Function at 0x1400facc8
Capabilities:
Create service
Enumerate services
Query service configuration
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov r12, rcx
xor esi, esi
mov dword [rbp - 0x1c], esi
lea rax, [rsp + 0x70]
mov qword [rbp + 8], rax
mov r14, qword [rcx + 0x10]
mov r15, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1400fad1b
mov r15, qword [rcx]
call fcn.14010046c
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov rax, rsi
mov qword [rbp - 0x80], rax
mov edx, 7
mov qword [rbp - 0x78], rdx
mov word [rsp + 0x70], si
mov dword [rbp - 0x1c], 4
test r14, r14
je 0x1400fae31
cmp r14, 0x7fffffff
ja 0x1400fb427
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, r13d
call fcn.140100494
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x1400fb42d
movsxd rdx, ebx
mov r8, qword [rbp - 0x80]
cmp rdx, r8
ja 0x1400fadaa
mov qword [rbp - 0x80], rdx
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rax, qword [rsp + 0x70]
mov word [rax + rdx*2], si
jmp 0x1400fadfb
sub rdx, r8
mov rax, qword [rbp - 0x78]
sub rax, r8
cmp rdx, rax
ja 0x1400fadee
lea rax, [r8 + rdx]
mov qword [rbp - 0x80], rax
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400fade3
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], si
jmp 0x1400fadfb
mov r9, rdx
lea rcx, [rsp + 0x70]
call fcn.1400fb448
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r13d
call fcn.140100494
shr rax, 0x20
test eax, eax
jne 0x1400fb433
mov rdx, qword [rbp - 0x78]
mov rax, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
cmp rdx, 7
cmova rcx, qword [rsp + 0x70]
lea r8, [rcx + rax*2]
mov rdi, r8
mov rdx, r8
sub rdx, rcx
sar rdx, 1
mov r10w, 0x5c
mov r9w, 0x2f
cmp rdx, 2
jl 0x1400faf3d
mov eax, dword [rcx]
and eax, 0xffffffdf
sub eax, 0x3a0041
cmp eax, 0x1a
jae 0x1400fae7c
add rcx, 4
jmp 0x1400faf3d
cmp word [rcx], r10w
je 0x1400fae8c
cmp word [rcx], r9w
jne 0x1400faf3d
cmp rdx, 4
jl 0x1400faee4
cmp word [rcx + 6], r10w
je 0x1400faea0
cmp word [rcx + 6], r9w
jne 0x1400faef4
cmp rdx, 4
je 0x1400faeb4
cmp word [rcx + 8], r10w
je 0x1400faef4
cmp word [rcx + 8], r9w
je 0x1400faef4
cmp word [rcx + 2], r10w
je 0x1400faec2
cmp word [rcx + 2], r9w
jne 0x1400faed0
cmp word [rcx + 4], 0x3f
je 0x1400faede
cmp word [rcx + 4], 0x2e
je 0x1400faede
cmp word [rcx + 2], 0x3f
jne 0x1400faef4
cmp word [rcx + 4], 0x3f
jne 0x1400faef4
add rcx, 6
jmp 0x1400faf3d
mov rax, r8
sub rax, rcx
and rax, 0xfffffffffffffffe
cmp rax, 6
jl 0x1400faf3d
cmp word [rcx + 2], r10w
je 0x1400faf02
cmp word [rcx + 2], r9w
jne 0x1400faf3d
cmp word [rcx + 4], r10w
je 0x1400faf3d
cmp word [rcx + 4], r9w
je 0x1400faf3d
add rcx, 6
jmp 0x1400faf26
cmp word [rcx], r10w
je 0x1400faf3d
cmp word [rcx], r9w
je 0x1400faf3d
add rcx, 2
cmp rcx, r8
jne 0x1400faf16
jmp 0x1400faf3d
cmp word [rcx], r10w
je 0x1400faf39
cmp word [rcx], r9w
jne 0x1400faf42
add rcx, 2
cmp rcx, r8
jne 0x1400faf2d
cmp rcx, r8
je 0x1400faf5f
lea rax, [rdi - 2]
cmp word [rax], r10w
je 0x1400faf5f
cmp word [rax], r9w
je 0x1400faf5f
mov rdi, rax
cmp rcx, rax
jne 0x1400faf47
sub r8, rdi
sar r8, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400f8b0c
nop
lea r13, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova r13, qword [rbp - 0x70]
mov r15, qword [rbp - 0x60]
call fcn.14010046c
mov dword [rbp - 0x20], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rsi
mov qword [rbp], 0xf
mov byte [rbp - 0x18], sil
mov dword [rbp - 0x1c], 0x23b
test r15, r15
je 0x1400fb08f
cmp r15, 0x7fffffff
ja 0x1400fb43b
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r15d
mov rdx, r13
mov ecx, eax
call fcn.1401004dc
mov rdi, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x1400fb441
movsxd r14, edi
mov rcx, qword [rbp - 8]
cmp r14, rcx
ja 0x1400fb019
mov qword [rbp - 8], r14
lea rax, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rax, qword [rbp - 0x18]
mov byte [rax + r14], sil
jmp 0x1400fb063
sub r14, rcx
mov rax, qword [rbp]
sub rax, rcx
cmp r14, rax
ja 0x1400fb054
lea rax, [rcx + r14]
mov qword [rbp - 8], rax
lea rbx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rbx, qword [rbp - 0x18]
add rbx, rcx
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.140100736
mov byte [rbx + r14], sil
jmp 0x1400fb063
mov r9, r14
mov rdx, r14
lea rcx, [rbp - 0x18]
call fcn.1400fb5e0
lea r9, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova r9, qword [rbp - 0x18]
mov dword [rsp + 0x20], edi
mov r8d, r15d
mov rdx, r13
mov ecx, dword [rbp - 0x20]
call fcn.1401004dc
shr rax, 0x20
test eax, eax
jne 0x1400fb41f
lea rcx, [rbp - 0x70]
call fcn.1400f7b78
nop
lea rcx, [rsp + 0x70]
call fcn.1400f7b78
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1400fb3b1
mov dword [rbp - 0x20], esi
mov dword [rbp - 0x1c], esi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r14d, [r9 + 3]
mov r8d, r14d
lea r15d, [r9 + 0xb]
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400fb10f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400fb3b1
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.1400ffa84
mov rbx, rax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8d, r14d
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400fb3a8
mov r14d, esi
cmp dword [rbp - 0x1c], esi
jbe 0x1400fb1dd
mov eax, r14d
lea rcx, [rax + rax*2]
add rcx, rcx
mov r8d, 1
mov rdx, qword [rbx + rcx*8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r15, rax
test rax, rax
je 0x1400fb1d4
mov ecx, 0x1fa0
call fcn.1400ffa84
mov r13, rax
mov dword [rbp + 8], esi
lea r9, [rbp + 8]
mov r8d, 0x1fa0
mov rdx, rax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1400fb1cb
lea rdx, str.vulc_driver64.sys
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400fb2f8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc r14d
cmp r14d, dword [rbp - 0x1c]
jb 0x1400fb162
mov rcx, rbx
call fcn.1400ff4c0
mov dword [rbp - 0x20], esi
mov dword [rbp - 0x1c], esi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r15d, [r9 + 3]
mov r8d, r15d
lea ebx, [r9 + 0xb]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400fb234
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400fb3b1
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.1400ffa84
mov r14, rax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r9, r14
mov r8d, r15d
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400fb3a3
mov ebx, esi
cmp dword [rbp - 0x1c], esi
jbe 0x1400fb2d0
mov eax, ebx
lea rcx, [rax + rax*2]
add rcx, rcx
movups xmm0, xmmword [r14 + rcx*8 + 0x10]
movups xmmword [rbp + 8], xmm0
lea rdx, [0x1401520fc]
mov rcx, qword [r14 + rcx*8]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400fb2c9
movups xmm0, xmmword [rbp + 8]
psrldq xmm0, 4
movd eax, xmm0
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x1400fb3b1
inc ebx
cmp ebx, dword [rbp - 0x1c]
jb 0x1400fb285
mov rcx, r14
call fcn.1400ff4c0
cmp qword [r12 + 0x18], 0xf
jbe 0x1400fb2e4
mov r12, qword [r12]
lea r8, [rbp - 0x18]
cmp qword [rbp], 0xf
jbe 0x1400fb30e
mov r8, qword [rbp - 0x18]
mov rdx, r8
jmp 0x1400fb312
mov rcx, rbx
call fcn.1400ff4c0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400fb1e5
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
mov r9d, 0x10030
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x1400fb37b
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
lea r8d, [rax + 0x10]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x1400fb398
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
setne sil
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400fb3b1
mov rcx, r14
jmp 0x1400fb3ab
mov rcx, rbx
call fcn.1400ff4c0
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400fb3ef
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fb3ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fb3ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ff4c0
mov al, sil
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1400ff3d0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.1400fac84
nop
call fcn.1400faa2c
int3
call fcn.1400fac84
int3
mov ecx, eax
call fcn.1400fac84
nop
call fcn.1400faa2c
int3
call fcn.1400fac84
int3