Function at 0x140008f00
Capabilities:
Delete service
Enumerate processes
Stop service

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rbx, rcx
call fcn.140002fe0
cmp eax, 0x3fab
jbe 0x140008f77
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov rcx, rsi
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140008fe2
lea rdx, [rsp + 0x4c]
lea r8, str.Wls0wndh.dll
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x140008fbd
add rcx, 2
test ax, ax
jne 0x140008f61
jmp 0x140008fd0
mov rcx, rbx
lea rdx, str.The_UI0Detect_service_should_not_be_deleted_on_older_versions_of_Windows.
lea r8, [0x14001a1cc]
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140009106
lea rdx, [rsp + 0x4c]
lea r8, str.Wls0wndh.dll
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x140008fbd
add rcx, 2
test ax, ax
jne 0x140008fa7
jmp 0x140008fd0
mov rcx, rsi
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140008f99
jmp 0x140008fe2
mov edx, dword [rsp + 0x28]
xor ecx, ecx
xor r8d, r8d
call sub.WTSAPI32.dll_WTSTerminateProcess
test eax, eax
je 0x140009034
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x140009106
mov rcx, rsi
lea rdx, str.UI0Detect
mov r8d, 0x10020
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140009056
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
lea rdx, str.Required_run_as_Administrator.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140009106
xorps xmm0, xmm0
movups xmmword [rsp + 0x238], xmm0
mov qword [rsp + 0x248], 0
mov dword [rsp + 0x250], 0
mov rcx, rdi
mov edx, 1
lea r8, [rsp + 0x238]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000910a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41b
je 0x1400090d7
cmp eax, 0x425
jne 0x14000910a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
lea rdx, str.The_requested_control_code_can_not_be_sent_to_the_service.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140009106
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
lea rdx, str.The_service_cannot_be_stopped_because_other_running_services_are_dependent_on_it.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x14000915f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140009148
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
lea rdx, str.DeleteService_is_failed.
lea r8, str.Error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140009106
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret