + 0x280], 0
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x50]
lea rcx, [0x1400f3c5c]
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x56]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fa
rep stosb byte [rdi], al
mov r8d, 0x80000000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14006b76c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
jmp 0x14006ba3d
lea r9, [rsp + 0x50]
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x200
lea rcx, [rsp + 0x290]
call fcn.14006d5c0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x290]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x490], eax
cmp dword [rsp + 0x490], 0
je 0x14006b7d4
call fcn.14006af10
movzx eax, al
mov dword [rsp + 0x270], eax
jmp 0x14006b7ea
mov dword [rsp + 0x270], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x270], 0
je 0x14006b910
mov r8d, socket
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
je 0x14006b8f1
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rsp + 0x278], eax
cmp dword [rsp + 0x278], 0
je 0x14006b856
cmp dword [rsp + 0x254], 4
je 0x14006b8d5
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14006b8d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
cmp dword [rsp + 0x274], 0x420
je 0x14006b8d5
cmp dword [rsp + 0x274], 0xb7
je 0x14006b8d5
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rsp + 0x48], 0
je 0x14006b8b4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14006bd2d
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x280], 0
jmp 0x14006b90b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006ba3d
cmp dword [rsp + 0x490], 0
je 0x14006b92b
call fcn.14006af10
movzx eax, al
mov dword [rsp + 0x270], eax
jmp 0x14006b936
mov dword [rsp + 0x270], 1
cmp dword [rsp + 0x270], 0
je 0x14006ba3d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x280], rax
cmp qword [rsp + 0x280], 0
je 0x14006ba23
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rsp + 0x278], eax
cmp dword [rsp + 0x278], 0
je 0x14006b9a2
cmp dword [rsp + 0x254], 4
je 0x14006ba07
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14006ba07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
cmp dword [rsp + 0x274], 0x420
je 0x14006ba07
cmp dword [rsp + 0x274], 0xb7
je 0x14006ba07
cmp qword [rsp + 0x48], 0
je 0x14006b9f3
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14006bd2d
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x280], 0
jmp 0x14006ba3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rsp + 0x48], 0
je 0x14006ba50
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, 0x178
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x498], rax
cmp qword [rsp + 0x498], 0
jne 0x14006ba9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14006bd2d
mov rax, qword [rsp + 0x498]
mov dword [rax + 0x48], 1
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov eax, eax
and rax, 0xffff
movzx eax, ax
cmp eax, 4
jne 0x14006bb3f
mov rcx, qword [rsp + 0x5e0]
call fcn.140099f30
mov qword [rsp + 0x5b0], rax
lea rcx, [0x1400f3c90]
call fcn.140099f30
mov rcx, qword [rsp + 0x5b0]
cmp rcx, rax
jbe 0x14006bb28
lea rcx, [0x1400f3ca8]
call fcn.140099f30
mov rcx, qword [rsp + 0x5e0]
add rcx, rax
mov rax, rcx
mov r9, rax
lea r8, str.._s
mov edx, 0x104
lea rcx, [rsp + 0x4a0]
call fcn.14006d5c0
jmp 0x14006bb3d
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x4a0]
call fcn.140096590
jmp 0x14006bbba
mov rcx, qword [rsp + 0x5e0]
call fcn.140099f30
mov qword [rsp + 0x5b8], rax
lea rcx, [0x1400f3cc0]
call fcn.140099f30
mov rcx, qword [rsp + 0x5b8]
cmp rcx, rax
jbe 0x14006bba5
lea rcx, [0x1400f3cd0]
call fcn.140099f30
mov rcx, qword [rsp + 0x5e0]
add rcx, rax
mov rax, rcx
mov r9, rax
lea r8, str..Global_s
mov edx, 0x104
lea rcx, [rsp + 0x4a0]
call fcn.14006d5c0
jmp 0x14006bbba
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x4a0]
call fcn.140096590
mov rax, qword [rsp + 0x498]
add rax, 8
mov r8d, 0x40
xor edx, edx
mov rcx, rax
call fcn.140096590
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rsp + 0x498]
mov qword [rcx], rax
mov rax, qword [rsp + 0x498]
cmp qword [rax], 0xffffffffffffffff
je 0x14006bce3
mov rcx, qword [rsp + 0x498]
call fcn.14006ae30
movzx eax, al
test eax, eax
jne 0x14006bc99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov rax, qword [rsp + 0x498]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14006bd2d
mov rcx, qword [rsp + 0x498]
call fcn.14006ad60
mov rax, qword [rsp + 0x498]
mov dword [rax + 0x170], 0
mov rax, qword [rsp + 0x498]
add rax, 0x5c
mov r8, qword [rsp + 0x5e0]
mov edx, 0x10c
mov rcx, rax
call fcn.14006d4e0
mov rax, qword [rsp + 0x498]
jmp 0x14006bd2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x274], eax
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [rsp + 0x274]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x5c8
pop rdi
pop rsi
ret