Function at 0x140004190
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Query or enumerate registry value
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4d0
mov rax, qword [0x140026010]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov edi, ecx
mov rbx, rdx
lea rcx, [0x140027fe8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor esi, esi
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x78], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400215d0]
mov rcx, 0xffffffff80000002
lea r9d, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000424b
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str.Log_Enable
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x70], 1
mov eax, esi
mov rcx, qword [rsp + 0x78]
sete al
mov dword [0x140027da0], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.Inside_wmain...._n
call fcn.140001650
mov r8d, 0x1f4
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, eax
add rcx, rcx
cmp rcx, 0x3ea
jae 0x140004685
mov word [rsp + rcx + 0xd0], si
cmp eax, 4
jbe 0x14000467e
add eax, 0xfffffffc
mov ecx, eax
add rcx, rcx
cmp word [rsp + rcx + 0xd0], 0x2e
jne 0x14000467e
cmp rcx, 0x3ea
jae 0x140004685
mov word [rsp + rcx + 0xd0], si
cmp edi, 2
jne 0x14000457a
mov rdx, qword [rbx + 8]
lea rcx, [0x1400236e4]
call fcn.140009a6c
test eax, eax
jne 0x1400043f5
lea rcx, str.Entering_Unistall_Service...._n
call fcn.140001650
xor edx, edx
mov dword [rsp + 0x70], esi
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x140004317
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed__error_code___d_n
jmp 0x140004643
mov r8d, 0xf01ff
lea rdx, str.Credential_Vault_Host_Storage
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000434e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed__error_code___d_n
call fcn.140001650
jmp 0x1400043db
lea rax, [rsp + 0x70]
mov r9d, 0x24
lea r8, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp dword [rsp + 0x8c], 1
je 0x1400043a9
lea r8, [rsp + 0xb0]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400043a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ControlService_failed__error_code___d_n
call fcn.140001650
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
lea rdx, str.Service__S_removed_successfully_n
lea rcx, str.Failed_to_delete_service__s_n
cmovne rcx, rdx
lea rdx, str.Credential_Vault_Host_Storage
call fcn.140001650
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Exiting_Unistal_service_n
call fcn.140001650
jmp 0x14000464a
mov rdx, qword [rbx + 8]
lea rcx, [0x1400236ec]
call fcn.140009a6c
test eax, eax
jne 0x140004534
lea rcx, str.Command_is_for_Installing_Service...._n
call fcn.140001650
lea rcx, str.Entering_InstallService...._n
call fcn.140001650
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x140004305
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x58], rsi
lea r8, str.Credential_Vault_Host_Storage
mov qword [rsp + 0x50], rsi
lea rdx, str.Credential_Vault_Host_Storage
mov qword [rsp + 0x48], rsi
mov r9d, 0xf01ff
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x1400044c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Credential_Vault_Host_Storage
lea rcx, str.Failed_to_create_service__s__error_code___d_n
call fcn.140001650
jmp 0x14000451a
lea rcx, str.Changing_the_Service_Description_n
call fcn.140001650
lea rax, str.Host_Storage_Service_for_Persisting_CV_Objects_into_Hard_drive
mov edx, 1
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x140004505
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_change_the_service_desc__error_code___d_n
call fcn.140001650
jmp 0x140004511
lea rcx, str.Service_description_is_set_n
call fcn.140001650
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Service_Installed_Successfully...._n
call fcn.140001650
jmp 0x14000464a
mov rdx, qword [rbx + 8]
lea rcx, [0x140023720]
call fcn.140009a6c
test eax, eax
jne 0x140004625
lea rcx, str.Boucning_the_Service...._n
call fcn.140001650
lea rcx, str.Credential_Vault_Host_Storage
call fcn.1400040a0
xor r8d, r8d
lea rcx, str.Credential_Vault_Host_Storage
xor edx, edx
call fcn.140003fa0
jmp 0x14000464a
cmp edi, 3
jne 0x1400045ca
mov rdx, qword [rbx + 8]
lea rcx, [0x140023744]
call fcn.140009a6c
test eax, eax
jne 0x1400045cc
lea rcx, str.To_Kill_the_Service...._n
call fcn.140001650
mov rcx, qword [rbx + 0x10]
call fcn.1400040a0
test al, al
lea rdx, str.Failed_to_kill_service__s_n
lea rcx, str.Killed_service__s_n
cmove rcx, rdx
mov rdx, qword [rbx + 0x10]
call fcn.140001650
jmp 0x14000464a
jl 0x140004625
mov rdx, qword [rbx + 8]
lea rcx, [0x1400237a4]
call fcn.140009a6c
test eax, eax
jne 0x140004625
lea rcx, str.To_Run_the_Service...._n
call fcn.140001650
mov rcx, qword [rbx + 0x10]
lea edx, [rdi - 3]
cmp edi, 3
lea r8, [rbx + 0x18]
cmovle r8, rsi
cmovle edx, esi
call fcn.140003fa0
test al, al
lea rdx, str.Failed_to_run_service__s_n
lea rcx, str.Ran_service__s_n
cmove rcx, rdx
mov rdx, qword [rbx + 0x10]
call fcn.140001650
jmp 0x14000464a
lea rcx, str.Credential_Vault_Host_Storage
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000464a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.StartServiceCtrlDispatcher_failed__error_code___d_n
mov edx, eax
call fcn.140001650
lea rcx, [0x140027fe8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1400046a0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov eax, 0xffffffff
jmp 0x140004659
call fcn.1400047c8
int3