Function at 0x180005bf0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push rbx
push rsi
sub rsp, 0x68
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x180005c1b
mov eax, 0x80004005
add rsp, 0x68
pop rsi
pop rbx
ret
lea rdx, str.KuaiZipDrive
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180005c71
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x180005c8e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x88]
mov eax, 0x80004005
add rsp, 0x68
pop rsi
pop rbx
ret
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x60], r12
mov r12d, 0x2710
cmp eax, 1
je 0x180005d50
cmp eax, 3
je 0x180005cd0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180005e63
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0x44]
mov ebp, eax
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x180005cf7
mov edx, 0x3e8
jmp 0x180005cfe
cmp edx, r12d
cmova edx, r12d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180005d89
cmp dword [rsp + 0x44], ebx
jbe 0x180005d3b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x180005d49
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0x48]
ja 0x180005d89
cmp dword [rsp + 0x34], 3
je 0x180005cd0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x180005d89
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x180005da5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x80004005
jmp 0x180005e63
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x44]
mov ebp, eax
cmp ecx, 2
jne 0x180005e42
nop
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x180005ddb
mov edx, 0x3e8
jmp 0x180005de2
cmp edx, r12d
cmova edx, r12d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180005e3e
cmp dword [rsp + 0x44], ebx
jbe 0x180005e25
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0x44]
mov ebp, eax
jmp 0x180005e33
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0x48]
ja 0x180005e3e
mov ecx, dword [rsp + 0x34]
cmp ecx, 2
je 0x180005dc0
jmp 0x180005e42
mov ecx, dword [rsp + 0x34]
xor eax, eax
cmp ecx, 4
mov ebx, 0x80004005
mov rcx, rdi
cmove ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
pop rsi
pop rbx
ret