Function at 0x1400f2a20
Capabilities:
Delete service
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1403f80a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx edi, r8b
mov r14, rdx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x1400f2aa9
mov rbx, qword [0x1403fe908]
test rbx, rbx
je 0x1400f2a91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str._1:__u_n
lea edx, [rsi + 6]
mov rcx, rbx
call fcn.1400d88a0
test r14, r14
je 0x1400f2a9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14], eax
mov ebp, 0xe0002714
jmp 0x1400f2c5b
mov r8d, 0x10024
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
setne r12b
test rax, rax
jne 0x1400f2b0e
mov rdi, qword [0x1403fe908]
test rdi, rdi
je 0x1400f2af6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str._1:__u_n
lea edx, [rbx + 6]
mov rcx, rdi
call fcn.1400d88a0
test r14, r14
je 0x1400f2b04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14], eax
mov ebp, 0xe0002715
jmp 0x1400f2c4c
xor ebp, ebp
test dil, dil
je 0x1400f2bad
lea r8, [rsp + 0x30]
lea edx, [rbp + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400f2b7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
lea ecx, [rax - 0x425]
cmp ecx, 1
jbe 0x1400f2b7b
mov rdi, qword [0x1403fe908]
test rdi, rdi
je 0x1400f2b69
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str._1:__u_n
lea edx, [rbp + 6]
mov rcx, rdi
call fcn.1400d88a0
test r14, r14
je 0x1400f2b71
mov dword [r14], r15d
mov ebp, 0xe0002717
jmp 0x1400f2c4c
mov rdi, rbp
nop
cmp dword [rsp + 0x34], 3
jne 0x1400f2bad
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400f2c06
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rdi
cmp rdi, 0x14
jb 0x1400f2b80
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400f2c44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp eax, 0x430
je 0x1400f2c44
mov rdi, qword [0x1403fe908]
test rdi, rdi
je 0x1400f2bf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str._1:__u_n
mov edx, 6
mov rcx, rdi
call fcn.1400d88a0
test r14, r14
je 0x1400f2bff
mov dword [r14], r15d
mov ebp, 0xe0002718
jmp 0x1400f2c4c
mov rdi, qword [0x1403fe908]
test rdi, rdi
je 0x1400f2c2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str._1:__u_n
mov edx, 6
mov rcx, rdi
call fcn.1400d88a0
test r14, r14
je 0x1400f2c3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14], eax
mov ebp, 0xe0002716
jmp 0x1400f2c4c
test r14, r14
je 0x1400f2c4c
mov dword [r14], ebp
test r12b, r12b
je 0x1400f2c5b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rsi, rsi
je 0x1400f2c69
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401304f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret