Function at 0x180004fe0
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov rax, qword [section..data]
mov r13d, ecx
lea rcx, section..data
lea rbp, str.cz_ddall
call qword [rax + 0x18]
or r12, 0xffffffffffffffff
lea rdi, [rax + 0x18]
mov qword [rsp + 0xc8], rdi
test rbp, 0xffffffffffff0000
jne 0x180005058
movzx ebx, bp
xor edx, edx
mov ecx, ebx
call fcn.1800039b0
test rax, rax
je 0x180005082
lea rcx, [rsp + 0xc8]
mov r8d, ebx
mov rdx, rax
call fcn.180003af0
jmp 0x18000507a
xor eax, eax
mov rcx, r12
mov rdi, rbp
repne scasw ax, word [rdi]
mov rdx, rbp
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0xc8]
call fcn.180003e40
mov rdi, qword [rsp + 0xc8]
xor r14d, r14d
lea rsi, str.CezurityAntivirusService
mov rbx, r14
nop
mov rdx, qword [rbx + rsi]
mov eax, r14d
test rdx, rdx
setne al
test eax, eax
je 0x180005320
mov rcx, rdi
call fcn.18000cc44
test eax, eax
je 0x1800050bf
add rbx, 8
cmp rbx, 0x20
jb 0x180005090
xor al, al
jmp 0x1800050c1
mov al, 1
test al, al
lea rdx, [rdi - 0x18]
mov eax, r12d
sete bl
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800050e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.msi.dll_MsiConfigureFeatureFromDescriptorA]
test bl, bl
je 0x180005126
mov qword [rsp + 0x20], r14
mov r9d, 0x80070057
mov r8d, 0x24e
lea rdx, [0x18001c470]
mov ecx, r13d
call fcn.1800021b0
mov eax, 0x643
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
lea rdx, str.ServicesActive
mov r8d, 1
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x180005165
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180005155
movzx eax, ax
or eax, 0x80070000
mov qword [rsp + 0x20], r14
mov r9d, eax
mov r8d, 0x25a
jmp 0x1800050f6
mov r8d, 0x24
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
jne 0x1800051d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x18000519e
mov rcx, rsi
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, 0x424
jmp 0x18000510a
test eax, eax
jle 0x1800051aa
movzx eax, ax
or eax, 0x80070000
lea rdx, [0x18001c470]
mov r9d, eax
mov r8d, 0x26a
mov ecx, r13d
mov qword [rsp + 0x20], r14
call fcn.1800021b0
mov rcx, rsi
call sub.ADVAPI32.dll_CloseServiceHandle
jmp 0x180005105
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x180005309
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
mov ebx, eax
cmp eax, 0x426
jne 0x180005215
call sub.ADVAPI32.dll_CloseServiceHandle
mov rcx, rsi
call sub.ADVAPI32.dll_CloseServiceHandle
mov eax, ebx
jmp 0x18000510a
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0x58]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x180005278
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18000524c
mov edi, dword [rsp + 0xb8]
jmp 0x18000527c
test ebx, ebx
jle 0x180005259
movzx ebx, bx
or ebx, 0x80070000
lea rdx, [0x18001c470]
mov r9d, ebx
mov r8d, 0x282
mov ecx, r13d
mov qword [rsp + 0x20], r14
call fcn.1800021b0
jmp 0x1800052f4
mov edi, dword [rsp + 0x64]
mov rax, qword [section..data]
lea rcx, section..data
call qword [rax + 0x18]
lea rdx, str.Service_exit_code:__d
lea rcx, [rsp + 0x30]
add rax, 0x18
mov r8d, edi
mov qword [rsp + 0x30], rax
call fcn.1800030b0
test ebx, ebx
jle 0x1800052b7
movzx ebx, bx
or ebx, 0x80070000
mov rdi, qword [rsp + 0x30]
lea rdx, [0x18001c470]
mov r9d, ebx
mov r8d, 0x27e
mov ecx, r13d
mov qword [rsp + 0x20], rdi
call fcn.1800021b0
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x1800052f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov rcx, rbp
call sub.ADVAPI32.dll_CloseServiceHandle
mov rcx, rsi
call sub.ADVAPI32.dll_CloseServiceHandle
jmp 0x180005105
mov rcx, rbp
call sub.ADVAPI32.dll_CloseServiceHandle
mov rcx, rsi
call sub.ADVAPI32.dll_CloseServiceHandle
xor eax, eax
jmp 0x18000510a
mov ecx, 0x80004005
call fcn.180003e10
int3