Function at 0x140044f80
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
xor eax, eax
mov r12d, r8d
mov rdi, rdx
xor ebp, ebp
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0xb8], ebp
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov r13, rax
je 0x14004518e
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
je 0x14004515a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x140045140
lea rax, [rsp + 0xb8]
lea r9d, [rbp + 0x24]
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140045126
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rsp + 0x4c], 2
mov edi, dword [rsp + 0x5c]
mov ebx, eax
jne 0x14004510a
mov qword [rsp + 0xa0], r14
mov r14d, 0x2710
mov eax, 0xcccccccd
mul dword [rsp + 0x60]
shr edx, 3
cmp edx, 0x3e8
jae 0x14004507e
mov edx, 0x3e8
jmp 0x140045085
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0xb8]
lea r8, [rsp + 0x48]
mov r9d, 0x24
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400450ea
cmp dword [rsp + 0x5c], edi
jbe 0x1400450c8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [rsp + 0x5c]
mov ebx, eax
jmp 0x1400450dd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x60]
mov edx, eax
add ecx, r12d
sub edx, ebx
cmp edx, ecx
ja 0x140045102
cmp dword [rsp + 0x4c], 2
je 0x140045063
jmp 0x140045102
lea rcx, str.ntsvcStartService
call fcn.140041bd0
lea rcx, str.ntsvcStartService:_QueryServiceStatusEx_call_failed
call fcn.14003e3d0
mov r14, qword [rsp + 0xa0]
cmp dword [rsp + 0x4c], 4
jne 0x140045118
mov ebp, 1
jmp 0x140045172
lea rcx, str.ntsvcStartService:_dwCurrentState_is_not_SERVICE_RUNNING
call fcn.14003e3d0
jmp 0x140045172
lea rcx, str.ntsvcStartService
call fcn.140041bd0
lea rcx, str.ntsvcStartService:_QueryServiceStatusEx_call_failed
call fcn.14003e3d0
jmp 0x140045172
lea rcx, str.ntsvcStartService
call fcn.140041bd0
lea rcx, str.ntsvcStartService:_StartService_call_failed
call fcn.14003e3d0
jmp 0x140045172
lea rcx, str.ntsvcStartService
call fcn.140041bd0
lea rcx, str.ntsvcStartService:_OpenService_call_failed
call fcn.14003e3d0
test rsi, rsi
je 0x140045180
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14004525c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov ecx, 0x1100
mov r8d, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rdx, qword [rsp + 0x40]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
movzx eax, byte [rdx + rcx - 1]
cmp al, 0xa
je 0x1400451e1
cmp al, 0xd
jne 0x1400451e7
sub rcx, 1
jmp 0x1400451d4
mov byte [rcx + rdx], bpl
mov rsi, qword [rsp + 0x40]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rbx, [rcx - 1]
call fcn.140056200
test rax, rax
mov rdi, rax
je 0x14004521e
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14004a400
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.ntsvcStartService
lea rcx, str._s:_Error_0x_x_____s.
mov r8d, eax
mov r9, rdi
call fcn.14003e3d0
mov rcx, rdi
call fcn.14004ad40
lea rcx, str.ntsvcStartService:_OpenSCManager_call_failed
call fcn.14003e3d0
mov eax, ebp
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret