Function at 0x1400ea2c0
Capabilities:
Create service
Delete service
Start service

Disassembly:
push r15
sub rsp, 0xc0
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r15, rcx
mov rcx, qword [rcx + 0x58]
call fcn.1400ea0a0
test eax, eax
jns 0x1400ea2f3
lfence
jmp 0x1400ea6d3
mov qword ss:[rsp + 0xa0], r14
call sym.SystemInformer.exe_QiGetApplicationFileNameWin32
mov r14, rax
test rax, rax
jne 0x1400ea317
mov eax, 0xc0000229
jmp 0x1400ea6cb
mov r8, qword [r15 + 0x48]
lea rcx, str.__s___ras___s_
mov rdx, qword [rax + 8]
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xa8], r13
call sym.SystemInformer.exe_QiFormatString
xor r13d, r13d
mov rsi, rax
test rax, rax
je 0x1400ea36c
mov rbp, qword [rax + 8]
jmp 0x1400ea36f
mov rbp, r13
mov r12, qword ds:[r15 + 0x48]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400ea3b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov ebx, eax
test eax, eax
js 0x1400ea43f
mov rdi, qword [rsp + 0x80]
lea rax, [0x1402332cc]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov r8, r12
lea rax, str.LocalSystem
mov rdx, r12
mov qword [rsp + 0x58], rax
mov rcx, rdi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbp, rax
test rax, rax
je 0x1400ea41c
mov rcx, rdi
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ea444
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_QiDosErrorToNtStatus
mov rbp, qword [rsp + 0x78]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ea444
mov rbp, qword [rsp + 0x78]
lea rcx, [rsi - 0x10]
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400ea45e
call fcn.14013fb00
lea rcx, [r14 - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400ea473
call fcn.14013fb00
test ebx, ebx
jns 0x1400ea47f
lfence
jmp 0x1400ea699
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400ea497
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400ea4b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [r15 + 0x48]
lea r8, str.BaseNamedObjects_
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1400ea4ef
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x70], ecx
je 0x1400ea4eb
mov edx, ecx
shr rdx, 1
jmp 0x1400ea538
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x70], ecx
jne 0x1400ea52a
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x70], ecx
je 0x1400ea510
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov rdi, r12
lea r13, [rdx + rdx]
and rdi, 0xfffffffffffffff1
mov ecx, r12d
and ecx, 0xf
je 0x1400ea56d
movdqu xmm0, xmmword [rdi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x74], ecx
je 0x1400ea569
mov edi, ecx
shr rdi, 1
jmp 0x1400ea5aa
add rdi, 0x10
movdqu xmm0, xmmword [rdi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x74], ecx
jne 0x1400ea59c
movdqu xmm0, xmmword [rdi + 0x10]
add rdi, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x74], ecx
je 0x1400ea582
sub rdi, r12
mov eax, ecx
sar rdi, 1
shr rax, 1
add rdi, rax
mov rdx, qword [0x1402c4fb8]
add rdi, rdi
lea rbx, [rdi + r13]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_QiCreateObject
mov r14, rax
lea rdx, str.BaseNamedObjects_
mov r8, r13
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [r14 + 8]
call fcn.1402074d0
mov rcx, qword [r14 + 8]
mov r8, rdi
add rcx, r13
mov rdx, r12
call fcn.1402074d0
movzx eax, word [r14]
mov edi, 0x32
mov word [rsp + 0x88], ax
movzx eax, word [r14]
add ax, 2
mov word [rsp + 0x8a], ax
mov rax, qword [r14 + 8]
mov qword [rsp + 0x90], rax
nop dword [rax + rax]
lea rcx, [rsp + 0x88]
call fcn.1400a1940
mov ebx, eax
test eax, eax
jns 0x1400ea665
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x80], 0xfffffffffff0bdc0
call fcn.14013e980
nop dword [rax]
add edi, 0xffffffff
jne 0x1400ea630
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x1400ea678
call fcn.14013fb00
test ebx, ebx
js 0x1400ea690
mov rdx, r15
mov ecx, 0xc
call fcn.1400a1cc0
mov ebx, eax
call fcn.1400a1b20
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0xa8]
mov eax, ebx
mov rbx, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xa0]
mov rcx, qword ds:[rsp + 0x98]
xor rcx, rsp
call fcn.1401e0100
add rsp, 0xc0
pop r15
ret