Function at 0x140008300
Capabilities:
Acquire debug privileges

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push rbp
mov rbp, rsp
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rdi, rdi
je 0x1400089ba
mov rcx, rdi
mov rdx, rsi
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 4], 0
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov edx, 6
xor r8, r8
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
jne 0x140008386
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400089b1
mov r9d, dword [rbp - 4]
mov eax, r9d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000f5f0
sub rsp, rax
lea rax, [rsp + 0x30]
mov rdi, rax
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov edx, 6
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
je 0x1400089b1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400089ba
cmp word [rdi], 0
je 0x1400089aa
lea r12, [0x14001897a]
lea r14, [0x14001893e]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [r12 + rcx]
jne 0x140008417
add rcx, 2
test ax, ax
jne 0x1400083f6
mov rcx, rbx
mov edx, 2
call fcn.1400081b0
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [r14 + rcx]
jne 0x14000843a
add rcx, 2
test ax, ax
jne 0x140008419
mov rcx, rbx
mov edx, 3
call fcn.1400081b0
lea rdx, str.SeLockMemoryPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008463
add rcx, 2
test ax, ax
jne 0x140008443
mov rcx, rbx
mov edx, 4
call fcn.1400081b0
lea rdx, [0x1400188e0]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000848c
add rcx, 2
test ax, ax
jne 0x14000846c
mov rcx, rbx
mov edx, 5
call fcn.1400081b0
lea rdx, str.SeMachineAccountPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400084b5
add rcx, 2
test ax, ax
jne 0x140008495
mov rcx, rbx
mov edx, 6
call fcn.1400081b0
lea rdx, [0x14001888e]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400084de
add rcx, 2
test ax, ax
jne 0x1400084be
mov rcx, rbx
mov edx, 7
call fcn.1400081b0
lea rdx, str.SeSecurityPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008507
add rcx, 2
test ax, ax
jne 0x1400084e7
mov rcx, rbx
mov edx, 8
call fcn.1400081b0
lea rdx, str.SeTakeOwnershipPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008530
add rcx, 2
test ax, ax
jne 0x140008510
mov rcx, rbx
mov edx, 9
call fcn.1400081b0
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008559
add rcx, 2
test ax, ax
jne 0x140008539
mov rcx, rbx
mov edx, 0xa
call fcn.1400081b0
lea rdx, str.SeSystemProfilePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008582
add rcx, 2
test ax, ax
jne 0x140008562
mov rcx, rbx
mov edx, 0xb
call fcn.1400081b0
lea rdx, str.SeSystemtimePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400085ab
add rcx, 2
test ax, ax
jne 0x14000858b
mov rcx, rbx
mov edx, 0xc
call fcn.1400081b0
lea rdx, str.SeProfileSingleProcessPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400085d4
add rcx, 2
test ax, ax
jne 0x1400085b4
mov rcx, rbx
mov edx, 0xd
call fcn.1400081b0
lea rdx, str.SeIncreaseBasePriorityPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400085fd
add rcx, 2
test ax, ax
jne 0x1400085dd
mov rcx, rbx
mov edx, 0xe
call fcn.1400081b0
lea rdx, str.SeCreatePagefilePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008626
add rcx, 2
test ax, ax
jne 0x140008606
mov rcx, rbx
mov edx, 0xf
call fcn.1400081b0
lea rdx, str.SeCreatePermanentPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000864f
add rcx, 2
test ax, ax
jne 0x14000862f
mov rcx, rbx
mov edx, 0x10
call fcn.1400081b0
lea rdx, str.SeBackupPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008678
add rcx, 2
test ax, ax
jne 0x140008658
mov rcx, rbx
mov edx, 0x11
call fcn.1400081b0
lea rdx, str.SeRestorePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400086a1
add rcx, 2
test ax, ax
jne 0x140008681
mov rcx, rbx
mov edx, 0x12
call fcn.1400081b0
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400086ca
add rcx, 2
test ax, ax
jne 0x1400086aa
mov rcx, rbx
mov edx, 0x13
call fcn.1400081b0
lea rdx, [0x14001862c]
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400086f3
add rcx, 2
test ax, ax
jne 0x1400086d3
mov rcx, rbx
mov edx, 0x14
call fcn.1400081b0
lea rdx, str.SeAuditPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000871c
add rcx, 2
test ax, ax
jne 0x1400086fc
mov rcx, rbx
mov edx, 0x15
call fcn.1400081b0
lea rdx, str.SeSystemEnvironmentPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008745
add rcx, 2
test ax, ax
jne 0x140008725
mov rcx, rbx
mov edx, 0x16
call fcn.1400081b0
lea rdx, str.SeChangeNotifyPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000876e
add rcx, 2
test ax, ax
jne 0x14000874e
mov rcx, rbx
mov edx, 0x17
call fcn.1400081b0
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008797
add rcx, 2
test ax, ax
jne 0x140008777
mov rcx, rbx
mov edx, 0x18
call fcn.1400081b0
lea rdx, str.SeUndockPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400087c0
add rcx, 2
test ax, ax
jne 0x1400087a0
mov rcx, rbx
mov edx, 0x19
call fcn.1400081b0
lea rdx, str.SeSyncAgentPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400087e9
add rcx, 2
test ax, ax
jne 0x1400087c9
mov rcx, rbx
mov edx, 0x1a
call fcn.1400081b0
lea rdx, str.SeEnableDelegationPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008812
add rcx, 2
test ax, ax
jne 0x1400087f2
mov rcx, rbx
mov edx, 0x1b
call fcn.1400081b0
lea rdx, str.SeManageVolumePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000883b
add rcx, 2
test ax, ax
jne 0x14000881b
mov rcx, rbx
mov edx, 0x1c
call fcn.1400081b0
lea rdx, str.SeImpersonatePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008864
add rcx, 2
test ax, ax
jne 0x140008844
mov rcx, rbx
mov edx, 0x1d
call fcn.1400081b0
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000888d
add rcx, 2
test ax, ax
jne 0x14000886d
mov rcx, rbx
mov edx, 0x1e
call fcn.1400081b0
lea rdx, str.SeTrustedCredManAccessPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400088b6
add rcx, 2
test ax, ax
jne 0x140008896
mov rcx, rbx
mov edx, 0x1f
call fcn.1400081b0
lea rdx, str.SeRelabelPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x1400088df
add rcx, 2
test ax, ax
jne 0x1400088bf
mov rcx, rbx
mov edx, 0x20
call fcn.1400081b0
lea rdx, str.SeIncreaseWorkingSetPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008908
add rcx, 2
test ax, ax
jne 0x1400088e8
mov rcx, rbx
mov edx, 0x21
call fcn.1400081b0
lea rdx, str.SeTimeZonePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008931
add rcx, 2
test ax, ax
jne 0x140008911
mov rcx, rbx
mov edx, 0x22
call fcn.1400081b0
lea rdx, str.SeCreateSymbolicLinkPrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x14000895a
add rcx, 2
test ax, ax
jne 0x14000893a
mov rcx, rbx
mov edx, 0x23
call fcn.1400081b0
lea rdx, str.SeDelegateSessionUserImpersonatePrivilege
xor ecx, ecx
mov ax, word [rdi + rcx]
cmp ax, word [rdx + rcx]
jne 0x140008983
add rcx, 2
test ax, ax
jne 0x140008963
mov rcx, rbx
mov edx, 0x24
call fcn.1400081b0
mov rax, 0xffffffffffffffff
nop word [rax + rax]
add rax, 1
cmp word [rdi + rax*2], 0
jne 0x140008990
lea rdi, [rdi + rax*2 + 2]
cmp word [rdi], 0
jne 0x1400083f4
mov eax, 1
jmp 0x1400089bc
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rsp, rbp
pop rbp
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret