Function at 0x140001000
Capabilities:
Copy file
Create service
Delete file
Get common file path
Move file
Persist via windows service

Disassembly:
push rsi
push rdi
mov eax, 0x1518
call fcn.140002e60
sub rsp, rax
mov dword [rsp + 0x94], 0
lea rax, [rsp + 0x4f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rax, [rsp + 0x900]
mov rdi, rax
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
mov r8d, 0x208
lea rdx, [rsp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x900]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rsp + 0x900]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax]
mov word [rsp + 0x74], ax
mov rax, qword [rsp + 0x98]
movzx ecx, word [rsp + 0x74]
mov word [rax], cx
mov rax, qword [rsp + 0xa8]
add rax, 2
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x98]
add rax, 2
mov qword [rsp + 0x98], rax
cmp word [rsp + 0x74], 0
jne 0x1400010b0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x78], rax
sub qword [rsp + 0x78], 2
add qword [rsp + 0x78], 2
mov rax, qword [rsp + 0x78]
cmp word [rax], 0
jne 0x140001113
mov rax, qword [rsp + 0x78]
mov rcx, qword [0x14000e3c8]
xor edx, edx
movzx edi, word [rcx + rdx*2]
mov word [rax + rdx*2], di
inc rdx
test di, di
jne 0x140001132
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x80], rax
sub qword [rsp + 0x80], 2
add qword [rsp + 0x80], 2
mov rax, qword [rsp + 0x80]
cmp word [rax], 0
jne 0x14000115b
mov rax, qword [rsp + 0x80]
lea rcx, str..exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 1
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140001382
mov rdx, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InstallService:_Error_CopyFile___d_
call fcn.140002fc0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [str.PandaAAV]
call fcn.1400040b0
lea rcx, str.InstallService:_Try_StopService__wait...
call fcn.140002fc0
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xd10]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xb0]
movzx eax, word [rax]
mov word [rsp + 0x76], ax
mov rax, qword [rsp + 0xa0]
movzx ecx, word [rsp + 0x76]
mov word [rax], cx
mov rax, qword [rsp + 0xb0]
add rax, 2
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xa0]
add rax, 2
mov qword [rsp + 0xa0], rax
cmp word [rsp + 0x76], 0
jne 0x140001262
lea rax, [rsp + 0xd10]
mov qword [rsp + 0x88], rax
sub qword [rsp + 0x88], 2
add qword [rsp + 0x88], 2
mov rax, qword [rsp + 0x88]
cmp word [rax], 0
jne 0x1400012cb
mov rax, qword [rsp + 0x88]
lea rcx, [0x14000abc0]
mov rdi, rax
mov rsi, rcx
mov ecx, 8
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xd10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, 1
lea rdx, [rsp + 0xd10]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000133a
lea rcx, str.Moved
call fcn.140002fc0
jmp 0x140001346
lea rcx, str.Not_Moved
call fcn.140002fc0
mov r8d, 1
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140001374
lea rcx, str.InstallService:_Error_Copy_New_File
call fcn.140002fc0
jmp 0x140001380
lea rcx, str.InstallService:_Copy_New_File___OK
call fcn.140002fc0
jmp 0x14000138e
lea rcx, str.InstallService:_CopyFile___OK
call fcn.140002fc0
jmp 0x14000139d
mov r8d, 2
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
jne 0x1400013d6
lea rcx, str.InstallService:_Cant_open_Service_Control_Manager
call fcn.140002fc0
mov eax, 0xffffffff
jmp 0x1400015c2
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0x10
mov r8, qword [0x14000e3c8]
mov rdx, qword [0x14000e3c8]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
jne 0x140001586
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x421
jg 0x1400014b6
cmp dword [rsp + 0x70], 0x421
je 0x140001538
cmp dword [rsp + 0x70], 5
je 0x1400014e4
cmp dword [rsp + 0x70], 6
je 0x14000150e
cmp dword [rsp + 0x70], 0x57
je 0x14000152a
cmp dword [rsp + 0x70], 0x7b
je 0x14000151c
jmp 0x140001560
cmp dword [rsp + 0x70], 0x423
je 0x1400014f2
cmp dword [rsp + 0x70], 0x430
je 0x140001554
cmp dword [rsp + 0x70], 0x431
je 0x140001546
cmp dword [rsp + 0x70], 0x436
je 0x140001500
jmp 0x140001560
lea rcx, str.InstallService:_ERROR_ACCESS_DENIED
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_CIRCULAR_DEPENDENCY
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_DUPLICATE_SERVICE_NAME
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_INVALID_HANDLE
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_INVALID_NAME
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_INVALID_PARAMETER
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_INVALID_SERVICE_ACCOUNT
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_SERVICE_EXISTS
call fcn.140002fc0
jmp 0x14000156c
lea rcx, str.InstallService:_ERROR_SERVICE_MARKED_FOR_DELETE
call fcn.140002fc0
lea rcx, str.InstallService:_Undefined
call fcn.140002fc0
cmp dword [rsp + 0x90], 0x431
je 0x140001584
mov dword [rsp + 0x94], 0xffffffff
jmp 0x1400015ad
mov rcx, qword [0x14000e3c8]
call fcn.140005d70
mov rcx, qword [rsp + 0xb8]
call fcn.140004e10
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x94]
add rsp, 0x1518
pop rdi
pop rsi
ret