Function at 0x404950
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58d756
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00405c00
call fcn.004144a0
mov eax, dword [0x64065c]
and eax, 0xf
cmp eax, 2
jb 0x4049fa
lea ecx, [ebp - 0x13c]
call fcn.004046c0
mov dword [ebp - 4], 0
push str.allow_remote_server_in
lea ecx, [ebp - 0x13c]
call fcn.00406110
push 1
lea ecx, [ebp - 0x13c]
push ecx
call fcn.0049ca00
add esp, 8
push str.allow_remote_server_out
lea ecx, [ebp - 0x13c]
call fcn.00406110
push 1
lea edx, [ebp - 0x13c]
push edx
call fcn.0049ca00
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00404750
jmp 0x404a5b
lea ecx, [ebp - 0x254]
call fcn.004046c0
mov dword [ebp - 4], 1
push str.allow_remote_server
lea ecx, [ebp - 0x254]
call fcn.00406110
push 1
sub esp, 0x118
mov ecx, esp
mov dword [ebp - 0x270], esp
lea eax, [ebp - 0x254]
push eax
call fcn.004047e0
mov dword [ebp - 0x278], eax
call fcn.00497f10
add esp, 0x11c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.00404750
mov dword [ebp - 0x14], 0
push str.Globalzns1ksrv_ctrl_FA71F693_0272_441c_9B9B_56A50336A896
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x404a98
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_OpenEvent_for_zns1ksrv_ctrl_event__err_d_n
push 0x603db0
call fcn.0040c230
add esp, 0xc
jmp 0x404ad2
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 0x258], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x258]
push edx
push str.SetEvent_for_zns1ksrv_ctrl_ret_d__err_d_n
push 0x603e20
call fcn.0040c230
add esp, 0x10
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x404cd7
push 0x24
push 0x603cac
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404cad
push 0x640480
push 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x404b50
push 0x603d34
push str.Try_stopping_service__s_by_SCM.
push 0x603e7c
call fcn.0040c230
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404b6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x603e94
push str.WAR:Try_stopping_service__s_by_SCM_fail__code_d
push 0x603f0c
call fcn.0040c230
add esp, 0x10
push 0
call fcn.0044b6e0
add esp, 4
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], edx
push 0x640480
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x404c48
cmp dword [0x640484], 1
je 0x404c41
mov ecx, dword [0x640484]
push ecx
push str.Wait_for_service_zns1ksrv_stop_pending..._d
push 0x603f84
call fcn.0040c230
add esp, 0xc
push 0
call fcn.0044b6e0
add esp, 4
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], edx
mov edx, dword [ebp - 0x26c]
sub edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x268]
sbb eax, dword [ebp - 0x260]
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jl 0x404c34
jg 0x404c0f
cmp dword [ebp - 0x280], 0x78
jb 0x404c34
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x274], esp
push str.taskkill__F__IM_AD_ESS.exe__T
call fcn.00406050
mov dword [ebp - 0x284], eax
call fcn.00415f10
add esp, 0x20
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404c43
jmp 0x404c48
jmp 0x404b84
mov ecx, dword [0x640484]
push ecx
push str.Service_zns1ksrv_status_d...
push 0x603ff8
call fcn.0040c230
add esp, 0xc
cmp dword [0x640484], 1
jne 0x404c8a
push 0x604010
push str.Service__s_stop_successed...
push 0x604060
call fcn.0040c230
add esp, 0xc
mov dword [ebp - 0x14], 1
jmp 0x404ca1
push 0x604078
push str.Err:_Service__s_stop_failed_
push 0x6040cc
call fcn.0040c230
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x404ccb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6040e4
push 0x6040f8
push 0x604148
call fcn.0040c230
add esp, 0x10
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x404cf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x604160
push str.service_stop_external
call fcn.0040c230
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret