Function at 0x18000ff54
Capabilities:
Create service
Delete service
Query service status
Start service

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x18003e060]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x70], r8
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x6800
lea r12d, [rax + 0x4e20]
call fcn.180015244
mov ebp, 0x400
mov rcx, rax
mov edx, ebp
mov r14, rax
call fcn.180015328
mov edx, ebp
mov rcx, r14
mov rsi, rax
call fcn.180015328
mov edx, 0x4000
mov rcx, r14
mov rbp, rax
call fcn.180015328
mov edx, 0x2000
mov rcx, r14
mov r13, rax
call fcn.180015328
lea rcx, [rsp + 0x78]
mov r8d, edi
mov rdx, rbx
mov r15, rax
call fcn.1800152e0
mov ebx, 0x400
lea rcx, [rsp + 0x78]
mov r8d, ebx
mov rdx, rsi
call fcn.180015388
lea rcx, [rsp + 0x78]
mov r8d, ebx
mov rdx, rbp
call fcn.180015388
lea rcx, [rsp + 0x78]
mov r8d, 0x4000
mov rdx, r13
call fcn.180015388
xor edx, edx
mov r8d, 0xf003f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
xor eax, eax
test rdi, rdi
jne 0x18001005c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rdi + 0x33]
mov rdx, rsi
mov r8d, eax
call fcn.18000dbd8
jmp 0x1800101c9
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], eax
mov r9d, 0xf01ff
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x1800100cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._s_on__s:__d
lea ecx, [rbx + 0x36]
mov r9, rsi
mov r8, rbp
mov dword [rsp + 0x20], eax
call fcn.18000da80
jmp 0x1800101c0
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x1800100fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41d
je 0x1800100fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, gethostname
jmp 0x180010173
lea r8, str.Started_service__s_on__s
mov r9, rbp
mov edx, 0x2000
mov rcx, r15
mov qword [rsp + 0x20], rsi
call fcn.18001b94c
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [r15 + rdx], 0
jne 0x18001011b
xor r8d, r8d
mov rcx, r15
call qword [rsp + WSAStartup]
jmp 0x18001015b
lea rdx, [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180010168
cmp dword [rsp + 0x9c], 1
je 0x180010189
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, r12d
jb 0x180010131
jmp 0x180010189
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, gethostname
lea rdx, str._s_on__s:__d
mov r9, rsi
mov r8, rbp
mov dword [rsp + 0x20], eax
call fcn.18000da80
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1800101b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._s_on__s:__d
mov r9, rsi
mov r8, rbp
mov ecx, reloc.WS2_32.dll_gethostname
mov dword [rsp + 0x20], eax
call fcn.18000da80
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call fcn.1800152c0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.18001be40
mov rbx, qword [rsp + 0x118]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret