Function at 0x10000aa98
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15d, 1
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov ebx, r15d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x10000ac81
lea rdx, [0x1000017c8]
mov r8d, r15d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor edi, edi
test rax, rax
setne dil
test rax, rax
je 0x10000ab03
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x10000acb6
xor r12d, r12d
mov edi, r15d
mov esi, 0x80070000
lea r14d, [r12 + 5]
mov eax, r14d
dec r14d
test eax, eax
je 0x10000ac08
lea rdx, [0x1000017c8]
mov r8d, 0x24
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r13, rax
test rax, rax
je 0x10000abc0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10000abac
cmp dword [rsp + 0x24], r15d
je 0x10000aba2
lea r8, [rsp + 0x20]
mov edx, r15d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10000aba7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
sub eax, 0x425
je 0x10000ab9b
xor edi, edi
cmp eax, r15d
je 0x10000aba7
movzx ebx, r11w
or ebx, esi
test r11d, r11d
cmovle ebx, r11d
jmp 0x10000abf2
cmp dword [rsp + 0x24], r15d
jne 0x10000abf2
mov r12d, r15d
jmp 0x10000abf0
mov r12d, r15d
jmp 0x10000abf2
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
jmp 0x10000abf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, esi
test r11d, r11d
cmovle eax, r11d
test eax, eax
jns 0x10000abeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
jmp 0x10000abf0
mov ebx, 0x80004005
xor edi, edi
test r13, r13
je 0x10000ac00
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
jne 0x10000ab1b
test r12d, r12d
je 0x10000acb6
lea rdx, [0x1000017c8]
mov r8d, 0x10000
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x10000ac41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
xor ebx, ebx
test eax, eax
sete bl
jmp 0x10000ac71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, esi
test r11d, r11d
cmovle eax, r11d
test eax, eax
jns 0x10000ac6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
jmp 0x10000acb6
mov ebx, 0x80004005
test rdi, rdi
je 0x10000acb6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10000acb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0x80070000
mov r11d, eax
movzx eax, ax
or eax, esi
test r11d, r11d
cmovle eax, r11d
test eax, eax
jns 0x10000acb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
jmp 0x10000acc4
mov ebx, 0x80004005
test rbp, rbp
je 0x10000acc4
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret