Function at 0x1400dc3a0
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov edi, 1
mov qword [rsp + 0x80], 0x10
lea rax, str.Device_
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x70]
mov r14, r8
mov dword [rsp + 0x90], edi
mov r12, rdx
mov qword [rsp + 0xa0], 0x1e
lea rax, str.KProcessHacker3
xor r13d, r13d
lea edx, [rdi + 1]
mov qword [rsp + 0xa8], rax
mov r9d, 0x200
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0xb0]
xor sil, sil
xor r15b, r15b
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
jne 0x1400dc438
mov eax, 0xc0000106
jmp 0x1400dc620
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x2e0], rbx
call fcn.1400dc270
mov ebx, eax
mov eax, 0x80000000
lea ecx, [rbx + rax]
test eax, ecx
jne 0x1400dc616
cmp ebx, 0xc000020a
je 0x1400dc616
lea eax, [rbx + 0x3ffffff2]
cmp eax, 0x2c
ja 0x1400dc616
movabs rcx, 0x104000000003
bt rcx, rax
jae 0x1400dc616
mov r8d, edi
mov qword [rsp + 0x2e8], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x1400dc505
mov r8d, 0x10
lea rdx, str.KProcessHacker3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1400dc4ee
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movzx esi, sil
mov rcx, rdi
test eax, eax
mov eax, 1
cmovne esi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test sil, sil
jne 0x1400dc5e3
mov edi, 1
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
je 0x1400dc60e
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
je 0x1400dc60e
lea rax, [0x14013ca58]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
lea r8, str.KProcessHacker3
mov qword [rsp + 0x58], r13
lea rdx, str.KProcessHacker3
mov qword [rsp + 0x50], r13
mov rcx, rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x1400dc5c0
mov rcx, rax
mov r15b, 1
call fcn.1400dc800
test r14, r14
je 0x1400dc5a9
mov rdx, r14
call fcn.1400dc640
mov ebx, eax
test eax, eax
js 0x1400dc5f7
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1400dc5c0
mov sil, 1
jmp 0x1400dc5d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400dc5d5
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test sil, sil
je 0x1400dc5f2
lea rcx, [rsp + 0xb0]
call fcn.1400dc270
mov ebx, eax
test r15b, r15b
je 0x1400dc60e
test rdi, rdi
je 0x1400dc60e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x2e8]
mov eax, ebx
mov rbx, qword [rsp + 0x2e0]
mov rsi, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
ret