Function at 0x10000c084
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x10000c0e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100004500]
lea rcx, [0x100005810]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10000ec98
jmp 0x10000c2f5
lea rdx, [0x100004500]
mov r8d, 0x2c
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10000c134
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005880]
movzx ebx, ax
lea rdx, [0x100004500]
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10000ec98
jmp 0x10000c2de
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10000c16a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000058f0]
jmp 0x10000c112
cmp dword [rsp + 0x34], 1
jne 0x10000c17d
lea rcx, [0x100005968]
jmp 0x10000c2d9
cmp dword [rsp + 0x34], 3
jne 0x10000c20c
mov r14d, 0x2710
lea rcx, [0x1000059a8]
call fcn.10000ec98
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x10000c1b5
mov edx, 0x3e8
jmp 0x10000c1bc
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10000c275
cmp dword [rsp + 0x34], 1
je 0x10000c26c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x7530
ja 0x10000c259
cmp dword [rsp + 0x34], 3
je 0x10000c18e
mov rdx, rdi
mov rcx, rsi
call fcn.10000c314
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10000c2cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005a58]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10000ec98
jmp 0x10000c2de
lea rcx, [0x100005a20]
call fcn.10000ec98
mov ebx, 0x800705b4
jmp 0x10000c2de
lea rcx, [0x1000059e0]
jmp 0x10000c2d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100005590]
jmp 0x10000c23f
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10000c275
cmp dword [rsp + 0x34], 1
je 0x10000c2d2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x7530
ja 0x10000c259
cmp dword [rsp + 0x34], 1
jne 0x10000c284
lea rcx, [0x100005a98]
call fcn.10000ec98
test rdi, rdi
je 0x10000c2ec
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret