Function at 0x140001760
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14002a028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
cmp ecx, 2
jne 0x140001b0f
mov rdx, qword [rdx + 8]
lea rcx, [0x140026ae0]
call fcn.14000963c
test eax, eax
jne 0x1400017a8
call fcn.140002bf0
jmp 0x140001924
mov rdx, qword [rbx + 8]
lea rcx, [0x140026ae8]
call fcn.14000963c
test eax, eax
jne 0x14000186f
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140001b39
mov r8d, 0xf01ff
lea rdx, str.BalloonService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140001b4e
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140001b63
cmp dword [rsp + 0x2c], 1
je 0x14000184d
lea rcx, str.Stopping_service..._n
call fcn.140001c70
lea r8, [rsp + 0x28]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140001b78
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x140001b8d
lea rcx, str.Service_Uninstalled_n
call fcn.140001c70
jmp 0x140001912
mov rdx, qword [rbx + 8]
lea rcx, [0x140026af0]
call fcn.14000963c
test eax, eax
jne 0x14000188d
call fcn.140002e80
jmp 0x140001924
mov rdx, qword [rbx + 8]
lea rcx, [0x140026af8]
call fcn.14000963c
test eax, eax
jne 0x140001943
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140001ba2
mov r8d, 0xf01ff
lea rdx, str.BalloonService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140001bb7
lea rcx, str.Service_is_stopping..._n
call fcn.140001c70
lea r8, [rsp + 0x28]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140001bcc
mov rdx, rbx
call fcn.140002940
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400033b0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rdx, qword [rbx + 8]
lea rcx, str.status
call fcn.14000963c
test eax, eax
jne 0x1400019ab
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140001be1
mov r8d, 0xf01ff
lea rdx, str.BalloonService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140001bf6
lea rcx, str.STATUS:
call fcn.140001c70
mov rdx, rbx
call fcn.140002940
jmp 0x140001924
mov rdx, qword [rbx + 8]
lea rcx, str.config
call fcn.14000963c
test eax, eax
jne 0x140001a9a
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140001c0b
mov r8d, 1
lea rdx, str.BalloonService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140001c20
mov edx, 0x1000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001c35
lea r9, [rsp + 0x20]
mov r8d, 0x1000
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x140001c4a
mov rdx, qword [rbx + 0x38]
lea rcx, str.Service_name:_t_S_n
call fcn.140001c70
mov edx, dword [rbx]
lea rcx, str.Service_type:_t_d_n
call fcn.140001c70
mov edx, dword [rbx + 4]
lea rcx, str.Start_type:_t_d_n
call fcn.140001c70
mov rdx, qword [rbx + 0x30]
lea rcx, str.Start_name:_t_S_n
call fcn.140001c70
mov rdx, qword [rbx + 0x10]
lea rcx, str.Path:_t_t_S_n
call fcn.140001c70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
jmp 0x140001915
mov rdx, qword [rbx + 8]
lea rcx, str.help
call fcn.14000963c
lea rcx, [0x140026dc4]
call fcn.140001c70
lea rcx, str.USAGE:_n
call fcn.140001c70
lea rcx, str.blnsvr__i_tInstall_service_n
call fcn.140001c70
lea rcx, str.blnsvr__u_tUninstall_service_n
call fcn.140001c70
lea rcx, str.blnsvr__r_tRun_service_n
call fcn.140001c70
lea rcx, str.blnsvr__s_tStop_service_n
call fcn.140001c70
lea rcx, str.blnsvr_status_tCurrent_status_n
call fcn.140001c70
lea rcx, [0x140026dc4]
call fcn.140001c70
jmp 0x140001924
lea rcx, str.BalloonService
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140001924
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartServiceCtrlDispatcher
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140026e90]
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140026ec0]
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140026ee8]
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140026ec0]
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140026f98]
call fcn.140002b30
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryServiceConfig
call fcn.140002b30
int3