Function at 0x140015430
Capabilities:
Create service
Persist via windows service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov r12, r8
mov r13, rdx
xor r10d, r10d
mov esi, r10d
mov rbx, qword [rsp + 0xd0]
cmp qword [rbx + 0x20], 8
jb 0x140015480
mov r9, qword [rbx + 8]
jmp 0x140015484
lea r9, [rbx + 8]
cmp qword [rbp + 0x20], 8
jb 0x140015491
mov rax, qword [rbp + 8]
jmp 0x140015495
lea rax, [rbp + 8]
cmp qword [r12 + 0x20], 8
jb 0x1400154a4
mov r8, qword [r12 + 8]
jmp 0x1400154a9
lea r8, [r12 + 8]
cmp qword [r13 + 0x20], 8
jb 0x1400154b6
mov rdx, qword [r13 + 8]
jmp 0x1400154ba
lea rdx, [r13 + 8]
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x430
jne 0x140015832
inc esi
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 5
jge 0x140015532
mov rcx, qword [rsp + 0xb0]
xor r10d, r10d
jmp 0x140015473
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rcx, str.swifdiag.log
call fcn.140001910
mov rbx, rax
lea r12, str.Failed_to_create_service
lea r13, str._err:
lea r15, str.CreateServiceWithRetry
lea r14, str....._src_swic_srcSwiConfigApp.cpp
test rax, rax
je 0x1400156ba
mov r10, qword [rax]
mov qword [rsp + 0x20], r15
mov r9, r14
lea r8, str.default
mov edx, 1
mov rcx, rax
call qword [r10 + 8]
test al, al
je 0x1400156ba
mov byte [rbx + 0xf8], 0x65
xor eax, eax
mov r8b, 0x2e
mov rcx, r14
mov edx, 1
nop dword [rax + rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x1400155b0
add rax, r14
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], 0x54
mov qword [rbx + 0x110], r15
mov rcx, rbx
call fcn.1400027f0
mov rdi, rax
xor ebx, ebx
nop dword [rax]
inc rbx
cmp byte [rbx + r12], 0
jne 0x1400155f0
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], 0
cmp ebx, ecx
jge 0x140015639
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x70], al
sub ecx, ebx
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14002f090
sub rsi, 1
jne 0x140015620
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call fcn.14002f090
xor ebx, ebx
nop dword [rax]
inc rbx
cmp byte [rbx + r13], 0
jne 0x140015650
mov ecx, dword [rdi + 0x430]
mov dword [rdi + 0x430], 0
cmp ebx, ecx
jge 0x140015699
movzx eax, byte [rdi + 0x42c]
mov byte [rsp + 0x70], al
sub ecx, ebx
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14002f090
sub rsi, 1
jne 0x140015680
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.14002f090
mov edx, ebp
mov rcx, rdi
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
lea rcx, [0x14019e670]
call fcn.140030de0
mov rbx, rax
test rax, rax
je 0x14001581b
mov r10, qword [rax]
mov qword [rsp + 0x20], r15
mov r9, r14
lea r8, str.default
mov edx, 1
mov rcx, rax
call qword [r10 + 8]
test al, al
je 0x14001581b
mov byte [rbx + 0xf8], 0x65
xor eax, eax
mov r8b, 0x2e
mov rcx, r14
mov edx, 1
nop dword [rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140015710
add rax, r14
mov qword [rbx + 0x100], rax
mov dword [rbx + 0x108], 0x54
mov qword [rbx + 0x110], r15
mov rcx, rbx
call fcn.1400027f0
mov rdi, rax
xor ebx, ebx
nop dword [rax]
inc rbx
cmp byte [rbx + r12], 0
jne 0x140015750
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], 0
cmp ebx, ecx
jge 0x140015799
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x70], al
sub ecx, ebx
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14002f090
sub rsi, 1
jne 0x140015780
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call fcn.14002f090
xor ebx, ebx
nop dword [rax]
inc rbx
cmp byte [rbx + r13], 0
jne 0x1400157b0
mov ecx, dword [rdi + 0x430]
mov dword [rdi + 0x430], 0
cmp ebx, ecx
jge 0x1400157f9
movzx eax, byte [rdi + 0x42c]
mov byte [rsp + 0x70], al
sub ecx, ebx
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14002f090
sub rsi, 1
jne 0x1400157e0
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.14002f090
mov edx, ebp
mov rcx, rdi
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14001582e
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140015848
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140015845
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret