Function at 0x10001c418
Capabilities:
Start service

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r13, rdx
mov rbp, rcx
mov dl, 1
lea rcx, [0x10000aab8]
call fcn.100015444
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x10001c460
call qword [sym.imp.msvcrt.dll_free]
and qword [rbp + 0x118], 0
lea r9, [0x10000ab08]
lea r8, [0x10000a618]
lea rdx, [rbp + 0x118]
mov rcx, rbp
call fcn.10001b2b0
test eax, eax
js 0x10001c6df
mov rdx, qword [rbp + 0x118]
lea rcx, [0x10000ab38]
call fcn.10001288c
mov rbx, qword [r13]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x28]
mov r8d, eax
mov rdx, qword [rbp + 0x118]
mov rcx, r13
call qword [rbx + 0x30]
test eax, eax
js 0x10001c6df
mov dl, 1
lea rcx, [0x10000ab70]
call fcn.100015444
xor ebx, ebx
mov qword [rsp + 0x60], rbx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
jne 0x10001c4f1
call fcn.100027b98
mov edi, eax
jmp 0x10001c4fb
mov rbx, rax
mov qword [rsp + 0x60], rax
xor edi, edi
test edi, edi
jns 0x10001c523
lea rdx, [0x10000ab90]
mov ecx, edi
call fcn.1000128bc
nop
test rbx, rbx
je 0x10001c51c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
jmp 0x10001c6df
and qword [rsp + 0x78], 0
xor edi, edi
mov qword [rsp + 0x70], rdi
mov rax, qword [rbp + 0x98]
mov r8d, 0xa0000000
mov rdx, qword [rax + 0x30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
jne 0x10001c558
call fcn.100027b98
mov esi, eax
jmp 0x10001c562
mov rdi, rax
mov qword [rsp + 0x70], rax
xor esi, esi
test esi, esi
jns 0x10001c599
lea rdx, [0x10000abb0]
mov ecx, esi
call fcn.1000128bc
nop
test rdi, rdi
je 0x10001c584
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rbx, rbx
je 0x10001c592
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x10001c6df
mov r12d, 0x1d4c0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10001c5c1
call fcn.100027b98
mov esi, eax
cmp eax, 0x80070420
je 0x10001c5c7
jmp 0x10001c5c3
xor esi, esi
test esi, esi
js 0x10001c5e3
mov r9d, 2
lea r8d, [r9 + 2]
mov edx, r12d
mov rcx, rdi
call fcn.100015bd0
xor esi, esi
test eax, eax
cmovs esi, eax
test esi, esi
jns 0x10001c61d
mov r8d, r12d
lea rdx, [0x10000abd0]
mov ecx, esi
call fcn.1000128bc
nop
test rdi, rdi
je 0x10001c608
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rbx, rbx
je 0x10001c616
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x10001c6df
mov rdx, qword [rbp + 0x98]
mov rdx, qword [rdx + 0x30]
lea rcx, [0x10000ac18]
call fcn.10001288c
mov r11, qword [rbp + 0x98]
mov eax, 0x668a0
cmp dword [r11 + 0x20], 1
cmove r12d, eax
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x20]
mov esi, eax
mov rdx, qword [rbp]
mov rcx, rbp
call qword [rdx + 0x28]
and esi, eax
mov r8d, esi
mov edx, r12d
mov rcx, rbp
call fcn.10001c6f8
mov esi, eax
test eax, eax
jns 0x10001c6a8
mov r8d, r12d
lea rdx, [0x10000ac50]
mov ecx, eax
call fcn.1000128bc
nop
test rdi, rdi
je 0x10001c696
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rbx, rbx
je 0x10001c6a4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x10001c6df
mov rdx, qword [rbp + 0x98]
mov rdx, qword [rdx + 0x30]
lea rcx, [0x10000acb0]
call fcn.10001288c
nop
test rdi, rdi
je 0x10001c6cf
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rbx, rbx
je 0x10001c6dd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret