Function at 0x1400c5500
Capabilities:
Create service
Start service

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x12df0
call fcn.1400fd8d0
sub rsp, rax
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x12e28], rbx
mov qword [rsp + 0x12e30], rbp
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x12de0], rax
mov r12, r9
mov rbp, rcx
mov rbx, qword [rsp + 0x12e40]
mov rax, qword [rcx]
call qword [rax + 0x20]
cmp eax, 0x2210101
je 0x1400c5566
xor al, al
jmp 0x1400c5a59
xor esi, esi
cmp r12, rsi
jne 0x1400c5571
mov eax, esi
jmp 0x1400c5579
mov rcx, r12
call fcn.1400e1d50
mov r8d, eax
mov rdx, r12
lea rcx, [rbp + 0xc0]
call fcn.1400a779c
mov r13d, 4
mov r8, r13
lea rdx, str.._
mov rcx, rbx
call fcn.1400e3e4c
cmp eax, esi
je 0x1400c55bf
lea rcx, [rbp + 0xc8]
mov r8, rbx
lea rdx, str.._s
call fcn.1400a8b84
jmp 0x1400c55e2
cmp rbx, rsi
jne 0x1400c55c8
mov eax, esi
jmp 0x1400c55d0
mov rcx, rbx
call fcn.1400e1d50
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0xc8]
call fcn.1400a779c
mov rcx, rbp
call fcn.1400c4c2c
cmp al, sil
je 0x1400c568e
mov dword [rsp + 0x74], esi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x7c], esi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x74]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rsp + 0x7c]
mov edx, 0x222014
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x74]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rsp + 0x7c]
mov edx, 0x222018
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r11, qword [rbp]
mov edx, 0x2210103
mov rcx, rbp
call qword [r11 + 0x28]
mov rcx, rbp
call fcn.1400c5100
mov al, 1
jmp 0x1400c5a59
lea rcx, [rsp + 0xb0]
call fcn.1400cc9ec
nop
lea rcx, [rsp + 0x240]
call fcn.1400a70a8
nop
lea rcx, [rsp + 0x360]
call fcn.1400bfd08
nop
mov r13b, sil
lea rcx, [rsp + 0xb0]
call fcn.1400cc990
call fcn.1400c47dc
mov ebx, eax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
cmp rax, rsi
jne 0x1400c5705
lea rcx, [rsp + 0x360]
call fcn.1400c02c0
nop
lea rcx, [rsp + 0x240]
call fcn.1400a71cc
nop
jmp 0x1400c5a49
cmp ebx, esi
je 0x1400c576b
lea rdx, [0x14010a708]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x104
lea rcx, [rsp + 0x12cd0]
call rax
lea r8, [rsp + 0x12cd0]
lea rdx, str._sSystem32
lea rcx, [rsp + 0x12bc0]
call qword [sym.imp.USER32.dll_wsprintfA]
mov r13b, 1
lea rcx, [rbp + 0xd0]
mov r9, r12
lea r8, [rsp + 0x12bc0]
lea rdx, str._sDrivers_s.sys
call fcn.1400a8b84
jmp 0x1400c58f8
mov qword [rsp + 0x28], rsi
lea r9, str.VE2DATA
mov qword [rsp + 0x20], r9
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0xb0]
call fcn.1400cc5f8
cmp eax, esi
je 0x1400c58f8
lea rcx, [rsp + 0xb8]
call fcn.1400a71b0
mov rdx, rax
lea rcx, [rsp + 0x360]
call fcn.1400c02a0
add eax, 0x1fa0
mov dword [rsp + 0x70], eax
mov r8d, eax
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.1400a70dc
cmp al, sil
je 0x1400c58eb
lea rcx, [rsp + 0xb8]
call fcn.1400a71b0
mov rdi, rax
lea rcx, [rsp + 0x240]
call fcn.1400a71b0
mov rbx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400cc3bc
mov r8d, eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rdx, rdi
lea rcx, [rsp + 0x360]
call fcn.1400c0474
cmp al, sil
je 0x1400c58eb
lea rcx, [rsp + 0x80]
call fcn.1400d2584
nop
lea rdx, [0x14010a6c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0x104
lea rcx, [rsp + 0x12bc0]
call rax
mov r9, r12
lea r8, [rsp + 0x12bc0]
lea rdx, str._sDrivers_s.sys
lea rcx, [rbp + 0xd0]
call fcn.1400a8b84
xor r9d, r9d
mov r8d, 0x1001
mov rdx, qword [rbp + 0xd0]
lea rcx, [rsp + 0x80]
call fcn.1400d2d04
cmp eax, esi
je 0x1400c58de
lea rcx, [rsp + 0x240]
call fcn.1400a71b0
mov rdx, rax
mov r8d, dword [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.1400d2204
movsxd rdx, dword [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.1400d23e4
lea rcx, [rsp + 0x80]
call fcn.1400d24fc
mov r13b, 1
lea rcx, [rsp + 0x80]
call fcn.1400d27cc
lea rcx, [rsp + 0xb0]
call fcn.1400cc990
mov rcx, qword [rbp + 0xa8]
cmp rcx, rsi
je 0x1400c590a
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.1400a701c
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call rax
mov qword [rbp + 0xa8], rax
cmp r13b, sil
je 0x1400c5a0b
mov r8d, 0x80000000
mov rdx, r12
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rbp + 0xb8], rax
cmp rax, rsi
jne 0x1400c59a6
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov r8, r12
mov rdx, r12
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [rbp + 0xb8], rax
mov rcx, qword [rbp + 0xb8]
cmp rcx, rsi
je 0x1400c5a0b
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp + 0xb8], rsi
mov r8d, 0x10014
mov rdx, r12
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rbp + 0xb8], rax
cmp rax, rsi
je 0x1400c5a01
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov r11, qword [rbp]
mov edx, 0x2210102
mov rcx, rbp
call qword [r11 + 0x28]
jmp 0x1400c5a1a
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400c5a1a
mov rax, qword [rbp]
mov edx, 0x2210104
mov rcx, rbp
call qword [rax + 0x28]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
cmp eax, 0x2210101
setne sil
lea rcx, [rsp + 0x360]
call fcn.1400c02c0
nop
lea rcx, [rsp + 0x240]
call fcn.1400a71cc
nop
lea rcx, [rsp + 0xb0]
call fcn.1400ccbfc
mov al, sil
mov rcx, qword [rsp + 0x12de0]
xor rcx, rsp
call fcn.1400e2890
lea r11, [rsp + 0x12df0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret