Function at 0x18001aa94
Capabilities:
Query service status
Start service
Stop service

Disassembly:
mov rax, rsp
push r12
sub rsp, 0xd0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rcx
mov ecx, 8
call fcn.18003c23c
test rax, rax
je 0x18001aadb
lea rcx, [rsp + 0x88]
mov qword [rax], rcx
jmp 0x18001aadd
xor eax, eax
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x88]
call fcn.18000d978
mov qword [rsp + 0xb0], rax
and qword [rsp + 0xb8], 0
mov ecx, 8
call fcn.18003c23c
test rax, rax
je 0x18001ab1c
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
jmp 0x18001ab1e
xor eax, eax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.18000d978
mov qword [rsp + 0x78], rax
and qword [rsp + 0x80], 0
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x88]
mov rcx, rbx
call fcn.180019f34
mov rdi, qword [rsp + 0xb0]
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
test rsi, rsi
je 0x18001ab8c
cmp rsi, rax
je 0x18001ab91
call fcn.18003c934
cmp rbx, rdi
je 0x18001acb2
test rsi, rsi
jne 0x18001aba9
call fcn.18003c934
xor r11d, r11d
jmp 0x18001abac
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001abb7
call fcn.18003c934
cmp qword [rbx + 0x30], 8
jb 0x18001abc4
mov rdx, qword [rbx + 0x18]
jmp 0x18001abc8
lea rdx, [rbx + 0x18]
lea rcx, str.test_start_service:_ls
call fcn.180039a28
test rsi, rsi
jne 0x18001abe3
call fcn.18003c934
xor r11d, r11d
jmp 0x18001abe6
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001abf1
call fcn.18003c934
cmp qword [rbx + 0x30], 8
jb 0x18001abfe
mov rbp, qword [rbx + 0x18]
jmp 0x18001ac02
lea rbp, [rbx + 0x18]
test rbp, rbp
je 0x18001ac7d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x18001ac7d
mov r8d, 0x10
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x18001ac44
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
test rdi, rdi
je 0x18001ac61
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x18001ac61
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbp, rbp
je 0x18001ac6f
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x18001ac7d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
jne 0x18001ac8c
call fcn.18003c934
xor r11d, r11d
jmp 0x18001ac8f
mov r11, qword [rsi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001ac9a
call fcn.18003c934
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x88]
jmp 0x18001ab82
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
test rdi, rdi
je 0x18001ace8
cmp rdi, rax
je 0x18001aced
call fcn.18003c934
cmp rbx, rsi
je 0x18001ae4a
test rdi, rdi
jne 0x18001ad05
call fcn.18003c934
xor r11d, r11d
jmp 0x18001ad08
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001ad13
call fcn.18003c934
cmp qword [rbx + 0x30], 8
jb 0x18001ad20
mov rdx, qword [rbx + 0x18]
jmp 0x18001ad24
lea rdx, [rbx + 0x18]
lea rcx, str.test_stop_service:_ls
call fcn.180039a28
test rdi, rdi
jne 0x18001ad3f
call fcn.18003c934
xor r11d, r11d
jmp 0x18001ad42
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001ad4d
call fcn.18003c934
cmp qword [rbx + 0x30], 8
jb 0x18001ad5a
mov rbp, qword [rbx + 0x18]
jmp 0x18001ad5e
lea rbp, [rbx + 0x18]
xor r12d, r12d
test rbp, rbp
je 0x18001ae15
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18001ae15
mov r8d, 0xf01ff
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x18001adab
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
test rsi, rsi
je 0x18001adf4
and dword [rsp + 0x30], r12d
xor edx, edx
lea r8d, [rdx + 0x18]
lea rcx, [rsp + 0x34]
call fcn.1800413a0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x18001adf4
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x18001adf4
mov r12d, 1
test rbp, rbp
je 0x18001ae02
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x18001ae10
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r12d, r12d
jne 0x18001ae1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
jne 0x18001ae2a
call fcn.18003c934
xor r11d, r11d
jmp 0x18001ae2d
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x18001ae38
call fcn.18003c934
mov rbx, qword [rbx]
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x50]
jmp 0x18001acde
lea rcx, [rsp + 0x50]
call fcn.1800017e4
mov rcx, qword [rsp + 0x78]
call fcn.18003c1d8
and qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x50]
call fcn.18003c1d8
nop
lea rcx, [rsp + 0x88]
call fcn.1800017e4
mov rcx, qword [rsp + 0xb0]
call fcn.18003c1d8
and qword [rsp + 0xb0], 0
mov rcx, qword [rsp + 0x88]
call fcn.18003c1d8
mov al, 1
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret