Function at 0x140036940
Capabilities:
Query service status
Start service

Disassembly:
mov rax, rsp
push rsi
push r14
sub rsp, 0x88
mov qword [rax + 8], rbx
or r14d, 0xffffffff
mov qword [rax - 0x20], r12
mov rbx, r8
xor r12d, r12d
mov rsi, rcx
mov qword [rax + 0x20], r12
mov qword [rax - 0x60], r12
mov qword [rax - 0x68], r12
test r8, r8
je 0x140036976
mov dword [r8], r12d
lea rcx, [rsp + 0xb8]
call fcn.140039a80
mov rdx, qword [rsp + 0xb8]
test rdx, rdx
je 0x14003699a
lea rcx, [rsp + 0x30]
call fcn.140039f70
cmp qword [0x14026e570], r12
mov qword [rsp + 0x70], r15
je 0x140036bd8
lea rcx, [rsp + 0x98]
mov rdx, rsi
sub rcx, 8
call fcn.140025620
mov rcx, qword [0x14026e570]
mov r8d, 0xf01ff
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rax
call fcn.140172370
mov r15, rax
test rax, rax
je 0x140036bd8
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x80], rdi
call fcn.140039ef0
mov r8, qword [rsp + 0x30]
mov edx, eax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movsxd rcx, eax
call fcn.140172320
test rax, rax
jne 0x140036aac
mov rax, qword gs:[0x58]
mov edi, 0x2fe0
add rdi, qword [rax]
mov rax, qword [rdi]
test rax, rax
jne 0x140036a3b
call fcn.140176664
cmp dword [rax], 0x420
jne 0x140036a68
cmp dword [0x1402734bc], 6
jl 0x140036a60
mov r8, rsi
lea rdx, str.service__s_already_running
mov ecx, 0x670006
call fcn.140028ca0
mov r14d, r12d
jmp 0x140036ba7
test rbx, rbx
je 0x140036a7e
mov rax, qword [rdi]
test rax, rax
jne 0x140036a7a
call fcn.140176664
mov eax, dword [rax]
mov dword [rbx], eax
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x38]
call fcn.140039e50
mov r8, rsi
lea rdx, str.failed_start_service__s__s:__m
mov ecx, 0x670003
mov r9, qword [rax]
call fcn.140028ca0
jmp 0x140036ba7
lea rax, [rsp + 0xb0]
mov r9d, 0x24
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movsxd rcx, eax
call fcn.140172320
test rax, rax
jne 0x140036af8
mov r8, rsi
lea rdx, str.failed_query_service_status__s:__m
mov ecx, 0x670003
call fcn.140028ca0
test eax, eax
jne 0x140036ba7
mov eax, dword [rsp + 0x44]
mov ebx, r12d
mov qword [rsp + 0xa8], rbp
mov edi, r12d
mov ebp, dword [rsp + 0x54]
cmp eax, 4
je 0x140036b9c
cmp ebx, 0xea60
jge 0x140036b97
cmp edi, 0x1d4c0
jge 0x140036b97
lea rax, [rsp + 0xb0]
mov r9d, 0x24
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movsxd rcx, eax
call fcn.140172320
test rax, rax
jne 0x140036b6f
mov r8, rsi
lea rdx, str.failed_query_service_status__s:__m
mov ecx, 0x670003
call fcn.140028ca0
test eax, eax
jne 0x140036b9f
mov eax, dword [rsp + 0x54]
cmp eax, ebp
jbe 0x140036b7c
mov ebx, r12d
mov ebp, eax
mov ecx, 0x64
call fcn.14002ad30
mov eax, dword [rsp + 0x44]
add ebx, 0x64
add edi, 0x64
cmp eax, 4
jne 0x140036b17
jmp 0x140036b9c
cmp eax, 4
jne 0x140036b9f
mov r14d, r12d
mov rbp, qword [rsp + 0xa8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movsxd rcx, eax
call fcn.140172320
mov rdi, qword [rsp + 0x80]
test rax, rax
jne 0x140036bec
lea rdx, str.Failed_close_service_handle:__m
mov ecx, 0x670003
call fcn.140028ca0
jmp 0x140036bec
mov r8, rsi
lea rdx, str.service__s_doesnt_exist
mov ecx, 0x670005
call fcn.140028ca0
lea rcx, [rsp + 0xb8]
call fcn.140039c40
mov rcx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140036c1a
call fcn.14017668c
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x30]
call fcn.140039f10
mov r12, qword [rsp + 0x78]
test r14d, r14d
je 0x140036c42
mov r8, rsi
lea rdx, str.error_starting_service__s
mov ecx, 0x670003
call fcn.140028ca0
mov eax, r14d
add rsp, 0x88
pop r14
pop rsi
ret