Function at 0x140009dc0
Capabilities:
Start service
Stop service

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400f60c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.jhi_service
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.UALSVC
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.smstsmgr
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.SepLpsService
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.NcaSvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.iphlpsvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.CcmExec
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.Winmgmt
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0xf01ff
lea rdx, str.jhi_service
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0xf01ff
lea rdx, str.UALSVC
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0xf01ff
lea rdx, str.smstsmgr
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0xf01ff
lea rdx, str.NcaSvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0xf01ff
lea rdx, str.iphlpsvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0xf01ff
lea rdx, str.CcmExec
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r8d, 0xf01ff
lea rdx, str.Winmgmt
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ba5d0
add rsp, 0x58
ret