Function at 0x140029780
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
jmp 0x140029780
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rbp + 0x48], rax
movzx r12d, cl
xor ebx, ebx
xor ecx, ecx
call fcn.1400022ca
cmp byte [0x14007ca62], bl
je 0x14002983e
call fcn.14000283d
cmp eax, 0x14
je 0x14002983e
call fcn.14000283d
cmp eax, 0x15
je 0x14002983e
call fcn.14000283d
cmp eax, 0x1e
je 0x14002983e
call fcn.14000283d
cmp eax, 0x28
je 0x14002983e
call fcn.14000283d
cmp eax, 0x32
je 0x14002983e
call fcn.14000283d
cmp eax, 0x33
je 0x14002983e
call fcn.14000283d
cmp eax, 0x3c
je 0x14002983e
call fcn.14000283d
cmp eax, 0x3d
je 0x14002983e
mov r9d, 0x1e9
lea r8, str.ServiceMain.cpp
lea rdx, str.EOSTYPE_IS_WIN_CSystemState::GetOSType___
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
call fcn.14000283d
cmp eax, 0x14
je 0x140029892
call fcn.14000283d
cmp eax, 0x15
je 0x140029892
call fcn.14000283d
cmp eax, 0x1e
je 0x140029892
call fcn.14000283d
cmp eax, 0x28
je 0x140029892
call fcn.14000283d
cmp eax, 0x32
je 0x140029892
call fcn.14000283d
cmp eax, 0x33
je 0x140029892
call fcn.14000283d
cmp eax, 0x3c
je 0x140029892
call fcn.14000283d
cmp eax, 0x3d
jne 0x140029cb1
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140003305
nop
mov r8, rax
lea rdx, [0x14006467c]
lea rcx, [rbp + 0x28]
call fcn.1400011c2
nop
lea r8, [0x14006467c]
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140002617
nop
cmp qword [rbp + 0x40], 8
jb 0x1400298d6
mov rcx, qword [rbp + 0x28]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x38], rbx
mov word [rbp + 0x28], bx
cmp qword [rbp - 0x40], 8
jb 0x1400298f6
mov rcx, qword [rbp - 0x58]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp - 0x40], 7
mov qword [rbp - 0x48], rbx
mov word [rbp - 0x58], bx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x140029ca1
mov edx, 5
mov r8d, 0x201
lea rcx, [rbp - 0x38]
call fcn.1400037f1
mov rdi, rax
mov edx, 4
mov r8d, 0x201
lea rcx, [rbp + 8]
call fcn.1400037f1
lea rcx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rcx, qword [rbp - 0x18]
cmp qword [rdi + 0x18], 8
jb 0x140029963
mov rdi, qword [rdi]
cmp qword [rax + 0x18], 8
jb 0x14002996d
mov rax, qword [rax]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
lea rdx, [0x1400624f4]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rbx
lea rdx, [0x140064680]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov r8, rdi
mov rdx, rax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
cmp qword [rbp + 0x20], 8
jb 0x1400299d9
mov rcx, qword [rbp + 8]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], rbx
mov word [rbp + 8], bx
cmp qword [rbp - 0x20], 8
jb 0x1400299f9
mov rcx, qword [rbp - 0x38]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], rbx
mov word [rbp - 0x38], bx
test r14, r14
je 0x140029c97
mov edx, 6
mov r8d, 0x201
lea rcx, [rbp - 0x78]
call fcn.1400037f1
mov rsi, rax
lea rdi, [0x14007c290]
cmp rdi, rax
je 0x140029a6f
cmp qword [0x14007c2a8], 8
jb 0x140029a4b
mov rcx, qword [0x14007c290]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [0x14007c2a8], 7
mov qword [0x14007c2a0], rbx
mov word [0x14007c290], bx
mov rdx, rsi
mov rcx, rdi
call fcn.140001d6b
cmp qword [rbp - 0x60], 8
jb 0x140029a7f
mov rcx, qword [rbp - 0x78]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
cmp qword [0x14007c2a8], 8
cmovae rdi, qword [0x14007c290]
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x70], ebx
mov edx, 0xb
mov r8d, 0x101
lea rcx, [rbp - 0x78]
call fcn.1400037f1
cmp qword [rax + 0x18], 8
jb 0x140029ace
mov rax, qword [rax]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp qword [rbp - 0x60], 8
jb 0x140029b1b
mov rcx, qword [rbp - 0x78]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test edi, edi
je 0x140029b38
cmp byte [0x14007ca60], 0
je 0x140029b43
mov edx, edi
lea rcx, str.Could_not_create_pen_param_key__d_n
call fcn.1400031a2
jmp 0x140029b43
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x70], ebx
mov edx, 0xb
mov r8d, 0x201
lea rcx, [rbp - 0x78]
call fcn.1400037f1
cmp qword [rax + 0x18], 8
jb 0x140029b6a
mov rax, qword [rax]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp qword [rbp - 0x60], 8
jb 0x140029bb7
mov rcx, qword [rbp - 0x78]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test edi, edi
je 0x140029bd4
cmp byte [0x14007ca60], 0
je 0x140029bdf
mov edx, edi
lea rcx, str.Could_not_create_pen_param_key__d_n
call fcn.1400031a2
jmp 0x140029bdf
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x70], ebx
mov edx, 0xa
lea r8d, [rdx - 9]
lea rcx, [rbp - 0x78]
call fcn.1400037f1
cmp qword [rax + 0x18], 8
jb 0x140029c04
mov rax, qword [rax]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp qword [rbp - 0x60], 8
jb 0x140029c51
mov rcx, qword [rbp - 0x78]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test edi, edi
je 0x140029c6e
cmp byte [0x14007ca60], 0
je 0x140029c79
mov edx, edi
lea rcx, str.Could_not_create_pen_param_key__d_n
call fcn.1400031a2
jmp 0x140029c79
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12b, r12b
je 0x140029c8e
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp qword [rbp], 8
jb 0x140029cb1
mov rcx, qword [rbp - 0x18]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, ebx
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.140052d40
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret