Function at 0x10001b800
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x10001b863
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x100013520]
lea rcx, [0x1000148f0]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10001e3a8
jmp 0x10001ba71
lea rdx, [0x100013520]
mov r8d, 0x2c
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x10001b8b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014960]
movzx ebx, ax
lea rdx, [0x100013520]
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.10001e3a8
jmp 0x10001ba5a
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10001b8e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000149d0]
jmp 0x10001b88e
cmp dword [rsp + 0x34], 1
jne 0x10001b8f9
lea rcx, [0x100014a48]
jmp 0x10001ba55
cmp dword [rsp + 0x34], 3
jne 0x10001b988
mov r14d, 0x2710
lea rcx, [0x100014a88]
call fcn.10001e3a8
mov eax, 0xcccccccd
mul dword [rsp + 0x48]
shr edx, 3
cmp edx, 0x3e8
jae 0x10001b931
mov edx, 0x3e8
jmp 0x10001b938
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b9f1
cmp dword [rsp + 0x34], 1
je 0x10001b9e8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x7530
ja 0x10001b9d5
cmp dword [rsp + 0x34], 3
je 0x10001b90a
mov rdx, rdi
mov rcx, rsi
call fcn.10001ba90
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x10001ba47
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014b38]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov edx, ebx
call fcn.10001e3a8
jmp 0x10001ba5a
lea rcx, [0x100014b00]
call fcn.10001e3a8
mov ebx, 0x800705b4
jmp 0x10001ba5a
lea rcx, [0x100014ac0]
jmp 0x10001ba55
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100014670]
jmp 0x10001b9bb
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x88]
lea r8, [rsp + 0x30]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x10001b9f1
cmp dword [rsp + 0x34], 1
je 0x10001ba4e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x7530
ja 0x10001b9d5
cmp dword [rsp + 0x34], 1
jne 0x10001ba00
lea rcx, [0x100014b78]
call fcn.10001e3a8
test rdi, rdi
je 0x10001ba68
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret