Function at 0x140019130
Capabilities:
Start service

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x10
mov eax, dword [r14 + rdi]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test al, 1
jne 0x14000c847
or eax, 1
mov dword [r14 + rdi], eax
mov ecx, edx
add rcx, rdi
call fcn.14000b960
nop
mov ebx, edx
add rbx, rdi
lea rbp, [0x1402a6fe0]
cmp byte [rbx + 1], 0
je 0x14000c890
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
mov rcx, rbp
call fcn.140012600
mov rax, qword [0x1402a6fe0]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140013c50
movzx edx, al
mov rcx, rbp
call fcn.140013a90
mov rcx, rbp
call fcn.1400118c0
mov eax, dword [r14 + rdi]
test al, 1
jne 0x14000c8a8
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000b960
nop
cmp byte [rbx + 1], 0
je 0x14000c8e5
lea rdx, str.Start_Minifilter
mov rcx, rbp
call fcn.140012600
mov rax, qword [0x1402a6fe0]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140013c50
movzx edx, al
mov rcx, rbp
call fcn.140013a90
mov rcx, rbp
call fcn.1400118c0
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp 0x140019130
push rbx
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
test eax, eax
jne 0x14001922d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x30]
cmp eax, 0x420
jne 0x1400191ae
call fcn.140005480
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x40]
call fcn.140009120
lea rcx, [rsp + 0x40]
call fcn.14000cb50
nop
jmp 0x14001921c
call fcn.140005480
xor eax, eax
mov qword [rsp + 0x140], 7
mov qword [rsp + 0x138], rax
mov word [rsp + 0x128], ax
cmp ebx, 2
jne 0x1400191f4
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x40]
call fcn.140009120
lea rcx, [rsp + 0x40]
call fcn.14000cb50
nop
jmp 0x14001921c
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x40]
call fcn.140009120
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.14001bb40
lea rcx, [rsp + 0x40]
call fcn.14000cb50
nop
lea rcx, [rsp + 0x30]
call fcn.14000ba70
mov eax, 0x6e
jmp 0x1400192a5
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test al, 1
jne 0x14001925d
or eax, 1
mov dword [rcx + rdx], eax
mov ecx, r8d
add rcx, rdx
call fcn.14000b960
nop
cmp byte [r8 + rdx + 1], 0
je 0x1400192a3
lea rdx, str.Service_started_successfully.
lea rbx, [0x1402a6fe0]
mov rcx, rbx
call fcn.140012600
mov rax, qword [0x1402a6fe0]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140013c50
movzx edx, al
mov rcx, rbx
call fcn.140013a90
mov rcx, rbx
call fcn.1400118c0
xor eax, eax
add rsp, 0x150
pop rbx
ret