Function at 0x140004270
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
sub rsp, 0xa8
mov dword [rsp + 0x74], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov r8d, 0x10000000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140004311
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, dword [rsp + 0x74]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rdx, qword [rsp + 0x78]
lea rcx, [0x140011df0]
call fcn.140005008
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0xffffffff
jmp 0x1400044e5
mov r8d, 0x10000000
lea rdx, str.LC7Agent
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x1400043c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x424
jne 0x140004361
lea rcx, str._nLC_Agent_was_not_installed_on_this_machine._n
call fcn.140005008
xor eax, eax
jmp 0x1400044e5
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, dword [rsp + 0x74]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rdx, qword [rsp + 0x80]
lea rcx, [0x140011e50]
call fcn.140005008
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0xffffffff
jmp 0x1400044e5
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x88], 0
jmp 0x1400043e9
mov eax, dword [rsp + 0x88]
add eax, 1
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x70], 0
jne 0x14000443d
cmp dword [rsp + 0x88], 5
jge 0x14000443d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x44], 1
je 0x140004433
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000443b
mov dword [rsp + 0x70], 1
jmp 0x1400043d8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400044ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, dword [rsp + 0x74]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rdx, qword [rsp + 0x90]
lea rcx, str._nFailed_to_remove_LC_Agent._n_s
call fcn.140005008
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsp + 0x70], 0
jne 0x1400044c1
lea rcx, str._nThe_LC_Agent_service_could_not_be_stopped._It_will_be_removed_on_the_next_reboot._n
call fcn.140005008
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str._nLC_Agent_has_been_removed_n
call fcn.140005008
xor eax, eax
add rsp, 0xa8
ret