Function at 0x140003cb0
Capabilities:
Query service status
Stop service

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
xor edx, edx
xor ecx, ecx
lea r8d, [r15 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x1400043ff
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140003d16
mov rdx, qword [rbx]
mov r8d, 0xf01ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x140003e50
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], al
mov dword [rbp - 0x39], 1
lea rdi, [rbx + 0x10]
mov rdx, qword [rdi]
add rdx, 3
lea rcx, [rbp - 0x29]
call fcn.14000ce70
mov r8d, 3
lea rdx, [0x14006bea0]
lea rcx, [rbp - 0x29]
call fcn.14000a720
cmp qword [rbx + 0x18], 0x10
jb 0x140003d7c
mov rbx, qword [rbx]
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000a720
mov r8d, 0x24
lea rdx, str.__was_not_registered_as_a_NT_Service
lea rcx, [rbp - 0x29]
call fcn.14000a720
movups xmm0, xmmword [rax]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 7], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rbp - 0x39], 3
lea rcx, [rbp - 9]
call fcn.140001ec0
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140003e0c
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004442
call fcn.140013ee4
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400043f6
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004448
call fcn.140013ee4
jmp 0x1400043f6
lea rdx, [rbp + 0x17]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140003ed4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], r15b
lea r8d, [rax + 0x20]
lea rdx, str.__failed_to_query_service_status
lea rcx, [rbp - 0x29]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400043ed
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004430
jmp 0x1400043e8
cmp dword [rbp + 0x1b], 1
jne 0x14000400e
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov dword [rbp - 0x39], 4
lea r14, [rbx + 0x10]
mov rdx, qword [r14]
add rdx, 2
lea rcx, [rbp - 0x29]
call fcn.14000ce70
mov r8d, 2
lea rdx, [0x14006bee8]
lea rcx, [rbp - 0x29]
call fcn.14000a720
cmp qword [rbx + 0x18], 0x10
jb 0x140003f2a
mov rbx, qword [rbx]
mov r8, qword [r14]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000a720
mov r8d, 0x14
lea rdx, str._has_already_stopped
lea rcx, [rbp - 0x29]
call fcn.14000a720
movups xmm0, xmmword [rax]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 7], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rbp - 0x39], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rbp - 9]
call fcn.140001ec0
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x140003fba
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000444e
call fcn.140013ee4
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140003ff5
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ff0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004454
call fcn.140013ee4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x140004401
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov dword [rbp - 0x39], 0x10
lea r14, [rbx + 0x10]
mov rdx, qword [r14]
add rdx, 0xc
lea rcx, [rbp - 0x29]
call fcn.14000ce70
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.__stopping_:
lea rcx, [rbp - 0x29]
call fcn.14000a720
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000405d
mov rdx, qword [rbx]
mov r8, qword [r14]
lea rcx, [rbp - 0x29]
call fcn.14000a720
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400040ae
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000445a
call fcn.140013ee4
lea r8, [rbp + 0x17]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000416b
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], al
mov dword [rbp - 0x39], 0x20
mov rdx, qword [r14]
add rdx, 0x12
lea rcx, [rbp - 0x29]
call fcn.14000ce70
mov r8d, 0x12
lea rdx, str.__Failed_to_stop:
lea rcx, [rbp - 0x29]
call fcn.14000a720
cmp qword [rbx + 0x18], 0x10
jb 0x14000410f
mov rbx, qword [rbx]
mov r8, qword [r14]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000a720
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400043ed
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004436
jmp 0x1400043e8
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov r8d, 0x1e
lea rdx, str.__waiting_for_the_state_change
lea rcx, [rbp - 0x29]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400041d8
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004460
call fcn.140013ee4
mov ebx, r15d
nop dword [rax + rax]
lea rdx, [rbp + 0x17]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140004384
cmp dword [rbp + 0x1b], 1
je 0x1400042f6
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x29], 0
mov r8d, 3
lea rdx, [0x14006bf94]
lea rcx, [rbp - 0x29]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140004276
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004271
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004466
call fcn.140013ee4
inc ebx
cmp ebx, 0x1e
jl 0x1400041e0
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov r8d, 0x1c
lea rdx, str.__Failed_to_stop_the_service
lea rcx, [rbp - 0x29]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400043ed
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000443c
jmp 0x1400043e8
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov r8d, 0xa
lea rdx, str.__stopped.
lea rcx, [rbp - 0x29]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140004363
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000435e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000446c
call fcn.140013ee4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x140004401
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov r8d, 0x44
lea rdx, str.__failed_to_query_service_status_while_waiting_for_the_status_change
lea rcx, [rbp - 0x29]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x29]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x1400043ed
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000442a
call fcn.140013ee4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140013980
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3