Function at 0x180048640
Capabilities:
Query service status
Set registry value
Stop service

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x3c8
cmp qword [rsp + 0x3d0], 0
je 0x180048670
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x3d0]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x180048677
xor eax, eax
jmp 0x180048b89
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x51], 0
call fcn.180036930
mov dword [rsp + 0xb0], 0x19
mov byte [rsp + 0xc8], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xb0]
mov edx, 0x22e008
mov rcx, qword [rsp + 0x3d0]
call fcn.180047aa0
test eax, eax
je 0x1800486cc
mov dword [rsp + 0x6c], 1
jmp 0x1800486d4
mov dword [rsp + 0x6c], 0
movzx eax, byte [rsp + 0x6c]
mov byte [rsp + 0x51], al
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x18004870c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180048b2b
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x3d0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x18004879d
lea r8, [rsp + 0xd0]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_ControlService]
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180048781
cmp dword [rsp + 0xd4], 1
jne 0x180048781
mov dword [rsp + 0x68], 1
jmp 0x180048789
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x180048b2b
mov r8d, 0x40
lea rdx, [rsp + 0xf0]
lea rcx, [0x18007c9f0]
call fcn.1800493f0
lea rdx, [rsp + 0x1b0]
mov rcx, rax
call fcn.18004d250
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x1b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180048b2b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x3d0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180048aea
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x3d0]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180048ae8
mov dword [rsp + 0x90], 1
mov r8d, 0x40
lea rdx, [rsp + 0xf0]
lea rcx, [0x18007c9c0]
call fcn.1800493f0
lea rdx, [rsp + 0x130]
mov rcx, rax
call fcn.18004d250
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x180048ab4
mov eax, 2
imul rax, rax, 0
mov ecx, 0x5c
mov word [rsp + rax + 0x1b0], cx
mov eax, 2
imul rax, rax, 1
xor ecx, ecx
mov word [rsp + rax + 0x1b0], cx
mov r8d, 0x40
lea rdx, [rsp + 0xf0]
lea rcx, str.02____t846__0U
call fcn.1800493f0
lea rdx, [rsp + 0x130]
mov rcx, rax
call fcn.18004d250
lea r8, [rsp + 0x130]
mov edx, 0x105
lea rcx, [rsp + 0x1b0]
call fcn.18005384c
lea r8, [0x180088bec]
mov edx, 0x105
lea rcx, [rsp + 0x1b0]
call fcn.18005384c
mov r8d, 0x40
lea rdx, [rsp + 0xf0]
lea rcx, [0x18007c9f0]
call fcn.1800493f0
lea rdx, [rsp + 0x130]
mov rcx, rax
call fcn.18004d250
lea r8, [rsp + 0x130]
mov edx, 0x105
lea rcx, [rsp + 0x1b0]
call fcn.18005384c
lea r8, [0x180088bec]
mov edx, 0x105
lea rcx, [rsp + 0x1b0]
call fcn.18005384c
mov r8, qword [rsp + 0x3d0]
mov edx, 0x105
lea rcx, [rsp + 0x1b0]
call fcn.18005384c
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x1b0]
call fcn.18005754c
movzx eax, ax
shl eax, 1
mov word [rsp + 0xa0], ax
movzx eax, word [rsp + 0xa0]
add eax, 2
mov word [rsp + 0xa2], ax
xor edx, edx
lea rcx, [0x18007c998]
call fcn.18004a600
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x180048ab4
lea rcx, [rsp + 0xa0]
call qword [rsp + 0x98]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
jl 0x180048a7f
mov dword [rsp + 0x60], 1
jmp 0x180048a87
mov dword [rsp + 0x60], 0
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x180048aa3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180048ab4
mov ecx, dword [rsp + 0x64]
call fcn.180046230
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x3d0]
mov rcx, qword [rsp + 0x88]
call fcn.180047700
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180048b09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, byte [rsp + 0x50]
test eax, eax
jne 0x180048b84
movzx eax, byte [rsp + 0x51]
test eax, eax
je 0x180048b84
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x80], eax
mov byte [rsp + 0xc8], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xb0]
mov edx, 0x22e008
mov rcx, qword [rsp + 0x3d0]
call fcn.180047aa0
mov ecx, dword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, byte [rsp + 0x50]
add rsp, 0x3c8
ret