Function at 0x14003e680
Capabilities:
Create service
Delete service
Modify service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rdi, qword [rsp + 0xd8]
xor esi, esi
xor r14b, r14b
mov rbp, r9
mov r12, r8
mov rax, rdx
movzx ebx, cl
test rdi, rdi
je 0x14003e6c0
mov qword [rdi], rsi
mov edx, 1
mov rcx, rax
call fcn.140042350
mov edx, 1
mov rcx, r12
mov r15, rax
call fcn.140042350
mov rcx, qword [rsp + 0xd0]
mov edx, 1
mov r13, rax
call fcn.140042350
mov edx, 1
mov qword [rsp + 0xd8], rax
mov rcx, rbp
call fcn.140042350
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov r12, rax
call fcn.140024f70
mov rbp, rax
test rax, rax
jne 0x14003e763
test rdi, rdi
je 0x14003e835
call fcn.140013250
lea rdx, str.Could_not_open_SCManager:__s_n
mov r8, rax
xor ecx, ecx
call fcn.140030510
xor r8d, r8d
mov rcx, rax
mov rbx, rax
lea rdx, [r8 - 1]
call fcn.140042490
mov rcx, rbx
mov qword [rdi], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14003e835
mov rdx, r15
mov rcx, rbp
test bl, bl
je 0x14003e91f
mov rax, qword [rsp + 0xd8]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rsi
mov r8, r13
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x14003e81a
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x430
je 0x14003e804
cmp eax, 1
je 0x14003e7ee
test rdi, rdi
je 0x14003e835
call fcn.140013250
lea rdx, str.Could_not_create_service:__s_n
jmp 0x14003e736
test rdi, rdi
je 0x14003e835
lea rcx, str.Service_is_already_registered.
call fcn.140042340
mov qword [rdi], rax
jmp 0x14003e835
test rdi, rdi
je 0x14003e835
lea rcx, str.Could_not_register_service_because_it_is_currently_marked_for_deletion.
call fcn.140042340
mov qword [rdi], rax
jmp 0x14003e835
lea r8, [rsp + 0x70]
mov qword [rsp + 0x70], r12
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov r14b, 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r15
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r13
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rsp + 0xd8]
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, r12
mov edi, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], edi
test rsi, rsi
je 0x14003e8ec
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbp, rbp
je 0x14003e8fa
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r11, [rsp + 0x80]
movzx eax, r14b
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8d, 0x10000
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14003e96e
test rdi, rdi
je 0x14003e835
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x14003e95d
lea rcx, str.Service_is_not_registered.
call fcn.140042340
mov qword [rdi], rax
jmp 0x14003e835
call fcn.140013250
lea rdx, str.Could_not_open_service:__s_n
jmp 0x14003e736
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14003e832
test rdi, rdi
je 0x14003e835
call fcn.140013250
lea rdx, str.Could_not_delete_service:__s_n
jmp 0x14003e736