Function at 0x1400410f0
Capabilities:
Create service
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
sub rsp, 0x180
lea rbp, [rsp + 0x90]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401d9080]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor edx, edx
xor ecx, ecx
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400413f3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
movabs rax, 0xcd4ecf7086a51df3
mov qword [rbp], rax
movabs rdx, 0xc2cd3cfac6176e88
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xd8f75aecef76a39f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x5cf1052ce6f7f5b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x3d3bf8e28333321
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xc0970333884427fc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x95cbb15854866b5d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x57a70e5bea81e254
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xc2803cdac67b6ee7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x21094370ec47a8dc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x3ad270ad001b9c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x3b14b9e95ede70da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x48c0e24692412a5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0xcd22cf1986c41db5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xd8835accef12a3fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x5c810543e6d7f5d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x380bfae285d3344
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xc0fe034588362799
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x9588b17854e36b3e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x57d50e2feaefe23b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs r9, 0x216e4311ec29a8bd
lea rdx, [rbp + 0x80]
mov qword [rbp], r9
movabs r8, 0x38d2724d073b9a2
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x3b7bb99b5eac709f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x48c0e266927b2a2c
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x80], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xa0], ymm1
mov qword [rbp + 0x78], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0xc0], ymm1
vzeroupper
call fcn.140047820
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140047820
xor al, al
jmp 0x140041ba5
cmp qword [0x1401dc880], 7
lea rdx, [0x1401dc848]
mov r8, rdx
lea r9, [0x1401dc868]
cmova r9, qword [0x1401dc868]
mov rcx, rdi
cmp qword [0x1401dc860], 7
cmova r8, qword [0x1401dc848]
cmova rdx, qword [0x1401dc848]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
mov r9d, gethostname
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
jne 0x1400416c7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
movabs rax, 0xcd4ecf7086a51df3
mov qword [rbp], rax
movabs r8, 0x38d2724d073b9a2
mov rax, qword [rbp]
movabs rdx, 0xc2cd3cfac6176e88
mov qword [rbp + 0x20], rax
movabs r9, 0x216e4311ec29a8bd
movabs rax, 0xd8f75aecef76a39f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x5cf30520e6f7f5b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x3e5bfda283c3321
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xc08c0320884527b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x95edb11b548a6b48
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x57a70e6aeacfe215
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xc2f73c88c6786efa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x216e4311ec29a89d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xcd22cf1986c41db5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xd8835accef12a3fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x5c810543e6d7f5d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x380bfae285d3344
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xc0fe034588362799
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x9588b17854e36b3e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x57d50e2feaefe23b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r8
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x80]
mov qword [rbp + 0xc8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa xmm2, xmmword [rbp + 0x60]
lea rdx, [rbp + 0x20]
vxorps xmm2, xmm2, xmmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmmword [rbp + 0x60], xmm2
vzeroupper
call fcn.140047820
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140047820
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x140041ba5
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400419e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x420
jne 0x1400417a4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
movabs rax, 0xcd54cf6b86a11de6
mov qword [rbp], rax
movabs rdx, 0xc2cd3cfac6176e88
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xd8a35aa9ef71a393
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x5ce00563e6a4f5be
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x3e1bfcb282f3328
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xc08c0365884f27fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x95e1b116548d6b4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x57df0e01ea88e255
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rdx
jmp 0x140041a9b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
movabs rax, 0xcd4ecf7086a51df3
mov qword [rbp], rax
movabs r9, 0x216e4311ec29a8bd
mov rax, qword [rbp]
movabs r8, 0x38d2724d073b9a2
mov qword [rbp + 0x20], rax
movabs rdx, 0xc2cd3cfac6176e88
movabs rax, 0xd8f75aecef76a39f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x5cf50530e6f7f5b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x3a0bfda282f3325
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xc0880337885327ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x95a6b11d54806b57
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x57a70e5deaaae21b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xc2ed3cc0c6656ee7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xcd22cf1986c41db5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xd8835accef12a3fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x5c810543e6d7f5d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x380bfae285d3344
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xc0fe034588362799
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x9588b17854e36b3e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x57d50e2feaefe23b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r8
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0xc8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa xmm2, xmmword [rbp + 0x60]
lea rdx, [rbp + 0x20]
vxorps xmm2, xmm2, xmmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmmword [rbp + 0x60], xmm2
vzeroupper
call fcn.140047820
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, reloc.WS2_32.dll_ioctlsocket
call fcn.140047820
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x140041ba5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
movabs rax, 0xcd50cf7c86971d9d
mov qword [rbp], rax
movabs rdx, 0xc2cd3cfac6176e88
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xd8e65aafef7ba38c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x5ce00537e6a4f5f7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x3e4bfcb28293336
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xc09d0330884527b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x95fbb10b54866b5d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x57b90e43ea9ae25d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xc2cd3cf0c6396ef1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xcd22cf1986c41db5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xd8835accef12a3fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x5c810543e6d7f5d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x380bfae285d3344
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xc0fe034588362799
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x9588b17854e36b3e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x57d50e2feaefe23b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x20]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0xb8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140047820
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1400c1ee0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret