Function at 0x140009e40
Capabilities:
Create service
Persist via windows service
Query service status
Start service

Disassembly:
push r15
xor eax, eax
mov r8d, 0x103
push r14
push r13
push r12
push rbp
push rdi
push rsi
mov rsi, rdx
xor edx, edx
push rbx
mov rbx, rcx
mov ecx, 0x3d
sub rsp, 0x1a8
lea rdi, [rsp + 0xac]
mov qword [rsp + 0xa4], rdx
lea rdx, [rsp + 0x9d]
rep stosd dword [rdi], eax
mov qword [rsp + 0x9c], 0x22
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140009eac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Cannot_install_service___d__n
mov edx, eax
jmp 0x140009fa7
lea rdi, [rsp + 0x9c]
lea rdx, [0x140011f8a]
mov ebp, 1
mov rcx, rdi
lea r15, [0x140011f8c]
call sub.msvcrt.dll_strcat
mov r14, qword [0x140013090]
mov rax, qword [0x140013080]
cmp dword [rax], ebp
jle 0x140009f85
mov rdx, qword [r14]
movsxd rax, ebp
lea r12, [rdx + rax*8]
mov rdx, r15
mov r13, qword [r12]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140009f7e
lea rdx, [0x140011f8f]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140009f28
lea rdx, [0x140011f92]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140009f2c
inc ebp
jmp 0x140009f7e
lea rdx, [0x140011f95]
mov rcx, rdi
call sub.msvcrt.dll_strcat
mov r13, qword [r12]
mov edx, 0x20
mov rcx, r13
call sub.msvcrt.dll_strchr
mov rdx, r13
test rax, rax
je 0x140009f76
lea rdx, [0x140011f8a]
mov rcx, rdi
call sub.msvcrt.dll_strcat
mov rdx, qword [r12]
mov rcx, rdi
call sub.msvcrt.dll_strcat
lea rdx, [0x140011f8a]
mov rcx, rdi
call sub.msvcrt.dll_strcat
inc ebp
jmp 0x140009ed6
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x74]
call fcn.140009830
test al, al
jne 0x140009fb1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Service_removal_failed___d__n
mov edx, eax
call fcn.14000ac20
jmp 0x14000a1bc
xor ebp, ebp
test rbx, rbx
je 0x14000a036
mov rcx, rbx
mov r12, qword [sym.imp.msvcrt.dll__stricmp]
lea rdx, [0x140011fb4]
call r12
lea rdx, [0x140011fb7]
test eax, eax
lea rax, str.NT_AUTHORITYLocalService
cmove rbx, rax
mov rcx, rbx
call r12
mov edx, 0x5c
test eax, eax
lea rax, str.NT_AUTHORITYNetworkService
cmove rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x14000a036
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rcx, [rax + 3]
call fcn.14000eab0
lea rdx, [0x140011fba]
mov rbp, rax
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rdx, rbx
mov rcx, rbp
mov rbx, rbp
call sub.msvcrt.dll_strcat
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x78]
lea rax, str.tcpip
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rax
xor eax, eax
lea r8, str.Key_Management_Server
lea rdx, str.vlmcsd
mov qword [rsp + 0x38], rdi
mov rdi, rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rcx, rsi
mov rbx, rax
call sub.msvcrt.dll_strlen
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
test rbp, rbp
je 0x14000a0b6
mov rcx, rbp
call sub.msvcrt.dll_free
mov rdi, qword [rsp + 0x78]
test rbx, rbx
jne 0x14000a0e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateService_failed___u__n
mov edx, eax
call fcn.14000ac20
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000a1bc
lea rcx, str.Service_installed_successfully_n
call fcn.14000ac20
cmp dword [rsp + 0x74], 4
jne 0x14000a1ab
lea rcx, str.Restarting_vlmcsd_service__
call fcn.14000cf40
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x84], 1
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x14000a197
mov r13, qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
lea r12, [rsp + 0x80]
mov rdx, r12
mov rcx, rbx
call r13
test eax, eax
jne 0x14000a15f
mov eax, dword [rsp + 0x84]
cmp eax, 4
jne 0x14000a176
lea rcx, str.Success_n
jmp 0x14000a182
cmp dword [rsp + 0x84], 2
jne 0x14000a14a
mov ecx, 0x64
call rbp
dec esi
jne 0x14000a13d
jmp 0x14000a14a
cmp eax, 2
jne 0x14000a189
lea rcx, str.Not_ready_within_a_second_n
call fcn.14000cf40
jmp 0x14000a1ab
lea rcx, str.Error_n
call fcn.14000ac20
jmp 0x14000a1ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__u_n
mov edx, eax
call fcn.14000ac20
mov rcx, rbx
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rbx
mov rcx, rdi
call rbx
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret