Function at 0x14000a9a0
Capabilities:
Modify service

Disassembly:
jmp 0x1400355f0
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x20e0
call fcn.140001170
sub rsp, rax
mov rdi, rsp
mov ecx, 0x838
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20f0]
mov rax, qword [0x1401b1f88]
xor rax, rsp
mov qword [rsp + 0x20d0], rax
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x1400356a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea rax, [0x140167658]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x1a7
lea rdx, [0x140167900]
mov rax, qword [rsp + 0x20f0]
mov rcx, qword [rax + 8]
call fcn.140001970
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_open_SCM._Error__u
mov ecx, 0x15
call fcn.140007d00
jmp 0x1400359e1
mov rax, qword [rsp + 0x20f0]
add rax, 0x780
mov r8d, 3
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x140035750
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x20f0]
add rcx, 0x780
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
lea rax, [0x140167678]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x1b2
lea rdx, [0x1401679e0]
mov rax, qword [rsp + 0x20f0]
mov rcx, qword [rax + 8]
call fcn.140001970
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x20f0]
add rcx, 0x780
mov r9d, eax
mov r8, rcx
lea rdx, str.Failed_to_open_service__ls._Error__u
mov ecx, 0x16
call fcn.140007d00
jmp 0x1400359d6
mov dword [rsp + 0x70], 0x2000
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20b8], rax
lea r9, [rsp + 0x20a4]
mov r8d, 0x2000
mov rdx, qword [rsp + 0x20b8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14003580c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x20f0]
add rcx, 0x780
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
lea rax, [0x1401677e8]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x1c3
lea rdx, [0x140167aa0]
mov rax, qword [rsp + 0x20f0]
mov rcx, qword [rax + 8]
call fcn.140001970
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x20f0]
add rcx, 0x780
mov r9d, eax
mov r8, rcx
lea rdx, str.Failed_to_query_service_configuration_for__ls._Error__u
mov ecx, 0x17
call fcn.140007d00
jmp 0x1400359cb
mov rax, qword [rsp + 0x20b8]
cmp dword [rax + 4], 3
je 0x140035871
mov rax, qword [rsp + 0x20f0]
add rax, 0x780
mov rcx, qword [rsp + 0x20b8]
mov ecx, dword [rcx + 4]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
lea rax, str.Leaving_service__ls_start_type__u_unchanged
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x1cb
lea rdx, [0x140167b40]
mov rax, qword [rsp + 0x20f0]
mov rcx, qword [rax + 8]
call fcn.140001970
jmp 0x1400359cb
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x20b8]
mov r9d, dword [rax + 8]
mov r8d, 2
mov rax, qword [rsp + 0x20b8]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [rsp + 0x20c0], eax
cmp dword [rsp + 0x20c0], 0
je 0x140035951
mov rax, qword [rsp + 0x20f0]
add rax, 0x780
mov qword [rsp + 0x28], rax
lea rax, str.Changed_service__ls_start_type_to_auto_start
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x1dd
lea rdx, [0x140167be0]
mov rax, qword [rsp + 0x20f0]
mov rcx, qword [rax + 8]
call fcn.140001970
mov edx, 0x200
mov rcx, qword [rsp + 0x20f0]
call fcn.14000d4d0
mov edx, 0x100
mov rcx, qword [rsp + 0x20f0]
call fcn.14000d4d0
jmp 0x1400359cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x20f0]
add rcx, 0x780
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
lea rax, [0x140167c38]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0x1ed
lea rdx, [0x140167cc0]
mov rax, qword [rsp + 0x20f0]
mov rcx, qword [rax + 8]
call fcn.140001970
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x20f0]
add rcx, 0x780
mov r9d, eax
mov r8, rcx
lea rdx, str.Failed_to_change_service_to_auto_start_for__ls._Error__u
mov ecx, 0x18
call fcn.140007d00
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsp
lea rdx, [0x140168620]
call fcn.14000eab0
mov rcx, qword [rsp + 0x20d0]
xor rcx, rsp
call fcn.140004ef0
add rsp, 0x20e0
pop rdi
ret