Function at 0x18000fb7c
Capabilities:
Create service
Delete service
Query service status
Start service

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x18003b2e0]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x70], r8
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x6800
lea r12d, [rax + 0x4e20]
call fcn.180013f54
mov ebp, 0x400
mov rcx, rax
mov edx, ebp
mov r14, rax
call fcn.180014038
mov edx, ebp
mov rcx, r14
mov rsi, rax
call fcn.180014038
mov edx, 0x4000
mov rcx, r14
mov rbp, rax
call fcn.180014038
mov edx, 0x2000
mov rcx, r14
mov r13, rax
call fcn.180014038
lea rcx, [rsp + 0x78]
mov r8d, edi
mov rdx, rbx
mov r15, rax
call fcn.180013ff0
mov ebx, 0x400
lea rcx, [rsp + 0x78]
mov r8d, ebx
mov rdx, rsi
call fcn.180014098
lea rcx, [rsp + 0x78]
mov r8d, ebx
mov rdx, rbp
call fcn.180014098
lea rcx, [rsp + 0x78]
mov r8d, 0x4000
mov rdx, r13
call fcn.180014098
xor edx, edx
mov r8d, 0xf003f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
xor eax, eax
test rdi, rdi
jne 0x18000fc88
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_open_service_control_manager_on__s:__d
mov rdx, rsi
mov r8d, eax
call fcn.18000d9a8
jmp 0x18000fde7
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], eax
mov r9d, 0xf01ff
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x18000fcf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_create_service__s_on__s:__d
mov r8, rsi
mov r9d, eax
mov rdx, rbp
call fcn.18000d9a8
jmp 0x18000fdde
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x18000fd25
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41d
je 0x18000fd25
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_start_service__s_on__s:__d
jmp 0x18000fd9f
lea r8, str.Started_service__s_on__s
mov r9, rbp
mov edx, 0x2000
mov rcx, r15
mov qword [rsp + 0x20], rsi
call fcn.18001a12c
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [r15 + rdx], 0
jne 0x18000fd45
xor r8d, r8d
mov rcx, r15
call qword [rsp + WSAStartup]
jmp 0x18000fd85
lea rdx, [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x18000fd92
cmp dword [rsp + 0x9c], 1
je 0x18000fdad
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, r12d
jb 0x18000fd5b
jmp 0x18000fdad
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_query_service__s_on__s:__d
mov r9d, eax
mov r8, rsi
mov rdx, rbp
call fcn.18000d9a8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x18000fdd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_delete_service__s_on__s:__d
mov r8, rsi
mov r9d, eax
mov rdx, rbp
call fcn.18000d9a8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call fcn.180013fd0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.18001ac30
mov rbx, qword [rsp + 0x118]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret