Function at 0x140008440
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rbp - 8], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400086c2
mov r8d, 0xf01ff
lea rdx, str.Canon_Driver_Information_Assist_Service
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
movdqa xmm0, xmmword [0x14006ce90]
mov byte [rbp - 0x48], 0
lea rcx, [rbp - 0x48]
movdqu xmmword [rbp - 0x38], xmm0
test rax, rax
jne 0x14000851d
lea r8d, [rax + 0x1e]
lea rdx, str.__DIAS_service_is_not_running.
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400086b9
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008513
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088bb
call fcn.140013ee4
jmp 0x1400086b9
mov r8d, 0x23
lea rdx, str.__stopping_DIAS_dependent_services
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140008575
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008570
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088c1
call fcn.140013ee4
mov rdx, rdi
mov rcx, rsi
call fcn.140008b70
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, 0x17
lea rdx, str.__stopping_DIAS_service
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400085ed
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088c7
call fcn.140013ee4
xor r14d, r14d
mov ebx, r14d
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400086b0
cmp dword [rbp - 0x24], 1
je 0x1400086ea
test ebx, ebx
jne 0x14000862e
lea r8, [rbp - 0x28]
lea edx, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400086b0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov r8d, 3
lea rdx, [0x14006bf94]
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400086a5
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400086a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088cd
call fcn.140013ee4
inc ebx
cmp ebx, 0x1e
jb 0x1400085f3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140013980
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, 0xa
lea rdx, str.__stopped.
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140008757
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008752
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088d3
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov r8d, 0x20
lea rdx, str.__unregister_DIAS_from_NTService
lea rcx, [rbp - 0x48]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400087c4
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400087bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088d9
call fcn.140013ee4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
movdqa xmm0, xmmword [0x14006ce90]
mov byte [rbp - 0x48], 0
lea rcx, [rbp - 0x48]
movdqu xmmword [rbp - 0x38], xmm0
test eax, eax
jne 0x140008845
lea r8d, [rax + 0x27]
lea rdx, str.__failed_to_remove_the_service_from_SCM
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400086b0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000883b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088df
call fcn.140013ee4
jmp 0x1400086b0
mov r8d, 6
lea rdx, str.__done
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x48]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140008899
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008894
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400088b5
call fcn.140013ee4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x1400086c4
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3