Function at 0x140008a20
Capabilities:
Pause service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rdx + 0x10]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x140008a8b
lea r8, [rsp + 0x38]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
test eax, eax
je 0x140008a85
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x140008d2a
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140008aa0
movzx ebx, ax
or ebx, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_pause
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
mov rdx, qword [rax + 8]
call fcn.1400018e0
test al, al
je 0x140008c3e
cmp byte ds:[rsp + 0x30], 0
je 0x140008d28
mov rcx, qword [rsi + 0x10]
mov edx, 3
mov rcx, qword [rcx + 8]
call fcn.14007ace0
mov ebx, eax
test eax, eax
js 0x140008b0d
mov bl, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x140008d2a
mov r8, qword [rsi + 0x10]
lea rdx, str.pause
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x140008b4f
cmp ebx, 0xc0000005
je 0x140008b4f
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140008b5e
movzx eax, bx
jmp 0x140008b5a
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140008b6a
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140008b74
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x140008bf4
lfence
lfence
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140008bb4
mov rax, qword [rax + 8]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140008bc5
mov r9, qword ds:[rbx + 8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140008c2f
lfence
call fcn.1400fbcc0
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x140008d2a
mov edx, 0x10
test rsi, rsi
je 0x140008c1c
mov r9, rsi
lea r8, [0x1401efb68]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x140008d2a
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x140008d2a
mov r8, qword [rsi + 0x10]
lea rdx, str.pause
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword ds:[rax + 8]
cmp ebx, 0xc0000022
je 0x140008c83
cmp ebx, 0xc0000005
je 0x140008c83
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140008c8f
movzx eax, bx
jmp 0x140008c8b
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140008c98
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140008c9f
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x140008cff
mov r9, qword [rax + 8]
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140008cd9
mov qword [rsp + 0x28], r9
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r9, rsi
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140008ce5
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140008d28
call fcn.1400fbcc0
jmp 0x140008d28
mov edx, 0x10
test rsi, rsi
je 0x140008d15
mov r9, rsi
lea r8, [0x1401efb68]
jmp 0x140008d23
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret