Function at 0x140004f30
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rdi, rdi
je 0x1400055ea
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 4], 0
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov edx, 6
xor r8, r8
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
jne 0x140004fb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400055e1
mov r9d, dword [rbp - 4]
mov eax, r9d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000bbc0
sub rsp, rax
lea rax, [rsp + 0x30]
mov rdi, rax
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov edx, 6
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
je 0x1400055e1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400055ea
cmp word [rdi], 0
je 0x1400055da
lea r12, [0x1400159c8]
lea r14, [0x14001598c]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [r12 + rcx]
jne 0x140005047
add rcx, 2
test ax, ax
jne 0x140005026
mov rcx, rbx
mov edx, 2
call fcn.1400046e0
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [r14 + rcx]
jne 0x14000506a
add rcx, 2
test ax, ax
jne 0x140005049
mov rcx, rbx
mov edx, 3
call fcn.1400046e0
lea rdx, str.SeLockMemoryPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005093
add rcx, 2
test ax, ax
jne 0x140005073
mov rcx, rbx
mov edx, 4
call fcn.1400046e0
lea rdx, [0x14001592e]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400050bc
add rcx, 2
test ax, ax
jne 0x14000509c
mov rcx, rbx
mov edx, 5
call fcn.1400046e0
lea rdx, str.SeMachineAccountPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400050e5
add rcx, 2
test ax, ax
jne 0x1400050c5
mov rcx, rbx
mov edx, 6
call fcn.1400046e0
lea rdx, [0x1400158dc]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000510e
add rcx, 2
test ax, ax
jne 0x1400050ee
mov rcx, rbx
mov edx, 7
call fcn.1400046e0
lea rdx, str.SeSecurityPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005137
add rcx, 2
test ax, ax
jne 0x140005117
mov rcx, rbx
mov edx, 8
call fcn.1400046e0
lea rdx, str.SeTakeOwnershipPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005160
add rcx, 2
test ax, ax
jne 0x140005140
mov rcx, rbx
mov edx, 9
call fcn.1400046e0
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005189
add rcx, 2
test ax, ax
jne 0x140005169
mov rcx, rbx
mov edx, 0xa
call fcn.1400046e0
lea rdx, str.SeSystemProfilePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400051b2
add rcx, 2
test ax, ax
jne 0x140005192
mov rcx, rbx
mov edx, 0xb
call fcn.1400046e0
lea rdx, str.SeSystemtimePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400051db
add rcx, 2
test ax, ax
jne 0x1400051bb
mov rcx, rbx
mov edx, 0xc
call fcn.1400046e0
lea rdx, str.SeProfileSingleProcessPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005204
add rcx, 2
test ax, ax
jne 0x1400051e4
mov rcx, rbx
mov edx, 0xd
call fcn.1400046e0
lea rdx, str.SeIncreaseBasePriorityPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000522d
add rcx, 2
test ax, ax
jne 0x14000520d
mov rcx, rbx
mov edx, 0xe
call fcn.1400046e0
lea rdx, str.SeCreatePagefilePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005256
add rcx, 2
test ax, ax
jne 0x140005236
mov rcx, rbx
mov edx, 0xf
call fcn.1400046e0
lea rdx, str.SeCreatePermanentPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000527f
add rcx, 2
test ax, ax
jne 0x14000525f
mov rcx, rbx
mov edx, 0x10
call fcn.1400046e0
lea rdx, str.SeBackupPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400052a8
add rcx, 2
test ax, ax
jne 0x140005288
mov rcx, rbx
mov edx, 0x11
call fcn.1400046e0
lea rdx, str.SeRestorePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400052d1
add rcx, 2
test ax, ax
jne 0x1400052b1
mov rcx, rbx
mov edx, 0x12
call fcn.1400046e0
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400052fa
add rcx, 2
test ax, ax
jne 0x1400052da
mov rcx, rbx
mov edx, 0x13
call fcn.1400046e0
lea rdx, [0x14001567a]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005323
add rcx, 2
test ax, ax
jne 0x140005303
mov rcx, rbx
mov edx, 0x14
call fcn.1400046e0
lea rdx, str.SeAuditPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000534c
add rcx, 2
test ax, ax
jne 0x14000532c
mov rcx, rbx
mov edx, 0x15
call fcn.1400046e0
lea rdx, str.SeSystemEnvironmentPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005375
add rcx, 2
test ax, ax
jne 0x140005355
mov rcx, rbx
mov edx, 0x16
call fcn.1400046e0
lea rdx, str.SeChangeNotifyPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000539e
add rcx, 2
test ax, ax
jne 0x14000537e
mov rcx, rbx
mov edx, 0x17
call fcn.1400046e0
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400053c7
add rcx, 2
test ax, ax
jne 0x1400053a7
mov rcx, rbx
mov edx, 0x18
call fcn.1400046e0
lea rdx, str.SeUndockPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400053f0
add rcx, 2
test ax, ax
jne 0x1400053d0
mov rcx, rbx
mov edx, 0x19
call fcn.1400046e0
lea rdx, str.SeSyncAgentPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005419
add rcx, 2
test ax, ax
jne 0x1400053f9
mov rcx, rbx
mov edx, 0x1a
call fcn.1400046e0
lea rdx, str.SeEnableDelegationPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005442
add rcx, 2
test ax, ax
jne 0x140005422
mov rcx, rbx
mov edx, 0x1b
call fcn.1400046e0
lea rdx, str.SeManageVolumePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000546b
add rcx, 2
test ax, ax
jne 0x14000544b
mov rcx, rbx
mov edx, 0x1c
call fcn.1400046e0
lea rdx, str.SeImpersonatePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005494
add rcx, 2
test ax, ax
jne 0x140005474
mov rcx, rbx
mov edx, 0x1d
call fcn.1400046e0
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400054bd
add rcx, 2
test ax, ax
jne 0x14000549d
mov rcx, rbx
mov edx, 0x1e
call fcn.1400046e0
lea rdx, str.SeTrustedCredManAccessPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400054e6
add rcx, 2
test ax, ax
jne 0x1400054c6
mov rcx, rbx
mov edx, 0x1f
call fcn.1400046e0
lea rdx, str.SeRelabelPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000550f
add rcx, 2
test ax, ax
jne 0x1400054ef
mov rcx, rbx
mov edx, 0x20
call fcn.1400046e0
lea rdx, str.SeIncreaseWorkingSetPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005538
add rcx, 2
test ax, ax
jne 0x140005518
mov rcx, rbx
mov edx, 0x21
call fcn.1400046e0
lea rdx, str.SeTimeZonePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140005561
add rcx, 2
test ax, ax
jne 0x140005541
mov rcx, rbx
mov edx, 0x22
call fcn.1400046e0
lea rdx, str.SeCreateSymbolicLinkPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000558a
add rcx, 2
test ax, ax
jne 0x14000556a
mov rcx, rbx
mov edx, 0x23
call fcn.1400046e0
lea rdx, str.SeDelegateSessionUserImpersonatePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400055b3
add rcx, 2
test ax, ax
jne 0x140005593
mov rcx, rbx
mov edx, 0x24
call fcn.1400046e0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
add rax, 1
cmp word [rdi + rax*2], 0
jne 0x1400055c0
lea rdi, [rdi + rax*2 + 2]
cmp word [rdi], 0
jne 0x140005024
mov eax, 1
jmp 0x1400055ec
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rsp, rbp
pop rbp
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret