Function at 0x14004f276
Capabilities:
Check if file exists
Enumerate services
Get file attributes
Query environment variable

Disassembly:
jmp 0x14005b610
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xa68
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1c6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa88]
mov rax, qword [0x14013a908]
xor rax, rbp
mov qword [rbp + 0xa00], rax
lea rcx, [0x14014d429]
call fcn.1400529c1
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov dword [rbp + 0x4e4], 0
mov dword [rbp + 0x504], 0
mov dword [rbp + 0x524], 0
mov dword [rbp + 0x544], 0
mov qword [rbp + 0x588], 0
mov r8d, 5
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14005b6e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_opening_handle_on_the_SCM__OpenSCManager_failed:_0x_08lx__n
call fcn.14004f249
mov eax, 1
jmp 0x14005bfc8
cmp qword [rbp + 0x48], 0
je 0x14005b6fd
mov rcx, qword [rbp + 0x48]
call fcn.14005049b
mov qword [rbp + 0x48], 0
mov eax, dword [rbp + 0x524]
mov ecx, dword [rbp + 0x504]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x504], eax
mov eax, dword [rbp + 0x504]
mov edx, 1
mov ecx, eax
call fcn.1400510e9
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14005b741
lea rcx, str.____Failed_to_allocate_memory_to_enumerate_services
call fcn.140051549
jmp 0x14005bf41
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x4e4]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x524]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x504]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x3b
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov dword [rbp + 0x564], eax
cmp dword [rbp + 0x564], 0
jne 0x14005b7b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x544], eax
jmp 0x14005b7bd
mov dword [rbp + 0x544], 0
cmp dword [rbp + 0x544], 0xea
je 0x14005b6e5
cmp dword [rbp + 0x544], 0
je 0x14005b7ed
mov edx, dword [rbp + 0x544]
lea rcx, str.____Could_not_enumerate_EDR_services__EnumServicesStatusEx_failed:_0x_08lx__n
call fcn.14004f249
jmp 0x14005bf41
mov eax, dword [rbp + 0x504]
mov ecx, dword [rbp + 0x4e4]
imul rcx, rcx, 0x38
cmp rax, rcx
jae 0x14005b813
lea rcx, str.____Could_not_enumerate_EDR_services__problem_in_allocation_
call fcn.140051549
jmp 0x14005bf41
mov dword [rbp + 0x5a4], 0
jmp 0x14005b82d
mov eax, dword [rbp + 0x5a4]
inc eax
mov dword [rbp + 0x5a4], eax
mov eax, dword [rbp + 0x4e4]
cmp dword [rbp + 0x5a4], eax
jae 0x14005bef6
mov dword [rbp + 0x504], 0
mov dword [rbp + 0x524], 0
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov r8d, 1
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14005b8b6
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov ecx, dword [rbp + 0x5a4]
imul rcx, rcx, 0x38
mov rdx, qword [rbp + 0x48]
mov r8, qword [rdx + rax + 8]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + rcx]
lea rcx, str.____Could_not_open_handle_on_service___s_____s___n
call fcn.14004f249
jmp 0x14005b81f
cmp qword [rbp + 0x68], 0
je 0x14005b8ce
mov rcx, qword [rbp + 0x68]
call fcn.14005049b
mov qword [rbp + 0x68], 0
mov eax, dword [rbp + 0x524]
mov edx, 1
mov ecx, eax
call fcn.1400510e9
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14005b8fc
lea rcx, str.____Failed_to_allocate_memory_to_retrieve_service_configuration
call fcn.140051549
jmp 0x14005bf41
mov eax, dword [rbp + 0x524]
mov dword [rbp + 0x504], eax
lea r9, [rbp + 0x524]
mov r8d, dword [rbp + 0x504]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov dword [rbp + 0x564], eax
cmp dword [rbp + 0x564], 0
jne 0x14005b941
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x544], eax
jmp 0x14005b94b
mov dword [rbp + 0x544], 0
cmp dword [rbp + 0x544], 0x7a
je 0x14005b8b6
cmp dword [rbp + 0x544], 0
