Function at 0x401df9
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], rcx
mov r8d, 0xf003f
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call rax
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x401e7b
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 5
je 0x401e71
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov eax, dword [rbp + 4]
mov r8d, eax
lea rdx, str.OpenSCManager_failed___lu__n
call sym.fprintf
mov eax, 0x67
jmp 0x4020e2
mov eax, 0x66
jmp 0x4020e2
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 0x38]
mov rax, qword [rbp + 8]
mov r8d, 0x24
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenServiceA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x401f2f
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0x424
jne 0x401ee7
mov rax, qword [rbp + 0x30]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r8, rbx
lea rdx, str.Service_does_not_exist:__s
mov rcx, rax
call sym.fprintf
jmp 0x401f15
mov rax, qword [rbp + 0x30]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov eax, dword [rbp - 0xc]
mov r9d, eax
mov r8, rbx
lea rdx, str.Failed_to_open_service__s___lu__n
call sym.fprintf
mov rax, qword [rbp + 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
mov eax, 0x68
jmp 0x4020e2
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 8]
mov r8, rdx
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_ControlService]
call rax
test eax, eax
jne 0x401fc4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 0x10], eax
cmp dword [rbp - 0x10], 0x426
jne 0x401f91
mov rax, qword [rbp + 0x30]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r8, rbx
lea rdx, str.Service_is_already_INACTIVE:__s
mov rcx, rax
call sym.fprintf
jmp 0x4020bd
mov rax, qword [rbp + 0x30]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov eax, dword [rbp - 0x10]
mov r9d, eax
mov r8, rbx
lea rdx, str.Failed_to_stop_service__s___lu__n
call sym.fprintf
jmp 0x4020bd
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
mov dword [rbp - 0x14], eax
mov dword [rbp - 0x18], 0x7530
jmp 0x402086
mov eax, dword [rbp - 0x28]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x44]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
mov r8, rdx
mov edx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
call rax
test eax, eax
jne 0x402043
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov ebx, eax
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r8d, ebx
lea rdx, str.QueryServiceStatusEx_failed___lu__n
mov rcx, rax
call sym.fprintf
jmp 0x4020bd
mov eax, dword [rbp - 0x3c]
cmp eax, 1
je 0x402094
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rax
sub eax, dword [rbp - 0x14]
cmp dword [rbp - 0x18], eax
jae 0x402086
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0xf
mov edx, 1
lea rcx, str.Wait_timed_out_n
call sym.fwrite
jmp 0x4020bd
mov eax, dword [rbp - 0x3c]
cmp eax, 1
jne 0x401fdc
jmp 0x402095
nop
mov rax, qword [rbp + 0x30]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r8, rbx
lea rdx, str.Service_stopped:__s_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
mov rax, qword [rbp + 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
mov eax, 0
add rsp, 0x98
pop rbx
pop rbp
ret