Function at 0x140006700
Capabilities:
Query service status
Start service

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x14000e010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
test rdx, rdx
je 0x140006941
xor eax, eax
mov qword [rsp + 0x60], r12
mov qword [rdx], rax
xor ecx, ecx
xor edx, edx
lea r8d, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x14000675b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140006755
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x140006929
mov qword [rsp + 0x80], rbx
lea rdx, str.TrustedInstaller
mov r8d, 0x14
mov qword [rsp + 0x58], r14
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x14000678a
xor ebx, ebx
jmp 0x1400067a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000679f
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x140006907
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x68], rsi
xor esi, esi
mov qword [rsp + 0x50], r15
xor r15d, r15d
xor bpl, bpl
mov dword [rsp + 0x30], 0
nop dword [rax]
lea rax, [rsp + 0x30]
mov r9d, 0x24
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14000680c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140006806
movzx eax, ax
or eax, 0x80070000
test eax, eax
jne 0x1400068e2
mov eax, dword [rdi + 4]
cmp eax, 1
jne 0x14000685e
test bpl, bpl
jne 0x1400068d6
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140006854
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140006844
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jne 0x1400068e2
mov bpl, 1
jmp 0x1400067d0
xor ebx, ebx
mov bpl, 1
jmp 0x1400067d0
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400068e2
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140006896
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140006896
imul rax, qword [rsp + 0x38], 0x3e8
cqo
idiv qword [rsp + 0x40]
jmp 0x14000689c
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
mov eax, dword [rdi + 0x14]
test rsi, rsi
jne 0x1400068bf
mov rsi, rcx
xor edx, edx
mov ecx, 0xfa
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x1400067d0
cmp eax, r15d
ja 0x1400068cf
mov eax, dword [rdi + 0x18]
sub rcx, rsi
cmp rcx, rax
ja 0x1400068dd
xor esi, esi
jmp 0x1400067d0
mov ebx, 1
jmp 0x1400068e2
mov ebx, 0x800705b4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x90]
test eax, eax
jne 0x140006907
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14, qword [rsp + 0x58]
test eax, eax
jne 0x14000691f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140008c60
add rsp, 0x70
pop rdi
ret
mov eax, 0x80070057
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140008c60
add rsp, 0x70
pop rdi
ret