Function at 0x1400721cb
Capabilities:
Create service
Delete service
Get common file path
Query service status
Start service

Disassembly:
jmp 0x1400787b0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4a8
lea rbp, [rsp + 0x70]
lea rdi, [rsp + 0x70]
mov ecx, 0xae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4c8]
mov rax, qword [0x140194040]
xor rax, rbp
mov qword [rbp + 0x428], rax
lea rcx, [0x1401a60a8]
call fcn.14007411a
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14007882f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenSCManager_failed._Error_code:_0x_x._n
call fcn.1400711fe
xor eax, eax
jmp 0x140078a92
mov rax, qword [rbp + 0x450]
mov rdx, qword [rax]
lea rcx, str.___Creating_service:__ws._n
call fcn.1400711fe
mov r8d, 0xf01ff
mov rax, qword [rbp + 0x450]
mov rdx, qword [rax]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14007898e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____Creating_service_failed._Error_code:_0x_x._n
call fcn.1400711fe
lea rdx, [rbp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1400788e1
mov rax, qword [rbp + 0x450]
mov rdx, qword [rax + 8]
lea rcx, [rbp + 0x50]
call fcn.1400721d0
lea rcx, [rbp + 0x50]
call fcn.1400740fc
test eax, eax
jne 0x1400788cf
lea rdx, [rbp + 0x50]
lea rcx, str._t____File__ws_not_found._n
call fcn.1400711fe
xor eax, eax
jmp 0x140078a92
lea rdx, [rbp + 0x50]
lea rcx, str.___Full_path:__ws__n
call fcn.1400711fe
jmp 0x1400788f4
lea rcx, str._t____Error_getting_psCurrentProcessInfo_directory._n
call fcn.1400711fe
xor eax, eax
jmp 0x140078a92
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
mov rax, qword [rbp + 0x450]
mov r8, qword [rax]
mov rax, qword [rbp + 0x450]
mov rdx, qword [rax]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x14007898e
lea rcx, str._t____CreateService_failed._n
call fcn.1400711fe
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140078a92
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140078a6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____StartService_unsuccessful.
call fcn.140074610
lea rdx, [rbp + 0x278]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140078a03
cmp dword [rbp + 0x27c], 4
jne 0x140078a01
lea rcx, str._t____Service_is_already_running._n
call fcn.1400711fe
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140078a92
jmp 0x140078a27
lea rcx, str._t____QueryServiceStatus_failed._n
call fcn.1400711fe
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140078a92
lea rcx, str._t____StartService_failed._n
call fcn.1400711fe
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140078a55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____DeleteService_failed._Error_code:_0x_x._n
call fcn.1400711fe
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140078a92
lea rcx, str.___Driver_loaded_successfully_
call fcn.1400711fe
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x70]
lea rdx, [0x140160040]
call fcn.14007385a
mov rax, rdi
mov rcx, qword [rbp + 0x428]
xor rcx, rbp
call fcn.1400727e8
lea rsp, [rbp + 0x438]
pop rdi
pop rbp
ret