Function at 0x1400336f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Modify service

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r13, rdx
mov r14, rcx
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140033797
lea rdx, [0x14012ff18]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140033743
mov r8d, eax
mov rcx, rsi
call fcn.14000c510
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033775
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140033790
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor al, al
jmp 0x140033be9
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x1400337cb
lea rdx, [0x14012ff1c]
or rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400337c0
jmp 0x14003374c
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x1400337e3
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x2e], 0x650074
mov dword [rsp + 0x60], 0x6d0072
mov dword [rsp + 0x38], 0x730020
mov dword [rsp + 0x4e], 0x650020
mov dword [rsp + 0x28], 0x650072
mov dword [rsp + 0x7a], 0x250022
mov dword [rsp + 0x40], 0x740072
mov r15d, 0x61
mov dword [rsp + 0x46], 0x750061
mov dword [rsp + 0x34], 0x730025
mov dword [rsp + 0x3c], 0x610074
mov dword [rsp + 0x74], 0x680074
mov dword [rsp + 0x5c], 0x6f006e
mov dword [rsp + 0x6c], 0x6e0069
lea ebx, [r15 + 0xe]
mov dword [rsp + 0x7e], 0x220073
mov dword [rsp + 0x24], 0x630020
mov dword [rsp + 0x64], 0x6c0061
mov r9d, 0x3d
mov word [rsp + 0x44], r9w
mov word [rsp + 0x2c], r15w
lea ecx, [rbx - 0x4f]
mov dword [rsp + 0x4a], 0x6f0074
mov dword [rsp + 0x68], 0x620020
mov dword [rsp + 0x20], 0x630073
xor edi, edi
mov word [rbp - 0x7e], di
mov dword [rsp + 0x52], 0x720072
mov dword [rsp + 0x58], 0x3d0072
mov dword [rsp + 0x70], 0x610070
mov word [rsp + 0x32], cx
mov word [rsp + 0x56], bx
mov word [rsp + 0x78], r9w
mov r9, qword [r13]
mov r8, qword [r14]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.140022d70
mov rbx, qword [rbp - 0x70]
nop
xor edx, edx
mov rcx, rbx
call fcn.140001060
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0xf01ff
mov rdx, qword [r14]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r15, rax
test rax, rax
jne 0x140033926
inc edi
cmp edi, 5
jl 0x1400338f0
lea rdx, [rbx - 0x18]
or rdi, 0xffffffffffffffff
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140033943
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r15, r15
jne 0x14003396e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.03_d
mov rcx, rsi
call fcn.14000bb10
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140033758
mov edx, 0xa8
lea rcx, [rbp - 0x48]
call fcn.1400244d0
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x140033989
mov rsi, qword [rax]
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x1400339a1
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x78], rbx
test rsi, rsi
je 0x1400339ee
test rsi, 0xffffffffffff0000
jne 0x1400339df
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.14000b6e0
test rax, rax
je 0x140033a03
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.14000bf00
jmp 0x1400339ff
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400339e2
jmp 0x1400339f0
xor eax, eax
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp + 0x78]
call fcn.1400144a0
mov rbx, qword [rbp + 0x78]
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x140033a1d
inc r8
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.1400146a0
mov qword [rbp - 0x30], 7
xor esi, esi
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
cmp dword [rbx - 8], 1
jle 0x140033a45
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x78]
call fcn.14000ba60
mov rbx, qword [rbp + 0x78]
mov qword [rbp - 0x50], rbx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400e5368
test eax, eax
js 0x140033bde
cmp eax, dword [rbx - 0xc]
jg 0x140033bde
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
lea r8, [rbp - 0x50]
mov edx, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r12b, r12b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x140033b6b
mov r8d, 0xf01ff
mov rdx, qword [r14]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140033b47
mov dword [rbp - 0x28], 1
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 3
lea rax, [rbp - 0x68]
mov qword [rbp - 8], rax
mov dword [rbp - 0x68], 1
mov dword [rbp - 0x64], 0x64
mov dword [rbp - 0x60], 1
mov dword [rbp - 0x5c], 0x64
mov dword [rbp - 0x58], 1
mov dword [rbp - 0x54], 0x64
lea r8, [rbp - 0x28]
mov edx, 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rsi
call fcn.140032f60
mov r12b, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140033b85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.05_d
mov rcx, qword [rbp + 0x70]
call fcn.14000bb10
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140033b85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.04_d
mov rcx, qword [rbp + 0x70]
call fcn.14000bb10
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033b9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033bbc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140033bd8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, r12b
jmp 0x140033be9
mov ecx, 0x80070057
call fcn.14000b790
nop
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret