Function at 0x14000ccf0
Capabilities:
Create service
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
push rbp
mov eax, 0x1088
push rdi
push rsi
push rbx
call fcn.14001da80
sub rsp, rax
lea rax, str.Bareos_Storage_Service
lea r8, str.service:_install:__s
mov edx, 0x800
mov dword [rsp + 0x28], 0
lea rbp, [rsp + 0x880]
mov r9, rcx
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, rbp
lea rdi, [rsp + 0x80]
call sym.Bsnprintf_char__int__char_const__::_
xor ecx, ecx
mov r8d, 0x7f5
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000cfa0
mov rcx, rdi
call sym.strlen
mov rcx, rbx
mov rsi, rax
call sym.strlen
add esi, eax
cmp esi, 0x7e1
jg 0x14000cf58
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov edx, 0x800
mov rcx, rbp
lea r8, str.__s___service__s
call sym.Bsnprintf_char__int__char_const__::_
mov rax, qword [0x14004ea60]
cmp byte [rax], 0
je 0x14000cec8
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
je 0x14000d090
lea rax, str.tcpip
mov qword [rsp + 0x38], rbp
mov r9d, 0xf01ff
lea r8, str.Bareos_Storage_Service
mov qword [rsp + 0x50], rax
lea rdx, str.Bareos_sd
mov rcx, rbx
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
test rax, rax
je 0x14000d050
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000ceae
mov rcx, rax
lea rdx, str.ChangeServiceConfig2A
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbp, rbp
je 0x14000ceae
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov rdi, rax
test rax, rax
je 0x14000d0d0
lea rax, str.Provides_bareos_storage_services.
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, rsi
mov qword [rsp + 0x78], rax
call rbp
test eax, eax
je 0x14000d070
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rbx
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rbx
mov rcx, rsi
call rbx
jmp 0x14000cf2b
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunServices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14000cfd0
mov rcx, rbp
call sym.strlen
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rbp
xor r8d, r8d
add eax, 1
mov r9d, 1
lea rdx, str.Bareos_sd
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x14000d010
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x14004ea90]
cmp byte [rax], 0
je 0x14000cf8d
mov r9d, 0x40
lea r8, str.Bareos_Storage_Service
lea rdx, str.The_Bareos_Storage_Servicewas_successfully_installed._nThe_service_may_be_started_by_double_clicking_on_the_nBareos__Start__icon_and_will_be_automatically_nbe_run_the_next_time_this_machine_is_rebooted.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000cf8d
mov r8d, 0xdd
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.Service_command_length_too_long
call dbg.LogLastErrorMsg(char const*, char const*, int)
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
lea rdx, str.Service_command_length_too_long._Service_not_registered.
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0x1088
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
lea rdx, str.Unable_to_install_the_service
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0x1088
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x113
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.Cannot_write_System_Registry_for_Bareos_Storage_Service
call dbg.LogLastErrorMsg(char const*, char const*, int)
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
lea rdx, str.The_System_Registry_could_not_be_updated___the_Bareos_service_was_not_installed
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000cf8d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x120
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.Cannot_add_Bareos_key_to_System_Registry
call dbg.LogLastErrorMsg(char const*, char const*, int)
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
lea rdx, str.The_Bareos_service:_Bareos_sd_could_not_be_installed
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000cf8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0xfd
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.CreateService_failed_for_Bareos_Storage_Service
jmp 0x14000d02a
mov r8d, 0x233
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.ChangeServiceConfig2
call dbg.LogLastErrorMsg(char const*, char const*, int)
jmp 0x14000cea5
mov r8d, 0xea
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.Open_Service_Manager_failed
call dbg.LogLastErrorMsg(char const*, char const*, int)
mov r9d, 0x30
lea r8, str.Bareos_Storage_Service
xor ecx, ecx
lea rdx, str.The_Service_Control_Manager_could_not_be_contacted___the_service_was_not_installed
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000cf8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41f
je 0x14000d0fb
mov r8d, 0x20d
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.LockServiceDatabase
call dbg.LogLastErrorMsg(char const*, char const*, int)
jmp 0x14000ceae
mov edx, 0x118
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14000d180
lea r9, [rsp + 0x78]
mov r8d, 0x118
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusA]
lea rbp, str..._.._.._.._core_src_win32_generic_service.cc
test eax, eax
je 0x14000d19e
mov eax, dword [rdi]
test eax, eax
je 0x14000d172
mov rdx, qword [rdi + 8]
mov r8d, dword [rdi + 0x10]
lea rcx, str.Locked_by:__s__duration:__ld_seconds_n
call dbg.printf(char const*, ::)
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8d, 0x228
mov rdx, rbp
lea rcx, str.Could_not_lock_database
call dbg.LogLastErrorMsg(char const*, char const*, int)
jmp 0x14000ceae
lea rcx, str.No_longer_locked_n
call dbg.printf(char const*, ::)
jmp 0x14000d14f
mov r8d, 0x215
lea rdx, str..._.._.._.._core_src_win32_generic_service.cc
lea rcx, str.LocalAlloc
call dbg.LogLastErrorMsg(char const*, char const*, int)
jmp 0x14000ceae
mov r8d, 0x21d
mov rdx, rbp
lea rcx, str.QueryServiceLockStatus
call dbg.LogLastErrorMsg(char const*, char const*, int)
jmp 0x14000d135