Function at 0x14003cad0
Capabilities:
Execute command
Persist via windows service

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov ecx, 0x50
call fcn.1400abf3c
mov rcx, rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], 0x49
mov qword [rbp - 8], 0x4f
movaps xmm0, xmmword [str.sc_create_Mapper_typekernel_startdemand_binPath_C:Windowshuh9vp.sys_]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400d7fe0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400d7ff0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400d8000]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1400d8010]
movsd qword [rax + 0x40], xmm0
movzx eax, byte [0x1400d8018]
mov byte [rcx + 0x48], al
mov byte [rcx + 0x49], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14003cb9e
lea rdx, str.Error_executing_command:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140041640
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov rcx, rax
call fcn.140041db0
lea rdx, [0x140041810]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0xf
mov qword [rbp - 0x28], 0xf
movsd xmm0, qword [str.sc_start_Mapper]
movsd qword [rbp - 0x40], xmm0
mov eax, dword [0x1400d8028]
mov dword [rbp - 0x38], eax
movzx eax, word [0x1400d802c]
mov word [rbp - 0x34], ax
movzx eax, byte [0x1400d802e]
mov byte [rbp - 0x32], al
mov byte [rbp - 0x31], 0
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14003cc30
lea rdx, str.Error_executing_command:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140041640
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
mov rcx, rax
call fcn.140041db0
lea rdx, [0x140041810]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14003cc6e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003cc69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003cc69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac290
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14003ccc0
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ccbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ccbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ac290
add rsp, 0x60
pop rbp
ret