Function at 0x14003cfd0
Capabilities:
Query service status
Stop service

Disassembly:
push rbp
push r12
push r14
push r15
sub rsp, 0x68
or r15d, 0xffffffff
mov r14d, 0x1d4c0
test edx, edx
mov rbp, rcx
cmovne r14d, edx
cmp qword [0x140279320], 0
je 0x14003d2ea
lea rcx, [rsp + 0x88]
mov rdx, rbp
sub rcx, 8
call fcn.1400296d0
mov rcx, qword [0x140279320]
lea r8d, [r15 + 0x2d]
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rax
call fcn.1401712b0
mov r12, rax
test rax, rax
je 0x14003d2ea
lea rax, [rsp + 0x98]
xor edx, edx
lea r9d, [r15 + 0x25]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003d083
mov r8, rbp
lea rdx, str.failed_query_service_status__s:__m
mov ecx, 0x5b0003
call fcn.14002d450
test eax, eax
jne 0x14003d29b
mov eax, dword [rsp + 0x34]
cmp eax, 1
jne 0x14003d0a8
mov r8, rbp
lea rdx, str.service__s_already_stopped
mov ecx, 0x5b0005
call fcn.14002d450
xor r15d, r15d
jmp 0x14003d29b
mov qword [rsp + 0x90], rbx
xor ebx, ebx
mov qword [rsp + 0xa0], rsi
mov esi, dword [rsp + 0x44]
mov qword [rsp + 0x60], rdi
xor edi, edi
cmp eax, 3
jne 0x14003d15f
nop
cmp edi, 0xea60
jge 0x14003d15f
cmp ebx, r14d
jge 0x14003d15f
lea rax, [rsp + 0x98]
mov r9d, 0x24
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003d12d
mov r8, rbp
lea rdx, str.failed_query_service_status__s:__m
mov ecx, 0x5b0003
call fcn.14002d450
test eax, eax
jne 0x14003d286
cmp dword [rsp + 0x34], 1
je 0x14003d1bc
mov eax, dword [rsp + 0x44]
cmp eax, esi
jbe 0x14003d144
xor edi, edi
mov esi, eax
mov ecx, 0x64
call fcn.14002f3f0
add edi, 0x64
add ebx, 0x64
cmp dword [rsp + 0x34], 3
je 0x14003d0d0
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003d1e2
mov rax, qword gs:[0x58]
mov edx, 0x2f80
mov rcx, qword [rax]
mov rax, qword [rdx + rcx]
test rax, rax
jne 0x14003d19e
call fcn.1401762d4
cmp dword [rax], 0x6d
je 0x14003d1e2
mov r8, rbp
lea rdx, str.ControlService_failed_for__s:__m
mov ecx, 0x5b0003
call fcn.14002d450
jmp 0x14003d286
cmp dword [0x14027e48c], 6
jl 0x14003d283
mov r8, rbp
lea rdx, str.service__s__stopped_successfully
mov ecx, 0x5b0006
call fcn.14002d450
jmp 0x14003d283
mov eax, dword [rsp + 0x34]
xor edi, edi
cmp eax, 1
je 0x14003d272
cmp edi, 0xea60
jge 0x14003d26d
cmp ebx, r14d
jge 0x14003d26d
lea rax, [rsp + 0x98]
mov r9d, 0x24
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003d246
mov r8, rbp
lea rdx, str.failed_query_service_status__s:__m
mov ecx, 0x5b0003
call fcn.14002d450
test eax, eax
jne 0x14003d286
mov eax, dword [rsp + 0x44]
cmp eax, esi
jbe 0x14003d252
xor edi, edi
mov esi, eax
mov ecx, 0x64
add edi, 0x64
add ebx, 0x64
call fcn.14002f3f0
mov eax, dword [rsp + 0x34]
cmp eax, 1
jne 0x14003d1f1
jmp 0x14003d272
cmp eax, 1
jne 0x14003d286
lea rdx, str.service_stopped_successfully
mov ecx, 0x5b0005
call fcn.14002d450
xor r15d, r15d
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movsxd rcx, eax
call fcn.140171260
test rax, rax
jne 0x14003d2c2
lea rdx, str.Failed_close_service_handle:__m
mov ecx, 0x5b0003
call fcn.14002d450
test r15d, r15d
je 0x14003d2db
mov r8, rbp
lea rdx, str.error_stopping_service__s
mov ecx, 0x5b0003
call fcn.14002d450
mov eax, r15d
add rsp, 0x68
pop r15
pop r14
pop r12
pop rbp
ret
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r12
pop rbp
ret