Function at 0x1400758b0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Modify service

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140075919
lea rdx, [0x140416624]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x140075900
mov r8d, eax
mov rcx, r13
call fcn.140007ea0
jmp 0x140075b7f
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
jne 0x14007595b
lea rdx, [0x140416628]
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140075942
mov r8d, eax
mov rcx, r13
call fcn.140007ea0
jmp 0x140075b7f
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x140075e68
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x40], rax
mov dword [rsp + 0x5e], 0x650074
mov dword [rbp - 0x70], 0x6d0072
mov dword [rsp + 0x68], 0x730020
mov dword [rsp + 0x7e], 0x650020
mov dword [rsp + 0x58], 0x650072
mov dword [rbp - 0x56], 0x250022
mov dword [rsp + 0x70], 0x740072
mov edi, 0x61
mov dword [rsp + 0x76], 0x750061
mov dword [rsp + 0x64], 0x730025
mov dword [rsp + 0x6c], 0x610074
mov dword [rbp - 0x5c], 0x680074
mov dword [rbp - 0x74], 0x6f006e
mov dword [rbp - 0x64], 0x6e0069
lea r11d, [rdi + 0xe]
mov dword [rbp - 0x52], 0x220073
mov dword [rsp + 0x54], 0x630020
mov dword [rbp - 0x6c], 0x6c0061
mov r9d, 0x3d
mov word [rsp + 0x74], r9w
mov word [rsp + 0x5c], di
lea ecx, [rdi - 0x41]
mov dword [rsp + 0x7a], 0x6f0074
mov dword [rbp - 0x68], 0x620020
mov dword [rsp + 0x50], 0x630073
xor eax, eax
mov word [rbp - 0x4e], ax
mov dword [rbp - 0x7e], 0x720072
mov dword [rbp - 0x78], 0x3d0072
lea r13d, [rdi + 0xb]
mov dword [rbp - 0x60], 0x610070
mov word [rsp + 0x62], cx
mov word [rbp - 0x7a], r11w
mov word [rbp - 0x58], r9w
mov r9, qword [r12]
mov r8, qword [rsi]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x40]
call fcn.140008c18
xor r12d, r12d
mov edi, r12d
lea r9d, [r13 - 0x21]
mov rbx, qword [rbp - 0x40]
nop dword [rax + rax]
mov dword [rbp + 0x98], 0x456e6957
mov dword [rbp + 0x9c], 0x636578
mov dword [rsp + 0x2a], 0x720065
mov dword [rsp + 0x30], 0x6c0065
mov dword [rsp + 0x38], 0x64002e
mov dword [rsp + 0x3e], r13d
mov ecx, WSASetLastError
mov word [rsp + 0x2e], cx
mov word [rsp + 0x3c], r13w
mov dword [rsp + 0x34], 0x320033
mov word [rsp + 0x28], r9w
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140075af6
xor edx, edx
mov rcx, rbx
call rax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0xf01ff
mov rdx, qword [rsi]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
jne 0x140075b2a
inc edi
cmp edi, 5
lea r9d, [rax + 0x4b]
jl 0x140075a80
lea rdx, [rbx - 0x18]
mov rdi, 0xffffffffffffffff
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
mov r12, qword [rbp + 0x88]
mov r13, qword [rbp + 0x90]
jg 0x140075b58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r14, r14
jne 0x140075bcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14041662c]
mov rcx, r13
call fcn.140008c60
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140075b9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140075bb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor al, al
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, 0x9f
lea rcx, [rbp - 0x18]
call fcn.1400177a0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x140075be8
mov rbx, qword [rax]
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x140075e73
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140007020
test al, al
jne 0x140075c4b
test rbx, rbx
jne 0x140075c24
xor ecx, ecx
mov eax, ecx
jmp 0x140075c3a
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140075c30
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140008250
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140075c8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075c86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140075e57
call fcn.140133e68
xor eax, eax
mov qword [rbp - 8], rax
mov qword [rbp], 7
mov word [rbp - 0x18], ax
mov rbx, qword [rsp + 0x20]
cmp dword [rbx - 8], 1
jle 0x140075cba
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.1400088a8
mov rbx, qword [rsp + 0x20]
mov qword [rbp - 0x20], rbx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140173a1c
test eax, eax
js 0x140075e5d
cmp eax, dword [rbx - 0xc]
jg 0x140075e5d
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
lea r8, [rbp - 0x20]
lea edx, [rcx + 1]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r14b, r14b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x140075de2
mov r8d, 0xf01ff
mov rdx, qword [rsi]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x140075dbc
mov dword [rbp + 8], 1
xor eax, eax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x20], 3
lea rax, [rbp - 0x38]
mov qword [rbp + 0x28], rax
mov dword [rbp - 0x38], 1
mov dword [rbp - 0x34], 0x64
mov dword [rbp - 0x30], 1
mov dword [rbp - 0x2c], 0x64
mov dword [rbp - 0x28], 1
mov dword [rbp - 0x24], 0x64
lea r8, [rbp + 8]
mov edx, 2
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, r14
call fcn.140075120
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14b, 1
jmp 0x140075dfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140416634]
mov rcx, r13
call fcn.140008c60
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r14b, r14b
jmp 0x140075dfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14041663c]
mov rcx, r13
call fcn.140008c60
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140075e15
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140075e32
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140075e4e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, r14b
jmp 0x140075bb9
call fcn.1401462a8
int3
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3