Function at 0x140002d20
Capabilities:
Acquire debug privileges
Enumerate processes
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x210], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r15d, r15d
test eax, eax
je 0x140002dd7
lea r8, [rsp + 0x68]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x60]
test eax, eax
je 0x140002dd1
mov dword [rsp + 0x70], 1
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x74], rax
mov dword [rsp + 0x7c], 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x14000a958]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], r15b
jne 0x140003039
lea rdx, [rbx + 0x20]
lea r13, [rdx + 0x20]
cmp qword [rdx + 0x18], 7
jbe 0x140002dfd
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
call fcn.140003cb0
nop
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x40]
cmp rax, 0xffffffffffffffff
je 0x140002ef3
mov dword [rbp - 0x30], 0x238
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002ee9
mov r12, qword [rsp + 0x50]
nop dword [rax]
lea rdx, [rbp - 4]
lea rcx, [rbp - 0x80]
call fcn.140003cb0
lea rdx, [rsp + 0x40]
cmp r14, 7
cmova rdx, rsi
lea rax, [rbp - 0x80]
mov r9, qword [rbp - 0x80]
mov r10, qword [rbp - 0x68]
cmp r10, 7
cmova rax, r9
mov r8, qword [rbp - 0x70]
cmp r8, r12
jne 0x140002fb6
test r8, r8
je 0x140002eaa
movzx ecx, word [rdx]
cmp word [rax], cx
jne 0x140002fb6
add rax, 2
add rdx, 2
sub r8, 1
jne 0x140002e90
mov r15d, dword [rbp - 0x28]
cmp r10, 7
jbe 0x140002ee9
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140002ee1
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000302b
mov rcx, r9
call fcn.140005890
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp r14, 7
jbe 0x140002f2e
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002f26
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003032
mov rcx, rsi
call fcn.140005890
test r15d, r15d
je 0x140002f80
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140002f80
mov r14, qword [r13 + 8]
mov rdi, qword [r13]
cmp rdi, r14
je 0x140002f77
nop dword [rax + rax]
mov r8, rsi
mov rdx, rdi
mov ecx, r15d
call fcn.140002890
add rdi, 0x20
cmp rdi, r14
jne 0x140002f60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140003007
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140002fa7
cmp rbx, qword [rax + 0x10]
jne 0x140002fa7
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140002f94
mov rbx, rax
xor r15d, r15d
cmp byte [rax + 0x19], r15b
jmp 0x140002de5
cmp r10, 7
jbe 0x140002fed
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140002fe5
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000302b
mov rcx, r9
call fcn.140005890
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002e50
jmp 0x140002ee9
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14000301f
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140003013
xor r15d, r15d
cmp byte [rbx + 0x19], r15b
jmp 0x140002de5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, qword [0x14000a948]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x14000320c
nop dword [rax]
lea rdi, [rbx + 0x20]
lea r12, [rdi + 0x20]
xor edx, edx
xor ecx, ecx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x1400031b0
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140003081
mov r8, qword [rdi]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r15, eax
mov rcx, r15
call fcn.140005be4
mov r14, rax
cmp qword [rdi + 0x18], 7
jbe 0x1400030bd
mov rdi, qword [rdi]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
mov r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8d, 4
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
mov rcx, r14
call fcn.140005890
test rdi, rdi
jne 0x140003116
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400031b0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rdi
test eax, eax
jne 0x14000314d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400031b0
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14d, dword [rbp - 0x44]
test r14d, r14d
je 0x1400031b0
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400031b0
mov r15, qword [r12 + 8]
mov rdi, qword [r12]
cmp rdi, r15
je 0x1400031a7
nop dword [rax + rax]
mov r8, rsi
mov rdx, rdi
mov ecx, r14d
call fcn.140002890
add rdi, 0x20
cmp rdi, r15
jne 0x140003190
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400031dc
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400031d7
cmp rbx, qword [rax + 0x10]
jne 0x1400031d7
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400031c4
mov rbx, rax
jmp 0x1400031fc
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1400031fc
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400031f0
cmp byte [rbx + 0x19], 0
mov r15d, 0
je 0x140003050
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140005870
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret