Function at 0x140067110
Capabilities:
Create service
Persist via windows service

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x848]
sub rsp, 0x948
mov qword [rbp + 0xe8], 0xfffffffffffffffe
xor r14d, r14d
mov dword [rbp + 0x890], r14d
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], r14b
lea r8d, [r14 + 0x12]
lea rdx, str.ServiceRegistrator
lea rcx, [rbp + 0xa8]
call fcn.14001e6d0
nop
mov rcx, qword [0x14028ae30]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x58], xmm0
mov rax, qword [rcx + 0x208]
test rax, rax
je 0x14006718f
lock inc dword [rax + 8]
mov rax, qword [rcx + 0x200]
mov qword [rbp + 0x58], rax
mov rax, qword [rcx + 0x208]
mov qword [rbp + 0x60], rax
lea r8, [rbp + 0xa8]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x78]
call fcn.1400fdd70
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x1400671fb
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400671f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d7c
call fcn.14014f740
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x104
lea rdx, [rbp + 0x730]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdi, 0xffffffffffffffff
test eax, eax
jne 0x140067360
lea r9, [0x14027b5a0]
xor r8d, r8d
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x78]
call fcn.1400fde20
nop
lea rbx, [rax + 0x68]
lea rdx, str.GetModuleFileName_failed_with_error:
mov rcx, rbx
call fcn.14001abc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp + 0x898], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x898]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, eax
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x898]
lea rcx, [rbp - 8]
call fcn.14001e6d0
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rdx, qword [rbp - 8]
mov r8, qword [rbp + 8]
mov rcx, rbx
call fcn.14001b330
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14006731c
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067317
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d82
call fcn.14014f740
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
lea rcx, [rbp + 0xf0]
call fcn.1400fd530
nop
lea r12, vtable.std::ios_base.0
mov qword [rbp + 0x1d0], r12
lea rcx, [rbp + 0x1d0]
call fcn.14012f920
nop
mov r14d, 1
jmp 0x140067c86
lea rax, [rbp + 0x730]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140067370
lea rdx, [rbp + 0x730]
lea rcx, [rbp - 0x50]
call fcn.14001e6d0
lea rcx, [rbp - 0x50]
mov r9, qword [rbp - 0x50]
mov r10, qword [rbp - 0x38]
cmp r10, 0x10
cmovae rcx, r9
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1400673d3
lea rax, [rdx - 1]
mov r8, rdi
cmp rax, rdi
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x5c
je 0x1400673ce
nop
cmp r8, rcx
je 0x1400673d3
dec r8
cmp byte [r8], 0x5c
jne 0x1400673c0
sub r8, rcx
jmp 0x1400673d6
mov r8, rdi
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], shutdown
mov byte [rbp - 0x28], 0
inc r8
cmp rdx, r8
cmovb r8, rdx
lea rdx, [rbp - 0x50]
cmp r10, 0x10
cmovae rdx, r9
lea rcx, [rbp - 0x28]
call fcn.14001e6d0
nop
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov dword [rbp + 0x890], 6
mov rsi, qword [rbp - 0x18]
lea rdx, [rsi + 0xa]
lea rcx, [rsp + 0x70]
call fcn.14001ff70
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x14006747d
lea rax, [rcx + 0xa]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8d, 0xa
lea rdx, str.___config
mov rcx, rbx
call fcn.14016d600
mov byte [rbx + 0xa], 0
jmp 0x14006749e
mov qword [rsp + 0x20], 0xa
lea r9, str.___config
xor r8d, r8d
lea edx, [r8 + 0xa]
lea rcx, [rsp + 0x70]
call fcn.14001b7f0
lea r9, [rbp - 0x28]
mov rdi, qword [rbp - 0x28]
mov r15, qword [rbp - 0x10]
cmp r15, 0x10
cmovae r9, rdi
mov r12, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r12
cmp rsi, rax
ja 0x1400674f6
lea rax, [rsi + r12]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0x10
cmovae rbx, qword [rsp + 0x70]
lea rcx, [rbx + r12]
mov r8, rsi
mov rdx, r9
call fcn.14016d600
lea rax, [rsi + rbx]
mov byte [rax + r12], 0
jmp 0x140067517
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.14001b7f0
mov r15, qword [rbp - 0x10]
mov rsi, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0x17
jb 0x140067565
lea rax, [rcx + 0x17]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.payment_service.conf__d
mov rcx, rbx
call fcn.14016d600
mov byte [rbx + 0x17], 0
lea rax, [rsp + 0x70]
jmp 0x140067586
mov qword [rsp + 0x20], reloc.WS2_32.dll_socket
lea r9, str.payment_service.conf__d
xor r8d, r8d
lea edx, [r8 + 0x17]
lea rcx, [rsp + 0x70]
call fcn.14001b7f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd8], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], shutdown
mov byte [rax], 0
mov dword [rbp + 0x890], reloc.WS2_32.dll_ntohl
lea r9, [rbp + 0xc8]
movq r13, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
mov qword [rbp - 0x30], rax
cmp rax, 0x10
cmovae r9, r13
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
movq r12, xmm1
cmp r12, rax
ja 0x140067623
lea rax, [r12 + rcx]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x50]
add rbx, rcx
mov r8, r12
mov rdx, r9
mov rcx, rbx
call fcn.14016d600
mov byte [rbx + r12], 0
mov rax, qword [rbp - 0x30]
jmp 0x140067645
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, r12
lea rcx, [rbp - 0x50]
call fcn.14001b7f0
mov rax, qword [rbp + 0xe0]
mov r13, qword [rbp + 0xc8]
cmp rax, 0x10
jb 0x14006767d
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140067674
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d88
mov rcx, r13
call fcn.14014f740
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400676b9
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400676b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d8e
call fcn.14014f740
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rcx, rax
mov qword [rbp + 0x70], rax
test rax, rax
jne 0x140067842
lea r9, [0x14027b5a0]
xor r8d, r8d
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x78]
call fcn.1400fde20
nop
lea rbx, [rax + 0x68]
lea rdx, str.OpenSCManager_failed_with_error:
mov rcx, rbx
call fcn.14001abc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp + 0x8a0], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x8a0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, eax
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x8a0]
lea rcx, [rbp + 0x18]
call fcn.14001e6d0
mov rcx, qword [rbp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rdx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x28]
mov rcx, rbx
call fcn.14001b330
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x1400677c3
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400677be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d94
call fcn.14014f740
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
lea rcx, [rbp + 0x230]
call fcn.1400fd530
nop
lea r12, vtable.std::ios_base.0
mov qword [rbp + 0x310], r12
lea rcx, [rbp + 0x310]
call fcn.14012f920
nop
mov r14d, 1
cmp r15, 0x10
jb 0x140067c7f
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140067835
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d9a
mov rcx, rdi
call fcn.14014f740
jmp 0x140067c7f
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rax, qword [rbp - 0x50]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], shutdown
mov r9d, 4
xor r8d, r8d
lea rdx, str.Turtle_Service
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov r13, rax
lea rcx, [rbp + 0x78]
test rax, rax
jne 0x140067a0f
lea r9, [0x14027b5a0]
xor r8d, r8d
lea rdx, [rbp + 0x370]
call fcn.1400fde20
nop
lea rbx, [rax + 0x68]
lea rdx, str.CreateService_failed_with_error:
mov rcx, rbx
call fcn.14001abc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbp + 0x8a8], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x8a8]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8d, eax
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], r13b
mov rdx, qword [rbp + 0x8a8]
lea rcx, [rbp + 0x38]
call fcn.14001e6d0
mov rcx, qword [rbp + 0x8a8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
mov rcx, rbx
call fcn.14001b330
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140067994
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006798f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067da0
call fcn.14014f740
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x38], 0
lea rcx, [rbp + 0x370]
call fcn.1400fd530
nop
lea r12, vtable.std::ios_base.0
mov qword [rbp + 0x450], r12
lea rcx, [rbp + 0x450]
call fcn.14012f920
nop
mov r14d, 1
cmp r15, 0x10
jb 0x140067c67
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140067c5f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d76
jmp 0x140067c5f
lea r9, [0x14027b640]
mov r8d, 3
lea rdx, [rbp + 0x4b0]
call fcn.1400fde20
nop
lea rcx, [rax + 0x68]
lea rdx, str.Service_is_registered_successfully
call fcn.14001abc0
nop
lea rcx, [rbp + 0x4b0]
call fcn.1400fd530
nop
lea r12, vtable.std::ios_base.0
mov qword [rbp + 0x590], r12
lea rcx, [rbp + 0x590]
call fcn.14012f920
nop
lea r9, [0x14027b640]
mov r8d, 3
lea rdx, [rbp + 0x5f0]
lea rcx, [rbp + 0x78]
call fcn.1400fde20
nop
add rax, 0x68
mov qword [rbp + 0x68], rax
lea rdx, str.Please_make_sure
mov rcx, rax
call fcn.14001abc0
nop
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov dword [rbp + 0x890], 0x4a
lea rdx, [rsi + 0x14]
lea rcx, [rbp - 0x70]
call fcn.14001ff70
lea r9, [rbp - 0x28]
cmp r15, 0x10
cmovae r9, rdi
mov rcx, qword [rbp - 0x60]
mov qword [rbp - 0x30], rcx
mov rdx, qword [rbp - 0x58]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140067b14
lea rax, [rsi + rcx]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x70]
add rcx, rbx
mov r8, rsi
mov rdx, r9
call fcn.14016d600
lea rax, [rsi + rbx]
mov rcx, qword [rbp - 0x30]
mov byte [rax + rcx], 0
jmp 0x140067b30
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.14001b7f0
mov r15, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x14
jb 0x140067b77
lea rax, [rcx + 0x14]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x70]
add rbx, rcx
mov r8d, shutdown
lea rdx, str.payment_service.conf
mov rcx, rbx
call fcn.14016d600
mov byte [rbx + 0x14], 0
jmp 0x140067b97
mov qword [rsp + 0x20], shutdown
lea r9, str.payment_service.conf
xor r8d, r8d
lea edx, [r8 + 0x14]
lea rcx, [rbp - 0x70]
call fcn.14001b7f0
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x68]
call fcn.14001b330
lea rdx, str._exists
mov rcx, qword [rbp + 0x68]
call fcn.14001abc0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140067bfe
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067da6
call fcn.14014f740
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
lea rcx, [rbp + 0x5f0]
call fcn.1400fd530
nop
mov qword [rbp + 0x6d0], r12
lea rcx, [rbp + 0x6d0]
call fcn.14012f920
nop
cmp r15, 0x10
jb 0x140067c67
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140067c5f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067dac
mov rcx, rdi
call fcn.14014f740
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r13, r13
je 0x140067c7f
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, 0xffffffffffffffff
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140067cc1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067cbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067db2
call fcn.14014f740
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x140067d0f
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140067d0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140067d70
call fcn.14014f740
movdqa xmm0, xmmword [0x1401b6b30]
movdqu xmmword [rbp + 0x98], xmm0
mov byte [rbp + 0x88], 0
mov rbx, qword [rbp + 0x80]
test rbx, rbx
je 0x140067d59
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140067d59
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140067d59
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
mov eax, r14d
add rsp, 0x948
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
nop
call fcn.1401705dc
int3