Function at 0x1400017d0
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2e0
mov rax, qword [0x14001f010]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbx, rdx
cmp ecx, 2
jl 0x140001aa7
mov rcx, qword [rbx + 8]
lea rdx, str._install
call fcn.1400070f4
test eax, eax
jne 0x14000198e
mov rbp, qword [rbx + 0x10]
xor edx, edx
xor ebx, ebx
xor ecx, ecx
mov r8d, 0xf003f
mov esi, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140001873
lea r8d, [rbx + 1]
mov rcx, rax
lea rdx, str.GuardEassosRestoreBoot
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140001862
mov rcx, rax
lea esi, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
jne 0x140001aff
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140001a14
mov ecx, 0x10000
call fcn.1400020e8
mov rsi, rax
test rax, rax
je 0x140001980
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call fcn.140003860
mov r8d, 0x8000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x60], rbx
lea rax, [0x14001c390]
mov qword [rsp + 0x58], rbx
lea r8, str.GuardEassosRestoreBoot
mov qword [rsp + 0x50], rax
lea rdx, str.GuardEassosRestoreBoot
mov qword [rsp + 0x48], rbx
mov r9d, 0xf01ff
mov qword [rsp + 0x40], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
jne 0x140001957
mov rcx, rsi
call fcn.140001ca4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r9d, r9d
lea r8, str.GuardEassosRestoreBoot
lea rdx, str.Couldnt_create_service
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001aff
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], rbp
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rsi
call fcn.140001ca4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001aff
mov rcx, qword [rbx + 8]
lea rdx, str._uninstall
call fcn.1400070f4
test eax, eax
jne 0x140001aa7
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140001aff
lea r8d, [rbx + 1]
mov rcx, rax
lea rdx, str.GuardEassosRestoreBoot
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x1400019eb
mov rcx, rax
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x140001aff
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140001a32
xor r9d, r9d
lea r8, str.GuardEassosRestoreBoot
lea rdx, str.Couldnt_open_service_manager
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001aff
mov r8d, 0x10020
lea rdx, str.GuardEassosRestoreBoot
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140001a77
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r9d, r9d
lea r8, str.GuardEassosRestoreBoot
lea rdx, str.Couldnt_open_service
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001aff
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140001aff
lea r8, str.GuardEassosRestoreBoot
mov edx, 0x104
lea rcx, [rsp + 0xc0]
call fcn.14000728c
xor ebx, ebx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x98]
lea rax, [0x140001180]
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140001c80
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret