Function at 0x14004d27b
Capabilities:
Check if file exists
Enumerate services
Get file attributes
Query environment variable

Disassembly:
jmp 0x1400589b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xa68
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1c6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xa88]
mov rax, qword [0x140131878]
xor rax, rbp
mov qword [rbp + 0xa00], rax
lea rcx, [0x140143073]
call fcn.1400508f4
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov dword [rbp + 0x4e4], 0
mov dword [rbp + 0x504], 0
mov dword [rbp + 0x524], 0
mov dword [rbp + 0x544], 0
mov qword [rbp + 0x588], 0
mov r8d, 5
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140058a85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_opening_handle_on_the_SCM__OpenSCManager_failed:_0x_08lx__n
call fcn.14004d24e
mov eax, 1
jmp 0x140059342
cmp qword [rbp + 0x48], 0
je 0x140058a9d
mov rcx, qword [rbp + 0x48]
call fcn.14004e45f
mov qword [rbp + 0x48], 0
mov eax, dword [rbp + 0x524]
mov ecx, dword [rbp + 0x504]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x504], eax
mov eax, dword [rbp + 0x504]
mov edx, 1
mov ecx, eax
call fcn.14004f076
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140058ae1
lea rcx, str.____Failed_to_allocate_memory_to_enumerate_services
call fcn.14004f4d1
jmp 0x1400592bb
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x4e4]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x524]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x504]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x3b
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov dword [rbp + 0x564], eax
cmp dword [rbp + 0x564], 0
jne 0x140058b53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x544], eax
jmp 0x140058b5d
mov dword [rbp + 0x544], 0
cmp dword [rbp + 0x544], 0xea
je 0x140058a85
cmp dword [rbp + 0x544], 0
je 0x140058b8d
mov edx, dword [rbp + 0x544]
lea rcx, str.____Could_not_enumerate_EDR_services__EnumServicesStatusEx_failed:_0x_08lx__n
call fcn.14004d24e
jmp 0x1400592bb
mov dword [rbp + 0x5a4], 0
jmp 0x140058ba7
mov eax, dword [rbp + 0x5a4]
inc eax
mov dword [rbp + 0x5a4], eax
mov eax, dword [rbp + 0x4e4]
cmp dword [rbp + 0x5a4], eax
jae 0x140059270
mov dword [rbp + 0x504], 0
mov dword [rbp + 0x524], 0
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov r8d, 1
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140058c30
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov ecx, dword [rbp + 0x5a4]
imul rcx, rcx, 0x38
mov rdx, qword [rbp + 0x48]
mov r8, qword [rdx + rax + 8]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + rcx]
lea rcx, str.____Could_not_open_handle_on_service___s_____s___n
call fcn.14004d24e
jmp 0x140058b99
cmp qword [rbp + 0x68], 0
je 0x140058c48
mov rcx, qword [rbp + 0x68]
call fcn.14004e45f
mov qword [rbp + 0x68], 0
mov eax, dword [rbp + 0x524]
mov edx, 1
mov ecx, eax
call fcn.14004f076
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140058c76
lea rcx, str.____Failed_to_allocate_memory_to_retrieve_service_configuration
call fcn.14004f4d1
jmp 0x1400592bb
mov eax, dword [rbp + 0x524]
mov dword [rbp + 0x504], eax
lea r9, [rbp + 0x524]
mov r8d, dword [rbp + 0x504]
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov dword [rbp + 0x564], eax
cmp dword [rbp + 0x564], 0
jne 0x140058cbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x544], eax
jmp 0x140058cc5
mov dword [rbp + 0x544], 0
cmp dword [rbp + 0x544], 0x7a
je 0x140058c30
cmp dword [rbp + 0x544], 0
je 0x140058d18
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov ecx, dword [rbp + 0x5a4]
imul rcx, rcx, 0x38
mov r9d, dword [rbp + 0x544]
mov rdx, qword [rbp + 0x48]
mov r8, qword [rdx + rax + 8]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + rcx]
lea rcx, str.____Could_not_query_information_of_service___s_____s____QueryServiceConfig_failed:_0x_08lx__n
call fcn.14004d24e
jmp 0x140058b99
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
mov rcx, qword [rcx + 0x10]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x140058d36
jmp 0x140058b99
mov rax, qword [rbp + 0x68]
mov r8, qword [rax + 0x10]
mov edx, 0x104
lea rcx, [rbp + 0x2c0]
call fcn.14004ea2c
lea rax, str.SystemRoot_
mov qword [rbp + 0x5c8], rax
mov rcx, qword [rbp + 0x5c8]
call fcn.14004d3c0
mov qword [rbp + 0x5e8], rax
mov r8, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x5c8]
lea rcx, [rbp + 0x2c0]
call fcn.14004fc38
test eax, eax
jne 0x140058e0b
mov eax, 2
imul rax, rax, 0
mov ecx, 0x25
mov word [rbp + rax + 0x2c0], cx
lea rcx, [rbp + 0x2c0]
call fcn.14004d3c0
inc rax
mov rcx, qword [rbp + 0x5e8]
dec rcx
sub rax, rcx
shl rax, 1
mov qword [rbp + 0x608], rax
mov rax, qword [rbp + 0x5e8]
lea rax, [rbp + rax*2 + 0x2be]
mov rcx, qword [rbp + 0x5e8]
lea rcx, [rbp + rcx*2 + 0x2c0]
mov r8, qword [rbp + 0x608]
mov rdx, rax
call fcn.140050c96
mov eax, 0x25
mov rcx, qword [rbp + 0x5e8]
mov word [rbp + rcx*2 + 0x2be], ax
lea rax, [0x1400fe120]
mov qword [rbp + 0x5c8], rax
mov rcx, qword [rbp + 0x5c8]
call fcn.14004d3c0
mov qword [rbp + 0x5e8], rax
mov r8, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x5c8]
lea rcx, [rbp + 0x2c0]
call fcn.14004fc38
test eax, eax
jne 0x140058e99
lea rcx, [rbp + 0x2c0]
call fcn.14004d3c0
inc rax
sub rax, qword [rbp + 0x5e8]
shl rax, 1
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x5e8]
lea rax, [rbp + rax*2 + 0x2c0]
mov ecx, 2
imul rcx, rcx, 0
lea rcx, [rbp + rcx + 0x2c0]
mov r8, qword [rbp + 0x628]
mov rdx, rax
call fcn.140050c96
lea rax, str.system32
mov qword [rbp + 0x5c8], rax
mov rcx, qword [rbp + 0x5c8]
call fcn.14004d3c0
mov qword [rbp + 0x5e8], rax
mov r8, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x5c8]
lea rcx, [rbp + 0x2c0]
call fcn.14004fc38
test eax, eax
jne 0x140058f64
lea rcx, [rbp + 0x2c0]
call fcn.14004d3c0
lea rax, [rax + rax + 2]
mov qword [rbp + 0x648], rax
lea rax, str._SystemRoot__
mov qword [rbp + 0x668], rax
mov rcx, qword [rbp + 0x668]
call fcn.14004d3c0
mov qword [rbp + 0x688], rax
mov eax, 2
imul rax, rax, 0
lea rax, [rbp + rax + 0x2c0]
mov rcx, qword [rbp + 0x688]
lea rcx, [rbp + rcx*2 + 0x2c0]
mov r8, qword [rbp + 0x648]
mov rdx, rax
call fcn.140050c96
mov rax, qword [rbp + 0x688]
shl rax, 1
mov r8, rax
mov rdx, qword [rbp + 0x668]
lea rcx, [rbp + 0x2c0]
call fcn.14004eb7b
mov qword [rbp + 0x6a8], 0
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x2c0]
cmp eax, 0x22
jne 0x140059027
mov eax, 2
imul rax, rax, 1
lea rax, [rbp + rax + 0x2c0]
mov dx, 0x22
mov rcx, rax
call fcn.140050714
mov qword [rbp + 0x6c8], rax
mov eax, 2
imul rax, rax, 1
lea rax, [rbp + rax + 0x2c0]
mov rcx, qword [rbp + 0x6c8]
sub rcx, rax
mov rax, rcx
sar rax, 1
shl rax, 1
mov ecx, 2
imul rcx, rcx, 1
lea rcx, [rbp + rcx + 0x2c0]
mov edx, 2
imul rdx, rdx, 0
lea rdx, [rbp + rdx + 0x2c0]
mov qword [rbp + 0x9f8], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rbp + 0x9f8]
mov rcx, rax
call fcn.140050c96
mov eax, 2
imul rax, rax, 0xffffffffffffffff
xor ecx, ecx
mov rdx, qword [rbp + 0x6c8]
mov word [rdx + rax], cx
jmp 0x140059054
mov dx, 0x20
lea rcx, [rbp + 0x2c0]
call fcn.140050714
mov qword [rbp + 0x6a8], rax
cmp qword [rbp + 0x6a8], 0
je 0x140059054
xor eax, eax
mov rcx, qword [rbp + 0x6a8]
mov word [rcx], ax
mov r8d, 0x104
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rbp + 0x564], eax
cmp dword [rbp + 0x564], 0
jne 0x14005909e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x2c0]
lea rcx, str.____Error_while_attempting_to_expand_service_binary_path___s___ExpandEnvironmentStrings_failed:_:_0x_08lx__n
call fcn.14004d24e
jmp 0x1400592bb
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005915f
lea rcx, [rbp + 0x90]
call fcn.14004d3c0
mov qword [rbp + 0x6e8], rax
mov eax, 0x104
sub rax, qword [rbp + 0x6e8]
mov rcx, qword [rbp + 0x6e8]
lea rcx, [rbp + rcx*2 + 0x90]
lea r8, [0x1400fe278]
mov rdx, rax
call fcn.14004ea2c
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005915f
mov eax, 0x104
sub rax, qword [rbp + 0x6e8]
mov rcx, qword [rbp + 0x6e8]
lea rcx, [rbp + rcx*2 + 0x90]
lea r8, str..sys
mov rdx, rax
call fcn.14004ea2c
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005915f
lea r8, [rbp + 0x90]
mov rax, qword [rbp + 0x68]
mov rdx, qword [rax + 0x10]
lea rcx, str.____Did_not_find_service_binary__s__sanitized_path:__s__n
call fcn.14004d24e
jmp 0x140058b99
lea rcx, [rbp + 0x90]
call fcn.14004f855
test eax, eax
jne 0x140059183
lea rcx, [rbp + 0x90]
call fcn.14004e702
test eax, eax
je 0x140059247
mov edx, 0x20
mov ecx, 1
call fcn.14004f076
mov qword [rbp + 0x588], rax
cmp qword [rbp + 0x588], 0
jne 0x1400591c6
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
lea rcx, str.____Couldnt_alloc_memory_for_binary_path__slistNewEntry__for_service___s__n
call fcn.14004d24e
jmp 0x1400592bb
lea rcx, [rbp + 0x90]
call fcn.14004e4c8
mov rcx, qword [rbp + 0x588]
mov qword [rcx], rax
mov rax, qword [rbp + 0x588]
cmp qword [rax], 0
jne 0x14005920c
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
lea rcx, str.____Couldnt_alloc_memory_for_binary_path__slistNewEntry__binaryPath__for_service___s__n
call fcn.14004d24e
jmp 0x1400592bb
mov rdx, qword [rbp + 0x588]
mov rcx, qword [rbp + 0xa30]
call fcn.140050ea3
mov eax, dword [rbp + 0x5a4]
imul rax, rax, 0x38
mov rcx, qword [rbp + 0x588]
mov r8, qword [rcx]
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rcx + rax]
lea rcx, str.___Found_EDR_binary_executed_through_a_service_name___s___path___s__n
call fcn.14004d24e
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x14005926b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_service_handle__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004d24e
jmp 0x1400592bb
jmp 0x140058b99
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x140059292
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_handle_on_the_SCM__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004d24e
mov rcx, qword [rbp + 0x68]
call fcn.14004e45f
mov qword [rbp + 0x68], 0
mov rcx, qword [rbp + 0x48]
call fcn.14004e45f
mov qword [rbp + 0x48], 0
xor eax, eax
jmp 0x140059342
cmp qword [rbp + 0x28], 0
je 0x1400592e4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1400592e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_service_handle__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004d24e
cmp qword [rbp + 8], 0
je 0x14005930d
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x14005930d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_while_closing_handle_on_the_SCM__CloseServiceHandle_failed:_0x_08lx__n
call fcn.14004d24e
cmp qword [rbp + 0x68], 0
je 0x140059325
mov rcx, qword [rbp + 0x68]
call fcn.14004e45f
mov qword [rbp + 0x68], 0
cmp qword [rbp + 0x48], 0
je 0x14005933d
mov rcx, qword [rbp + 0x48]
call fcn.14004e45f
mov qword [rbp + 0x48], 0
mov eax, 0xffffffff
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1400fd290]
call fcn.14004fed6
mov rax, rdi
mov rcx, qword [rbp + 0xa00]
xor rcx, rbp
call fcn.14004eb76
lea rsp, [rbp + 0xa18]
pop rdi
pop rbp
ret