Function at 0x18001b1a8
Capabilities:
Query service status
Start service
Stop service

Disassembly:
mov rax, rsp
push r12
sub rsp, 0xd0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
mov ecx, 8
call fcn.18003c28c
test rax, rax
je 0x18001b1ef
lea rcx, [rsp + 0x88]
mov qword [rax], rcx
jmp 0x18001b1f1
xor eax, eax
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x88]
call fcn.18000eb20
mov qword [rsp + 0xb0], rax
and qword [rsp + 0xb8], 0
mov ecx, 8
call fcn.18003c28c
test rax, rax
je 0x18001b230
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
jmp 0x18001b232
xor eax, eax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.18000eb20
mov qword [rsp + 0x78], rax
and qword [rsp + 0x80], 0
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x88]
mov rcx, rbx
call fcn.18001a638
mov rdi, qword [rsp + 0xb0]
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
test rsi, rsi
je 0x18001b2a0
cmp rsi, rax
je 0x18001b2a5
call fcn.18003c9b4
cmp rbx, rdi
je 0x18001b3c6
test rsi, rsi
jne 0x18001b2bd
call fcn.18003c9b4
xor r11d, r11d
jmp 0x18001b2c0
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001b2cb
call fcn.18003c9b4
cmp qword [rbx + 0x30], 8
jb 0x18001b2d8
mov rdx, qword [rbx + 0x18]
jmp 0x18001b2dc
lea rdx, [rbx + 0x18]
lea rcx, str.test_start_service:_ls
call fcn.180039ab0
test rsi, rsi
jne 0x18001b2f7
call fcn.18003c9b4
xor r11d, r11d
jmp 0x18001b2fa
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001b305
call fcn.18003c9b4
cmp qword [rbx + 0x30], 8
jb 0x18001b312
mov rbp, qword [rbx + 0x18]
jmp 0x18001b316
lea rbp, [rbx + 0x18]
test rbp, rbp
je 0x18001b391
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x18001b391
mov r8d, 0x10
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x18001b358
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
test rdi, rdi
je 0x18001b375
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x18001b375
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbp, rbp
je 0x18001b383
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x18001b391
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
jne 0x18001b3a0
call fcn.18003c9b4
xor r11d, r11d
jmp 0x18001b3a3
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001b3ae
call fcn.18003c9b4
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x88]
jmp 0x18001b296
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
test rdi, rdi
je 0x18001b3fc
cmp rdi, rax
je 0x18001b401
call fcn.18003c9b4
cmp rbx, rsi
je 0x18001b55e
test rdi, rdi
jne 0x18001b419
call fcn.18003c9b4
xor r11d, r11d
jmp 0x18001b41c
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001b427
call fcn.18003c9b4
cmp qword [rbx + 0x30], 8
jb 0x18001b434
mov rdx, qword [rbx + 0x18]
jmp 0x18001b438
lea rdx, [rbx + 0x18]
lea rcx, str.test_stop_service:_ls
call fcn.180039ab0
test rdi, rdi
jne 0x18001b453
call fcn.18003c9b4
xor r11d, r11d
jmp 0x18001b456
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001b461
call fcn.18003c9b4
cmp qword [rbx + 0x30], 8
jb 0x18001b46e
mov rbp, qword [rbx + 0x18]
jmp 0x18001b472
lea rbp, [rbx + 0x18]
xor r12d, r12d
test rbp, rbp
je 0x18001b529
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18001b529
mov r8d, 0xf01ff
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x18001b4bf
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
test rsi, rsi
je 0x18001b508
and dword [rsp + 0x30], r12d
xor edx, edx
lea r8d, [rdx + 0x18]
lea rcx, [rsp + 0x34]
call fcn.180041420
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x18001b508
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x18001b508
mov r12d, 1
test rbp, rbp
je 0x18001b516
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x18001b524
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r12d, r12d
jne 0x18001b52f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
jne 0x18001b53e
call fcn.18003c9b4
xor r11d, r11d
jmp 0x18001b541
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001b54c
call fcn.18003c9b4
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x50]
jmp 0x18001b3f2
lea rcx, [rsp + 0x50]
call fcn.18000de5c
mov rcx, qword [rsp + 0x50]
call fcn.18003c228
nop
lea rcx, [rsp + 0x88]
call fcn.18000de5c
mov rcx, qword [rsp + 0x88]
call fcn.18003c228
mov al, 1
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret