Function at 0x14000db30
Capabilities:
Query service status
Start service

Disassembly:
push rbp
push r14
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x140048010]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov qword [rbp - 0x40], rax
mov r8d, 0xf003f
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x48], eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x14000db84
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000ddaf
mov r8d, 0xf01ff
mov qword [rsp + 0x98], rsi
lea rdx, [0x14003f598]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14000dbbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000dda7
mov qword [rsp + 0x90], rbx
lea rax, [rbp - 0x48]
mov qword [rsp + 0xa0], rdi
lea r8, [rbp - 0x40]
mov r9d, 0x24
mov qword [rsp + 0x70], r15
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000dd7a
mov eax, dword [rbp - 0x3c]
dec eax
test eax, 0xfffffffd
jne 0x14000dd80
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp dword [rbp - 0x3c], 3
mov r15d, 0x2710
mov ebx, dword [rbp - 0x2c]
mov rdi, rax
jne 0x14000dca5
mov eax, 0xcccccccd
mul dword [rbp - 0x28]
shr edx, 3
cmp edx, 0x3e8
jae 0x14000dc3f
mov edx, 0x3e8
jmp 0x14000dc46
cmp edx, r15d
cmova edx, r15d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x48]
mov r9d, 0x24
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000dd7a
mov eax, dword [rbp - 0x2c]
cmp rax, rbx
jbe 0x14000dc8a
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ebx, dword [rbp - 0x2c]
mov rdi, rax
jmp 0x14000dc9f
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [rbp - 0x28]
sub rax, rdi
cmp rax, rcx
ja 0x14000dd80
cmp dword [rbp - 0x3c], 3
je 0x14000dc25
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x14000dd7a
lea rax, [rbp - 0x48]
mov r9d, 0x24
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000dd7a
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp dword [rbp - 0x3c], 2
mov rdi, rax
mov ebx, dword [rbp - 0x2c]
jne 0x14000dd80
nop word [rax + rax]
mov eax, 0xcccccccd
mul dword [rbp - 0x28]
shr edx, 3
cmp edx, 0x3e8
jae 0x14000dd1a
mov edx, 0x3e8
jmp 0x14000dd21
cmp edx, r15d
cmova edx, r15d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x48]
mov r9d, 0x24
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000dd7a
mov eax, dword [rbp - 0x2c]
cmp rax, rbx
jbe 0x14000dd61
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ebx, dword [rbp - 0x2c]
mov rdi, rax
jmp 0x14000dd72
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, dword [rbp - 0x28]
sub rax, rdi
cmp rax, rcx
ja 0x14000dd80
cmp dword [rbp - 0x3c], 2
je 0x14000dd00
jmp 0x14000dd80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400109a0
add rsp, 0x78
pop r14
pop rbp
ret