Function at 0x14002b700
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x264
mov eax, dword [r14 + rdi]
mov edx, 0x260
test al, 1
jne 0x140019d0d
or eax, 1
mov dword [r14 + rdi], eax
lea rcx, [rdi + rdx]
call fcn.14000fa60
nop
lea rbx, [rdi + rdx]
lea rbp, [0x1401950c0]
cmp byte [rbx + 1], 0
je 0x140019d55
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
mov rcx, rbp
call fcn.1400104a0
mov rax, qword [0x1401950c0]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140010290
movzx edx, al
mov rcx, rbp
call fcn.140010130
mov rcx, rbp
call fcn.140010060
mov eax, dword [r14 + rdi]
test al, 1
jne 0x140019d6d
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000fa60
nop
cmp byte [rbx + 1], 0
je 0x140019daa
lea rdx, str.Start_Minifilter
mov rcx, rbp
call fcn.1400104a0
mov rax, qword [0x1401950c0]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140010290
movzx edx, al
mov rcx, rbp
call fcn.140010130
mov rcx, rbp
call fcn.140010060
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x14002b700
push rbx
sub rsp, 0x140
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14002b82a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 1
lea rcx, [rsp + 0x20]
cmp eax, 0x420
jne 0x14002b790
call fcn.14001a6d0
xor eax, eax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x30]
call fcn.14001b1c0
lea rcx, [rsp + 0x30]
call fcn.14001a8c0
nop
lea rcx, [rsp + 0x20]
call fcn.1400193a0
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
call fcn.14001a6d0
xor eax, eax
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x128], rax
mov word [rsp + 0x118], ax
cmp ebx, 2
jne 0x14002b7ea
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x30]
call fcn.14001b1c0
lea rcx, [rsp + 0x30]
call fcn.14001a8c0
nop
lea rcx, [rsp + 0x20]
call fcn.1400193a0
lea eax, [rbx + 0x6c]
add rsp, 0x140
pop rbx
ret
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x30]
call fcn.14001b1c0
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14001e540
lea rcx, [rsp + 0x30]
call fcn.14001a8c0
nop
lea rcx, [rsp + 0x20]
call fcn.1400193a0
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x264
mov eax, dword [rcx + rdx]
mov r8d, 0x260
test al, 1
jne 0x14002b858
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [rdx + r8]
call fcn.14000fa60
nop
cmp byte [rdx + r8 + 1], 0
je 0x14002b89e
lea rdx, str.Service_started_successfully.
lea rbx, [0x1401950c0]
mov rcx, rbx
call fcn.1400104a0
mov rax, qword [0x1401950c0]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140010290
movzx edx, al
mov rcx, rbx
call fcn.140010130
mov rcx, rbx
call fcn.140010060
xor eax, eax
add rsp, 0x140
pop rbx
ret