Function at 0x14013b3c0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1402bf5c8]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov byte [rsp + 0x40], r9b
movzx r13d, r8b
movzx r15d, dl
mov r12, rcx
mov qword [rbp - 0x40], rcx
mov r8d, 0xf003f
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
mov qword [rbp - 0x50], rax
xor edi, edi
test rax, rax
jne 0x14013b607
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x18]
call fcn.140023b20
nop
mov qword [rbp - 0x48], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov ecx, 0x13ff
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, eax
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 7
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x38]
call fcn.140018360
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x18]
mov rdx, qword [rbp]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.Opening_SC_Manager_failed_with_error_code:__d__s
lea r8, [r14 - 1]
call fcn.14009de10
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14013b512
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b50d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013be25
call fcn.1401a9a50
lea rdi, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdi, qword [rbp - 0x18]
xor esi, esi
mov dword [rbp - 0x48], esi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 7
lea r8d, [rsi + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rbp - 0x38]
call fcn.140018360
nop
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
lea r8d, [rsi + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rsp + 0x48]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x10f8
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x48]
call fcn.1400b16b0
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14013b5fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b5f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013be2b
call fcn.1401a9a50
test r15b, r15b
jne 0x14013be31
xor edi, edi
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14013b616
mov rdx, qword [r12]
mov r8d, 0xf003f
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14013b815
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
mov qword [rbp - 0x48], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov ecx, 0x13ff
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, eax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rdi
mov qword [rbp], 7
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x18]
call fcn.140018360
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rax, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.Opening_Windows_Update_Service_failed_with_error_code:__d__s
lea r8, [rsi - 1]
call fcn.14009de10
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14013b716
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b711
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013be5e
call fcn.1401a9a50
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
xor ecx, ecx
mov dword [rbp - 0x48], ecx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 7
lea r8d, [rcx + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rax
mov qword [rbp], 7
lea r8d, [rax + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x1100
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b16b0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14013b803
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b7fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013be64
call fcn.1401a9a50
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15b, r15b
jne 0x14013be6a
lea r8, [rbp + 8]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov r14d, eax
test eax, eax
jne 0x14013ba07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor edi, edi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], di
mov edx, 0x400
lea rcx, [rbp - 0x38]
call fcn.140023c30
mov rdx, rax
mov qword [rbp - 0x28], 0x3ff
mov qword [rbp - 0x20], 0x3ff
movzx eax, di
mov rdi, rdx
mov ecx, 0x3ff
rep stosw word [rdi], ax
xor eax, eax
mov word [rdx + 0x7fe], ax
mov qword [rbp - 0x38], rdx
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.14007e3e0
cmp qword [rax + 0x18], 8
jb 0x14013b8a2
mov rax, qword [rax]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.Unable_to_pause_Windows_Update_Service._Error_code:__d__s
mov r8, 0xffffffffffffffff
call fcn.14009de10
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14013b911
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b90c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013be97
call fcn.1401a9a50
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
xor ecx, ecx
mov dword [rbp - 0x48], ecx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 7
lea r8d, [rcx + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rax
mov qword [rbp], 7
lea r8d, [rax + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x110b
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b16b0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14013b9fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b9f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013be9d
call fcn.1401a9a50
test r15b, r15b
jne 0x14013bdf7
test r13b, r13b
je 0x14013bd9e
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov eax, dword [rbp + 0x20]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0xc]
mov dword [rsp + 0x20], eax
lea r9, str.Stop_command_is_given_to_Windows_Update_Service._Current_status_is:__d._Suggested_wait_time:__d_ms
mov r8, 0xffffffffffffffff
call fcn.14009de10
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
xor r15d, r15d
mov dword [rbp - 0x48], r15d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
lea r8d, [r15 + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 7
lea r8d, [r15 + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x1112
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b16b0
nop
mov r8, qword [rbp - 0x20]
cmp r8, 8
jb 0x14013bb1b
inc r8
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.140023c60
mov ebx, r15d
cmp r14d, 1
jne 0x14013bd9e
nop dword [rax + rax]
cmp dword [rbp + 0xc], 1
je 0x14013bd9e
cmp ebx, 0x1388
jg 0x14013bd9e
mov ecx, 0x65
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x65
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14013bcb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.14007e3e0
cmp qword [rax + 0x18], 8
jb 0x14013bb99
mov rax, qword [rax]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str.Failed_to_query_Windows_Update_status_when_waiting_for_Windows_Update_to_stop_with_error_code:__d__s
mov r8, 0xffffffffffffffff
call fcn.14009de10
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14013bbe3
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140023c60
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
mov dword [rbp - 0x48], r15d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov r8d, 0x12
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
mov r8d, 0x111b
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b16b0
nop
mov r8, qword [rbp - 0x20]
cmp r8, 8
jb 0x14013bb30
inc r8
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.140023c60
jmp 0x14013bb30
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov eax, dword [rbp + 0xc]
mov dword [rsp + 0x20], eax
lea r9, str.Waiting_for_Windows_Update_to_stop._Queried_Windows_Update_Status:__d
mov r8, 0xffffffffffffffff
call fcn.14009de10
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
mov dword [rbp - 0x48], r15d
lea rax, [rbp - 0x48]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov r8d, 0x12
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x60]
mov r8d, 0x111e
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b16b0
nop
jmp 0x14013bc91
cmp byte [rsp + 0x40], 0
je 0x14013bdae
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, r12
call fcn.1400272a0
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1401a9a30
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140015e70
nop
mov r8, rax
lea r9, str.Unable_to_send_SERVICE_CONTROL_STOP_to_Windows_Update_Service
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140047a10
lea rdx, [0x1402ba7f0]
lea rcx, [rsp + 0x48]
call fcn.1401cfc8c
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
int3
call fcn.140015e70
mov r8, rax
lea r9, str.Opening_SC_Manager_failed
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140047a10
lea rdx, [0x1402ba7f0]
lea rcx, [rsp + 0x48]
call fcn.1401cfc8c
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
int3
call fcn.140015e70
mov r8, rax
lea r9, str.Opening_Windows_Update_Service_failed
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140047a10
lea rdx, [0x1402ba7f0]
lea rcx, [rsp + 0x48]
call fcn.1401cfc8c
nop
call fcn.1401e3dbc
nop
call fcn.1401e3dbc
int3