Function at 0x140009510
Capabilities:
Query service status
Start service

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [0x14001d010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rcx], 0x80070057
mov rdi, r8
mov rbx, rcx
test r8, r8
je 0x14000975d
xor eax, eax
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r13
xor edx, edx
xor r13d, r13d
mov dword [rcx], r13d
xor ecx, ecx
mov qword [r8], rax
lea r8d, [r13 + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
je 0x14000973a
lea r8d, [r13 + 0x14]
mov qword [rsp + 0x58], r14
lea rdx, str.TrustedInstaller
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x1400096ed
mov qword [rsp + 0x98], rbp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rsi
lea r9d, [r13 + 0x24]
mov qword [rsp + 0x50], r15
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x30], r13d
mov rcx, r14
mov qword [rsp + 0x20], rax
mov r15d, r13d
mov esi, r13d
xor bpl, bpl
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400096d0
mov eax, dword [rdi + 4]
cmp eax, 1
jne 0x140009602
test bpl, bpl
jne 0x1400096c2
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x14000969f
mov dword [rbx], r13d
mov bpl, 1
jmp 0x140009677
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400096d0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000963e
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14000963e
imul rax, qword [rsp + 0x38], 0x3e8
cqo
idiv qword [rsp + 0x40]
jmp 0x140009644
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
mov eax, dword [rdi + 0x14]
test rsi, rsi
jne 0x140009664
mov rsi, rcx
xor edx, edx
mov ecx, 0xfa
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x140009677
cmp eax, r15d
ja 0x140009674
mov eax, dword [rdi + 0x18]
sub rcx, rsi
cmp rcx, rax
ja 0x1400096ca
mov rsi, r13
lea rax, [rsp + 0x30]
mov r9d, 0x24
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400095d3
jmp 0x1400096d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400096b3
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x1400096be
mov ecx, 0x8007065b
mov dword [rbx], ecx
jmp 0x1400096d0
mov dword [rbx], eax
jmp 0x1400096d0
mov dword [rbx], 1
jmp 0x1400096d0
mov dword [rbx], 0x800705b4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
jmp 0x14000970b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400096ff
movzx eax, ax
or eax, 0x80070000
test eax, eax
mov ecx, 0x8007065b
cmove eax, ecx
mov dword [rbx], eax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14, qword [rsp + 0x58]
mov rax, rbx
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000ac70
add rsp, 0x78
pop rdi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14000974c
movzx eax, ax
or eax, 0x80070000
test eax, eax
mov ecx, 0x8007065b
cmove eax, ecx
mov dword [rbx], eax
mov rax, rbx
jmp 0x14000971c
mov rax, rbx
jmp 0x140009726