Function at 0x140002ad4
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4c0
mov eax, dword [rdx + 0x46b8]
xor r13d, r13d
mov r14, r9
cmp eax, 4
mov r15, r8
mov rbx, rdx
mov rsi, rcx
mov edi, r13d
jne 0x140002cde
cmp dword [rdx + 0x5910], r13d
je 0x140002ba2
lea rdx, [r11 + 0x10]
mov qword [r11 + 0x10], r13
call fcn.1400044c8
cmp eax, r13d
mov edi, eax
jne 0x14000354a
mov rcx, qword [rsp + 0x548]
mov edx, dword [rsp + 0x528]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x540]
bts edx, 0xa
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x538]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x530]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], edx
mov rcx, qword [rsp + 0x4f8]
xor r9d, r9d
mov r8, r14
mov rdx, r15
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140002cc4
mov ebx, 0x208
lea rcx, [rsp + 0xa2]
xor edx, edx
mov r8, rbx
mov word [rsp + 0xa0], r13w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x2b2]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x2b0], r13w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa0]
call fcn.140009eec
lea rcx, str.winlogon.exe
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0xa0]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, 0x104
jae 0x140002c32
lea r8, [rsp + 0x2b0]
lea rdx, str.winlogon.exe
lea rcx, [rsp + 0xa0]
call fcn.140009e48
jmp 0x140002c3b
mov word [rsp + 0x2b0], r13w
lea r8, [rsp + 0x4f8]
lea rdx, [rsp + 0x2b0]
mov rcx, rsi
mov qword [rsp + 0x4f8], r13
call fcn.140002838
cmp eax, r13d
mov edi, eax
jne 0x14000354a
mov rax, qword [rsp + 0x548]
mov rdx, qword [rsp + 0x4f8]
lea rcx, [rsi + 0x800]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x540]
mov r9, r15
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x538]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
call fcn.140004afc
cmp eax, r13d
jne 0x140002cd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x4f8]
jmp 0x1400034df
cmp eax, 5
jne 0x140002d56
lea rcx, [rdx + 0x46bc]
call sub.msvcrt.dll_wcslen
cmp eax, r13d
jle 0x14000354a
movsxd r8, eax
mov rbp, r13
mov qword [rsp + 0x4f8], r13
cmp r8, r13
mov rcx, r13
jle 0x140002d2f
lea rdx, [rbx + 0x46bc]
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 9
ja 0x140002d3d
add rcx, 1
add rdx, 2
cmp rcx, r8
jl 0x140002d15
lea rcx, [rbx + 0x46bc]
call sub.msvcrt.dll__wtoi
jmp 0x140002d87
lea r8, [rsp + 0x4f8]
lea rdx, [rbx + 0x46bc]
mov rcx, rsi
call fcn.140002838
jmp 0x140002daf
cmp eax, 9
jne 0x140002ead
lea rcx, [rsp + 0x4f8]
add rdx, 0x48c6
call fcn.14000ae58
cmp eax, r13d
je 0x14000354a
mov rbp, r13
mov qword [rsp + 0x4f8], r13
mov r8d, eax
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, r13
je 0x140002db9
lea rdx, [rsp + 0x4f8]
mov r8, rax
mov rcx, rsi
call fcn.14000290c
mov rbp, qword [rsp + 0x4f8]
jmp 0x140002dbf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, r13d
mov edi, eax
jne 0x14000354a
cmp dword [rbx + 0x5910], r13d
mov rdx, rbp
je 0x140002e42
mov rcx, rsi
call fcn.140004464
mov rax, qword [rsp + 0x548]
mov r11d, dword [rsp + 0x528]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x540]
bts r11d, 0xa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x538]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x530]
mov r8, r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r11d
mov rdx, r15
mov rcx, rbp
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140002e98
mov rax, qword [rsp + 0x548]
lea rcx, [rsi + 0x800]
mov r9, r15
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x540]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
call fcn.140004afc
cmp eax, r13d
jne 0x140002ea5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbp
jmp 0x1400034df
cmp eax, 8
jne 0x140003073
lea r8d, [rax + 0x2d]
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp rax, r13
mov rbp, rax
je 0x140002f29
lea rdx, str.TrustedInstaller
mov r8d, 0x34
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp rax, r13
mov rdi, rax
je 0x140002f20
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, r13d
je 0x140002f17
cmp dword [rsp + 0x7c], 4
je 0x140002f17
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rbx + 0x5910], r13d
mov qword [rsp + 0x4f8], r13
jne 0x140002f4d
mov rcx, rsi
call fcn.1400029cc
cmp eax, r13d
mov edi, eax
jne 0x14000354a
lea r8, [rsp + 0x4f8]
lea rdx, str.TrustedInstaller.exe
mov rcx, rsi
call fcn.140002838
cmp eax, r13d
mov edi, eax
jne 0x14000305b
cmp dword [rbx + 0x5910], r13d
mov rbp, qword [rsp + 0x4f8]
mov rdx, rbp
je 0x140002fef
mov rcx, rsi
call fcn.140004464
mov rax, qword [rsp + 0x548]
mov r11d, dword [rsp + 0x528]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x540]
bts r11d, 0xa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x538]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x530]
mov r8, r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r11d
mov rdx, r15
mov rcx, rbp
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140003045
mov rax, qword [rsp + 0x548]
lea rcx, [rsi + 0x800]
mov r9, r15
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x540]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
call fcn.140004afc
cmp eax, r13d
jne 0x140003052
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbx + 0x5910], r13d
jne 0x14000354a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x14000354a
cmp eax, 6
jne 0x140003109
add rdx, 0x46bc
call fcn.140002760
cmp eax, r13d
je 0x14000354a
mov rcx, qword [rsp + 0x548]
mov r9, r14
mov r8, r15
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x540]
mov edx, eax
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x538]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x530]
mov qword [rsp + 0x40], rcx
mov ecx, dword [rsp + 0x528]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r13d
lea rcx, [rsp + 0x4f8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call fcn.140012c90
cmp eax, r13d
jne 0x14000354a
mov edi, dword [rsp + 0x4f8]
jmp 0x14000354a
cmp eax, 7
jne 0x140003272
xor eax, eax
xor ebx, ebx
lea r12, [rdx + 0x48c6]
cmp dword [rdx + 0x5910], eax
lea rbp, [rdx + 0x4ac6]
lea r13, [rdx + 0x4cc6]
je 0x1400031db
lea rax, [rsp + 0x4f8]
mov r9, r13
mov r8, rbp
mov rdx, r12
mov qword [rsp + 0x4f8], rbx
mov qword [rsp + 0x20], rax
call fcn.140004584
mov rsi, qword [rsp + 0x4f8]
cmp rsi, rbx
mov edi, eax
je 0x140003542
mov rax, qword [rsp + 0x548]
mov edx, dword [rsp + 0x528]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x540]
bts edx, 0xa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x538]
mov r8, r14
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x530]
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov rdx, r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003269
cmp word [rbp], bx
jne 0x1400031f4
mov dx, 0x40
mov rcx, r12
call sub.msvcrt.dll_wcschr
cmp rax, rbx
cmovne rbp, rbx
lea rcx, [rsi + 0x800]
call fcn.140004a6c
mov r11, qword [rsi + 0x818]
cmp r11, rbx
je 0x140003269
mov rax, qword [rsp + 0x548]
mov r9d, 1
mov r8, r13
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x540]
mov rdx, rbp
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x538]
mov rcx, r12
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call r11
mov ebx, eax
xor eax, eax
cmp ebx, eax
jmp 0x140003540
cmp eax, 0xa
jne 0x140003280
lea rdx, str.S_1_5_20
jmp 0x140003290
cmp eax, 0xb
jne 0x140003359
lea rdx, str.S_1_5_19
lea r8, [rsp + 0x4f8]
mov qword [rsp + 0x4f8], r13
call fcn.140004764
mov rbx, qword [rsp + 0x4f8]
cmp rbx, r13
mov edi, eax
je 0x14000354a
lea rcx, [rsp + 0x4f8]
mov r8d, 1
mov rdx, rbx
mov qword [rsp + 0x4f8], r13
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov rax, qword [rsp + 0x548]
mov r11d, dword [rsp + 0x528]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x538]
bts r11d, 0xa
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r11d
xor r9d, r9d
mov r8, r14
mov rdx, r15
mov rcx, rbx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, r13d
jne 0x14000333e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x4f8]
cmp rcx, r13
je 0x140003351
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, rbx
jmp 0x1400034df
cmp dword [rdx + 0x5910], r13d
je 0x1400034e7
cmp eax, 1
je 0x1400033e1
cmp eax, 3
je 0x1400033e1
cmp eax, 2
jne 0x14000354a
lea rdx, [rsp + 0x4f8]
mov qword [rsp + 0x4f8], r13
call fcn.1400043f0
cmp eax, r13d
mov edi, eax
jne 0x14000354a
mov rax, qword [rsp + 0x548]
mov ecx, dword [rsp + 0x528]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x540]
bts ecx, 0xa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
jmp 0x140002b7c
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
call fcn.1400043f0
cmp eax, r13d
mov edi, eax
jne 0x14000344f
mov rcx, qword [rsp + 0x68]
mov r9d, 8
lea rax, [rsp + 0x4f8]
lea r8, [rsp + 0x70]
lea edx, [r9 + 0xb]
mov dword [rsp + 0x4f8], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r13d
je 0x140003447
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x70]
mov qword [rsp + 0x60], r11
jmp 0x14000344f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, r13d
je 0x14000346c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400043f0
cmp eax, r13d
mov edi, eax
jne 0x14000354a
mov rax, qword [rsp + 0x548]
mov ecx, dword [rsp + 0x528]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x540]
bts ecx, 0xa
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x538]
mov r8, r14
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x530]
mov rdx, r15
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, r13d
jne 0x1400034da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000354a
mov rax, qword [rsp + 0x548]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x540]
mov rdx, r14
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x538]
mov rcx, r15
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r13d
jne 0x14000354a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea r11, [rsp + 0x4c0]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret