Function at 0x10001b06c
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x60
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x10001b0cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100013510]
lea rcx, [0x100014460]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10001e018
jmp 0x10001b3e8
lea rdx, [0x100013510]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10001b11a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100013510]
lea rcx, [0x1000144a0]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10001e018
jmp 0x10001b3d1
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10001b163
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014510]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
jmp 0x10001b3cc
cmp dword [rsp + 0x34], 1
je 0x10001b182
cmp dword [rsp + 0x34], 3
je 0x10001b182
lea rcx, [0x100014590]
call fcn.10001e018
jmp 0x10001b3d1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [rsp + 0x44]
mov r14d, 0x2710
mov ebp, eax
jmp 0x10001b209
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x10001b1b1
mov edx, 0x3e8
jmp 0x10001b1b8
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b255
cmp dword [rsp + 0x44], esi
jbe 0x10001b1fb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [rsp + 0x44]
mov ebp, eax
jmp 0x10001b209
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0x48]
ja 0x10001b244
cmp dword [rsp + 0x34], 3
je 0x10001b196
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10001b277
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000146a0]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
jmp 0x10001b3cc
mov ebx, 0x800705b4
lea rcx, [0x100014650]
jmp 0x10001b178
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014600]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
jmp 0x10001b3cc
lea rcx, [0x1000146d8]
call fcn.10001e018
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b255
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [rsp + 0x44]
mov ebp, eax
jmp 0x10001b337
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x10001b2d3
mov edx, 0x3e8
jmp 0x10001b2da
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b344
cmp dword [rsp + 0x44], esi
jbe 0x10001b329
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [rsp + 0x44]
lea rcx, [0x10001400c]
mov ebp, eax
call fcn.10001e018
jmp 0x10001b337
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0x48]
ja 0x10001b366
cmp dword [rsp + 0x34], 2
je 0x10001b2b8
jmp 0x10001b366
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014710]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10001e018
lea rcx, [0x10001475c]
call fcn.10001e018
cmp dword [rsp + 0x34], 4
jne 0x10001b385
lea rcx, [0x100014760]
jmp 0x10001b178
lea rcx, [0x1000147a0]
call fcn.10001e018
mov edx, dword [rsp + 0x34]
lea rcx, [0x1000147d0]
call fcn.10001e018
mov edx, dword [rsp + 0x3c]
lea rcx, [0x100014800]
call fcn.10001e018
mov edx, dword [rsp + 0x44]
lea rcx, [0x100014828]
call fcn.10001e018
mov edx, dword [rsp + 0x48]
lea rcx, [0x100014850]
call fcn.10001e018
test rdi, rdi
je 0x10001b3df
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret