Function at 0x140019f20
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x148
mov qword [rsp + 0x108], 0xfffffffffffffffe
mov rax, qword [0x1400311e8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov dword [rsp + 0xa0], 0
mov rax, qword [rsp + 0x160]
cmp qword [rax], 0
jne 0x140019f78
lea rcx, str.the_SCM_handl_is_NULL.
call fcn.140021d50
xor al, al
jmp 0x14001a2ab
mov rdx, qword [rsp + 0x160]
add rdx, 0x10
lea rcx, [rsp + 0x78]
call fcn.140004810
nop
mov rcx, qword [rsp + 0x160]
add rcx, 0x10
call fcn.140004a40
mov rdx, rax
lea rcx, str.Binary_is___s_
call fcn.140021de0
lea r8, [rsp + 0x78]
lea rdx, [0x140027c54]
lea rcx, [rsp + 0xb0]
call fcn.140008940
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x118], rax
lea r8, [0x140027bc4]
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0xd8]
call fcn.140008880
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x78]
call fcn.140004880
nop
lea rcx, [rsp + 0xd8]
call fcn.140004860
nop
lea rcx, [rsp + 0xb0]
call fcn.140004860
lea rdx, str.___service
lea rcx, [rsp + 0x78]
call fcn.140004910
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x78]
call fcn.140004a40
mov rdi, rax
lea rcx, [0x140033640]
call fcn.140004a40
mov rbx, rax
lea rcx, [0x140033640]
call fcn.140004a40
mov rdx, rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
lea rax, str.RPCSS
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
mov r9d, 0xf01ff
mov r8, rbx
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov r11, rax
mov rax, qword [rsp + 0x160]
mov qword [rax + 8], r11
mov rax, qword [rsp + 0x160]
cmp qword [rax + 8], 0
jne 0x14001a1a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa0], eax
lea rcx, [0x140033640]
call fcn.140004a40
mov r8d, dword [rsp + 0xa0]
mov rdx, rax
lea rcx, str.error_happens_during_creating_a_service_:_s.Error_Code:_d.
call fcn.140021d50
cmp dword [rsp + 0xa0], 0x431
jne 0x14001a18a
mov rcx, qword [rsp + 0x160]
call fcn.140019930
movzx eax, al
test eax, eax
je 0x14001a18a
lea rcx, str.startService_successfully.
call fcn.140021de0
mov byte [rsp + 0x100], 1
lea rcx, [rsp + 0x78]
call fcn.140004860
mov al, byte [rsp + 0x100]
jmp 0x14001a2ab
mov byte [rsp + 0x101], 0
lea rcx, [rsp + 0x78]
call fcn.140004860
mov al, byte [rsp + 0x101]
jmp 0x14001a2ab
lea rax, str.Service_for_runing_HiSuite_applications_autorun.
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0xa8]
mov edx, 1
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x14001a1f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ChangeServiceConfig2_failed__errno___d
call fcn.140021d50
jmp 0x14001a204
mov rdx, qword [rsp + 0xa8]
lea rcx, str.service_descpition_is___s_
call fcn.140021de0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x160]
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x14001a272
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa0], eax
lea rcx, [0x140033640]
call fcn.140004a40
mov r8d, dword [rsp + 0xa0]
mov rdx, rax
lea rcx, str.error_happens_during_starting_a_service:_s.Error_Code:_d
call fcn.140021d50
mov byte [rsp + 0x102], 0
lea rcx, [rsp + 0x78]
call fcn.140004860
mov al, byte [rsp + 0x102]
jmp 0x14001a2ab
mov rcx, qword [rsp + 0x160]
add rcx, 0x10
call fcn.140004a40
mov rdx, rax
lea rcx, str.Install_service_:_s_successfully.
call fcn.140021de0
mov byte [rsp + 0x103], 1
lea rcx, [rsp + 0x78]
call fcn.140004860
mov al, byte [rsp + 0x103]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140009950
add rsp, 0x148
pop rdi
pop rbx
ret