Function at 0x1400017c0
Capabilities:
Create service
Get token membership
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140042040]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
mov qword [rbp - 0x29], rcx
xor esi, esi
mov ecx, 1
call fcn.14000e020
mov qword [rdi], rax
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov dword [rbp - 1], esi
mov word [rbp + 3], 0x500
mov qword [rbp - 0x21], rsi
lea rax, [rbp - 0x21]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 9], eax
test eax, eax
je 0x140001be6
lea r8, [rbp - 9]
mov rdx, qword [rbp - 0x21]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140001874
mov dword [rbp - 9], esi
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 9], 0
je 0x140001be6
xor r8d, r8d
mov edx, 0xd
lea rcx, [rbp + 7]
call fcn.140002160
nop
xor r8d, r8d
mov edx, 0xd
lea rcx, [rbp + 0x27]
call fcn.140002160
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp - 0x21], eax
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rax, qword [rbp + 7]
mov dword [rax], ebx
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rax, qword [rbp + 7]
mov dword [rax + 4], edx
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rax, qword [rbp + 7]
mov dword [rax + 8], ecx
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
mov r8d, 0xc
lea rdx, str.GenuineIntel
call fcn.140016da0
mov ebx, eax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14000194b
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001945
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c07
call fcn.14000e05c
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140001986
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001981
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c0d
call fcn.14000e05c
test ebx, ebx
jne 0x140001c13
lea rcx, [rbp - 0x21]
call fcn.1400023b0
mov rcx, qword [rax]
mov qword [rax], rsi
mov rdx, qword [rdi + 8]
mov qword [rdi + 8], rcx
test rdx, rdx
je 0x1400019af
call fcn.140002270
mov rdx, qword [rbp - 0x21]
test rdx, rdx
je 0x1400019bd
call fcn.140002270
mov rbx, qword [rdi + 8]
mov rdx, qword [rbx]
lea rcx, [rbp + 7]
call fcn.140002950
lea rax, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rax, qword [rbp + 7]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 0x20010000
lea r8, str.OffensiveResearch
lea rdx, str.OffensiveResearch
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rbx + 0x10], rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x140001a73
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c34
call fcn.14000e05c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140001bb1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140001bc5
mov ecx, 0x10
call fcn.14000e020
mov rbx, rax
mov qword [rbp - 1], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], rsi
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..Pmxdrv
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x140001b54
mov rsi, qword [rdi + 0x10]
mov qword [rdi + 0x10], rbx
test rsi, rsi
je 0x140001b2c
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
je 0x140001b11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 8], 0xffffffffffffffff
mov rdx, qword [rsi]
test rdx, rdx
je 0x140001b1e
call fcn.1400014d0
mov edx, 0x10
mov rcx, rsi
call fcn.14000e05c
nop
mov rax, rdi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14000e000
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rbp - 9], eax
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x21]
call fcn.140001570
mov rdx, rax
mov rcx, rbx
call fcn.1400015c0
lea rcx, [rbp - 0x21]
call fcn.140001460
mov rcx, rbx
call fcn.140001450
mov rcx, rax
lea rdx, [rbp + 0x27]
call fcn.1400096f0
nop
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.140001380
lea rdx, [0x140040d60]
lea rcx, [rbp - 0x21]
call fcn.14000fed0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Getlasterror:__d_n
call fcn.140001600
lea rdx, str.Failed_to_start_kernel_service
lea rcx, [rbp - 0x21]
call fcn.140001750
lea rdx, [0x140040d60]
lea rcx, [rbp - 0x21]
call fcn.14000fed0
int3
lea rdx, str.Administrative_privileges_are_required._Please_try_again_as_Administrator.
lea rcx, [rbp - 0x21]
call fcn.140001750
lea rdx, [0x140040d60]
lea rcx, [rbp - 0x21]
call fcn.14000fed0
nop
call fcn.140013e54
nop
call fcn.140013e54
int3
lea rdx, str.Processor_is_not_supported.
lea rcx, [rbp - 0x21]
call fcn.140001750
lea rdx, [0x140040d60]
lea rcx, [rbp - 0x21]
call fcn.14000fed0
int3
call fcn.140013e54
int3