Function at 0x14000c200
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov r14d, 0x10
mov eax, dword [r14 + rdi]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test al, 1
jne 0x14000c24d
or eax, 1
mov dword [r14 + rdi], eax
lea rcx, [rdi + rdx]
call fcn.14000b340
nop
lea rbx, [rdi + rdx]
lea rbp, [0x1402b2c40]
cmp byte [rbx + 1], 0
je 0x14000c295
lea rdx, str.unsigned_long___cdecl_MinifilterStartCommand::Execute_int_wchar_t____
mov rcx, rbp
call fcn.1400127a0
mov rax, qword [0x1402b2c40]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140014960
movzx edx, al
mov rcx, rbp
call fcn.140014780
mov rcx, rbp
call fcn.1400118e0
mov eax, dword [r14 + rdi]
test al, 1
jne 0x14000c2ad
or eax, 1
mov dword [r14 + rdi], eax
mov rcx, rbx
call fcn.14000b340
nop
cmp byte [rbx + 1], 0
je 0x14000c2ea
lea rdx, str.Start_Minifilter
mov rcx, rbp
call fcn.1400127a0
mov rax, qword [0x1402b2c40]
movsxd rcx, dword [rax + 4]
add rcx, rbp
mov dl, 0xa
call fcn.140014960
movzx edx, al
mov rcx, rbp
call fcn.140014780
mov rcx, rbp
call fcn.1400118e0
mov rcx, qword [rsi + 8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x140019c90
push rbx
sub rsp, 0x140
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.DLL_StartServiceW]
test eax, eax
jne 0x140019dbe
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rsp + 0x20]
cmp eax, 0x420
jne 0x140019d24
call fcn.140005bf0
xor eax, eax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], ax
lea rdx, str.Cannot_start_service._ERROR_SERVICE_ALREADY_RUNNING
lea rcx, [rsp + 0x30]
call fcn.1400085f0
lea rcx, [rsp + 0x30]
call fcn.14000c470
nop
lea rcx, [rsp + 0x20]
call fcn.14000b440
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
call fcn.140005bf0
xor eax, eax
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x128], rax
mov word [rsp + 0x118], ax
cmp ebx, 2
jne 0x140019d7e
lea rdx, str.Cannot_start_service._ERROR_FILE_NOT_FOUND
lea rcx, [rsp + 0x30]
call fcn.1400085f0
lea rcx, [rsp + 0x30]
call fcn.14000c470
nop
lea rcx, [rsp + 0x20]
call fcn.14000b440
lea eax, [rbx + 0x6c]
add rsp, 0x140
pop rbx
ret
lea rdx, str.Cannot_start_service._Error
lea rcx, [rsp + 0x30]
call fcn.1400085f0
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14001c600
lea rcx, [rsp + 0x30]
call fcn.14000c470
nop
lea rcx, [rsp + 0x20]
call fcn.14000b440
mov eax, 0x6e
add rsp, 0x140
pop rbx
ret
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x10
mov eax, dword [rcx + rdx]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test al, 1
jne 0x140019dec
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [rdx + r8]
call fcn.14000b340
nop
cmp byte [rdx + r8 + 1], 0
je 0x140019e32
lea rdx, str.Service_started_successfully.
lea rbx, [0x1402b2c40]
mov rcx, rbx
call fcn.1400127a0
mov rax, qword [0x1402b2c40]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140014960
movzx edx, al
mov rcx, rbx
call fcn.140014780
mov rcx, rbx
call fcn.1400118e0
xor eax, eax
add rsp, 0x140
pop rbx
ret