Function at 0x140046e00
Capabilities:
Create service
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x1400ca1c0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, rdx
mov r15, rcx
lea rsi, section..data
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x140046e67
test byte [rcx + 0x1c], 1
je 0x140046e67
cmp byte [rcx + 0x19], 5
jb 0x140046e67
mov edx, 0x1c
mov r9, rdi
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140043490
xor r13d, r13d
mov ebx, r13d
lea rcx, [rbp - 0x59]
call fcn.1400096e0
nop
lea rcx, [rbp - 0x61]
call fcn.1400096e0
nop
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], r13
mov qword [rbp - 0x39], r13
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x51]
call fcn.140017070
nop
lea r14, [r15 + 0x28]
mov rdx, r14
lea rcx, [rbp - 0x51]
call fcn.14000d234
mov edx, dword [r15 + 0x30]
lea rcx, [rbp - 0x59]
call fcn.140045bfc
test eax, eax
jne 0x140046ecf
lea rdx, str.UNKNOWN_SERVICE
lea rcx, [rbp - 0x59]
call fcn.14000a900
mov edx, dword [r15 + 0x34]
lea rcx, [rbp - 0x61]
call fcn.140045bfc
test eax, eax
jne 0x140046ee9
lea rcx, [rbp - 0x61]
call fcn.140017350
mov rcx, r15
call fcn.1400474dc
mov r12d, 2
test eax, eax
jne 0x1400473b3
mov ebx, 0xf003f
mov r8d, ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140046f8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [section..data]
lea rsi, section..data
cmp rcx, rsi
je 0x140046f64
test byte [rcx + 0x1c], r12b
je 0x140046f64
cmp byte [rcx + 0x19], r12b
jb 0x140046f64
lea edx, [r12 + 0x1b]
mov r9d, eax
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
cmp ebx, 5
jne 0x140046f7a
movups xmm0, xmmword [0x1400b1560]
movdqu xmmword [rbp - 9], xmm0
jmp 0x14004706f
movups xmm0, xmmword [0x1400b1550]
movdqu xmmword [rbp - 9], xmm0
jmp 0x140047067
mov rax, qword [0x1400cb388]
lea rcx, [0x1400acdc4]
mov qword [rsp + 0x60], rcx
lea rcx, str.NT_AUTHORITYNetworkService
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetDim
mov r9d, 0xf01ff
mov r8, qword [rbp - 0x59]
mov rdx, qword [r14]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400470e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140047045
test byte [rcx + 0x1c], r12b
je 0x140047045
cmp byte [rcx + 0x19], r12b
jb 0x140047045
lea edx, [rdi + 0x1e]
mov dword [rsp + 0x20], ebx
mov r9, qword [r14]
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140049774
movups xmm0, xmmword [0x1400b1540]
movdqu xmmword [rbp - 9], xmm0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
lea rsi, section..data
test ebx, ebx
je 0x1400473bf
lea rcx, [rbp - 0x69]
call fcn.1400096e0
nop
mov r8d, ebx
lea rdx, [0x1400b1950]
lea rcx, [rbp - 0x69]
call fcn.14001c8e0
mov qword [rsp + 0x20], r13
mov r9, qword [rbp - 0x69]
mov r8, qword [r14]
lea rdx, [rbp - 9]
mov rcx, r15
call fcn.1400476b4
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x1400470d9
test byte [rcx + 0x1c], r12b
je 0x1400470d9
cmp byte [rcx + 0x19], r12b
jb 0x1400470d9
mov edx, 0x28
mov dword [rsp + 0x20], ebx
mov r9, qword [r14]
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140049774
nop
lea rcx, [rbp - 0x69]
call fcn.1400043f0
jmp 0x140047444
mov r9d, ebx
mov r8, qword [rbp - 0x51]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x49]
call fcn.140005e00
mov ebx, eax
movups xmm0, xmmword [0x1400b1530]
movdqu xmmword [rbp - 9], xmm0
mov rax, qword [rbp - 0x61]
cmp dword [rax - 0x10], r13d
je 0x1400471b8
mov qword [rbp - 0x69], rax
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140047152
test byte [rcx + 0x1c], r12b
je 0x140047152
cmp byte [rcx + 0x19], 4
jb 0x140047152
mov edx, 0x1f
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
lea r8, [rbp - 0x69]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
nop dword [rax + rax]
test eax, eax
jne 0x1400471b8
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400471bf
test byte [rcx + 0x1c], r12b
je 0x1400471bf
cmp byte [rcx + 0x19], 3
jb 0x1400471bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [section..data]
mov edx, 0x20
mov r9d, eax
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
mov rcx, qword [section..data]
mov edx, 1
mov dword [rbp + 7], edx
mov eax, 0x7530
mov dword [rbp + 0xb], eax
mov dword [rbp + 0xf], edx
mov qword [rbp + 0x13], rax
mov dword [rbp + 0x1b], r13d
mov qword [rbp - 0x31], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 3
lea rax, [rbp + 7]
mov qword [rbp - 0x11], rax
lea rax, section..data
cmp rcx, rax
je 0x140047223
test byte [rcx + 0x1c], r12b
je 0x140047223
cmp byte [rcx + 0x19], 4
jb 0x140047223
mov edx, 0x21
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
lea r8, [rbp - 0x31]
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
nop dword [rax + rax]
test eax, eax
jne 0x140047287
mov rax, qword [section..data]
lea rcx, section..data
cmp rax, rcx
je 0x140047287
test byte [rax + 0x1c], r12b
je 0x140047287
cmp byte [rax + 0x19], 3
jb 0x140047287
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [section..data]
mov edx, 0x22
mov r9d, eax
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
mov byte [rsp + 0x20], r13b
mov r9d, 0x2019d
mov r8d, r12d
lea rdx, str.S_1_5_4
mov rcx, rdi
call fcn.14009bf88
test eax, eax
jne 0x1400472dc
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x1400472ea
test byte [rcx + 0x1c], r12b
je 0x1400472ea
cmp byte [rcx + 0x19], 3
jb 0x1400472ea
mov edx, 0x23
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
lea rax, section..data
mov rcx, qword [section..data]
mov dword [rbp - 0x69], 1
cmp rcx, rax
je 0x140047317
test byte [rcx + 0x1c], r12b
je 0x140047317
cmp byte [rcx + 0x19], 4
jb 0x140047317
mov edx, 0x24
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
lea r8, [rbp - 0x69]
mov edx, 5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
nop dword [rax + rax]
test eax, eax
jne 0x14004737d
mov rax, qword [section..data]
lea rcx, section..data
cmp rax, rcx
je 0x14004737d
test byte [rax + 0x1c], r12b
je 0x14004737d
cmp byte [rax + 0x19], 3
jb 0x14004737d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [section..data]
mov edx, 0x25
mov r9d, eax
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop dword [rax + rax]
test ebx, ebx
jne 0x140047060
movups xmm0, xmmword [0x1400b15f0]
lea rsi, section..data
jmp 0x1400473ba
movups xmm0, xmmword [0x1400b15e0]
movdqu xmmword [rbp - 9], xmm0
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, qword [r14]
lea rdx, [rbp - 9]
mov rcx, r15
call fcn.1400476b4
mov rax, qword [0x1400b15e0]
sub rax, qword [rbp - 9]
jne 0x1400473ee
mov rax, qword [0x1400b15e8]
sub rax, qword [rbp - 1]
test rax, rax
jne 0x140047414
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x140047485
test byte [rcx + 0x1c], r12b
je 0x14004744b
cmp byte [rcx + 0x19], 4
jb 0x14004744b
lea edx, [rax + 0x26]
jmp 0x140047431
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x140047485
test byte [rcx + 0x1c], r12b
je 0x14004744b
cmp byte [rcx + 0x19], 4
jb 0x14004744b
mov edx, 0x27
mov r9, qword [r14]
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.140043490
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x140047485
test byte [rcx + 0x1c], 1
je 0x140047485
movzx r9d, byte [rcx + 0x19]
mov eax, ebx
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jb 0x140047485
mov edx, 0x29
mov r9d, ebx
lea r8, [0x1400afc60]
mov rcx, qword [rcx + 0x10]
call fcn.1400438d8
nop
lea rcx, [rbp - 0x51]
call fcn.1400043f0
nop
lea rcx, [rbp - 0x49]
call fcn.140006bec
nop
lea rcx, [rbp - 0x61]
call fcn.1400043f0
nop
lea rcx, [rbp - 0x59]
call fcn.1400043f0
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140044080
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret