Function at 0x1400169c4
Capabilities:
Create service
Modify service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x9b8]
sub rsp, 0xaa0
mov rax, qword [0x1400580e8]
xor rax, rsp
mov qword [rbp + 0x990], rax
xor esi, esi
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea r14d, [rsi + 1]
mov rbx, rax
test rax, rax
je 0x140016a50
mov r8d, r14d
lea rdx, [0x14005b9f8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140016a3b
mov rcx, rax
mov edi, r14d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x140016a50
mov eax, r14d
jmp 0x140016b2c
mov ebx, 0x104
lea rdx, [rbp - 0x7e]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140016b2a
cmp eax, ebx
je 0x140016b2a
lea ecx, [rax + 1]
mov r15d, 0x22
mov word [rbp - 0x80], r15w
mov word [rbp + rcx*2 - 0x80], r15w
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x140016c91
mov word [rbp + rcx - 0x80], si
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140016b58
lea rdx, [rbp + 0x190]
mov ecx, 0xd80a
call fcn.140017008
test eax, eax
jne 0x140016b11
lea r8, str.Could_not_open_Service_Manager
mov edx, 0x400
lea rcx, [rbp + 0x190]
call fcn.140023b18
test eax, eax
je 0x140016b11
cmp eax, 0xc
je 0x140016c65
cmp eax, 0x16
je 0x140016c5a
cmp eax, r15d
je 0x140016c5a
cmp eax, 0x50
jne 0x140016c4f
xor r9d, r9d
lea r8, [0x14005b9f8]
lea rdx, [rbp + 0x190]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.14001a5c0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x60], rsi
lea rax, str.RPCSS
mov qword [rsp + 0x58], rsi
lea r8, [0x14005bc24]
mov qword [rsp + 0x50], rax
lea rdx, [0x14005b9f8]
mov qword [rsp + 0x48], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rsi
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
mov rcx, rbx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x140016c1b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rbp + 0x190]
mov ecx, 0xd80b
call fcn.140017008
test eax, eax
jne 0x140016b11
lea r8, str.Could_not_start_service
mov edx, 0x400
lea rcx, [rbp + 0x190]
call fcn.140023b18
test eax, eax
je 0x140016b11
cmp eax, 0xc
je 0x140016c86
cmp eax, 0x16
je 0x140016c7b
cmp eax, r15d
je 0x140016c7b
cmp eax, 0x50
je 0x140016b11
jmp 0x140016c70
lea rax, [0x14005be24]
mov edx, r14d
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140016a48
mov ecx, 0x80004005
call fcn.140001820
int3
mov ecx, 0x80070057
call fcn.140001820
int3
mov ecx, 0x8007000e
call fcn.140001820
int3
mov ecx, 0x80004005
call fcn.140001820
int3
mov ecx, 0x80070057
call fcn.140001820
int3
mov ecx, 0x8007000e
call fcn.140001820
int3
call fcn.14001ad14
int3