Function at 0x140003a20
Capabilities:
Create service
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140046030]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebp, ebp
mov r8d, 0xf003f
cmp ecx, 1
mov esi, ebp
setg sil
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140003a7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed___d__n
call fcn.140001190
jmp 0x140003afa
mov qword [rsp + 0x60], rbp
lea rax, str.c:psnotifypsnotify.sys
mov qword [rsp + 0x58], rbp
lea rdx, str.psnotify
mov qword [rsp + 0x50], rbp
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rbp
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x140003b3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed___d__n
call fcn.140001190
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Cannot_install__press_any_key_to_close
call fcn.140001190
mov r8, 0xffffffffffffffff
call fcn.140003db0
mov eax, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000bd90
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, str.reg_import_inst.reg
call fcn.140014788
lea rcx, str.Service_installed_successfully_n
call fcn.140001190
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.1400032b0
test eax, eax
jne 0x140003b7e
call fcn.1400038e0
lea rcx, str.Cannot_start_service__press_any_key_to_close
jmp 0x140003b01
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x40000080
lea rcx, str..psnotify
mov edx, 0xc0000000
mov dword [0x140046cb0], esi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140046c38], rax
cmp rax, 0xffffffffffffffff
jne 0x140003bd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.failed_to_open_driver__u_n
call fcn.140001190
jmp 0x140003b12
mov rdx, rax
lea rcx, str.opened_driver_0x_p_n
call fcn.140001190
lea rax, [0x140046c40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rcx, str.psnotifyPort
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
call qword [sym.imp.FLTLIB.DLL_FilterConnectCommunicationPort]
mov r8, qword [0x140046c40]
lea rcx, str.opened_port_as_0x_x__0x_p_n
mov edx, eax
mov ebx, eax
call fcn.140001190
test ebx, ebx
jne 0x140003b12
mov r9d, dword [0x140046c30]
xor r8d, r8d
mov rcx, qword [0x140046c40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [0x140046c48], rax
test rax, rax
jne 0x140003c6d
lea rcx, str.failed_to_make_completion_n
call fcn.140001190
mov rax, qword [0x140046c48]
test rax, rax
je 0x140003b12
mov edx, 1
lea rcx, [0x1400039c0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov ebx, dword [0x140046c30]
mov rcx, 0xffffffffffffffff
mov eax, 0x1040
mov qword [rsp + 0x70], rbx
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.14000c044
mov qword [rsp + 0x70], rax
mov rdi, rax
test rbx, rbx
je 0x140003ccf
lea rcx, [rax + 0x10]
nop word [rax + rax]
mov dword [rcx], ebp
lea rcx, [rcx + 0x1040]
sub rbx, 1
jne 0x140003cc0
mov eax, dword [0x140046c30]
xor edx, edx
imul r8, rax, 0x1040
mov rcx, rdi
mov qword [0x140046cb8], rdi
call fcn.14000e2c0
mov eax, dword [0x140046c30]
mov ebx, ebp
test eax, eax
je 0x140003d39
nop dword [rax]
mov rcx, qword [0x140046c40]
mov r8d, 0x1020
mov eax, ebx
imul rdx, rax, 0x1040
add rdx, rdi
lea r9, [rdx + 0x1020]
call qword [sym.imp.FLTLIB.DLL_FilterGetMessage]
cmp eax, 0x800703e5
jne 0x140003d92
mov eax, dword [0x140046c30]
inc ebx
cmp ebx, eax
jb 0x140003d00
mov ebx, ebp
test eax, eax
je 0x140003d74
nop
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], ebp
mov qword [rsp + 0x28], rax
lea r9, [0x140046c30]
lea r8, [0x1400027e0]
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
inc ebx
cmp ebx, dword [0x140046c30]
jb 0x140003d40
lea rcx, str.Waiting_for_messages._Press_Ctrl_C_to_exit_n
call fcn.140001190
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x140003b17
mov edx, eax
lea rcx, str.invalid_state_of_message_0x_x
call fcn.140001190
jmp 0x140003d74