Function at 0x14000d260
Capabilities:
Stop service

Disassembly:
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor r15b, r15b
mov qword [rsp + 0x38], rdx
mov byte [rsp + 0x31], r15b
mov ebx, r8d
mov dword [rsp + 0x4c], ebx
mov r14, rdx
mov r12, rcx
mov sil, 1
test r8d, r8d
je 0x14000d8dd
lea rax, str.EnableWarnings
mov qword [rsp + 0x58], 0x1c
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x60], rax
call sym.SystemInformer.exe_QiGetIntegerStringRefSetting
test eax, eax
je 0x14000d308
lea rax, str.the_selected_services
mov byte [rsp + 0x20], r15b
cmp ebx, 1
lea r8, str.the_selected_service
lea r9, str.Stopping_a_service_might_prevent_the_system_from_functioning_properly.
mov rcx, r12
cmovne r8, rax
lea rdx, str.stop
call sym.SystemInformer.exe_QiShowConfirmMessage
nop dword [rax]
test al, al
je 0x14000d8dd
xor edx, edx
mov dword [rsp + 0x48], edx
test ebx, ebx
je 0x14000d8d7
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0x90], r13
mov r13, qword [rsp + 0x50]
mov qword [rsp + 0xe0], rbp
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14]
mov rbx, r13
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000d355
mov rsi, qword [rcx + 8]
jmp 0x14000d358
mov rsi, rdx
xor eax, eax
lock cmpxchg qword [0x1402c86e0], rdx
mov rdi, rax
jne 0x14000d399
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 5]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rcx, rax
test rax, rax
je 0x14000d399
xor eax, eax
lock cmpxchg qword [0x1402c86e0], rcx
mov rdi, rax
jne 0x14000d393
mov rdi, rcx
jmp 0x14000d399
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x20
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r13, rax
test rax, rax
je 0x14000d3b8
mov rbx, rax
jmp 0x14000d3ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov ebp, eax
mov r13, rbx
test eax, eax
js 0x14000d406
lea r8, ds:[rsp + 0x68]
mov edx, 1
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000d42b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov ebp, eax
test eax, eax
jns 0x14000d42b
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor sil, sil
mov byte [rsp + 0x30], sil
test r15b, r15b
jne 0x14000d770
mov rax, qword ds:[r14]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000d43c
mov r14, qword [rcx + 8]
jmp 0x14000d43f
mov rcx, rbx
mov sil, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000d89d
xor r14d, r14d
lea r8, str.Unable_to_stop
xorps xmm1, xmm1
mov rax, r8
mov rcx, r8
and rax, 0xfffffffffffffff1
and ecx, 0xf
je 0x14000d47a
movdqu xmm0, xmmword [rax]
pcmpeqw xmm0, xmm1
pmovmskb edx, xmm0
shr edx, cl
bsf ecx, edx
mov dword [rsp + 0x40], ecx
je 0x14000d476
mov eax, ecx
shr rax, 1
jmp 0x14000d4b8
add rax, 0x10
movdqu xmm0, xmmword [rax]
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rsp + 0x40], edx
jne 0x14000d4aa
nop
movdqu xmm0, xmmword [rax + 0x10]
add rax, 0x10
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
bsf edx, ecx
mov dword [rsp + 0x40], edx
je 0x14000d490
sub rax, r8
mov ecx, edx
sar rax, 1
shr rcx, 1
add rax, rcx
mov rsi, r14
lea r15, [rax + rax]
and rsi, 0xfffffffffffffff1
mov ecx, r14d
and ecx, 0xf
je 0x14000d4ed
movdqu xmm0, xmmword [rsi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x44], ecx
je 0x14000d4e9
mov esi, ecx
shr rsi, 1
jmp 0x14000d52a
add rsi, 0x10
movdqu xmm0, xmmword [rsi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x44], ecx
jne 0x14000d51c
movdqu xmm0, xmmword [rsi + 0x10]
add rsi, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x44], ecx
je 0x14000d502
sub rsi, r14
mov eax, ecx
sar rsi, 1
shr rax, 1
add rsi, rax
mov rdx, qword [0x1402c4fb8]
add rsi, rsi
lea rbx, [rsi + r15]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov rdi, rax
lea rdx, str.Unable_to_stop
mov r8, r15
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [rdi + 8]
call fcn.1402074d0
mov rcx, qword [rdi + 8]
mov r8, rsi
add rcx, r15
mov rdx, r14
call fcn.1402074d0
mov rcx, rdi
call sym.SystemInformer.exe_QiAutoDereferenceObject
lea r9, [rsp + 0x32]
mov r8d, ebp
mov rcx, r12
mov rdx, qword [rax + 8]
call fcn.140001c40
mov r14, qword ds:[rsp + 0x38]
test al, al
je 0x14000d765
cmp byte [rsp + 0x32], 0
je 0x14000d753
mov rax, qword [r14]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14000d5c5
mov rcx, qword [rcx + 8]
jmp 0x14000d5c9
xor eax, eax
mov ecx, eax
mov edx, 4
call fcn.1400a2600
mov ebx, eax
test eax, eax
js 0x14000d5f0
mov sil, 1
call sym.SystemInformer.exe_QiUiDisconnectFromPhSvc
movzx r15d, byte [rsp + 0x31]
jmp 0x14000d89d
mov rax, qword [r14]
lea rdx, str.stop
lea rcx, str.Unable_to__s__s.
