Function at 0x140003fd0
Capabilities:
Create service
Delete service
Persist via windows service

Disassembly:
push rbx
sub rsp, 0x2b0
mov rax, qword [0x140019028]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rdx
lea rdx, str.install
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140004123
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000403e
lea rcx, str.ServiceInstall___GetModuleFileName
call fcn.14000d390
lea rcx, str.Service_Installed_Successfully
call fcn.140003f70
jmp 0x14000422b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140004073
lea rcx, str.ServiceInstall___OpenSCManager
call fcn.14000d390
lea rcx, str.Service_Installed_Successfully
call fcn.140003f70
jmp 0x14000422b
xor eax, eax
lea r8, [0x140013068]
mov qword [rsp + 0x60], rax
lea rdx, str.AMDPMFService
mov qword [rsp + 0x58], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rax
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x1400040fb
lea rcx, str.ServiceInstall___CreateService
call fcn.14000d390
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Service_Installed_Successfully
call fcn.140003f70
jmp 0x14000422b
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.14000c980
lea rcx, str.Service_Installed_Successfully
call fcn.140003f70
jmp 0x14000422b
mov rcx, qword [rbx + 8]
lea rdx, str.delete
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400041e6
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x140004171
lea rcx, str.ServiceDelete___OpenSCManager
call fcn.14000d390
lea rcx, str.Service_Uninstalled_Successfully
call fcn.140003f70
jmp 0x14000422b
mov r8d, 0xf01ff
mov qword [rsp + 0x2c0], rdi
lea rdx, str.AMDPMFService
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400041a5
lea rcx, str.ServiceDelete___OpenService
call fcn.14000d390
jmp 0x1400041c7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400041be
lea rcx, str.ServiceDelete___DeleteService
call fcn.14000d390
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x2c0]
lea rcx, str.Service_Uninstalled_Successfully
call fcn.140003f70
jmp 0x14000422b
lea rax, str.AMDPMFService
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
lea rax, [0x14000c4d0]
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000422b
lea rcx, str.StartServiceCtrlDispatcher_Failed
call fcn.14000d390
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14000e120
add rsp, 0x2b0
pop rbx
ret