Function at 0x1400024b0
Capabilities:
Query service status
Stop service

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x100
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdx
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x64
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rbx, 0xffffffffffffffff
mov r9d, ebx
mov r8, qword [rdx]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
jne 0x1400025c5
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400027fd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, str.Failed_to_open_service_control_manager
mov rdx, rsi
mov rcx, rdi
call fcn.14000ce70
test al, al
jne 0x140002599
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140002580
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x40], 1
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400027cb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
jmp 0x1400027cb
mov r8d, 0x24
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x140002646
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140002808
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, str.Failed_to_open_service
mov rdx, rsi
mov rcx, rdi
call fcn.14000ce70
test al, al
jne 0x140002639
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140002620
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x40], 1
jmp 0x1400027b1
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400026b6
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x140002813
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, str.Failed_to_query_service_status:
mov rdx, rsi
mov rcx, rdi
call fcn.14000ce70
test al, al
jne 0x1400026a9
mov rax, rbx
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x140002690
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x40], 1
jmp 0x1400027b1
mov eax, dword [rsp + 0x64]
dec eax
test eax, 0xfffffffd
je 0x140002753
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400026fa
lea rdx, str.Failed_to_stop_service:
mov rcx, rdi
call fcn.14000c950
mov dword [rsp + 0x40], 1
jmp 0x1400027b1
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140002733
nop dword [rax]
cmp dword [rsp + 0x64], 1
je 0x140002753
mov ecx, dword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140002710
cmp dword [rsp + 0x64], 1
je 0x140002753
lea rdx, str.Failed_to_stop_service_within_the_allotted_time.
mov rcx, rdi
call fcn.14000c950
mov dword [rsp + 0x40], 1
jmp 0x1400027b1
call fcn.14000db70
mov rcx, rax
test rax, rax
je 0x1400027f2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rsi, str.Service_stopped_successfully.
mov rdx, rsi
mov rcx, rdi
call fcn.14000ce70
test al, al
jne 0x1400027a9
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140002790
mov r8d, eax
mov rdx, rsi
mov rcx, rdi
call fcn.14000d350
nop
mov dword [rsp + 0x40], 1
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400027cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rdi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400693e0
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3
mov ecx, 0x80004005
call fcn.14000df80
int3