Function at 0x1400abf90
Capabilities:
Create service
Delete service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x140263a80]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov ecx, 0x168
mov rsi, rdx
call fcn.1401d0330
mov rbx, rax
mov qword [rsp + 0x90], rax
call fcn.140094a30
xor ebp, ebp
mov rdi, rax
mov qword [rbx + 0x140], rbp
xorps xmm0, xmm0
mov qword [rbx + 0x148], rbp
xor eax, eax
mov qword [rbx + 0x150], rbp
xor edx, edx
mov qword [rbx + 0x158], rbp
mov r8d, 0x100
mov dword [rbx + 0x160], ebp
mov rcx, rbx
movups xmmword [rbx + 0x100], xmm0
mov dword [rbx + 0x110], eax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 0x118]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test rdi, rdi
je 0x1400ac041
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
jmp 0x1400ac063
xor edx, edx
mov r8d, 0x100
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov rcx, qword [rsi + 8]
lea rdx, str.install
mov qword [0x140268478], rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400ac19a
call fcn.14008bc20
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400ac0bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cannot_install_service___d__n
call fcn.140088780
jmp 0x1400ac28b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x1400ac0ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed___d__n
call fcn.140088780
jmp 0x1400ac28b
lea rax, [0x140247e3c]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov rcx, rbx
mov qword [rsp + 0x58], rbp
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
lea rax, [0x140248610]
mov dword [rsp + 0x30], 1
mov r8, rax
mov rdx, rax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x1400ac177
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed___d__n
call fcn.140088780
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ac28b
lea rcx, str.Service_installed_successfully_n
call fcn.140088780
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ac28b
mov rcx, qword [rsi + 8]
lea rdx, str.uninstall
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400ac243
call fcn.14008c070
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x1400ac0d3
mov r8d, 0x10000
lea rdx, [0x140248610]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400ac211
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed___d__n
call fcn.140088780
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400ac28b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400ac237
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed___d__n
call fcn.140088780
jmp 0x1400ac183
lea rcx, str.Service_deleted_successfully_n
jmp 0x1400ac17e
call fcn.14008b7d0
lea rax, [0x140248610]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
lea rax, [0x1400ac2c0]
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x78], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x1400ac28b
lea rcx, str.StartServiceCtrlDispatcher
call fcn.1400ac620
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1401d0310
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret