Function at 0x14003a3b7
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push rbp
push r15
mov rax, 0x10
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14003a3c1
sub rsp, 0x28
call fcn.140061030
mov rdx, rsp
mov rcx, 0xca
call fcn.140061f60
mov rcx, 0x117
call fcn.14004f5b3
mov rcx, 0x119
call fcn.14004f5b3
movsxd r15, dword [rsp + 0x50]
movsxd rax, dword [rsp + 0x50]
imul r15, rax
mov rax, r15
push rax
pop rax
mov dword [rsp + 0x50], eax
mov rcx, 0x11a
call fcn.14004f5b3
mov rax, 0x30
mov rax, rax
push rax
pop rcx
call fcn.1400085ce
mov rcx, 0x11a
call fcn.14004f795
mov rcx, 0x11b
call fcn.14004f5b3
movsxd r15, dword [0x1400ee584]
cmp r15, 2
jle 0x14003a575
mov rcx, 0x11c
call fcn.14004f5b3
push 1
movsxd rax, dword [0x1400ee584]
mov rax, rax
push rax
pop rcx
pop rdx
movabs r10, 0x1400537b0
mov r11, 0
call fcn.14004f7b3
call fcn.1400538f0
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x28], eax
mov rcx, 0x11d
call fcn.14004f5b3
movsxd r15, dword [rsp + 0x28]
mov rax, r15
mov rdx, qword [0x1400d5108]
mov rdx, qword [rdx - 0x10]
call fcn.14004f6ee
mov rbp, qword [0x1400d5108]
imul r15, r15, 0x18
add rbp, r15
call fcn.14004f6cb
mov rcx, qword [rbp + 8]
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140061170
mov rcx, 0x11e
call fcn.14004f5b3
movsxd r15, dword [rsp + 0x28]
mov rax, r15
mov rdx, qword [0x1400d5108]
mov rdx, qword [rdx - 0x10]
call fcn.14004f6ee
mov rbp, qword [0x1400d5108]
imul r15, r15, 0x18
add rbp, r15
call fcn.14004f6cb
mov rcx, qword [rbp + 0x10]
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.140061170
mov rcx, 0x11f
call fcn.14004f5b3
jmp 0x14003a5c1
mov rcx, 0x11f
call fcn.14004f5b3
mov rcx, 0x120
call fcn.14004f5b3
movabs rdx, str.Health_Key_Authentication_Protocol
lea rcx, [rsp + 0x38]
call fcn.140060ea0
mov rcx, 0x121
call fcn.14004f5b3
movabs rdx, str.Authentication_Protocol__EAP__service_provides_network_authentication_in_such_scenarios_as_802.1x_wired_and_wireless__VPN__and_Network_Access_Protection__NAP_.__EAP_also_provides_application_programming_interfaces__APIs__that_are_used_by_network_access_clients__including_wireless_and_VPN_clients__during_the_authentication_process.__If_you_disable_this_service__this_computer_is_prevented_from_accessing_networks_that_require_EAP_authentication.
lea rcx, [rsp + 0x40]
call fcn.140060ea0
mov rcx, 0x122
call fcn.14004f5b3
mov rcx, 0x127
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
movabs r10, 0x1400529d8
mov r11, 0
call fcn.14004f7b3
call fcn.140052fc8
add rsp, 0x20
push rax
call fcn.1400610d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140052540
add rsp, 0x20
push rax
call fcn.1400610d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x1400516b0
mov r11, 0
call fcn.14004f7b3
call fcn.1400516c0
add rsp, 0x28
lea rcx, [rsp + 0x80]
pop rdx
call fcn.140061170
mov rcx, 0x128
call fcn.14004f5b3
push qword [rsp + 0x78]
movabs rcx, 0x1400d5206
pop rdx
call fcn.140061250
or rax, rax
jne 0x14003a7a2
mov rcx, 0x129
call fcn.14004f5b3
mov rcx, qword [rsp + 0x78]
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
lea rcx, [0x1400ee4f8]
pop rdx
call fcn.140061170
mov rcx, 0x12a
call fcn.14004f5b3
mov rax, qword [0x1400ee4f8]
mov rax, rax
push rax
lea rbp, [rsp + 0x60]
call fcn.14004f6cb
pop rax
mov qword [rbp], rax
mov rcx, 0x12b
call fcn.14004f5b3
lea rax, [0x140047b37]
mov rax, rax
push rax
call fcn.14004f6cb
pop rax
mov qword [rbp + 8], rax
mov rcx, 0x12c
call fcn.14004f5b3
lea rax, [rsp + 0x58]
mov rax, rax
push rax
pop rcx
call sub.ADVAPI32.DLL_StartServiceCtrlDispatcherW
mov rcx, 0x12c
call fcn.14004f795
mov rcx, 0x12d
call fcn.14004f5b3
jmp 0x14003b28d
mov rcx, 0x12d
call fcn.14004f5b3
mov rcx, 0x12e
call fcn.14004f5b3
call fcn.140027611
mov rcx, 0x12e
call fcn.14004f795
mov rcx, 0x12f
call fcn.14004f5b3
mov dword [rsp + 0x48], 0
mov rcx, 0x130
call fcn.14004f5b3
mov rcx, 0x131
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14003b8ee
add rsp, 0x28
mov rcx, 0x131
call fcn.14004f795
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140006a9a
add rsp, 0x30
mov rcx, 0x131
call fcn.14004f795
pop rax
lea rcx, [rsp + 0x78]
pop rdx
call fcn.140061170
mov rcx, 0x132
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push qword [rsp + 0x80]
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140052db4
add rsp, 0x20
push rax
call fcn.1400610d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x14005861c
mov r11, 0
call fcn.14004f7b3
call fcn.1400594cc
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004f864
add rsp, 0x28
pop rax
and rax, rax
je 0x14003a924
mov rcx, 0x133
call fcn.14004f5b3
jmp 0x14003a995
mov rcx, 0x134
call fcn.14004f5b3
mov rcx, 0x136
call fcn.14004f5b3
movsxd r15, dword [rsp + 0x48]
inc r15
mov rax, r15
push rax
pop rax
mov dword [rsp + 0x48], eax
mov rcx, 0x137
call fcn.14004f5b3
movsxd r15, dword [rsp + 0x48]
cmp r15, 0xc8
jle 0x14003a978
mov rcx, 0x138
call fcn.14004f5b3
jmp 0x14000168a
mov rcx, 0x139
call fcn.14004f5b3
mov rcx, 0x13a
call fcn.14004f5b3
jmp 0x14003a7df
mov rcx, 0x13b
call fcn.14004f5b3
push qword [rsp + 0x70]
pop rcx
call fcn.140025c3a
mov rcx, 0x13b
call fcn.14004f795
mov rcx, 0x13d
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14003b8ee
add rsp, 0x30
mov rcx, 0x13d
call fcn.14004f795
movabs rcx, str.ntdll.dll
sub rsp, 0x20
call fcn.1400612e0
add rsp, 0x20
push rax
call fcn.1400610d0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x140058900
mov r11, 0
call fcn.14004f7b3
call fcn.1400594f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004f864
add rsp, 0x28
pop rax
mov qword [rsp + 0x80], rax
mov rcx, 0x13e
call fcn.14004f5b3
mov r15, qword [rsp + 0x80]
and r15, r15
jne 0x14003aac5
mov rcx, 0x13f
call fcn.14004f5b3
movabs rax, str.2018_4_12_07:34:22
push rax
movabs rax, str._yyyy__mm__dd__hh:_ii:_ss
push rax
pop rcx
pop rdx
call fcn.14005c19c
mov qword [rsp + 0x80], rax
mov rcx, 0x140
call fcn.14004f5b3
mov rcx, 0x141
call fcn.14004f5b3
push qword [rsp + 0x80]
push 0
push qword [rsp + 0x80]
pop rcx
pop rdx
pop r8
movabs r10, 0x1400589f4
mov r11, 0
call fcn.14004f7b3
call fcn.1400595cc
mov rcx, 0x142
call fcn.14004f5b3
push qword [rsp + 0x80]
push 1
push qword [rsp + 0x80]
pop rcx
pop rdx
pop r8
movabs r10, 0x1400589f4
mov r11, 0
call fcn.14004f7b3
call fcn.1400595cc
mov rcx, 0x143
call fcn.14004f5b3
push qword [rsp + 0x80]
push 2
push qword [rsp + 0x80]
pop rcx
pop rdx
pop r8
movabs r10, 0x1400589f4
mov r11, 0
call fcn.14004f7b3
call fcn.1400595cc
mov rcx, 0x145
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140046254
add rsp, 0x28
mov rcx, 0x145
call fcn.14004f795
lea rcx, [0x1400ee4f8]
pop rdx
call fcn.140061170
mov rcx, 0x146
call fcn.14004f5b3
mov rcx, qword [rsp + 0x70]
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
movabs rcx, 0x1400d52d0
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
mov rcx, qword [0x1400ee4f8]
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
lea rcx, [rsp + 0x78]
pop rdx
call fcn.140061170
mov rcx, 0x147
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push qword [0x1400ee4f8]
mov rcx, qword [rsp]
sub rsp, 0x20
call fcn.140062520
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004f864
add rsp, 0x28
pop rax
mov rcx, 0x148
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x40]
mov rcx, qword [rsp]
sub rsp, 0x20
call fcn.140062520
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004f864
add rsp, 0x28
pop rax
mov rcx, 0x149
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x48]
mov rcx, qword [rsp]
sub rsp, 0x20
call fcn.140062520
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004f864
add rsp, 0x28
pop rax
mov rcx, 0x14b
call fcn.14004f5b3
push 2
push 0
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_OpenSCManagerW
mov rcx, 0x14b
call fcn.14004f795
mov qword [rsp + 0x88], rax
mov rcx, 0x14c
call fcn.14004f5b3
cmp qword [rsp + 0x88], 0
je 0x14003aeae
mov rcx, 0x14d
call fcn.14004f5b3
sub rsp, 8
push 0
push 0
push 0
push 0
push 0
mov rax, qword [rsp + 0xa0]
mov rax, rax
push rax
push 1
push 2
push 0x10
push 0xf01ff
mov rax, qword [rsp + 0x90]
mov rax, rax
push rax
mov rax, qword [0x1400ee4f8]
mov rax, rax
push rax
push qword [rsp + 0xf0]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.DLL_CreateServiceW
add rsp, 0x70
mov rcx, 0x14d
call fcn.14004f795
mov qword [rsp + 0x90], rax
mov rcx, 0x14e
call fcn.14004f5b3
cmp qword [rsp + 0x90], 0
je 0x14003ae7d
mov rcx, 0x14f
call fcn.14004f5b3
mov rax, qword [rsp + 0x40]
mov rax, rax
push rax
lea rbp, [rsp + 0x70]
call fcn.14004f6cb
pop rax
mov qword [rbp], rax
mov rcx, 0x150
call fcn.14004f5b3
lea rax, [rsp + 0x68]
mov rax, rax
push rax
push 1
push qword [rsp + 0xa0]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_ChangeServiceConfig2W
mov rcx, 0x150
call fcn.14004f795
mov rcx, 0x151
call fcn.14004f5b3
push qword [rsp + 0x90]
pop rcx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov rcx, 0x151
call fcn.14004f795
mov rcx, 0x152
call fcn.14004f5b3
mov rcx, 0x153
call fcn.14004f5b3
push qword [rsp + 0x88]
pop rcx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov rcx, 0x153
call fcn.14004f795
mov rcx, 0x154
call fcn.14004f5b3
mov rcx, 0x156
call fcn.14004f5b3
push 2
push 0
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_OpenSCManagerW
mov rcx, 0x156
call fcn.14004f795
mov qword [rsp + 0x88], rax
mov rcx, 0x157
call fcn.14004f5b3
cmp qword [rsp + 0x88], 0
je 0x14003afec
mov rcx, 0x158
call fcn.14004f5b3
push 0xf01ff
mov rax, qword [0x1400ee4f8]
mov rax, rax
push rax
push qword [rsp + 0x98]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_OpenServiceW
mov rcx, 0x158
call fcn.14004f795
mov qword [rsp + 0x90], rax
mov rcx, 0x159
call fcn.14004f5b3
cmp qword [rsp + 0x90], 0
je 0x14003afbb
mov rcx, 0x15a
call fcn.14004f5b3
push 0
push 0
push qword [rsp + 0xa0]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.DLL_StartServiceW
mov rcx, 0x15a
call fcn.14004f795
mov rcx, 0x15b
call fcn.14004f5b3
push qword [rsp + 0x90]
pop rcx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov rcx, 0x15b
call fcn.14004f795
mov rcx, 0x15c
call fcn.14004f5b3
mov rcx, 0x15d
call fcn.14004f5b3
push qword [rsp + 0x88]
pop rcx
call sub.ADVAPI32.DLL_CloseServiceHandle
mov rcx, 0x15d
call fcn.14004f795
mov rcx, 0x15e
call fcn.14004f5b3
mov rcx, 0x161
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14003b8ee
add rsp, 0x28
mov rcx, 0x161
call fcn.14004f795
movabs rcx, str.wostmp_
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
lea rcx, [rsp + 0xa0]
pop rdx
call fcn.140061170
mov rcx, 0x162
call fcn.14004f5b3
push qword [rsp + 0x98]
pop rcx
movabs r10, 0x140058620
mov r11, 0
call fcn.14004f7b3
call fcn.140058fec
mov rcx, 0x163
call fcn.14004f5b3
push qword [rsp + 0x98]
pop rcx
call fcn.140017970
mov rcx, 0x163
call fcn.14004f795
mov rcx, 0x164
call fcn.14004f5b3
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0xa8]
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
movabs rcx, 0x1400d53e6
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
sub rsp, 8
push 1
push 0x7fffffff
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x1400537b0
mov r11, 0
call fcn.14004f7b3
call fcn.1400538f0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
pop rdx
sub rsp, 0x20
call fcn.140052210
add rsp, 0x20
pop rax
movabs rcx, 0x1400d53e6
sub rsp, 0x28
call fcn.1400612e0
add rsp, 0x28
sub rsp, 8
push 1
push 0x7fffffff
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x1400537b0
mov r11, 0
call fcn.14004f7b3
call fcn.1400538f0
add rsp, 0x28
mov rax, rax
push rax
pop rcx
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
pop rdx
sub rsp, 0x20
call fcn.140052210
add rsp, 0x20
pop rax
call fcn.1400613d0
push rcx
sub rsp, 0x20
call fcn.140060f90
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140060f90
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140052db4
add rsp, 0x20
push rax
call fcn.1400610d0
mov rdx, rax
pop rax
add qword [rsp], rdx
push rax
call fcn.1400610d0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
movabs r10, 0x1400589f0
mov r11, 0
call fcn.14004f7b3
call fcn.1400596e8
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14004f864
add rsp, 0x28
pop rax
mov rcx, 0x165
call fcn.14004f5b3
jmp 0x14000168a
mov rcx, 0x166
call fcn.14004f5b3
mov rcx, 0x167
call fcn.14004f5b3
xor rax, rax
push rax
push rax
sub rsp, 0x20
call fcn.1400621b0
add rsp, 0x20
pop rax
mov rcx, qword [rsp + 0x80]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
mov rcx, qword [rsp + 0xa0]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
mov rcx, qword [rsp + 0x78]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.1400612b0
add rsp, 0x28
pop rax
add rsp, 0xa8
pop r15
pop rbp
ret