Function at 0x14006a6c0
Capabilities:
Enumerate services
Query service configuration
Query service status
Stop service

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 8], rbx
movaps xmmword [rax - 0x48], xmm6
mov rdi, rdx
mov rsi, rcx
xor r13d, r13d
mov rbp, r13
call fcn.140097090
mov rcx, rax
mov eax, r13d
test rcx, rcx
setne al
test eax, eax
jne 0x14006a715
mov ecx, 0x80004005
call fcn.140001a00
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r12, r13
mov qword [rsp + 0x40], r13
mov r15, r13
mov dword [rsp + 0x100], r13d
mov qword [rsi + 0x88], rdi
call fcn.140075480
test eax, eax
je 0x14006a786
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___return__1__LastError_u_detect_9x_OS._n
call fcn.140062f80
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14006adeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006adeb
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x14006a7df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___return__2__LastError_u_OpenSCManager_fail._n
call fcn.140062f80
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14006adeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006adeb
mov r8d, 0xf01ff
lea rdx, str.Spooler
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
mov qword [rsp + 0x38], rax
or rbx, 0xffffffffffffffff
test rax, rax
jne 0x14006a81f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___LastError_u_OpenService__Spooler__fail._n
call fcn.140062f80
jmp 0x14006adc2
lea rcx, [rsi + 0x18]
call fcn.1400a6970
lea rcx, [rsi + 0x50]
call fcn.1400a6970
mov dword [rsp + 0x108], r13d
lea rax, [rsp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
jne 0x14006a8b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14006a8b9
mov ecx, dword [rsp + 0x100]
call fcn.140096bcc
mov r15, rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x100]
mov r8, r15
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
mov r14d, 0x64
movsd xmm6, qword [0x140128378]
mov edx, dword [rsp + 0x108]
test edx, edx
je 0x14006ab2e
lea r12, [r15 + 8]
nop word [rax + rax]
mov eax, r13d
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, r15
je 0x14006aa14
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006a910
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r12]
lea ecx, [r9 + 1]
call rax
mov r8d, 0xf01ff
mov rdx, qword [r12 - 8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbp, rax
test rax, rax
je 0x14006aad2
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14006aa80
mov ecx, dword [rsp + 0x88]
test ecx, ecx
mov eax, 0x4e20
cmove ecx, eax
mov dword [rsp + 0x88], ecx
mov eax, ecx
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
cvttsd2si eax, xmm0
mov edi, r14d
sub edi, eax
test edi, edi
jle 0x14006a9fd
cmp dword [rsp + 0x74], 1
je 0x14006a9c6
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x1f4
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006a9b2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 4]
call rax
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test edi, edi
jg 0x14006a981
jmp 0x14006a9fd
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006a9e2
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r12]
lea ecx, [r9 + 3]
call rax
mov rdx, qword [r12 - 8]
lea rcx, [rsi + 0x18]
call fcn.1400a6c8c
mov rdx, qword [r12]
lea rcx, [rsi + 0x50]
call fcn.1400a6c8c
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x74], 1
jne 0x14006aa29
mov edx, dword [rsp + 0x108]
inc r13d
add r12, 0x30
cmp edx, r13d
jbe 0x14006ab24
jmp 0x14006a8e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
lea rdi, [rcx + rcx*2]
add rdi, rdi
mov r9d, dword [rsp + 0x74]
mov r8, qword [r15 + rdi*8]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___LastError_u_can_not_stop_Service.___s__dwCurrentState__d__n
call fcn.140062f80
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006ad6f
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15 + rdi*8 + 8]
lea ecx, [r9 + 2]
call rax
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
jmp 0x14006ad91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
lea rdi, [rcx + rcx*2]
add rdi, rdi
mov r8, qword [r15 + rdi*8]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___LastError_u_ControlService_fail.___s__n
call fcn.140062f80
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006ad7b
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15 + rdi*8 + 8]
lea ecx, [r9 + 2]
call rax
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
jmp 0x14006ad91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, r13d
lea rdi, [rcx + rcx*2]
add rdi, rdi
mov r8, qword [r15 + rdi*8]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___LastError_u_OpenService_fail.___s__n
call fcn.140062f80
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006ad87
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15 + rdi*8 + 8]
lea ecx, [r9 + 2]
call rax
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
jmp 0x14006ad91
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test r15, r15
je 0x14006ab3e
mov rcx, r15
call fcn.140096bc4
xor r15d, r15d
mov dword [rsp + 0x100], 0
lea r9, [rsp + 0x100]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x14006abba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14006ac04
mov ecx, dword [rsp + 0x100]
call fcn.140096bcc
mov r12, rax
lea r9, [rsp + 0x100]
mov r8d, dword [rsp + 0x100]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x14006abba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___LastError_u_QueryServiceConfig_fail.__Spooler__n
call fcn.140062f80
jmp 0x14006ad91
cmp eax, 1
jne 0x14006abf4
test r12, r12
je 0x14006ac04
mov rdx, qword [r12 + 0x38]
test rdx, rdx
jne 0x14006abd2
xor ecx, ecx
jmp 0x14006abe7
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, qword [rsp + 0x38]
mov r8d, ecx
lea rcx, [rsp + 0x30]
call fcn.1400017b0
test r12, r12
je 0x14006ac04
mov rcx, r12
call fcn.140096bc4
xor r12d, r12d
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006ac21
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
lea ecx, [r9 + 1]
call rax
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14006ac7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14006ac58
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x54], 1
jmp 0x14006ac7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___LastError_u_ControlService_fail.__Spooler__n
call fcn.140062f80
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14006ad91
mov eax, dword [rsp + 0x68]
test eax, eax
mov ecx, 0x4e20
cmove eax, ecx
mov dword [rsp + 0x68], eax
pxor xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
cvttsd2si eax, xmm0
sub r14d, eax
test r14d, r14d
jle 0x14006ad0e
cmp dword [rsp + 0x54], 1
je 0x14006acd3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
sub r14d, 0x1f4
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test r14d, r14d
jg 0x14006aca5
jmp 0x14006ad0e
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006acf0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
lea ecx, [r9 + 3]
call rax
lea rdx, str.Spooler
lea rcx, [rsi + 0x18]
call fcn.1400a6c8c
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x50]
call fcn.1400a6ae8
cmp dword [rsp + 0x54], 1
je 0x14006ad91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x54]
mov edx, eax
lea rcx, str.CSpoolerInfomation::kStopSpoolerService___LastError_u_can_not_stop_Service.__Spooler__dwCurrentState__d__n
call fcn.140062f80
mov rax, qword [rsi + 0x88]
test rax, rax
je 0x14006ad4c
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
lea ecx, [r9 + 2]
call rax
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14006adeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006adeb
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
jmp 0x14006ad91
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
jmp 0x14006ad91
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test rbp, rbp
je 0x14006ad9f
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15, r15
je 0x14006adb5
mov rcx, r15
call fcn.140096bc4
test r12, r12
je 0x14006adc2
mov rcx, r12
call fcn.140096bc4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x14006adeb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xf0]
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret