Function at 0x18000a360
Capabilities:
Query service configuration
Query service status

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18004c120]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, r8
mov rax, rdx
mov rsi, rcx
mov rdx, r15
mov rcx, rax
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r14, rax
test rax, rax
jne 0x18000a3ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jne 0x18000a3d6
lea rbx, [0x18004d320]
mov r8, r15
mov rcx, rbx
lea rdx, str._s_No_Found___r_n
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
jmp 0x18000a624
mov r8b, 1
lea rdx, str.qc__OpenService
mov rcx, rsi
call fcn.18000a64c
xor eax, eax
jmp 0x18000a629
mov ecx, 0x2000
call fcn.18001d2dc
lea r9, [rsp + 0x20]
mov r8d, 0x2000
mov rdx, rax
mov rcx, r14
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea rbx, [0x18004d320]
lea rdi, [0x1800362d8]
test eax, eax
jne 0x18000a43c
xor r8d, r8d
lea rdx, str.qc__QueryServiceConfig
mov rcx, rsi
call fcn.18000a64c
jmp 0x18000a527
lea rdx, str.Service_Information:_r_n_r_n
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
mov r8, r15
lea rdx, str.ServiceName:_t__s_r_n
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
mov r8, qword [rbp + 0x38]
lea rdx, str.DisplayName:_t__s_r_n
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
mov r8, qword [rbp + 0x10]
lea rdx, str.FilePath:_t__s_r_n
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
lea rdx, str.StartType:_t
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
mov ecx, dword [rbp + 4]
test ecx, ecx
je 0x18000a50d
sub ecx, 1
je 0x18000a504
sub ecx, 1
je 0x18000a4fb
sub ecx, 1
je 0x18000a4f2
cmp ecx, 1
je 0x18000a4e9
mov rdx, rdi
jmp 0x18000a514
lea rdx, str.Disabled_r_n
jmp 0x18000a514
lea rdx, str.Demand_Start_r_n
jmp 0x18000a514
lea rdx, str.Auto_Start_r_n
jmp 0x18000a514
lea rdx, str.System_Start_r_n
jmp 0x18000a514
lea rdx, str.Boot_Start_r_n
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
lea rdx, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x18000a550
mov r8b, 1
lea rdx, str.qc__QueryServiceStatus
mov rcx, rsi
call fcn.18000a64c
jmp 0x18000a5e4
lea rdx, str.CurrentState:_t
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
mov eax, dword [rsp + 0x2c]
sub eax, 1
je 0x18000a5c7
sub eax, 1
je 0x18000a5be
sub eax, 1
je 0x18000a5b5
sub eax, 1
je 0x18000a5ac
sub eax, 1
je 0x18000a5a3
sub eax, 1
je 0x18000a59a
cmp eax, 1
jne 0x18000a5ce
lea rdi, str.Paused_r_n
jmp 0x18000a5ce
lea rdi, str.Pausing_r_n
jmp 0x18000a5ce
lea rdi, str.Continue_r_n
jmp 0x18000a5ce
lea rdi, str.Running_r_n
jmp 0x18000a5ce
lea rdi, str.Stopping_r_n
jmp 0x18000a5ce
lea rdi, str.Starting_r_n
jmp 0x18000a5ce
lea rdi, str.Stopped_r_n
mov rdx, rdi
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
lea rdx, str._r_nService_Information_Completed_r_n
mov rcx, rbx
call fcn.180008f94
mov rdx, rbx
mov rcx, rsi
call fcn.180007150
test rbp, rbp
je 0x18000a60b
mov rcx, rbp
call fcn.18001659c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
mov r8d, 0x2000
mov rcx, rbx
call fcn.18000d040
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000c1a0
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret