Function at 0x140076e90
Capabilities:
Create service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0xa90
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0xa80], rax
xor esi, esi
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov edi, esi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea ebp, [rsi + 1]
lea r14, [0x14017e6c8]
mov rbx, rax
test rax, rax
je 0x140076f17
mov r8d, ebp
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140076f03
mov rcx, rax
mov edi, ebp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x140076f17
mov eax, ebp
jmp 0x140077002
mov ebx, 0x104
lea rdx, [rsp + 0x72]
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140077000
cmp eax, ebx
je 0x140077000
lea ecx, [rax + 1]
mov edi, 0x22
mov word [rsp + 0x70], di
mov word [rsp + rcx*2 + 0x70], di
lea ecx, [rax + 2]
add rcx, rcx
cmp rcx, 0x20c
jae 0x14007711c
mov word [rsp + rcx + 0x70], si
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140077030
lea rdx, [rsp + 0x280]
mov ecx, 0xd80a
call fcn.1400776e0
test eax, eax
jne 0x140076fea
lea r8, [0x140006ff0]
lea rcx, [rsp + 0x280]
mov edx, 0x400
call qword [sym.imp.msvcrt.dll_wcscpy_s]
test eax, eax
je 0x140076fea
cmp eax, 0xc
je 0x140076fdf
cmp eax, 0x16
je 0x140076fd4
cmp eax, edi
je 0x140076fd4
cmp eax, 0x50
je 0x140076fea
mov ecx, 0x80004005
call fcn.14001ad98
int3
mov ecx, 0x80070057
call fcn.14001ad98
int3
mov ecx, 0x8007000e
call fcn.14001ad98
int3
lea rdx, [rsp + 0x280]
xor r9d, r9d
mov r8, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.140168920
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
lea rax, [0x140007030]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x70]
mov r9d, 0xf01ff
mov r8, r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebp
mov rdx, r14
mov rcx, rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], CoRevokeClassObject
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140077105
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x280]
mov ecx, 0xd80b
call fcn.1400776e0
test eax, eax
jne 0x140076fea
lea r8, [0x140007040]
lea rcx, [rsp + 0x280]
mov edx, 0x400
call qword [sym.imp.msvcrt.dll_wcscpy_s]
test eax, eax
je 0x140076fea
cmp eax, 0xc
je 0x1400770fa
cmp eax, 0x16
je 0x1400770ef
cmp eax, edi
je 0x1400770ef
cmp eax, 0x50
je 0x140076fea
mov ecx, 0x80004005
call fcn.14001ad98
int3
mov ecx, 0x80070057
call fcn.14001ad98
int3
mov ecx, 0x8007000e
call fcn.14001ad98
int3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140076f10
xor ecx, ecx
call fcn.140168954
int3