Function at 0x1400328c4
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r13, rcx
mov qword [rsp + 0x98], rcx
xor esi, esi
xor ecx, ecx
mov rbx, rdx
mov qword [rsp + 0x60], rdx
mov ebp, esi
mov edi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rsi
lea rcx, [rsp + 0x70]
lea r8d, [r14 + 0x24]
xor edx, edx
mov r15, rax
lea esi, [r14 + 1]
call fcn.14010c6c0
xor edx, edx
mov r12d, edx
mov dword [rsp + 0x68], edx
cmp word [rbx], 0x3f
sete r12b
mov dword [rsp + 0x6c], r12d
cmp r12d, edx
je 0x140032998
add rbx, 2
mov r14, rbx
movzx eax, word [rbx]
mov qword [rsp + 0x60], rbx
cmp ax, dx
je 0x140032998
mov ecx, 9
cmp cx, ax
ja 0x140032977
cmp ax, 0xd
jbe 0x140032987
mov ecx, 0x20
cmp cx, ax
je 0x140032987
add rbx, 2
jmp 0x14003295a
cmp word [rbx], dx
je 0x140032998
mov word [rbx], dx
add rbx, 2
mov qword [rsp + 0x60], rbx
cmp r15, rdx
je 0x140032afa
cmp word [rbx], 0x21
mov r13d, edx
sete r13b
cmp r13d, edx
je 0x1400329ba
add rbx, 2
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x60]
call fcn.140029d28
mov rcx, qword [rsp + 0x60]
call fcn.14002e004
mov rcx, r15
mov rdx, rax
mov eax, r12d
neg eax
sbb r8d, r8d
and r8d, 0xffffffd4
add r8d, 0x30
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
je 0x140032ae7
cmp dword [rsp + 0x6c], edi
je 0x140032aa9
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x70]
mov r9d, 0x24
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov ebp, esi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebx, ebx
jne 0x140032a3f
test eax, eax
je 0x140032ade
mov esi, eax
jmp 0x140032ade
mov eax, dword [rsp + 0x90]
mov r9d, dword [rsp + 0x74]
mov r8d, dword [rsp + 0x70]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x8c]
lea rdx, str.0_0x_lX_0x_lX_0x_lX_0x_lX_0x_lX_0x_lX_0x_lX_0x_lX_0x_lX
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x88]
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x84]
xor esi, esi
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140032ade
mov rcx, rax
test r13d, r13d
je 0x140032ac3
lea r8, [rsp + 0xa0]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x140032ad4
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebp, eax
test eax, eax
jne 0x140032ade
mov ebp, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0x98]
xor edx, edx
cmp r14, rdx
je 0x140032b30
cmp esi, edx
je 0x140032b1b
lea rdx, [0x140142b58]
lea rcx, [rsp + 0xc0]
mov r8d, esi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0xc0]
mov rdx, r14
mov rcx, r13
call fcn.140061290
xor edx, edx
cmp ebp, edx
jne 0x140032b3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret