Function at 0x140033700
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Modify service

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r13, rdx
mov r14, rcx
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400337a7
lea rdx, [0x14012ff18]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140033753
mov r8d, eax
mov rcx, rsi
call fcn.14000c510
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033785
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400337a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor al, al
jmp 0x140033bf9
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
test rax, rax
jne 0x1400337db
lea rdx, [0x14012ff1c]
or rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400337d0
jmp 0x14003375c
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x1400337f3
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x2e], 0x650074
mov dword [rsp + 0x60], 0x6d0072
mov dword [rsp + 0x38], 0x730020
mov dword [rsp + 0x4e], 0x650020
mov dword [rsp + 0x28], 0x650072
mov dword [rsp + 0x7a], 0x250022
mov dword [rsp + 0x40], 0x740072
mov r15d, 0x61
mov dword [rsp + 0x46], 0x750061
mov dword [rsp + 0x34], 0x730025
mov dword [rsp + 0x3c], 0x610074
mov dword [rsp + 0x74], 0x680074
mov dword [rsp + 0x5c], 0x6f006e
mov dword [rsp + 0x6c], 0x6e0069
lea ebx, [r15 + 0xe]
mov dword [rsp + 0x7e], 0x220073
mov dword [rsp + 0x24], 0x630020
mov dword [rsp + 0x64], 0x6c0061
mov r9d, 0x3d
mov word [rsp + 0x44], r9w
mov word [rsp + 0x2c], r15w
lea ecx, [rbx - 0x4f]
mov dword [rsp + 0x4a], 0x6f0074
mov dword [rsp + 0x68], 0x620020
mov dword [rsp + 0x20], 0x630073
xor edi, edi
mov word [rbp - 0x7e], di
mov dword [rsp + 0x52], 0x720072
mov dword [rsp + 0x58], 0x3d0072
mov dword [rsp + 0x70], 0x610070
mov word [rsp + 0x32], cx
mov word [rsp + 0x56], bx
mov word [rsp + 0x78], r9w
mov r9, qword [r13]
mov r8, qword [r14]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.140022d70
mov rbx, qword [rbp - 0x70]
nop
xor edx, edx
mov rcx, rbx
call fcn.140001060
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0xf01ff
mov rdx, qword [r14]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r15, rax
test rax, rax
jne 0x140033936
inc edi
cmp edi, 5
jl 0x140033900
lea rdx, [rbx - 0x18]
or rdi, 0xffffffffffffffff
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140033953
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r15, r15
jne 0x14003397e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.03_d
mov rcx, rsi
call fcn.14000bb10
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140033768
mov edx, 0xa8
lea rcx, [rbp - 0x48]
call fcn.1400244d0
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x140033999
mov rsi, qword [rax]
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x1400339b1
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x78], rbx
test rsi, rsi
je 0x1400339fe
test rsi, 0xffffffffffff0000
jne 0x1400339ef
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.14000b6e0
test rax, rax
je 0x140033a13
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.14000bf00
jmp 0x140033a0f
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x1400339f2
jmp 0x140033a00
xor eax, eax
mov r8d, eax
mov rdx, rsi
lea rcx, [rbp + 0x78]
call fcn.1400144a0
mov rbx, qword [rbp + 0x78]
mov r8, qword [rbp - 0x30]
cmp r8, 8
jb 0x140033a2d
inc r8
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.1400146a0
mov qword [rbp - 0x30], 7
xor esi, esi
mov qword [rbp - 0x38], rsi
mov word [rbp - 0x48], si
cmp dword [rbx - 8], 1
jle 0x140033a55
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x78]
call fcn.14000ba60
mov rbx, qword [rbp + 0x78]
mov qword [rbp - 0x50], rbx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400e5378
test eax, eax
js 0x140033bee
cmp eax, dword [rbx - 0xc]
jg 0x140033bee
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
lea r8, [rbp - 0x50]
mov edx, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r12b, r12b
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x140033b7b
mov r8d, 0xf01ff
mov rdx, qword [r14]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140033b57
mov dword [rbp - 0x28], 1
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 3
lea rax, [rbp - 0x68]
mov qword [rbp - 8], rax
mov dword [rbp - 0x68], 1
mov dword [rbp - 0x64], 0x64
mov dword [rbp - 0x60], 1
mov dword [rbp - 0x5c], 0x64
mov dword [rbp - 0x58], 1
mov dword [rbp - 0x54], 0x64
lea r8, [rbp - 0x28]
mov edx, 2
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rsi
call fcn.140032f70
mov r12b, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140033b95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.05_d
mov rcx, qword [rbp + 0x70]
call fcn.14000bb10
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140033b95
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.04_d
mov rcx, qword [rbp + 0x70]
call fcn.14000bb10
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033baf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033bcc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140033be8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, r12b
jmp 0x140033bf9
mov ecx, 0x80070057
call fcn.14000b790
nop
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret