Function at 0x180005be0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push rbx
push rsi
sub rsp, 0x68
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x180005c0b
mov eax, 0x80004005
add rsp, 0x68
pop rsi
pop rbx
ret
lea rdx, str.KuaiZipDrive
mov r8d, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180005c61
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x180005c7e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x88]
mov eax, 0x80004005
add rsp, 0x68
pop rsi
pop rbx
ret
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x60], r12
mov r12d, 0x2710
cmp eax, 1
je 0x180005d40
cmp eax, 3
je 0x180005cc0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x180005e53
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0x44]
mov ebp, eax
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x180005ce7
mov edx, 0x3e8
jmp 0x180005cee
cmp edx, r12d
cmova edx, r12d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180005d79
cmp dword [rsp + 0x44], ebx
jbe 0x180005d2b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x180005d39
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0x48]
ja 0x180005d79
cmp dword [rsp + 0x34], 3
je 0x180005cc0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x180005d79
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x180005d95
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x80004005
jmp 0x180005e53
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x34]
mov ebx, dword [rsp + 0x44]
mov ebp, eax
cmp ecx, 2
jne 0x180005e32
nop
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x180005dcb
mov edx, 0x3e8
jmp 0x180005dd2
cmp edx, r12d
cmova edx, r12d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180005e2e
cmp dword [rsp + 0x44], ebx
jbe 0x180005e15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [rsp + 0x44]
mov ebp, eax
jmp 0x180005e23
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, dword [rsp + 0x48]
ja 0x180005e2e
mov ecx, dword [rsp + 0x34]
cmp ecx, 2
je 0x180005db0
jmp 0x180005e32
mov ecx, dword [rsp + 0x34]
xor eax, eax
cmp ecx, 4
mov ebx, 0x80004005
mov rcx, rdi
cmove ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
pop rsi
pop rbx
ret