je 0x14005b99e
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov ecx, dword [rbp + 0x5a4]
imul rcx, rcx, 0x38
mov r9d, dword [rbp + 0x544]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rdx + rax + 8]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + rcx]
lea rcx, str.____Could_not_query_information_of_service___s_____s____QueryServiceConfig_failed:_0x_08lx__n
call fcn.14004f249
jmp 0x14005b81f
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
mov rcx, qword [rcx + 0x10]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x14005b9bc
jmp 0x14005b81f
mov rax, qword [rbp + 0x68]
mov r8, qword [rax + 0x10]
mov edx, 0x104
lea rcx, [rbp + 0x2c0]
call fcn.140050a8b
lea rax, str.SystemRoot_
mov qword [rbp + 0x5c8], rax
mov rcx, qword [rbp + 0x5c8]
call fcn.14004f3bb
mov qword [rbp + 0x5e8], rax
mov r8, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x5c8]
lea rcx, [rbp + 0x2c0]
call fcn.140051cdd
test eax, eax
jne 0x14005ba91
mov eax, 2
imul rax, rax, 0
mov ecx, 0x25
mov word [rbp + rax + 0x2c0], cx
lea rcx, [rbp + 0x2c0]
call fcn.14004f3bb
inc rax
mov rcx, qword [rbp + 0x5e8]
dec rcx
sub rax, rcx
shl rax, 1
mov qword [rbp + 0x608], rax
mov rax, qword [rbp + 0x5e8]
lea rax, [rbp + rax*2 + 0x2be]
mov rcx, qword [rbp + 0x5e8]
lea rcx, [rbp + rcx*2 + 0x2c0]
mov r8, qword [rbp + 0x608]
mov rdx, rax
call fcn.140052d5e
mov eax, 0x25
mov rcx, qword [rbp + 0x5e8]
mov word [rbp + rcx*2 + 0x2be], ax
lea rax, [0x1401060b0]
mov qword [rbp + 0x5c8], rax
mov rcx, qword [rbp + 0x5c8]
call fcn.14004f3bb
mov qword [rbp + 0x5e8], rax
mov r8, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x5c8]
lea rcx, [rbp + 0x2c0]
call fcn.140051cdd
test eax, eax
jne 0x14005bb1f
lea rcx, [rbp + 0x2c0]
call fcn.14004f3bb
inc rax
sub rax, qword [rbp + 0x5e8]
shl rax, 1
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x5e8]
lea rax, [rbp + rax*2 + 0x2c0]
mov ecx, 2
imul rcx, rcx, 0
lea rcx, [rbp + rcx + 0x2c0]
mov r8, qword [rbp + 0x628]
mov rdx, rax
call fcn.140052d5e
lea rax, str.system32
mov qword [rbp + 0x5c8], rax
mov rcx, qword [rbp + 0x5c8]
call fcn.14004f3bb
mov qword [rbp + 0x5e8], rax
mov r8, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x5c8]
lea rcx, [rbp + 0x2c0]
call fcn.140051cdd
test eax, eax
jne 0x14005bbea
lea rcx, [rbp + 0x2c0]
call fcn.14004f3bb
lea rax, [rax + rax + 2]
mov qword [rbp + 0x648], rax
lea rax, str._SystemRoot__
mov qword [rbp + 0x668], rax
mov rcx, qword [rbp + 0x668]
call fcn.14004f3bb
mov qword [rbp + 0x688], rax
mov eax, 2
imul rax, rax, 0
lea rax, [rbp + rax + 0x2c0]
mov rcx, qword [rbp + 0x688]
lea rcx, [rbp + rcx*2 + 0x2c0]
mov r8, qword [rbp + 0x648]
mov rdx, rax
call fcn.140052d5e
mov rax, qword [rbp + 0x688]
shl rax, 1
mov r8, rax
mov rdx, qword [rbp + 0x668]
lea rcx, [rbp + 0x2c0]
call fcn.140050bd5
mov qword [rbp + 0x6a8], 0
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x2c0]
cmp eax, 0x22
jne 0x14005bcad
mov eax, 2
imul rax, rax, 1
lea rax, [rbp + rax + 0x2c0]
mov dx, 0x22
mov rcx, rax
call fcn.1400527dc
mov qword [rbp + 0x6c8], rax
mov eax, 2
imul rax, rax, 1
lea rax, [rbp + rax + 0x2c0]
mov rcx, qword [rbp + 0x6c8]
sub rcx, rax
mov rax, rcx
sar rax, 1
shl rax, 1
mov ecx, 2
imul rcx, rcx, 1
lea rcx, [rbp + rcx + 0x2c0]
mov edx, 2
imul rdx, rdx, 0
lea rdx, [rbp + rdx + 0x2c0]
mov qword [rbp + 0x9f8], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rbp + 0x9f8]
mov rcx, rax
call fcn.140052d5e
mov eax, 2
imul rax, rax, 0xffffffffffffffff
xor ecx, ecx
mov rdx, qword [rbp + 0x6c8]
mov word [rdx + rax], cx
jmp 0x14005bcda
mov dx, 0x20
lea rcx, [rbp + 0x2c0]
call fcn.1400527dc
mov qword [rbp + 0x6a8], rax
cmp qword [rbp + 0x6a8], 0
je 0x14005bcda
xor eax, eax
mov rcx, qword [rbp + 0x6a8]
mov word [rcx], ax
