Function at 0x140008d60
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140237008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rdx + 0x10]
mov edx, 0x20
mov rcx, qword [rcx + 8]
call sym.ProcessHacker.exe_PhOpenService
mov rbx, rax
test rax, rax
je 0x140008dcb
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
test eax, eax
je 0x140008dc5
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x14000906a
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140008de0
movzx ebx, ax
or ebx, 0xc0070000
mov rax, qword [rsi + 0x10]
lea rcx, str.Unable_to_stop
mov rdx, qword [rax + 8]
call sym.ProcessHacker.exe_PhConcatStrings2
mov rcx, rax
call sym.ProcessHacker.exe_PhAutoDereferenceObject
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
mov rdx, qword [rax + 8]
call fcn.1400018e0
test al, al
je 0x140008f7e
cmp byte ds:[rsp + 0x30], 0
je 0x140009068
mov rcx, qword [rsi + 0x10]
mov edx, 4
mov rcx, qword [rcx + 8]
call fcn.14007ace0
mov ebx, eax
test eax, eax
js 0x140008e4d
mov bl, 1
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x14000906a
mov r8, qword [rsi + 0x10]
lea rdx, str.stop
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x140008e8f
cmp ebx, 0xc0000005
je 0x140008e8f
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140008e9e
movzx eax, bx
jmp 0x140008e9a
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140008eaa
lfence
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140008eb4
lfence
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x140008f34
lfence
lfence
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140008ef4
mov rax, qword [rax + 8]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140008f05
mov r9, qword ds:[rbx + 8]
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140008f6f
lfence
call fcn.1400fbcc0
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x14000906a
mov edx, 0x10
test rsi, rsi
je 0x140008f5c
mov r9, rsi
lea r8, [0x1401efb68]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x14000906a
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor bl, bl
call sym.ProcessHacker.exe_PhUiDisconnectFromPhSvc
movzx eax, bl
jmp 0x14000906a
mov r8, qword [rsi + 0x10]
lea rdx, str.stop
lea rcx, str.Unable_to__s__s.
mov r8, qword [r8 + 8]
call fcn.140001720
mov rsi, qword ds:[rax + 8]
cmp ebx, 0xc0000022
je 0x140008fc3
cmp ebx, 0xc0000005
je 0x140008fc3
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x140008fcf
movzx eax, bx
jmp 0x140008fcb
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jne 0x140008fd8
mov ecx, ebx
call sym.ProcessHacker.exe_PhGetNtMessage
jmp 0x140008fdf
mov ecx, eax
call sym.ProcessHacker.exe_PhGetWin32Message
mov rbx, rax
mov rcx, rdi
test rax, rax
je 0x14000903f
mov r9, qword [rax + 8]
lea r8, [0x1401b8d58]
test rsi, rsi
je 0x140009019
mov qword [rsp + 0x28], r9
mov edx, 0x20
mov qword [rsp + 0x20], r8
mov r9, rsi
mov r8d, 0xfffe
call sym.ProcessHacker.exe_PhShowMessage2
jmp 0x140009025
mov edx, 0x10
call sym.ProcessHacker.exe_PhShowMessage
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140009068
call fcn.1400fbcc0
jmp 0x140009068
mov edx, 0x10
test rsi, rsi
je 0x140009055
mov r9, rsi
lea r8, [0x1401efb68]
jmp 0x140009063
lea r9, str.Unable_to_perform_the_operation.
lea r8, [0x1401b8d58]
call sym.ProcessHacker.exe_PhShowMessage
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401848a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret