Function at 0x140005cbc
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140017280]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x1400044eb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1400045cb
movzx eax, ax
or eax, 0x80070000
jmp 0x1400045cb
mov r8d, 0x14
lea rdx, str.DiagnosticsHub.StandardCollector.Service
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140004540
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x14000452a
movzx edi, ax
or edi, 0x80070000
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, edi
jmp 0x1400045cb
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
je 0x140004577
cmp dword [rsp + 0x24], 1
jne 0x14000459d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
nop dword [rax + rax]
test eax, eax
jne 0x140004594
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jle 0x1400045ab
movzx esi, ax
or esi, 0x80070000
jmp 0x1400045ab
lea rcx, str.SUCCESS:_The_service_was_started_successfully_n
jmp 0x1400045a4
lea rcx, str.WARNING:_The_service_is_already_started_n
call fcn.14000240c
xor esi, esi
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400016f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140017280]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, 1
xor edx, edx
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000464f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140004730
movzx eax, ax
or eax, 0x80070000
jmp 0x140004730
mov r8d, 0x24
lea rdx, str.DiagnosticsHub.StandardCollector.Service
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400046a4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x14000468e
movzx edi, ax
or edi, 0x80070000
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, edi
jmp 0x140004730
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
je 0x1400046dc
cmp dword [rsp + 0x24], esi
je 0x140004702
lea r8, [rsp + 0x20]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_ControlService]
nop dword [rax + rax]
test eax, eax
jne 0x1400046f9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jle 0x140004710
movzx esi, ax
or esi, 0x80070000
jmp 0x140004710
lea rcx, str.SUCCESS:_The_service_was_stopped_successfully_n
jmp 0x140004709
lea rcx, str.WARNING:_The_service_is_already_stopped_n
call fcn.14000240c
xor esi, esi
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400016f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
sub rsp, 0x48
mov r8d, dword [rdx]
test r8d, r8d
jle 0x140005cda
cmp r8d, 4
jle 0x140005d4c
cmp r8d, 6
jle 0x140005ce3
cmp r8d, 8
jle 0x140005d4c
or eax, 0xffffffff
add rsp, 0x48
ret
cmp r8d, 5
jne 0x140005d43
and qword [rsp + 0x30], 0
lea rax, str.DiagnosticsHub.StandardCollector.Service
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [0x140006480]
mov qword [rsp + 0x28], rax
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
test eax, eax
jne 0x140005d48
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x420
je 0x140005d48
test eax, eax
jle 0x140005cdd
movzx eax, ax
or eax, 0x80070000
jmp 0x140005cdd
call fcn.140006288
xor eax, eax
jmp 0x140005cdd
sub r8d, 3
je 0x140005d6b
cmp r8d, 1
je 0x140005d62
mov eax, 0x8000ffff
jmp 0x140005cdd
add rsp, 0x48
jmp 0x1400045f0
add rsp, 0x48
jmp 0x140004490