Function at 0x180050bc0
Capabilities:
Query service status
Set file attributes
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
sub rsp, 0x130
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1801f7e40]
xor rax, rsp
mov qword [rbp + 0xe0], rax
movabs rax, 0x27cf007f7ce8ad16
movabs rcx, 0x850656a6d407e8b0
mov qword [rbp], rax
movabs rdi, 0x55a86f0d2cb49755
mov rax, qword [rbp]
movabs rbx, 0xb6d29b90cec82ad2
mov qword [rbp + 0x20], rax
mov edx, 1
movabs rax, 0xf88efae4af8c47b3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x5b529dfeb8ef0821
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xfb9af08beb21bd8e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xe508fa9a864f0527
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xe4bfd7f5303e0ad7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x1e194198d07be73f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x3411bdbff1ab4177
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x94f384ea994ecdfc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x9366a6e9f40b5949
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x97daba9c644e7a96
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x1e1941eba016864b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0xd8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.18004fc50
movabs rax, 0x55a86f662cd39723
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rdi
xor edx, edx
mov rax, qword [rbp]
xor ecx, ecx
mov qword [rbp + 0x80], rax
mov r8d, 0xf003f
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, Ordinal_41
lea rdx, [rbp + 0x10]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x180050e1d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rbp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x180050e40
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rbp + 0x64], 4
jne 0x180050e58
lea r8, [rbp + 0x60]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.180050860
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.18013fb90
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret