Function at 0x1400fa8a4
Capabilities:
Create service
Enumerate services
Query service configuration
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov r12, rcx
xor esi, esi
mov dword [rbp - 0x1c], esi
lea rax, [rsp + 0x70]
mov qword [rbp + 8], rax
mov r14, qword [rcx + 0x10]
mov r15, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1400fa8f7
mov r15, qword [rcx]
call fcn.14010008c
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov rax, rsi
mov qword [rbp - 0x80], rax
mov edx, 7
mov qword [rbp - 0x78], rdx
mov word [rsp + 0x70], si
mov dword [rbp - 0x1c], 4
test r14, r14
je 0x1400faa0d
cmp r14, 0x7fffffff
ja 0x1400fb003
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, r13d
call fcn.1401000b4
mov rbx, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x1400fb009
movsxd rdx, ebx
mov r8, qword [rbp - 0x80]
cmp rdx, r8
ja 0x1400fa986
mov qword [rbp - 0x80], rdx
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rax, qword [rsp + 0x70]
mov word [rax + rdx*2], si
jmp 0x1400fa9d7
sub rdx, r8
mov rax, qword [rbp - 0x78]
sub rax, r8
cmp rdx, rax
ja 0x1400fa9ca
lea rax, [rdx + r8]
mov qword [rbp - 0x80], rax
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400fa9bf
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], si
jmp 0x1400fa9d7
mov r9, rdx
lea rcx, [rsp + 0x70]
call fcn.1400fb024
lea r9, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova r9, qword [rsp + 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r13d
call fcn.1401000b4
shr rax, 0x20
test eax, eax
jne 0x1400fb00f
mov rdx, qword [rbp - 0x78]
mov rax, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
cmp rdx, 7
cmova rcx, qword [rsp + 0x70]
lea r8, [rcx + rax*2]
mov rdi, r8
mov rdx, r8
sub rdx, rcx
sar rdx, 1
mov r10w, 0x5c
mov r9w, 0x2f
cmp rdx, 2
jl 0x1400fab1a
mov eax, dword [rcx]
and eax, 0xffffffdf
sub eax, 0x3a0041
cmp eax, 0x1a
jb 0x1400fab04
cmp word [rcx], r10w
je 0x1400faa63
cmp word [rcx], r9w
jne 0x1400fab1a
cmp rdx, 4
jl 0x1400faabb
cmp word [rcx + 6], r10w
je 0x1400faa77
cmp word [rcx + 6], r9w
jne 0x1400faacb
cmp rdx, 4
je 0x1400faa8b
cmp word [rcx + 8], r10w
je 0x1400faacb
cmp word [rcx + 8], r9w
je 0x1400faacb
cmp word [rcx + 2], r10w
je 0x1400faa99
cmp word [rcx + 2], r9w
jne 0x1400faaa7
cmp word [rcx + 4], 0x3f
je 0x1400faab5
cmp word [rcx + 4], 0x2e
je 0x1400faab5
cmp word [rcx + 2], 0x3f
jne 0x1400faacb
cmp word [rcx + 4], 0x3f
jne 0x1400faacb
add rcx, 6
jmp 0x1400fab1a
mov rax, r8
sub rax, rcx
and rax, 0xfffffffffffffffe
cmp rax, 6
jl 0x1400fab1a
cmp word [rcx + 2], r10w
je 0x1400faad9
cmp word [rcx + 2], r9w
jne 0x1400fab1a
cmp word [rcx + 4], r10w
je 0x1400fab1a
cmp word [rcx + 4], r9w
je 0x1400fab1a
add rcx, 6
jmp 0x1400faafd
cmp word [rcx], r10w
je 0x1400fab1a
cmp word [rcx], r9w
je 0x1400fab1a
add rcx, 2
cmp rcx, r8
jne 0x1400faaed
jmp 0x1400fab1a
add rcx, 4
jmp 0x1400fab1a
cmp word [rcx], r10w
je 0x1400fab16
cmp word [rcx], r9w
jne 0x1400fab1f
add rcx, 2
cmp rcx, r8
jne 0x1400fab0a
cmp rcx, r8
je 0x1400fab3c
lea rax, [rdi - 2]
cmp word [rax], r10w
je 0x1400fab3c
cmp word [rax], r9w
je 0x1400fab3c
mov rdi, rax
cmp rcx, rax
jne 0x1400fab24
sub r8, rdi
sar r8, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400f87a4
nop
lea r13, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova r13, qword [rbp - 0x70]
mov r15, qword [rbp - 0x60]
call fcn.14010008c
mov dword [rbp - 0x20], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rsi
mov qword [rbp], 0xf
mov byte [rbp - 0x18], sil
mov dword [rbp - 0x1c], 0x23b
test r15, r15
je 0x1400fac6c
cmp r15, 0x7fffffff
ja 0x1400fb017
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r15d
mov rdx, r13
mov ecx, eax
call fcn.1401000fc
mov rdi, rax
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
jne 0x1400fb01d
movsxd r14, edi
mov rcx, qword [rbp - 8]
cmp r14, rcx
ja 0x1400fabf6
mov qword [rbp - 8], r14
lea rax, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rax, qword [rbp - 0x18]
mov byte [rax + r14], sil
jmp 0x1400fac40
sub r14, rcx
mov rax, qword [rbp]
sub rax, rcx
cmp r14, rax
ja 0x1400fac31
lea rax, [r14 + rcx]
mov qword [rbp - 8], rax
lea rbx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rbx, qword [rbp - 0x18]
add rbx, rcx
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.140100356
mov byte [rbx + r14], sil
jmp 0x1400fac40
mov r9, r14
mov rdx, r14
lea rcx, [rbp - 0x18]
call fcn.1400fb154
lea r9, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova r9, qword [rbp - 0x18]
mov dword [rsp + 0x20], edi
mov r8d, r15d
mov rdx, r13
mov ecx, dword [rbp - 0x20]
call fcn.1401000fc
shr rax, 0x20
test eax, eax
jne 0x1400faffb
lea rcx, [rbp - 0x70]
call fcn.1400f7920
nop
lea rcx, [rsp + 0x70]
call fcn.1400f7920
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1400faf8d
mov dword [rbp - 0x20], esi
mov dword [rbp - 0x1c], esi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r14d, [r9 + 3]
mov r8d, r14d
lea r15d, [r9 + 0xb]
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400facec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400faf8d
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.1400ff584
mov rbx, rax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8d, r14d
mov edx, r15d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400faf84
mov r14d, esi
cmp dword [rbp - 0x1c], esi
jbe 0x1400fadba
mov eax, r14d
lea rcx, [rax + rax*2]
add rcx, rcx
mov r8d, 1
mov rdx, qword [rbx + rcx*8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r15, rax
test rax, rax
je 0x1400fadb1
mov ecx, 0x1fa0
call fcn.1400ff584
mov r13, rax
mov dword [rbp + 8], esi
lea r9, [rbp + 8]
mov r8d, 0x1fa0
mov rdx, rax
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1400fada8
lea rdx, str.vulc_driver64.sys
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400faf69
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc r14d
cmp r14d, dword [rbp - 0x1c]
jb 0x1400fad3f
mov rcx, rbx
call fcn.1400fefc0
mov dword [rbp - 0x20], esi
mov dword [rbp - 0x1c], esi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r15d, [r9 + 3]
mov r8d, r15d
lea ebx, [r9 + 0xb]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400fae11
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400faf8d
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.1400ff584
mov r14, rax
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r9, r14
mov r8d, r15d
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400faf7f
mov ebx, esi
cmp dword [rbp - 0x1c], esi
jbe 0x1400faead
mov eax, ebx
lea rcx, [rax + rax*2]
add rcx, rcx
movups xmm0, xmmword [r14 + rcx*8 + 0x10]
movups xmmword [rbp + 8], xmm0
lea rdx, [0x14015218c]
mov rcx, qword [r14 + rcx*8]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400faea6
movups xmm0, xmmword [rbp + 8]
psrldq xmm0, 4
movd eax, xmm0
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x1400faf8d
inc ebx
cmp ebx, dword [rbp - 0x1c]
jb 0x1400fae62
mov rcx, r14
call fcn.1400fefc0
cmp qword [r12 + 0x18], 0xf
jbe 0x1400faec1
mov r12, qword [r12]
lea r8, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova r8, qword [rbp - 0x18]
lea rdx, [rbp - 0x18]
cmova rdx, qword [rbp - 0x18]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
mov r9d, 0x10030
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x1400faf41
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
lea r8d, [rax + 0x10]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x1400faf5e
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
setne sil
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400faf8d
mov rcx, rbx
call fcn.1400fefc0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400fadc2
mov rcx, r14
jmp 0x1400faf87
mov rcx, rbx
call fcn.1400fefc0
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400fafcb
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fafc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fafc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
mov al, sil
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1400feed0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.1400fa860
nop
call fcn.1400fa608
int3
call fcn.1400fa860
int3
mov ecx, eax
call fcn.1400fa860
nop
call fcn.1400fa608
int3
call fcn.1400fa860
int3