Function at 0x1400126d0
Capabilities:
Create service
Delete service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
mov eax, 0x1090
call fcn.140014430
sub rsp, rax
mov rsi, rcx
mov ebx, 0x7fe
lea rcx, [rsp + 0x892]
xor r13d, r13d
xor edx, edx
mov r8, rbx
mov word [rsp + 0x890], r13w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x92]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x90], r13w
call sub.msvcrt.dll_memset
lea rbx, [rsi + 0x34]
mov dword [rsi + 0x654], r13d
cmp word [rbx], r13w
mov rbp, r13
je 0x14001275e
cmp word [rbx], 0x5c
jne 0x140012759
cmp word [rbx + 2], 0x5c
jne 0x140012759
lea rcx, [rbx + 4]
jmp 0x140012761
mov rcx, rbx
jmp 0x140012761
mov rcx, r13
lea rdx, str.ServicesActive
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp rax, r13
mov rdi, rax
je 0x1400127ee
lea rdx, str.NirSoftAdvancedRunService
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp rax, r13
mov r12, rax
je 0x1400127e5
xor edx, edx
lea rcx, [rsp + 0x74]
mov dword [rsp + 0x70], r13d
lea r8d, [rdx + 0x18]
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov r8d, 1
mov rdx, r12
mov rcx, rsi
call fcn.14001295c
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp word [rbx], r13w
je 0x14001280c
cmp word [rbx], 0x5c
jne 0x140012807
cmp word [rbx + 2], 0x5c
jne 0x140012807
lea rcx, [rbx + 4]
jmp 0x14001280f
mov rcx, rbx
jmp 0x14001280f
mov rcx, r13
lea rdx, str.ServicesActive
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp rax, r13
mov rdi, rax
je 0x14001292d
cmp word [rbx], r13w
je 0x14001284a
lea rdx, str._systemroot_AdvancedRun.exe
lea rcx, [rsp + 0x90]
call fcn.140014030
jmp 0x140012860
lea rdx, [rsp + 0x90]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, str._RunAsService
lea r9, [rsp + 0x90]
lea r8, str.__s___s
lea rcx, [rsp + 0x890]
mov edx, 0x3ff
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__snwprintf
cmp dword [rbx + 0x200], r13d
lea rax, [rbx + 0x404]
jne 0x140012921
mov rax, r13
mov rbx, r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x890]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea r8, str.NirSoftAdvancedRunService
lea rdx, str.NirSoftAdvancedRunService
mov r9d, 0xf01ff
mov rcx, rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], InitCommonControls
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp rax, r13
mov rbp, rax
jne 0x140012916
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x654], eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140012939
add rbx, 0x204
jmp 0x1400128a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x654], eax
lea r11, [rsp + 0x1090]
mov rax, rbp
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret