Function at 0x140015b60
Capabilities:
Create process on windows
Resume thread

Disassembly:
push rbx
mov eax, 0x10130
call fcn.140023f70
sub rsp, rax
mov rax, qword [0x14002dda0]
xor rax, rsp
mov qword [rsp + 0x10110], rax
cmp qword [rcx + 0x70500], 0
mov rbx, rcx
mov byte [rcx + 0x7051c], 0
je 0x140015b9c
xor eax, eax
jmp 0x1400160ed
inc dword [rcx + 0x705c4]
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x68]
mov qword [rsp + 0x10158], rdi
mov qword [rsp + 0x10128], r12
call fcn.14001a4c0
xor eax, eax
lea rdx, [rsp + 0x80]
mov rcx, rbx
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.1400114d0
test eax, eax
je 0x140015c2e
mov edi, 1
lea r8, [rbx + 2]
xor r9d, r9d
movzx ecx, di
mov edx, 0xc00003ec
call fcn.140007190
mov rcx, rbx
call fcn.140012400
lea edx, [rdi + 1]
movzx r9d, dil
movzx r8d, dil
mov rcx, rbx
call fcn.1400145f0
jmp 0x1400160dd
mov qword [rsp + 0x10148], rbp
lea rax, [rbx + 0x28428]
lea rbp, [rbx + 0x1842a]
mov qword [rsp + 0x28], rax
lea r9, str.__s___s
lea rcx, [rsp + 0x110]
or r8, 0xffffffffffffffff
mov edx, 0x8000
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10150], rsi
call fcn.140019e88
test eax, eax
jns 0x140015cbe
mov edi, 1
lea r9, str.start_service
lea r8, str.command_line
xor esi, esi
mov edx, 0xc00003eb
movzx ecx, di
mov qword [rsp + 0x20], rsi
call fcn.140007190
mov rcx, rbx
call fcn.140012400
lea edx, [rdi + 1]
movzx r9d, dil
movzx r8d, dil
mov rcx, rbx
call fcn.1400145f0
jmp 0x1400160cd
mov rcx, rbx
mov qword [rsp + 0x10120], r13
call fcn.1400147e0
mov rcx, qword [rbx + 0x704f8]
lea rdx, [rbx + 0x704d8]
mov r12d, 2
mov dword [rbx + 0x704e0], 0x45
mov dword [rbx + 0x704dc], r12d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor esi, esi
lea rax, [rsp + 0x50]
mov byte [rsp + 0x30], sil
lea r9, [0x140025af0]
lea r8, str.Start
lea rcx, [0x14004eeb8]
mov rdx, rbx
mov dword [rsp + 0x28], 0x4e20
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rax
call fcn.14000bab0
cmp eax, 0x63
jne 0x140015db0
lea r9, [0x140026188]
lea edx, [rsi + 0x10]
lea rcx, [rsp + 0xf0]
or r8, 0xffffffffffffffff
mov dword [rsp + 0x20], eax
call fcn.140019e88
lea rax, [rsp + 0xf0]
lea r11, [rbx + 2]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea edi, [rsi + 1]
lea r9, [0x140025af0]
lea r8, str.Start
mov edx, 0x40000437
movzx ecx, di
mov qword [rsp + 0x20], r11
call fcn.140007190
mov rcx, rbx
call fcn.140012400
lea edx, [rsi + 5]
movzx r9d, dil
movzx r8d, dil
mov rcx, rbx
call fcn.1400145f0
jmp 0x1400160c5
mov edi, 1
cmp byte [rbx + 0x7051d], sil
je 0x14001600a
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.14000da00
test eax, eax
je 0x140015e27
lea r8, [rbx + 2]
xor r9d, r9d
mov edx, 0xc000041b
movzx ecx, di
call fcn.140007190
cmp dword [rbx + 0x40440], esi
jne 0x140015df8
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, [rsp + 0x80]
call fcn.14000cff0
mov rcx, rbx
call fcn.140012400
movzx r9d, dil
movzx r8d, dil
mov edx, 4
mov rcx, rbx
call fcn.1400145f0
jmp 0x1400160c5
mov rcx, rbx
call fcn.1400123a0
xor r11b, r11b
bt dword [rsp + 0xbc], 8
