Function at 0x140073550
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Modify service

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r13, rdx
mov r14, rcx
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400735f7
lea rdx, [0x14042438c]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x1400735a3
mov r8d, eax
mov rcx, rsi
call fcn.140007a14
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400735d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400735f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor al, al
jmp 0x140073a49
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x14007362b
lea rdx, [0x140424394]
or rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140073620
jmp 0x1400735ac
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x140073643
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x2e], 0x650074
mov dword [rsp + 0x60], 0x6d0072
mov dword [rsp + 0x38], 0x730020
mov dword [rsp + 0x4e], 0x650020
mov dword [rsp + 0x28], 0x650072
mov dword [rsp + 0x7a], 0x250022
mov dword [rsp + 0x40], 0x740072
mov r15d, 0x61
mov dword [rsp + 0x46], 0x750061
mov dword [rsp + 0x34], 0x730025
mov dword [rsp + 0x3c], 0x610074
mov dword [rsp + 0x74], 0x680074
mov dword [rsp + 0x5c], 0x6f006e
mov dword [rsp + 0x6c], 0x6e0069
lea ebx, [r15 + 0xe]
mov dword [rsp + 0x7e], 0x220073
mov dword [rsp + 0x24], 0x630020
mov dword [rsp + 0x64], 0x6c0061
mov r9d, 0x3d
mov word [rsp + 0x44], r9w
mov word [rsp + 0x2c], r15w
lea ecx, [rbx - 0x4f]
mov dword [rsp + 0x4a], 0x6f0074
mov dword [rsp + 0x68], 0x620020
mov dword [rsp + 0x20], 0x630073
xor edi, edi
mov word [rbp - 0x7e], di
mov dword [rsp + 0x52], 0x720072
mov dword [rsp + 0x58], 0x3d0072
mov dword [rsp + 0x70], 0x610070
mov word [rsp + 0x32], cx
mov word [rsp + 0x56], bx
mov word [rsp + 0x78], r9w
mov r9, qword [r13]
mov r8, qword [r14]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.14000870c
mov rbx, qword [rbp - 0x70]
nop
xor edx, edx
mov rcx, rbx
call fcn.140001060
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0xf01ff
mov rdx, qword [r14]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r15, rax
test rax, rax
jne 0x140073786
inc edi
cmp edi, 5
jl 0x140073750
lea rdx, [rbx - 0x18]
or rdi, 0xffffffffffffffff
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400737a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r15, r15
jne 0x1400737ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.03_d
mov rcx, rsi
call fcn.140008754
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400735b8
mov edx, 0xac
lea rcx, [rbp - 0x48]
call fcn.140016310
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x1400737e9
mov rsi, qword [rax]
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x140073801
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x78], rbx
test rsi, rsi
je 0x14007384e
test rsi, 0xffffffffffff0000
jne 0x14007383f
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.14000b0cc
test rax, rax
je 0x140073863
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.140008224
jmp 0x14007385f
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x140073842
jmp 0x140073850
xor eax, eax
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp + 0x78]
call fcn.140007d30
mov rbx, qword [rbp + 0x78]
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x14007387d
inc r8
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.14000c6f4
mov qword [rbp - 0x30], 7
xor esi, esi
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
cmp dword [rbx - 8], 1
jle 0x1400738a5
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x78]
call fcn.1400083e8
mov rbx, qword [rbp + 0x78]
mov qword [rbp - 0x50], rbx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401567cc
test eax, eax
js 0x140073a3e
cmp eax, dword [rbx - 0xc]
jg 0x140073a3e
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
lea r8, [rbp - 0x50]
mov edx, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r12b, r12b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x1400739cb
mov r8d, 0xf01ff
mov rdx, qword [r14]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400739a7
mov dword [rbp - 0x28], 1
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 3
lea rax, [rbp - 0x68]
mov qword [rbp - 8], rax
mov dword [rbp - 0x68], 1
mov dword [rbp - 0x64], 0x64
mov dword [rbp - 0x60], 1
mov dword [rbp - 0x5c], 0x64
mov dword [rbp - 0x58], 1
mov dword [rbp - 0x54], 0x64
lea r8, [rbp - 0x28]
mov edx, 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rsi
call fcn.140072dc0
mov r12b, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400739e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.05_d
mov rcx, qword [rbp + 0x70]
call fcn.140008754
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400739e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.04_d
mov rcx, qword [rbp + 0x70]
call fcn.140008754
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400739ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140073a1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140073a38
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, r12b
jmp 0x140073a49
mov ecx, 0x80070057
call fcn.14000b9ec
nop
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret