Function at 0x14004d210
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
mov rdi, rcx
mov qword [r11 - 0x50], 7
xor esi, esi
mov qword [r11 - 0x58], rsi
mov word [rsp + 0x70], si
lea r8d, [rsi + 0xc]
lea rdx, str.Service_Stop
lea rcx, [r11 - 0x70]
call fcn.140001870
nop
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
lea edx, [rsi + 0x32]
lea r8d, [rsi + 1]
mov rcx, rdi
call fcn.1400144a0
mov dword [rsp + 0x40], esi
xor eax, eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], eax
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 2
lea rax, str.Parameter___i_:__s
mov qword [rsp + 0x20], rax
lea edx, [rsi + 0x1e]
lea r8d, [rsi + 1]
mov rcx, rdi
call fcn.1400144a0
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov r14d, 0x2710
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
lea rax, str.Parameter___i_:__i
mov qword [rsp + 0x20], rax
lea edx, [rsi + 0x1e]
lea r8d, [rsi + 1]
mov rcx, rdi
call fcn.1400144a0
xor edx, edx
xor ecx, ecx
lea r8d, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13, rax
test rax, rax
jne 0x14004d39f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
lea rax, str.OpenSCManager
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea r12, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], r12
lea edx, [rsi + 0xa]
lea r8d, [rsi + 1]
mov rcx, rdi
call fcn.1400144a0
jmp 0x14004d80f
mov r8d, 0x24
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x14004d40d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x424
cmove ebx, esi
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
lea rax, str.OpenService
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea r12, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], r12
lea edx, [rbp + 0x14]
lea r8d, [rbp + 1]
mov rcx, rdi
call fcn.1400144a0
jmp 0x14004d806
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea r12, str.Error___i__return_by_function___s_
lea r15, str.State
lea rcx, str.Parameter___s_:__i
test eax, eax
jne 0x14004d486
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
lea rcx, str.QueryServiceStatus_1_
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rdi
call fcn.1400144a0
mov dword [rsp + 0x44], 4
jmp 0x14004d4d8
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rdi
call fcn.1400144a0
mov r11d, dword [rsp + 0x44]
cmp r11d, 4
je 0x14004d4d8
cmp r11d, 2
je 0x14004d4d8
cmp r11d, 5
jne 0x14004d66d
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14004d65f
lea r15, str.Error_synchronizing
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x426
je 0x14004d615
cmp eax, 0x425
jne 0x14004d5d6
mov r11d, dword [rsp + 0x44]
cmp r11d, 4
je 0x14004d539
cmp r11d, 2
je 0x14004d539
cmp r11d, 5
jne 0x14004d666
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, r14d
ja 0x14004d5a7
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov qword [rsp + 0x20], r15
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rdi
call fcn.1400144a0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14004d500
mov r11d, dword [rsp + 0x44]
lea r15, str.State
jmp 0x14004d66d
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov qword [rsp + 0x20], r15
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rdi
call fcn.1400144a0
jmp 0x14004d7fd
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
lea rax, [0x1400b3c30]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r12
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rdi
call fcn.1400144a0
jmp 0x14004d7fd
xor ebx, ebx
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
lea rax, str.State
mov qword [rsp + 0x28], rax
lea rax, str.Parameter___s_:__i
mov qword [rsp + 0x20], rax
lea edx, [rbx + 0x1e]
lea r8d, [rbx + 1]
mov rcx, rdi
call fcn.1400144a0
jmp 0x14004d7fd
mov r11d, dword [rsp + 0x44]
jmp 0x14004d66d
lea r15, str.State
mov ebx, dword [rsp + 0x54]
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov dword [rsp + 0x30], r11d
mov qword [rsp + 0x28], r15
lea rax, str.Parameter___s_:__i
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rdi
call fcn.1400144a0
cmp dword [rsp + 0x44], 3
jne 0x14004d7b5
nop word [rax + rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x58]
shr edx, 3
cmp edx, 0x3e8
jae 0x14004d6db
mov edx, 0x3e8
jmp 0x14004d6e2
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14004d775
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
lea rax, str.Parameter___s_:__i
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rdi
call fcn.1400144a0
cmp dword [rsp + 0x54], ebx
jbe 0x14004d74e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov ebx, dword [rsp + 0x54]
jmp 0x14004d75b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, r14d
ja 0x14004d768
cmp dword [rsp + 0x44], 3
je 0x14004d6c0
jmp 0x14004d7b5
mov ecx, 0x41d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14004d7b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
lea rcx, [0x1400b3c50]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rdi
call fcn.1400144a0
cmp dword [rsp + 0x44], 1
jne 0x14004d7c0
xor ebx, ebx
jmp 0x14004d7fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov dword [rsp + 0x28], eax
lea rax, str.Return_code___u_
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rdi
call fcn.1400144a0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
mov dword [rsp + 0x28], ebx
lea rax, str.Return_code__0x_x_
mov qword [rsp + 0x20], rax
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, rdi
call fcn.1400144a0
lea r9, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae r9, qword [rsp + 0x70]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, rdi
call fcn.1400144a0
nop
cmp qword [rsp + 0x88], 8
jb 0x14004d897
mov rcx, qword [rsp + 0x70]
call fcn.140065920
mov eax, ebx
jmp 0x14004d899
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret