Function at 0x14000c4e0
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x14004ea60]
cmp byte [rax], 0
je 0x14000c588
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x14000c6d0
mov r8d, 0xf01ff
lea rdx, str.Bareos_sd
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x14000c6a0
lea rdi, [rsp + 0x20]
mov edx, 1
mov rcx, rax
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rbp, qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000c617
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14000c750
mov rax, qword [0x14004ea90]
cmp byte [rax], 0
jne 0x14000c7d8
xor edi, edi
jmp 0x14000c771
lea r8, [rsp + 0x20]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x14000c668
mov rbx, qword [0x14004ea90]
cmp byte [rbx], 0
jne 0x14000c728
lea rcx, str.Bareos_sd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
test rax, rax
je 0x14000c5e1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call qword [sym.imp.USER32.dll_PostMessageA]
mov ecx, 5
call sym.sleep_int_
cmp byte [rbx], 0
jne 0x14000c700
xor edi, edi
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 3
jne 0x14000c629
mov ecx, 1
call sym.sleep_int_
mov rdx, rdi
mov rcx, rbx
call rbp
mov edx, eax
mov eax, dword [rsp + 0x24]
test edx, edx
jne 0x14000c608
cmp eax, 1
je 0x14000c55b
mov rax, qword [0x14004ea90]
cmp byte [rax], 0
je 0x14000c55b
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
lea rdx, str.The_Bareos_service:_Bareos_sd_could_not_be_stopped
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c55b
mov rcx, qword [rsp + 0x20]
lea rdx, str.Bareos_sd
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rbx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14000c788
mov rcx, qword [rsp + 0x20]
mov edi, 1
call rbx
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rax, qword [0x14004ea90]
cmp byte [rax], 0
jne 0x14000c7b0
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
mov rcx, rsi
call rbx
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edi, 1
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
lea rdx, str.The_service_Manager_could_not_be_contacted___the_Bareos_service_was_not_removed
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
lea rdx, str.Bareos_could_not_be_contacted__probably_not_running
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c5f4
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
lea rdx, str.Could_not_find_registry_entry._nService_probably_not_registerd___the_Bareos_service_was_not_removed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c5b9
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
mov edi, 1
lea rdx, str.The_Bareos_service:_Bareos_sd_could_not_be_removed
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rbx
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rbx
jmp 0x14000c6b9
mov rcx, qword [rsp + 0x20]
call rbx
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
lea rdx, str.Could_not_delete_Registry_key_for_Bareos_sd._nThe_Bareos_service_could_not_be_removed
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c689
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
lea rdx, str.An_existing_Bareos_service:_Bareos_sd_could_not_be_found_for_removal._This_is_not_normally_an_error.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c6b0
mov r9d, 0x40
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
xor edi, edi
lea rdx, str.The_Bareos_service:_Bareos_sd_has_been_removed
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000c771