Function at 0x1401b0700
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14035cb78]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rcx
mov qword [rbp + 0x28], rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], eax
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1401b07b5
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov ebx, 7
mov qword [rsp + 0x60], rbx
lea r8d, [rax + 0x45]
lea rdx, str._Utility__RestartSoftwareManager__OpenSCManager_failed_w_err_0x_08lx_n
lea rcx, [rsp + 0x48]
call fcn.1400d07a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.1401639e0
jmp 0x1401b0999
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401b07c2
mov rdx, qword [rdi]
mov r8d, 0xf01ff
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1401b081f
xor esi, esi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov ebx, 7
mov qword [rbp - 0x80], rbx
lea r8d, [rax + 0x43]
lea rdx, str._Utility__RestartSoftwareManager__OpenService_failed_w_err_0x_08lx_n
lea rcx, [rsp + 0x68]
call fcn.1400d07a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.1401639e0
mov rcx, r14
jmp 0x1401b0992
lea rdx, [rbp + 0xb0]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
movabs r14, 0x7ffffffffffffffe
mov rax, r14
cmp dword [rbp + 0xb4], 4
jne 0x1401b09f9
mov r13, qword [rdi + 0x10]
sub rax, r13
cmp rax, 0x2a
jb 0x1401b0ef3
mov qword [rsp + 0x30], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401b086e
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
xor esi, esi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
lea r12, [r13 + 0x2a]
mov ebx, 7
lea r15, [rbp + 0x50]
cmp r12, rbx
jbe 0x1401b08bd
mov rbx, r12
or rbx, 7
cmp rbx, r14
jbe 0x1401b09d1
mov rbx, r14
movabs rcx, 0x7fffffffffffffff
lfence
add rcx, rcx
call fcn.1400b9950
mov r15, rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], rbx
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r15], xmm0
movaps xmm1, xmmword [0x14028e030]
movups xmmword [r15 + 0x10], xmm1
movaps xmm0, xmmword [0x14028e040]
movups xmmword [r15 + 0x20], xmm0
movaps xmm1, xmmword [0x14028e050]
movups xmmword [r15 + 0x30], xmm1
movaps xmm0, xmmword [0x14028e060]
movups xmmword [r15 + 0x40], xmm0
mov eax, dword [0x14028e070]
mov dword [r15 + 0x50], eax
lea rcx, [r15 + 0x54]
lea r8, [r13*2]
mov rdx, qword [rsp + 0x30]
call fcn.1401ff6b0
mov word [r15 + r12*2], si
lea r8, str._is_running
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140118890
mov rcx, rax
call fcn.140163440
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1401b0982
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401b097d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401b0ef9
call fcn.1401c72f8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, rdi
call fcn.1400ec0a0
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1401c7850
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs r15, 0x7fffffffffffffff
cmp rcx, r15
ja 0x1401b0ecf
jmp 0x1401b08ab
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rcx
sub rax, rcx
cmp rax, 0x2a
jb 0x1401b0eff
mov qword [rsp + 0x30], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401b0a23
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
xor esi, esi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
add rcx, 0x2a
mov qword [rsp + 0x28], rcx
mov ebx, 7
mov r13d, ebx
lea r12, [rbp + 0x30]
lea eax, [rsi + 0xa]
movabs r15, 0x7fffffffffffffff
cmp rcx, rbx
jbe 0x1401b0a84
mov r13, rcx
or r13, rbx
cmp r13, r14
jbe 0x1401b0cd4
mov r13, r14
mov rcx, r15
lfence
add rcx, rcx
call fcn.1400b9950
mov r12, rax
mov qword [rbp + 0x30], rax
mov rcx, qword [rsp + 0x28]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], r13
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r12], xmm0
movaps xmm1, xmmword [0x14028e030]
movups xmmword [r12 + 0x10], xmm1
movaps xmm0, xmmword [0x14028e040]
movups xmmword [r12 + 0x20], xmm0
movaps xmm1, xmmword [0x14028e050]
movups xmmword [r12 + 0x30], xmm1
movaps xmm0, xmmword [0x14028e060]
movups xmmword [r12 + 0x40], xmm0
mov eax, dword [0x14028e070]
mov dword [r12 + 0x50], eax
lea rcx, [r12 + 0x54]
mov r8, qword [rsp + 0x20]
add r8, r8
mov rdx, qword [rsp + 0x30]
call fcn.1401ff6b0
mov rax, qword [rsp + 0x28]
mov word [r12 + rax*2], si
lea r8, str._is_not_running__restart_now.