mov r8d, 0x104
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rbp + 0x564], eax
cmp dword [rbp + 0x564], 0
jne 0x14005bd24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x2c0]
lea rcx, str.____Error_while_attempting_to_expand_service_binary_path___s___ExpandEnvironmentStrings_failed:_:_0x_08lx__n
call fcn.14004f249
jmp 0x14005bf41
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005bde5
lea rcx, [rbp + 0x90]
call fcn.14004f3bb
mov qword [rbp + 0x6e8], rax
mov eax, 0x104
sub rax, qword [rbp + 0x6e8]
mov rcx, qword [rbp + 0x6e8]
lea rcx, [rbp + rcx*2 + 0x90]
lea r8, [0x140106208]
mov rdx, rax
call fcn.140050a8b
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005bde5
mov eax, 0x104
sub rax, qword [rbp + 0x6e8]
mov rcx, qword [rbp + 0x6e8]
lea rcx, [rbp + rcx*2 + 0x90]
lea r8, str..sys
mov rdx, rax
call fcn.140050a8b
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005bde5
lea r8, [rbp + 0x90]
mov rax, qword [rbp + 0x68]
mov rdx, qword [rax + 0x10]
lea rcx, str.____Did_not_find_service_binary__s__sanitized_path:__s__n
call fcn.14004f249
jmp 0x14005b81f
lea rcx, [rbp + 0x90]
call fcn.1400518e6
test eax, eax
jne 0x14005be09
lea rcx, [rbp + 0x90]
call fcn.140050752
test eax, eax
je 0x14005becd
mov edx, 0x20
mov ecx, 1
call fcn.1400510e9
mov qword [rbp + 0x588], rax
cmp qword [rbp + 0x588], 0
jne 0x14005be4c
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
lea rcx, str.____Couldnt_alloc_memory_for_binary_path__slistNewEntry__for_service___s__n
call fcn.14004f249
jmp 0x14005bf41
lea rcx, [rbp + 0x90]
call fcn.140050504
mov rcx, qword [rbp + 0x588]
mov qword [rcx], rax
mov rax, qword [rbp + 0x588]
cmp qword [rax], 0
jne 0x14005be92
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
lea rcx, str.____Couldnt_alloc_memory_for_binary_path__slistNewEntry__binaryPath__for_service___s__n
call fcn.14004f249
jmp 0x14005bf41
mov rdx, qword [rbp + 0x588]
mov rcx, qword [rbp + 0xa30]
call fcn.140052f75
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov rcx, qword [rbp + 0x588]
mov r8, qword [rcx]
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
lea rcx, str.___Found_EDR_binary_executed_through_a_service_name___s___path___s__n
call fcn.14004f249
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x14005bef1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_service_handle__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004f249
jmp 0x14005bf41
jmp 0x14005b81f
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x14005bf18
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_handle_on_the_SCM__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004f249
mov rcx, qword [rbp + 0x68]
call fcn.14005049b
mov qword [rbp + 0x68], 0
mov rcx, qword [rbp + 0x48]
call fcn.14005049b
mov qword [rbp + 0x48], 0
xor eax, eax
jmp 0x14005bfc8
cmp qword [rbp + 0x28], 0
je 0x14005bf6a
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x14005bf6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_service_handle__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004f249
cmp qword [rbp + 8], 0
je 0x14005bf93
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x14005bf93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_handle_on_the_SCM__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004f249
cmp qword [rbp + 0x68], 0
je 0x14005bfab
mov rcx, qword [rbp + 0x68]
call fcn.14005049b
mov qword [rbp + 0x68], 0
cmp qword [rbp + 0x48], 0
je 0x14005bfc3
mov rcx, qword [rbp + 0x48]
call fcn.14005049b
mov qword [rbp + 0x48], 0
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140105180]
call fcn.140051f80
mov rax, rdi
mov rcx, qword [rbp + 0xa00]
xor rcx, rbp
call fcn.140050bd0
lea rsp, [rbp + 0xa18]
pop rdi
pop rbp
ret