Function at 0x1805791e
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
movzx ecx, byte [0x180fb8f9]
sub esp, 0x44
push ebx
push esi
neg ecx
push edi
sbb ecx, ecx
and ecx, 0x180fbba0
push 1
pop ebx
je 0x1805796d
push ebx
push 7
pop esi
push esi
mov dword [esp + 0x1c], ecx
call fcn.18001d8a
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push str._ServiceInstall::StopService_
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call fcn.18001000
pop ecx
pop ecx
jmp 0x18057970
push 7
pop esi
push 0xf003f
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x10], eax
cmp eax, edi
jne 0x18057993
call fcn.1800fc86
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push 0x24
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esp + 0xc], eax
cmp eax, edi
jne 0x180579c2
call fcn.1800fc86
mov esi, eax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
jmp 0x1805798c
push 6
mov dword [esp + 0x38], edi
pop ecx
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x18057a2d
cmp dword [esp + 0x38], ebx
je 0x18057b75
cmp dword [esp + 0x38], 3
je 0x18057a2d
push 0x1c
lea eax, [esp + 0x38]
push 0
push eax
call fcn.1809d820
add esp, 0xc
lea eax, [esp + 0x34]
push eax
push ebx
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x18057a2d
call fcn.1800fc86
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180579b4
cmp dword [esp + 0x38], ebx
je 0x18057b75
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18057a72
push ebx
push esi
mov dword [esp + 0x1c], ecx
call fcn.18001d8a
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push str._Service_is_stopping..._
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call fcn.18001000
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x38], ebx
je 0x18057b75
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esp + 0x28]
cmp eax, 0x1f40
jae 0x18057b1e
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1c
lea eax, [esp + 0x38]
push 0
push eax
call fcn.1809d820
add esp, 0xc
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
movzx esi, byte [0x180fb8f9]
neg esi
sbb esi, esi
and esi, 0x180fbba0
je 0x18057b11
call edi
push ebx
mov edi, eax
sub edi, dword [esp + 0x2c]
push 7
mov ecx, esi
mov dword [esp + 0x1c], esi
call fcn.18001d8a
push edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push str._Waiting_for_service_to_stop__time_elapsed:__d_ms_
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 7
call fcn.18001000
add esp, 0xc
push 7
pop esi
cmp dword [esp + 0x38], ebx
jne 0x18057a86
cmp dword [esp + 0x38], ebx
je 0x18057b75
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18057b61
push 0xffffffffffffffff
push esi
mov dword [esp + 0x1c], ecx
call fcn.18001d8a
or dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push str._Service_did_not_stop__Not_good..._
push eax
mov dword [esp + 0x28], esi
call fcn.18001000
pop ecx
pop ecx
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 0x800705b4
jmp 0x180579b4
movzx ecx, byte [0x180fb8f9]
neg ecx
sbb ecx, ecx
and ecx, 0x180fbba0
je 0x18057bb0
push ebx
push esi
mov dword [esp + 0x1c], ecx
call fcn.18001d8a
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push str._ServiceInstall::StopService___service_stopped_
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call fcn.18001000
pop ecx
pop ecx
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x180579b4