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x38]
call fcn.140118890
mov rcx, rax
call fcn.1401639e0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1401b0b55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401b0b50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401b0f05
call fcn.1401c72f8
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, 1
je 0x1401b0d51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp eax, 0x420
jne 0x1401b0d0c
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rcx
mov rax, r14
sub rax, rcx
cmp rax, 0x2a
jb 0x1401b0f0b
mov qword [rsp + 0x28], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401b0baf
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], rsi
lea r13, [rcx + 0x2a]
lea r12, [rbp + 0x70]
cmp r13, 7
jbe 0x1401b0bf7
mov rbx, r13
or rbx, 7
cmp rbx, r14
jbe 0x1401b0ced
mov rbx, r14
mov rcx, r15
lfence
add rcx, rcx
call fcn.1400b9950
mov r12, rax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], rbx
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r12], xmm0
movaps xmm1, xmmword [0x14028e030]
movups xmmword [r12 + 0x10], xmm1
movaps xmm0, xmmword [0x14028e040]
movups xmmword [r12 + 0x20], xmm0
movaps xmm1, xmmword [0x14028e050]
movups xmmword [r12 + 0x30], xmm1
movaps xmm0, xmmword [0x14028e060]
movups xmmword [r12 + 0x40], xmm0
mov eax, dword [0x14028e070]
mov dword [r12 + 0x50], eax
lea rcx, [r12 + 0x54]
mov r8, qword [rsp + 0x20]
add r8, r8
mov rdx, qword [rsp + 0x28]
call fcn.1401ff6b0
mov word [r12 + r13*2], si
lea r8, str._is_already_running.
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x18]
call fcn.140118890
mov rcx, rax
call fcn.140163440
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x1401b0982
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401b097d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401b0ed5
jmp 0x1401b097d
cmp r13, rax
cmovb r13, rax
lea rcx, [r13 + 1]
cmp rcx, r15
ja 0x1401b0edb
jmp 0x1401b0a6d
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r15
ja 0x1401b0ee1
jmp 0x1401b0be5
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rbx
mov r8d, 0x63
lea rdx, str._Utility__RestartSoftwareManager__ERROR:_Failed_to_send_start_control_to_service._Error_code0x_08x
lea rcx, [rbp - 0x78]
call fcn.1400d07a0
mov edx, r12d
lea rcx, [rbp - 0x78]
call fcn.1401639e0
cmp r12d, 0xc1
jne 0x1401b0982
call fcn.1401a69f0
jmp 0x1401b0982
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x20], rcx
mov rax, r14
sub rax, rcx
cmp rax, 0x2a
jb 0x1401b0ec9
mov qword [rsp + 0x28], rdi
cmp qword [rdi + 0x18], 8
jb 0x1401b0d7e
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
lea r13, [rcx + 0x2a]
lea r12, [rbp + 0x90]
cmp r13, 7
jbe 0x1401b0dcf
mov rbx, r13
or rbx, 7
cmp rbx, r14
jbe 0x1401b0eae
mov rbx, r14
mov rcx, r15
lfence
add rcx, rcx
call fcn.1400b9950
mov r12, rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], rbx
movaps xmm0, xmmword [str._Utility__RestartSoftwareManager__Service]
movups xmmword [r12], xmm0
movaps xmm1, xmmword [0x14028e030]
movups xmmword [r12 + 0x10], xmm1
movaps xmm0, xmmword [0x14028e040]
movups xmmword [r12 + 0x20], xmm0
movaps xmm1, xmmword [0x14028e050]
movups xmmword [r12 + 0x30], xmm1
movaps xmm0, xmmword [0x14028e060]
movups xmmword [r12 + 0x40], xmm0
mov eax, dword [0x14028e070]
mov dword [r12 + 0x50], eax
lea rcx, [r12 + 0x54]
mov r8, qword [rsp + 0x20]
add r8, r8
mov rdx, qword [rsp + 0x28]
call fcn.1401ff6b0
mov word [r12 + r13*2], si
lea r8, str._StartService_successfully.
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 8]
call fcn.140118890
mov rcx, rax
call fcn.140163440
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x1401b0982
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401b097d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401b0ee7
jmp 0x1401b097d
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r15
ja 0x1401b0eed
jmp 0x1401b0dba
call fcn.1400d0220
int3
call fcn.1400d0090
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400d0090
int3
call fcn.1400d0090
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400d0090
int3
call fcn.1400d0220
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400d0220
int3
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
call fcn.1400d0220
int3