movzx edx, r11b
cmovb edx, edi
call fcn.1400122e0
and eax, dword [rbx + 0x4043c]
cmp qword [rbx + 0x40418], rsi
je 0x140015e59
or eax, 4
movzx edx, dl
lea r8, [rsp + 0x60]
lea rcx, [rbx + 0x30426]
mov qword [rsp + 0x48], r8
lea r8, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x110]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140015f00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fd0
lea r8, [rbx + 2]
mov r9, rbp
mov edx, 0xc00003f2
movzx ecx, di
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140007190
lea rcx, [rsp + 0x80]
call fcn.14000cff0
mov rcx, rbx
call fcn.140012400
movzx r9d, dil
movzx r8d, dil
mov edx, 3
mov rcx, rbx
call fcn.1400145f0
jmp 0x1400160c5
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x70]
inc dword [rbx + 0x705c8]
lea rdx, [rbx + 0x705a8]
mov qword [rbx + 0x70500], rcx
mov dword [rbx + 0x70508], eax
call fcn.14000ea80
test eax, eax
je 0x140015f3a
xor eax, eax
mov dword [rbx + 0x705a8], eax
mov dword [rbx + 0x705ac], eax
lea rcx, [rsp + 0x80]
call fcn.14000cff0
cmp dword [rbx + 0x40440], esi
jne 0x140015f55
call qword [sym.imp.KERNEL32.dll_FreeConsole]
cmp qword [rbx + 0x40418], rsi
je 0x14001600a
mov rcx, qword [rbx + 0x70500]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x140015f90
mov rdx, qword [rsp + 0x78]
and rdx, qword [rbx + 0x40418]
mov qword [rsp + 0x58], rdx
jmp 0x140015fc7
mov rax, qword [rbx + 0x40418]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fd0
lea r8, [rbx + 2]
mov edx, 0x8000042d
movzx ecx, di
mov r9, rax
mov qword [rsp + 0x20], rsi
call fcn.140007190
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x70500]
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
jne 0x140015fff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fd0
lea r8, [rbx + 2]
mov edx, 0xc000042e
movzx ecx, r12w
mov r9, rax
mov qword [rsp + 0x20], rsi
call fcn.140007190
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call fcn.140012400
mov eax, dword [rbx + 0x704b8]
mov r8, qword [rbx + 0x70500]
mov rcx, qword [rbx + 0x704f8]
mov dword [rsp + 0x28], eax
lea rax, str.start_service
lea r9, [rbx + 2]
lea rdx, [rbx + 0x704d8]
mov qword [rsp + 0x20], rax
call fcn.1400149e0
cmp eax, edi
jne 0x140016050
mov dword [rbx + 0x70520], esi
cmp byte [rbx + 0x7051d], sil
je 0x1400160c3
mov rcx, qword [rbx + 0x704f8]
and dword [rbx + 0x704e0], 0xfffffffd
lea rdx, [rbx + 0x704d8]
mov dword [rbx + 0x704dc], 4
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [rbx + 0x70520], esi
jne 0x1400160ad
lea rax, [rsp + 0x50]
lea r9, str.Post
lea r8, str.Start
lea rcx, [0x14004eeb8]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.14000c310
cmp dword [rbx + 0x704b4], esi
je 0x1400160c3
cmp dword [rbx + 0x70520], esi
jne 0x1400160c3
mov dword [rbx + 0x70520], edi
xor eax, eax
mov r13, qword [rsp + 0x10120]
mov rsi, qword [rsp + 0x10150]
mov rbp, qword [rsp + 0x10148]
mov rdi, qword [rsp + 0x10158]
mov r12, qword [rsp + 0x10128]
mov rcx, qword [rsp + 0x10110]
xor rcx, rsp
call fcn.14001a490
add rsp, 0x10130
pop rbx
ret