Function at 0x1400086e0
Capabilities:
Continue service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rdx + 0x10]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x14000874b
lea r8, [rsp + 0x38]
mov edx, 3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
test eax, eax
je 0x140008745
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400089ea
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140008760
movzx ebx, ax
or ebx, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_continue
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
mov rdx, qword [rax + 8]
call fcn.1400018e0
test al, al
je 0x1400088fe
cmp byte ds:[rsp + 0x30], 0
je 0x1400089e8
mov rcx, qword [rsi + 0x10]
mov edx, 2
mov rcx, qword [rcx + 8]
call fcn.14007ace0
mov ebx, eax
test eax, eax
js 0x1400087cd
mov bl, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x1400089ea
mov r8, qword [rsi + 0x10]
lea rdx, [0x1401b9410]
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x14000880f
cmp ebx, 0xc0000005
je 0x14000880f
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000881e
movzx eax, bx
jmp 0x14000881a
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x14000882a
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140008834
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x1400088b4
lfence
lfence
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140008874
mov rax, qword [rax + 8]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140008885
mov r9, qword ds:[rbx + 8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400088ef
lfence
call fcn.1400fbcc0
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x1400089ea
mov edx, 0x10
test rsi, rsi
je 0x1400088dc
mov r9, rsi
lea r8, [0x1401efb68]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x1400089ea
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x1400089ea
mov r8, qword [rsi + 0x10]
lea rdx, [0x1401b9410]
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword ds:[rax + 8]
cmp ebx, 0xc0000022
je 0x140008943
cmp ebx, 0xc0000005
je 0x140008943
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000894f
movzx eax, bx
jmp 0x14000894b
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140008958
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x14000895f
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x1400089bf
mov r9, qword [rax + 8]
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140008999
mov qword [rsp + 0x28], r9
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r9, rsi
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x1400089a5
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400089e8
call fcn.1400fbcc0
jmp 0x1400089e8
mov edx, 0x10
test rsi, rsi
je 0x1400089d5
mov r9, rsi
lea r8, [0x1401efb68]
jmp 0x1400089e3
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret