Function at 0x140005320
Capabilities:
Create service
Modify service
Persist via windows service
Query service status

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1400de7c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x140005395
lea rdx, str.Failed_to_open_service_manager._Error:
lea rcx, [0x1400e0430]
call fcn.14000cb00
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140009c20
mov rcx, rax
call fcn.14000cdc0
xor al, al
jmp 0x1400056e9
cmp qword [rdi + 0x18], 7
mov rdx, rdi
mov qword [rsp + 0xe0], rbp
jbe 0x1400053aa
mov rdx, qword [rdi]
mov r8d, 0xf01ff
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x14000560b
lea rax, [rsp + 0x74]
mov r9d, 0x24
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400053f5
lea rdx, str.Failed_to_query_service_status._Error:
jmp 0x1400055cb
xor ebx, ebx
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x70], ebx
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400055c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400055c4
mov edx, dword [rsp + 0x70]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8d, dword [rsp + 0x70]
lea r9, [rsp + 0x70]
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14000545d
lea rdx, str.Failed_to_query_service_config._Error:
jmp 0x14000557b
cmp dword [rdi + 4], 2
je 0x1400054ad
mov qword [rsp + 0x50], rbx
mov edx, 0xffffffff
mov qword [rsp + 0x48], rbx
mov r9d, edx
mov qword [rsp + 0x40], rbx
mov r8d, 2
mov qword [rsp + 0x38], rbx
mov rcx, rbp
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1400054ad
lea rdx, str.Failed_to_update_service_startup_type._Error:
jmp 0x14000557b
mov rcx, qword [rdi + 0x10]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x1400054c0
mov r9, qword [rsi + 0x18]
mov r8, rsi
mov rdx, qword [rsi + 0x10]
cmp r9, 7
jbe 0x1400054dd
mov r8, qword [rsi]
cmp rdx, rax
jne 0x140005530
test rdx, rdx
je 0x140005504
sub r8, rcx
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140005530
add rcx, 2
sub rdx, 1
jne 0x1400054f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, str.Service_updated_successfully.
lea rcx, [0x1400e0170]
call fcn.14000cb00
mov rcx, rax
call fcn.14000cdc0
mov rcx, rbp
jmp 0x1400056d0
cmp r9, 7
jbe 0x140005539
mov rsi, qword [rsi]
mov qword [rsp + 0x50], rbx
mov edx, 0xffffffff
mov qword [rsp + 0x48], rbx
mov r9d, edx
mov qword [rsp + 0x40], rbx
mov r8d, edx
mov qword [rsp + 0x38], rbx
mov rcx, rbp
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140005504
lea rdx, str.Failed_to_update_service_executable_path._Error:
lea rcx, [0x1400e0430]
call fcn.14000cb00
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140009c20
mov rcx, rax
call fcn.14000cdc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400056e1
lea rdx, str.Failed_to_query_service_config_size._Error:
lea rcx, [0x1400e0430]
call fcn.14000cb00
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140009c20
mov rcx, rax
call fcn.14000cdc0
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400056e1
cmp qword [rsi + 0x18], 7
jbe 0x140005615
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 7
mov r8, rdi
jbe 0x140005625
mov r8, qword [rdi]
mov rdi, r8
xor ebx, ebx
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rbx
mov rdx, rdi
mov qword [rsp + 0x58], rbx
mov rcx, r14
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
jne 0x1400056b2
lea rdx, str.Failed_to_create_service._Error:
lea rcx, [0x1400e0430]
call fcn.14000cb00
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140009c20
mov rcx, rax
call fcn.14000cdc0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400056e1
lea rdx, str.Service_created_successfully.
lea rcx, [0x1400e0170]
call fcn.14000cb00
mov rcx, rax
call fcn.14000cdc0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rbp, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140079350
mov rbx, qword [rsp + 0xe8]
add rsp, 0xb0
pop r14
pop rdi
pop rsi
ret