Function at 0x401580
Capabilities:
Create service
Modify service
Persist via windows service

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x150], rcx
mov r8d, 0xf003f
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call rax
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
jne 0x401616
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x114], eax
cmp dword [rbp + 0x114], 5
je 0x40160c
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov eax, dword [rbp + 0x114]
mov r8d, eax
lea rdx, str.OpenSCManager_failed___lu__n
call sym.fprintf
mov eax, 0x67
jmp 0x40193b
mov eax, 0x66
jmp 0x40193b
mov rax, rbp
mov word [rax], 0x22
mov rax, qword [rbp + 0x150]
mov rdx, qword [rax + 0x30]
mov rax, rbp
mov rcx, rax
call sym.strcat
mov rax, rbp
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, rbp
add rax, rdx
mov word [rax], 0x22
mov rax, rbp
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, rbp
add rax, rdx
movabs rsi, 0x6563697672657320
mov qword [rax], rsi
mov dword [rax + 8], 0x20642d20
mov byte [rax + 0xc], 0
mov rax, qword [rbp + 0x150]
mov rdx, qword [rax + 0x10]
mov rax, rbp
mov rcx, rax
call sym.strcat
mov rax, qword [rbp + 0x150]
mov eax, dword [rax + 4]
test eax, eax
je 0x4016f0
mov rax, rbp
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, rbp
add rax, rdx
mov dword [rax], 0x662d20
mov rax, rbp
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, rbp
add rax, rdx
mov dword [rax], 0x206a2d20
mov byte [rax + 4], 0
mov rax, rbp
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, rbp
add rax, rdx
mov word [rax], 0x22
mov rax, qword [rbp + 0x150]
mov rdx, qword [rax + 0x20]
mov rax, rbp
mov rcx, rax
call sym.strcat
mov rax, rbp
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
mov rax, rbp
add rax, rdx
mov word [rax], 0x22
mov rax, qword [rbp + 0x150]
mov r8, qword [rax + 0x40]
mov rax, qword [rbp + 0x150]
mov rdx, qword [rax + 0x38]
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, rbp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov rax, qword [sym.imp.ADVAPI32.dll_CreateServiceA]
call rax
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x4018bb
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x104], eax
cmp dword [rbp + 0x104], 0x431
jne 0x401865
mov rax, qword [rbp + 0x150]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r8, rbx
lea rdx, str.Service_already_exists:__s_n
mov rcx, rax
call sym.fprintf
jmp 0x40189e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov esi, eax
mov rax, qword [rbp + 0x150]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9d, esi
mov r8, rbx
lea rdx, str.Failed_to_create_service__s___lu__n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x118]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
mov eax, 0x65
jmp 0x40193b
lea rax, str.High_performance_time_series_database__www.questdb.io_
mov qword [rbp - 8], rax
lea rdx, [rbp - 8]
mov rax, qword [rbp + 0x108]
mov r8, rdx
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
call rax
mov rax, qword [rbp + 0x150]
mov rbx, qword [rax + 0x38]
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r8, rbx
lea rdx, str.Service_installed:__s_n
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
mov rax, qword [rbp + 0x118]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
mov eax, 0
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
ret