Function at 0x10001b40c
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x10001b46f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100013510]
lea rcx, [0x100014880]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10001e018
jmp 0x10001b67d
lea rdx, [0x100013510]
mov r8d, 0x2c
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10001b4bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000148f0]
movzx ebx, ax
lea rdx, [0x100013510]
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10001e018
jmp 0x10001b666
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10001b4f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014960]
jmp 0x10001b49a
cmp dword [rsp + 0x34], 1
jne 0x10001b505
lea rcx, [0x1000149d8]
jmp 0x10001b661
cmp dword [rsp + 0x34], 3
jne 0x10001b594
mov r14d, 0x2710
lea rcx, [0x100014a18]
call fcn.10001e018
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x10001b53d
mov edx, 0x3e8
jmp 0x10001b544
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b5fd
cmp dword [rsp + 0x34], 1
je 0x10001b5f4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x7530
ja 0x10001b5e1
cmp dword [rsp + 0x34], 3
je 0x10001b516
mov rdx, rdi
mov rcx, rsi
call fcn.10001b69c
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10001b653
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014ac8]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10001e018
jmp 0x10001b666
lea rcx, [0x100014a90]
call fcn.10001e018
mov ebx, 0x800705b4
jmp 0x10001b666
lea rcx, [0x100014a50]
jmp 0x10001b661
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014600]
jmp 0x10001b5c7
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b5fd
cmp dword [rsp + 0x34], 1
je 0x10001b65a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x7530
ja 0x10001b5e1
cmp dword [rsp + 0x34], 1
jne 0x10001b60c
lea rcx, [0x100014b08]
call fcn.10001e018
test rdi, rdi
je 0x10001b674
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret