Function at 0x14000a8e0
Capabilities:
Create service
Enumerate processes
Persist via windows service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140086070]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r15, rcx
xor r12d, r12d
mov dword [rbp], r12d
mov r8d, 0x104
lea rdx, [rbp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x290]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x14000a950
call fcn.140025178
lea rcx, [rbp + 0x290]
mov qword [rbp], rcx
mov qword [rbp + 8], rbx
lea r8, [rbp]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.140003f90
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.140004610
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000a9cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a9c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b0ae
call fcn.140026a10
movdqa xmm0, xmmword [0x14007d250]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r12w
call fcn.140025178
lea rcx, str.wsc_proxy.exe
mov qword [rbp], rcx
mov qword [rbp + 8], 0xd
lea r8, [rbp]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140003f90
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x28]
call fcn.1400041d0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000aa56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aa51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b0b4
call fcn.140026a10
lea rdx, str._loading_the_wsc_proxy
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
lea rsi, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x38]
call fcn.140025178
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14007d260]
movdqu xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], 0
mov dword [rbp], 0x23e
test rdi, rdi
je 0x14000ab2d
cmp rdi, 0x7fffffff
ja 0x14000b0ba
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.1400251e8
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000b0c0
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x70]
call fcn.140011640
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r9, qword [rsp + 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.1400251e8
shr rax, 0x20
test eax, eax
jne 0x14000b0c8
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rax, qword [rsp + 0x70]
mov qword [rbp], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp + 8], rax
movups xmm0, xmmword [rbp]
movups xmmword [rbp - 0x38], xmm0
movabs rax, 0xc000000000000000
mov qword [rbp - 0x40], rax
mov qword [rbp], 1
lea rax, [rbp - 0x40]
mov qword [rbp + 8], rax
lea rax, str.____runassvc__rpcserver
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0x19
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
movaps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm1
lea r8, [rbp]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.140019830
mov esi, 0x5fe
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rax, qword [rbp - 0x60]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, str.wsc_proxy
lea rdx, str.wsc_proxy
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x14000ac2e
mov r8d, 0xf01ff
lea rdx, str.wsc_proxy
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rbx, rbx
je 0x14000ac67
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x14000ac52
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x14000ac67
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rbx
mov byte [rbp + 0x20], 1
jmp 0x14000ac6b
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000aca6
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aca1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b0d0
call fcn.140026a10
movdqa xmm0, xmmword [0x14007d260]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14000acf3
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000acee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b0d6
call fcn.140026a10
movdqa xmm0, xmmword [0x14007d260]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
cmp byte [rbp + 0x20], 0
je 0x14000b0dc
lea rdx, str._waiting_for_wsc_proxy__this_could_take_some_time_
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
movabs r13, 0x7fffffffffffffff
movabs r14, 0x311cdad160000
movabs r15, 0x112e0be826d694b3
movsd xmm6, qword [0x14007d248]
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x38]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.1400040e0
cmp rax, r11
je 0x14000adae
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000ad85
cmp cx, 0x2f
jne 0x14000ad8e
add rax, 2
cmp rax, r11
jne 0x14000ad76
cmp rax, r11
je 0x14000adae
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14000adae
cmp cx, 0x2f
je 0x14000adae
mov r10, rdx
cmp rax, rdx
jne 0x14000ad93
mov qword [rbp - 0x70], r10
sub r11, r10
sar r11, 1
mov qword [rbp - 0x68], r11
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.140018a30
or esi, 1
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400044d0
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x14000ade6
mov rdi, qword [rax]
mov qword [rbp + 0x50], 0x238
mov dword [rbp + 0x58], r12d
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], r12
mov dword [rbp + 0x78], r12d
xor edx, edx
mov r8d, 0x20c
lea rcx, [rbp + 0x7c]
call fcn.140028f70
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000ae7b
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000ae7b
lea rax, [rbp + 0x7c]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ae64
add rax, 2
test ecx, ecx
jne 0x14000ae50
test edx, edx
jne 0x14000ae32
test rbx, rbx
je 0x14000ae77
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov bl, 1
jmp 0x14000ae8c
test rbx, rbx
je 0x14000ae8a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor bl, bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000aecc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b0fd
call fcn.140026a10
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14000af1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b103
call fcn.140026a10
test bl, bl
je 0x14000b024
call fcn.1400255d4
mov rbx, rax
call fcn.1400255b8
cmp rbx, 0x989680
jne 0x14000af41
imul rax, rax, 0x64
jmp 0x14000af5f
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7fffffffc46535fe
cmp rax, rcx
lea rdi, [rax + 0x3b9aca00]
jle 0x14000af78
mov rdi, r13
call fcn.1400255d4
mov rbx, rax
call fcn.1400255b8
cmp rbx, 0x989680
jne 0x14000af94
imul rbx, rax, 0x64
jmp 0x14000afb5
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rdi, rbx
je 0x14000ad50
jl 0x14000ad50
call fcn.1400256cc
imul rcx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x14000afea
mov rax, r14
lea r8, [rcx + r14]
jmp 0x14000afee
lea r8, [rcx + rax]
add rcx, rax
mov rax, r15
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp], rdx
imul eax, edx, 0x3b9aca00
sub r8d, eax
mov dword [rbp + 8], r8d
lea rcx, [rbp]
call fcn.14002644c
jmp 0x14000af78
cmp byte [rbp + 0x20], 0
je 0x14000b037
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14000b037
call qword [rbp + 0x10]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x14000b073
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b06e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b0a8
call fcn.140026a10
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400269f0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400317c4
nop
call fcn.1400317c4
nop
call fcn.1400317c4
nop
call fcn.140003250
int3
mov ecx, eax
call fcn.140003f50
int3
mov ecx, eax
call fcn.140003f50
nop
call fcn.1400317c4
nop
call fcn.1400317c4
int3
lea rdx, str.unable_to_load_wsc_proxy
lea rcx, [rbp - 0x40]
call fcn.140002e20
lea rdx, [0x140084d20]
lea rcx, [rbp - 0x40]
call fcn.1400287c8
nop
call fcn.1400317c4
nop
call fcn.1400317c4
int3