Function at 0x180019a80
Capabilities:
Enumerate services
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov rax, qword [0x180053040]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x50], rsp
mov qword [rsp + 0x38], 0
mov ecx, 0x58
call fcn.180020580
call rax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 0x7530
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x180019b0d
mov eax, 1
jmp 0x180019d57
mov ecx, 0x85
call fcn.180020580
call rax
cmp eax, 0xea
je 0x180019b27
xor eax, eax
jmp 0x180019d57
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x78]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180019b60
xor eax, eax
jmp 0x180019d57
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
mov r8, qword [rsp + 0x38]
mov edx, 1
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x180019bae
mov dword [rsp + 0x60], 0
lea rdx, [0x180019d3b]
mov rcx, qword [rsp + 0x50]
call fcn.180030280
mov dword [rsp + 0x30], 0
jmp 0x180019bc2
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x30], eax
jae 0x180019d1e
mov eax, dword [rsp + 0x30]
imul rax, rax, 0x30
lea rcx, [rsp + 0x80]
mov rdx, qword [rsp + 0x38]
mov rdi, rcx
lea rsi, [rdx + rax]
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x24
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x180019c36
mov dword [rsp + 0x64], 0
lea rdx, [0x180019d41]
mov rcx, qword [rsp + 0x50]
call fcn.180030280
nop
lea r8, [rsp + 0xb0]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x180019c6b
mov dword [rsp + 0x68], 0
lea rdx, [0x180019d47]
mov rcx, qword [rsp + 0x50]
call fcn.180030280
cmp dword [rsp + 0xb4], 1
je 0x180019d0e
mov ecx, 0x3f
call fcn.180020580
mov ecx, dword [rsp + 0xc8]
call rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x180019cce
mov dword [rsp + 0x6c], 0
lea rdx, [0x180019d4d]
mov rcx, qword [rsp + 0x50]
call fcn.180030280
cmp dword [rsp + 0xb4], 1
jne 0x180019cda
jmp 0x180019d0e
mov ecx, 0x58
call fcn.180020580
call rax
sub eax, dword [rsp + 0x58]
cmp eax, dword [rsp + 0x5c]
jbe 0x180019d09
mov dword [rsp + 0x70], 0
lea rdx, [0x180019d53]
mov rcx, qword [rsp + 0x50]
call fcn.180030280
jmp 0x180019c6b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180019bb8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x180019d57
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.18002f360
add rsp, 0xe8
pop rdi
pop rsi
ret