Function at 0x18000b700
Capabilities:
Access the windows event log
Check for time delay via gettickcount
Delete service
Query service status
Stop service

Disassembly:
push rbp
push rbx
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, rcx
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov r12d, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r13, rax
test rax, rax
je 0x18000b9a1
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], r15
lea r15, [r14 + 8]
mov r8d, 0xf01ff
mov rcx, rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [rbp - 0x11], ebx
mov rdi, rax
xor eax, eax
mov qword [rbp - 0xd], rax
mov qword [rbp - 5], rax
mov qword [rbp + 3], rax
mov qword [rbp + 0xb], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rbp - 0x11]
mov esi, eax
lea rax, [rbp - 0x19]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x18000b970
mov eax, dword [rbp - 0xd]
cmp eax, 1
je 0x18000b891
cmp eax, 3
jne 0x18000b81e
nop dword [rax]
mov ecx, dword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x19]
lea r8, [rbp - 0x11]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x18000b81e
cmp dword [rbp - 0xd], 1
je 0x18000b818
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
ja 0x18000b81e
cmp dword [rbp - 0xd], 3
je 0x18000b7d0
jmp 0x18000b81e
mov r12d, 1
lea r8, [rbp - 0x11]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x18000b888
cmp dword [rbp - 0xd], 1
je 0x18000b891
nop word [rax + rax]
mov ecx, dword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp - 0x19]
lea r8, [rbp - 0x11]
mov r9d, 0x24
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x18000b891
cmp dword [rbp - 0xd], 1
je 0x18000b891
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
ja 0x18000b891
cmp dword [rbp - 0xd], 1
jne 0x18000b840
jmp 0x18000b891
test r12d, r12d
je 0x18000b970
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov qword [rbp + 0x17], r15
movzx esi, bx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
test eax, eax
je 0x18000b912
test r15, r15
je 0x18000b8b7
mov esi, 1
cmp qword [r14 + 0x88], rbx
jne 0x18000b8d2
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [r14 + 0x88], rax
mov rcx, qword [r14 + 0x88]
test rcx, rcx
je 0x18000b90b
mov qword [rsp + 0x40], rbx
xor r8d, r8d
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
lea edx, [r8 + 4]
lea r9d, [r8 + 0x65]
mov word [rsp + 0x28], si
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov ebx, 1
jmp 0x18000b970
test r15, r15
je 0x18000b91c
mov esi, 1
cmp qword [r14 + 0x88], rbx
jne 0x18000b937
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [r14 + 0x88], rax
mov rcx, qword [r14 + 0x88]
test rcx, rcx
je 0x18000b970
mov qword [rsp + 0x40], rbx
xor r8d, r8d
lea rax, [rbp + 0x17]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
lea edx, [r8 + 1]
lea r9d, [r8 + 0x66]
mov word [rsp + 0x28], si
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov r15, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xd8]
test rdi, rdi
je 0x18000b98e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0xe0]
mov eax, ebx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800292b0
add rsp, 0xa0
pop r14
pop r13
pop r12
pop rbx
pop rbp
ret