Function at 0x18000f690
Capabilities:
Connect network resource
Create service
Delete service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor edi, edi
mov r12, r8
mov rsi, rcx
mov qword [rax - 0x58], rdi
xorps xmm0, xmm0
lea r8, str.IPC_
xorps xmm1, xmm1
mov rdx, rcx
lea rcx, str._ls_ls
mov r13d, edi
mov ebx, edi
mov r15, r9
movdqu xmmword [rax - 0x50], xmm0
movdqu xmmword [rax - 0x38], xmm1
call fcn.180001620
xor r9d, r9d
mov qword [rsp + 0x88], rax
mov r8, r12
lea rcx, [rsp + 0x70]
mov rdx, r15
call qword [sym.imp.MPR.dll_WNetAddConnection2W]
test eax, eax
jne 0x18000f8d5
mov r14, qword [rsp + 0x88]
lea rcx, str._lsIPC___username:__ls___password:__ls_
mov r9, r15
mov r8, r12
mov rdx, rsi
call fcn.180001620
mov rbp, rax
test r14, r14
je 0x18000f8fc
mov r9b, 1
mov qword [rsp + 0x30], rdi
movzx r8d, r9b
mov qword [rsp + 0x20], rax
lea rdx, str.connected
call fcn.180002a10
mov r8d, 0xf003f
lea rdx, str.ServicesActive
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x18000f7d0
call fcn.18000d050
mov rbx, rax
mov r9d, 0xf01ff
xor eax, eax
mov r8, rbx
mov qword [rsp + 0x60], rax
mov rdx, rbx
mov qword [rsp + 0x58], rax
mov rcx, rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
lea rax, str.C:windows_system32_notepad.exe
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r13, rax
mov r9, r12
mov qword [rsp + 0x20], r15
mov r8, rbx
lea rcx, str.Remote_Host_:__ls____Service_Name_:__ls__username:__ls___password:__ls_
mov rdx, rsi
call fcn.180001620
mov rsi, rax
lea rdx, str.createService
xor eax, eax
mov qword [rsp + 0x30], rax
test r13, r13
je 0x18000f85c
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov r8b, 1
call fcn.180002a10
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
lea rcx, str.Success
lea r8, str.Failed
cmovne r8, rcx
lea rdx, str.log:DeleteService____s_n
mov rcx, qword [0x18006abc8]
call fcn.1800022f0
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r15b, 1
jmp 0x18000f86f
mov r9b, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.180002a10
xor r15b, r15b
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 1]
call qword [sym.imp.MPR.dll_WNetCancelConnection2W]
test rdi, rdi
je 0x18000f88c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x18000f89e
mov edx, 2
mov rcx, rbx
call fcn.180010c10
test rsi, rsi
je 0x18000f8b0
mov edx, 2
mov rcx, rsi
call fcn.180010c10
mov edx, 2
mov rcx, r14
call fcn.180010c10
test rbp, rbp
je 0x18000f8cf
mov edx, 2
mov rcx, rbp
call fcn.180010c10
movzx eax, r15b
jmp 0x18000f91a
mov rcx, qword [rsp + 0x88]
mov edx, 2
call fcn.180010c10
mov r9, r15
lea rcx, str._lsIPC___username:__ls___password:__ls_
mov r8, r12
mov rdx, rsi
call fcn.180001620
mov qword [rsp + 0x30], rdi
lea rdx, str.connected
mov r9b, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call fcn.180002a10
xor al, al
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret