Function at 0x14013add0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1402be5c8]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov byte [rsp + 0x40], r9b
movzx r13d, r8b
movzx r15d, dl
mov r12, rcx
mov qword [rbp - 0x40], rcx
mov r8d, 0xf003f
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
mov qword [rbp - 0x50], rax
xor edi, edi
test rax, rax
jne 0x14013b017
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x18]
call fcn.140023b20
nop
mov qword [rbp - 0x48], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov ecx, 0x13ff
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, eax
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 7
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x38]
call fcn.140018360
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x18]
mov rdx, qword [rbp]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.Opening_SC_Manager_failed_with_error_code:__d__s
lea r8, [r14 - 1]
call fcn.14009d740
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14013af22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013af1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b835
call fcn.1401a9460
lea rdi, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdi, qword [rbp - 0x18]
xor esi, esi
mov dword [rbp - 0x48], esi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 7
lea r8d, [rsi + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rbp - 0x38]
call fcn.140018360
nop
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
lea r8d, [rsi + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rsp + 0x48]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x10f8
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x48]
call fcn.1400b0fe0
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14013b00c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b007
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b83b
call fcn.1401a9460
test r15b, r15b
jne 0x14013b841
xor edi, edi
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14013b026
mov rdx, qword [r12]
mov r8d, 0xf003f
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14013b225
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
mov qword [rbp - 0x48], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, ebx
xor edx, edx
mov ecx, 0x13ff
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, eax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rdi
mov qword [rbp], 7
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x18]
call fcn.140018360
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rax, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.Opening_Windows_Update_Service_failed_with_error_code:__d__s
lea r8, [rsi - 1]
call fcn.14009d740
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14013b126
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b121
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b86e
call fcn.1401a9460
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
xor ecx, ecx
mov dword [rbp - 0x48], ecx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 7
lea r8d, [rcx + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rax
mov qword [rbp], 7
lea r8d, [rax + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x1100
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b0fe0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14013b213
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b20e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b874
call fcn.1401a9460
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15b, r15b
jne 0x14013b87a
lea r8, [rbp + 8]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov r14d, eax
test eax, eax
jne 0x14013b417
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor edi, edi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], di
mov edx, 0x400
lea rcx, [rbp - 0x38]
call fcn.140023c30
mov rdx, rax
mov qword [rbp - 0x28], 0x3ff
mov qword [rbp - 0x20], 0x3ff
movzx eax, di
mov rdi, rdx
mov ecx, 0x3ff
rep stosw word [rdi], ax
xor eax, eax
mov word [rdx + 0x7fe], ax
mov qword [rbp - 0x38], rdx
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.14007dcf0
cmp qword [rax + 0x18], 8
jb 0x14013b2b2
mov rax, qword [rax]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, str.Unable_to_pause_Windows_Update_Service._Error_code:__d__s
mov r8, 0xffffffffffffffff
call fcn.14009d740
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14013b321
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b31c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b8a7
call fcn.1401a9460
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
xor ecx, ecx
mov dword [rbp - 0x48], ecx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 7
lea r8d, [rcx + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rax
mov qword [rbp], 7
lea r8d, [rax + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x110b
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b0fe0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14013b40e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013b409
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013b8ad
call fcn.1401a9460
test r15b, r15b
jne 0x14013b807
test r13b, r13b
je 0x14013b7ae
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov eax, dword [rbp + 0x20]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0xc]
mov dword [rsp + 0x20], eax
lea r9, str.Stop_command_is_given_to_Windows_Update_Service._Current_status_is:__d._Suggested_wait_time:__d_ms
mov r8, 0xffffffffffffffff
call fcn.14009d740
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
xor r15d, r15d
mov dword [rbp - 0x48], r15d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
lea r8d, [r15 + 0x12]
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 7
lea r8d, [r15 + 0x72]
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
mov r8d, 0x1112
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b0fe0
nop
mov r8, qword [rbp - 0x20]
cmp r8, 8
jb 0x14013b52b
inc r8
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.140023c60
mov ebx, r15d
cmp r14d, 1
jne 0x14013b7ae
nop dword [rax + rax]
cmp dword [rbp + 0xc], 1
je 0x14013b7ae
cmp ebx, 0x1388
jg 0x14013b7ae
mov ecx, 0x65
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x65
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14013b6c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.14007dcf0
cmp qword [rax + 0x18], 8
jb 0x14013b5a9
mov rax, qword [rax]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str.Failed_to_query_Windows_Update_status_when_waiting_for_Windows_Update_to_stop_with_error_code:__d__s
mov r8, 0xffffffffffffffff
call fcn.14009d740
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x14013b5f3
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140023c60
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
mov dword [rbp - 0x48], r15d
lea rax, [rbp - 0x48]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov r8d, 0x12
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
mov r8d, 0x111b
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b0fe0
nop
mov r8, qword [rbp - 0x20]
cmp r8, 8
jb 0x14013b540
inc r8
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call fcn.140023c60
jmp 0x14013b540
xor r8d, r8d
mov edx, 0x3ff
lea rcx, [rbp - 0x38]
call fcn.140023b20
nop
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
cmovae rcx, qword [rbp - 0x38]
mov eax, dword [rbp + 0xc]
mov dword [rsp + 0x20], eax
lea r9, str.Waiting_for_Windows_Update_to_stop._Queried_Windows_Update_Status:__d
mov r8, 0xffffffffffffffff
call fcn.14009d740
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdi, qword [rbp - 0x38]
mov dword [rbp - 0x48], r15d
lea rax, [rbp - 0x48]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x44]
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov r8d, 0x12
lea rdx, str.stopWindowsService
lea rcx, [rsp + 0x48]
call fcn.140018360
nop
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 7
mov r8d, MsiRecordSetStreamA
lea rdx, str.c:constructicon_buildsgfx_six23.19installNeomaInstallNeomaIN_Apps_srcCoreInstallManInstallManHelpers.cpp
lea rcx, [rbp - 0x18]
call fcn.140018360
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x60]
mov r8d, 0x111e
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x18]
call fcn.1400b0fe0
nop
jmp 0x14013b6a1
cmp byte [rsp + 0x40], 0
je 0x14013b7be
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, r12
call fcn.1400272a0
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1401a9440
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140015e70
nop
mov r8, rax
lea r9, str.Unable_to_send_SERVICE_CONTROL_STOP_to_Windows_Update_Service
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140047740
lea rdx, [0x1402b9650]
lea rcx, [rsp + 0x48]
call fcn.1401cf69c
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3
call fcn.140015e70
mov r8, rax
lea r9, str.Opening_SC_Manager_failed
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140047740
lea rdx, [0x1402b9650]
lea rcx, [rsp + 0x48]
call fcn.1401cf69c
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3
call fcn.140015e70
mov r8, rax
lea r9, str.Opening_Windows_Update_Service_failed
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140047740
lea rdx, [0x1402b9650]
lea rcx, [rsp + 0x48]
call fcn.1401cf69c
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3