mov r8, qword [rax + 0x10]
mov r8, qword [r8 + 8]
call fcn.140001a80
mov rdi, qword [rax + 8]
cmp ebx, 0xc0000022
je 0x14000d64d
nop word [rax + rax]
cmp ebx, 0xc0000005
je 0x14000d64d
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000d63b
movzx eax, bx
jmp 0x14000d658
mov eax, ebx
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000d65c
mov eax, ebx
jmp 0x14000d658
lfence
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14000d668
lfence
mov ecx, ebx
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x14000d672
lfence
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
mov rbx, rax
mov rcx, r12
mov r8d, 0xfffe
test rdi, rdi
je 0x14000d6a7
test rax, rax
je 0x14000d691
mov edx, 0x21
jmp 0x14000d6b8
mov qword [rsp + 0x28], rdi
lea r9, [0x1402332cc]
mov edx, 9
jmp 0x14000d72d
mov edx, 9
test rbx, rbx
je 0x14000d71a
lea rdi, [0x1402332cc]
mov r10d, 8
lea r9, [0x140236d98]
mov rax, rbx
lfence
mov rax, qword [rbx + r10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, rdi
call sym.SystemInformer.exe_QiShowMessage2
lfence
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000d73e
lfence
call fcn.14013fb00
movzx esi, byte [rsp + 0x30]
call sym.SystemInformer.exe_QiUiDisconnectFromPhSvc
movzx r15d, byte [rsp + 0x31]
jmp 0x14000d89d
lea rax, [0x1402332cc]
mov qword [rsp + 0x28], rax
lea r9, str.Unable_to_perform_the_operation.
lea rax, [0x140236d98]
mov qword [rsp + 0x20], rax
call sym.SystemInformer.exe_QiShowMessage2
movzx esi, byte [rsp + 0x30]
call sym.SystemInformer.exe_QiUiDisconnectFromPhSvc
movzx r15d, byte [rsp + 0x31]
jmp 0x14000d89d
movzx esi, byte [rsp + 0x30]
mov r15b, 1
mov byte [rsp + 0x31], r15b
jmp 0x14000d89d
movzx esi, byte [rsp + 0x30]
movzx r15d, byte [rsp + 0x31]
mov rax, qword [r14]
lea rdx, str.stop
lea rcx, str.Unable_to__s__s.
mov r8, qword [rax + 0x10]
mov r8, qword [r8 + 8]
call fcn.140001a80
mov rdi, qword [rax + 8]
cmp ebp, 0xc0000022
je 0x14000d7cd
nop word [rax + rax]
cmp ebp, 0xc0000005
je 0x14000d7cd
mov eax, ebp
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x14000d7bb
movzx eax, bp
jmp 0x14000d7d5
mov eax, ebp
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x14000d7d9
mov eax, ebp
jmp 0x14000d7d5
mov ecx, ebp
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x14000d7e7
mov ecx, ebp
call sym.SystemInformer.exe_QiGetNtMessage
jmp 0x14000d7ee
mov ecx, eax
call sym.SystemInformer.exe_QiGetWin32Message
mov rbx, rax
mov rcx, r12
mov r8d, 0xfffe
test rdi, rdi
je 0x14000d81a
nop
test rax, rax
je 0x14000d80c
mov edx, 0x21
jmp 0x14000d82b
mov qword [rsp + 0x28], rdi
lea r9, [0x1402332cc]
jmp 0x14000d880
test rbx, rbx
je 0x14000d86d
mov edx, 9
lea rdi, [0x1402332cc]
mov r10d, 8
lea r9, [0x140236d98]
mov rax, rbx
mov rax, qword [r10 + rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, rdi
call sym.SystemInformer.exe_QiShowMessage2
mov edi, eax
lea rcx, [rbx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000d898
call fcn.14013fb00
jmp 0x14000d898
lea rax, [0x1402332cc]
mov qword [rsp + 0x28], rax
lea r9, str.Unable_to_perform_the_operation.
lea rax, [0x140236d98]
mov edx, 9
mov qword [rsp + 0x20], rax
call sym.SystemInformer.exe_QiShowMessage2
mov edi, eax
cmp edi, 1
jne 0x14000d8bf
mov edx, dword [rsp + 0x48]
add r14, 8
inc edx
mov qword [rsp + 0x38], r14
cmp edx, dword [rsp + 0x4c]
mov dword [rsp + 0x48], edx
mov edx, 0
jb 0x14000d340
mov rbp, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x98]
mov r13, qword [rsp + 0x90]
movzx eax, sil
jmp 0x14000d8df
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret