Function at 0x140006840
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push rbp
push rdi
push r12
push r13
lea rbp, [rsp - 0x278]
sub rsp, 0x378
mov rax, qword [0x1402f8c60]
xor rax, rsp
mov qword [rbp + 0x260], rax
lea r8, str.InstallService
mov dword [rbp - 0x70], 0xad
lea r12, str.c:users_scddocumentsmyworkproject__dynabooksystemdriverdsd_for_tos6208_v6dsd_branch_dev_6.01.0029.xxcentennial_rs5dynabookecoserviceecoserver_toshibasystemmodules.cpp
mov qword [rbp - 0x80], r8
lea r13, str.__InstallService_
mov qword [rbp - 0x78], r12
lea rdi, [0x1402a214c]
mov qword [rbp - 0x68], r13
lea rdx, str.ENTER__s
mov qword [rbp - 0x60], rdi
lea rcx, [rbp - 0x78]
mov dword [rbp - 0x58], 3
call fcn.140008d50
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x208
call fcn.1401f5d40
lea rax, str.dynabook_Settings_Service
mov qword [rsp + 0x78], rax
call fcn.140002c10
mov rcx, rax
test rax, rax
je 0x140006b27
mov rax, qword [rax]
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x3a8], rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r8d, 0x104
lea rdx, [rbp + 0x50]
xor ecx, ecx
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140006949
mov qword [rbp - 0x38], rdi
lea rdx, str.Error_Code:_0x_x
xor edi, edi
mov qword [rbp - 0x50], r12
mov esi, 0x80004005
mov dword [rbp - 0x30], edi
mov r8d, esi
mov dword [rbp - 0x48], UnRegisterTypeLib
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x40], r13
call fcn.140008d50
jmp 0x140006ac7
lea r8, [rbp + 0x50]
mov qword [rsp + 0x3b0], r14
lea rdx, str.__s_
lea rcx, [rsp + 0x70]
call fcn.1400056c0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x1400069b8
mov qword [rbp - 0x10], rdi
lea rdx, str.Error_Code:_0x_x
xor edi, edi
mov qword [rbp - 0x28], r12
mov esi, 0x80004003
mov dword [rbp - 8], edi
mov r8d, esi
mov dword [rbp - 0x20], 0xbc
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x18], r13
call fcn.140008d50
mov rbx, qword [rsp + 0x70]
jmp 0x140006abf
mov rbx, qword [rsp + 0x70]
lea r8, str.dynabookSettingService
xor edi, edi
mov qword [rsp + 0x370], r15
mov qword [rsp + 0x60], rdi
lea rdx, str.dynabookSettingService
mov qword [rsp + 0x58], rdi
mov r9d, 0x10000000
mov qword [rsp + 0x50], rdi
mov rcx, r14
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], SafeArrayUnaccessData
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r15, rax
test rax, rax
jne 0x140006a55
lea rax, [0x1402a214c]
mov qword [rbp], r12
mov esi, 0x80004003
mov dword [rbp + 8], 0xcc
mov r8d, esi
mov qword [rbp + 0x10], r13
lea rdx, str.Error_Code:_0x_x
mov qword [rbp + 0x18], rax
lea rcx, [rbp]
mov dword [rbp + 0x20], edi
call fcn.140008d50
jmp 0x140006aae
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x140006aa3
lea rax, [0x1402a214c]
mov qword [rbp + 0x28], r12
mov esi, 0x80004005
mov dword [rbp + 0x30], 0xce
mov r8d, esi
mov qword [rbp + 0x38], r13
lea rdx, str.Error_Code:_0x_x
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x28]
mov dword [rbp + 0x48], edi
call fcn.140008d50
jmp 0x140006aa5
mov esi, edi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15, qword [rsp + 0x370]
mov r14, qword [rsp + 0x3b0]
lea rdx, [rbx - 0x18]
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
mov rbx, qword [rsp + 0x3a0]
sub ecx, 1
jg 0x140006aec
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov r8, qword [rbp - 0x80]
lea rdx, str.LEAVE__s
lea rcx, [rbp - 0x78]
call fcn.140008d50
mov eax, esi
mov rsi, qword [rsp + 0x3a8]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140072680
add rsp, 0x378
pop r13
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002ad0
int3