Function at 0x140070280
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov r13, rdx
mov r15d, ecx
call fcn.140074ef0
lea rax, [rbp + 0x88]
mov qword [rbp + 0x80], rax
mov edx, 0x161
lea rcx, [rbp - 0x48]
call fcn.1400177a0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1400702d2
mov rbx, qword [rax]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400708ae
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp + 0x88], rax
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.140007020
xor edi, edi
lea r14, [rdi - 1]
test al, al
jne 0x14007033c
test rbx, rbx
jne 0x140070316
mov eax, edi
jmp 0x140070329
mov rax, r14
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x140070320
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.140008250
nop
lea rcx, [rbp + 0x88]
call fcn.14006b760
mov ebx, eax
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14007038a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070385
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400708b9
call fcn.140133e68
xor ecx, ecx
call fcn.14017315c
mov rsi, rax
mov ecx, eax
sub ecx, ebx
cmp ecx, 0x2a300
jbe 0x1400704c8
mov edx, 0x160
lea rcx, [rbp - 0x28]
call fcn.1400175a0
nop
mov rcx, rax
call fcn.140075060
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400703f7
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400703f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400708bf
call fcn.140133e68
lea rax, [rsp + 0x20]
mov qword [rbp + 0x80], rax
mov edx, 0x161
lea rcx, [rbp - 8]
call fcn.1400177a0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x14007041e
mov rbx, qword [rax]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400708c5
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140007020
test al, al
jne 0x14007047b
test rbx, rbx
jne 0x140070458
mov eax, edi
jmp 0x14007046a
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140070460
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140008250
nop
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.14006b900
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x1400704c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400704c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400708d0
call fcn.140133e68
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400177a0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1400704e1
mov rbx, qword [rax]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400708d6
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140007020
test al, al
jne 0x14007053b
test rbx, rbx
jne 0x14007051b
mov eax, edi
jmp 0x14007052a
mov rax, r14
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140070520
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008250
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x14007057c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070577
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400708e1
call fcn.140133e68
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], di
cmp r15d, 2
jl 0x14007086c
mov rcx, qword [r13 + 8]
cmp word [rcx], 0x2d
jne 0x14007086c
add rcx, 2
mov rdx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140070713
mov ecx, dword [0x14070a508]
test ecx, ecx
jne 0x1400705da
call fcn.14002e1d0
mov ecx, edi
test al, al
setne cl
inc ecx
mov dword [0x14070a508], ecx
cmp ecx, 1
lea rcx, [rsp + 0x38]
mov edx, 0x14d
je 0x1400705ee
mov edx, 0x14e
call fcn.1400177a0
nop
lea rbx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rbx, qword [rsp + 0x38]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400708e7
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp + 0x80], rax
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140007020
test al, al
jne 0x140070663
test rbx, rbx
jne 0x140070643
mov eax, edi
jmp 0x140070650
mov rax, r14
inc rax
cmp word [rbx + rax*2], 0
jne 0x140070646
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140008250
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400706a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400706a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400708f2
call fcn.140133e68
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], di
mov rbx, qword [rbp + 0x80]
cmp dword [rbx - 8], 1
jle 0x1400706db
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x80]
call fcn.1400088a8
mov rbx, qword [rbp + 0x80]
mov qword [rbp - 0x68], rbx
lea rax, section..code5
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdi
lea rcx, [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140070713
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [r13 + 8]
add rcx, 2
lea rdx, [0x14041650c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14007086c
mov ecx, dword [0x14070a508]
test ecx, ecx
jne 0x14007074e
call fcn.14002e1d0
mov ecx, edi
test al, al
setne cl
inc ecx
mov dword [0x14070a508], ecx
cmp ecx, 1
lea rcx, [rsp + 0x58]
mov edx, 0x14d
je 0x140070762
mov edx, 0x14e
call fcn.1400177a0
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.140024970
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400707c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400707c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400708a8
call fcn.140133e68
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14007084c
mov r8d, reloc.WS2_32.dll_sendto
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x140070843
nop word [rax + rax]
cmp edi, 0x258
jge 0x14007082c
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14007082c
inc edi
cmp dword [rbp + 0x1c], 1
jne 0x140070800
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14007086c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14007088a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.1401462a8
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
call fcn.1401462a8
int3
call fcn.1401462a8
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
call fcn.1401462a8
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
call fcn.1401462a8
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
call fcn.1401462a8
int3