Function at 0x404850
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x587256
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00405aa0
call fcn.00414e80
mov eax, dword [0x63a638]
and eax, 0xf
cmp eax, 2
jb 0x4048fa
lea ecx, [ebp - 0x13c]
call fcn.004045c0
mov dword [ebp - 4], 0
push str.allow_remote_server_in
lea ecx, [ebp - 0x13c]
call fcn.00405fb0
push 1
lea ecx, [ebp - 0x13c]
push ecx
call fcn.00496a30
add esp, 8
push str.allow_remote_server_out
lea ecx, [ebp - 0x13c]
call fcn.00405fb0
push 1
lea edx, [ebp - 0x13c]
push edx
call fcn.00496a30
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.00404650
jmp 0x40495b
lea ecx, [ebp - 0x254]
call fcn.004045c0
mov dword [ebp - 4], 1
push str.allow_remote_server
lea ecx, [ebp - 0x254]
call fcn.00405fb0
push 1
sub esp, 0x118
mov ecx, esp
mov dword [ebp - 0x270], esp
lea eax, [ebp - 0x254]
push eax
call fcn.004046e0
mov dword [ebp - 0x278], eax
call fcn.00491f40
add esp, 0x11c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.00404650
mov dword [ebp - 0x14], 0
push str.Globalzns1ksrv_ctrl_FA71F693_0272_441c_9B9B_56A50336A896
push 0
push 0x100002
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x404998
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_OpenEvent_for_zns1ksrv_ctrl_event__err_d_n
push 0x5fdd38
call fcn.0040c050
add esp, 0xc
jmp 0x4049d2
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 0x258], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x258]
push edx
push str.SetEvent_for_zns1ksrv_ctrl_ret_d__err_d_n
push 0x5fdda8
call fcn.0040c050
add esp, 0x10
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x404bd7
push 0x24
push 0x5fdc34
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404bad
push 0x63a460
push 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x404a50
push 0x5fdcbc
push str.Try_stopping_service__s_by_SCM.
push 0x5fde04
call fcn.0040c050
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404a6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5fde1c
push str.WAR:Try_stopping_service__s_by_SCM_fail__code_d
push 0x5fde94
call fcn.0040c050
add esp, 0x10
push 0
call fcn.0046f900
add esp, 4
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], edx
push 0x63a460
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x404b48
cmp dword [0x63a464], 1
je 0x404b41
mov ecx, dword [0x63a464]
push ecx
push str.Wait_for_service_zns1ksrv_stop_pending..._d
push 0x5fdf0c
call fcn.0040c050
add esp, 0xc
push 0
call fcn.0046f900
add esp, 4
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], edx
mov edx, dword [ebp - 0x26c]
sub edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x268]
sbb eax, dword [ebp - 0x260]
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jl 0x404b34
jg 0x404b0f
cmp dword [ebp - 0x280], 0x78
jb 0x404b34
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x274], esp
push str.taskkill__F__IM_AD_ESS.exe__T
call fcn.00405ef0
mov dword [ebp - 0x284], eax
call fcn.004168f0
add esp, 0x20
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404b43
jmp 0x404b48
jmp 0x404a84
mov ecx, dword [0x63a464]
push ecx
push str.Service_zns1ksrv_status_d...
push 0x5fdf80
call fcn.0040c050
add esp, 0xc
cmp dword [0x63a464], 1
jne 0x404b8a
push 0x5fdf98
push str.Service__s_stop_successed...
push 0x5fdfe8
call fcn.0040c050
add esp, 0xc
mov dword [ebp - 0x14], 1
jmp 0x404ba1
push 0x5fe000
push str.Err:_Service__s_stop_failed_
push 0x5fe054
call fcn.0040c050
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x404bcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5fe06c
push 0x5fe080
push 0x5fe0d0
call fcn.0040c050
add esp, 0x10
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x404bf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5fe0e8
push str.service_stop_external
call fcn.0040c050
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret