Function at 0x14002ec60
Capabilities:
Create service
Start service
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140135080]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r12d, r12d
lea rdx, [0x14002bac0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, rax
movdqa xmm0, xmmword [0x14011e940]
mov dword [rbp - 0x80], 0xd11869ba
mov dword [rbp - 0x7c], 0xfd61df93
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx]
mov ecx, 0x4a8
mov eax, dword [rcx + rdi]
mov ebx, 0x460
add rbx, rdi
test al, 1
jne 0x14002ed33
or eax, 1
mov dword [rcx + rdi], eax
mov byte [rbx + 0x18], 1
lea rax, [rbx + 0x17]
lea rcx, [rbp - 0x79]
cmp rbx, rcx
ja 0x14002ed19
lea rcx, [rsp + 0x70]
cmp rax, rcx
jb 0x14002ed19
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbx + 0x10], xmm0
jmp 0x14002ed26
movups xmmword [rbx], xmm0
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbx + 0x10], xmm0
lea rcx, [0x1400ec8a0]
call fcn.1400e72f0
nop
mov rcx, rbx
call fcn.140034350
mov rdx, rbx
mov rcx, rsi
call fcn.140036200
call fcn.14002eab0
test al, al
jne 0x14002f3eb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rax
mov ecx, 0x344
mov eax, dword [rcx + rdi]
mov edx, 0x398
test al, 1
jne 0x14002ed97
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdx + rdi]
mov dword [rbx + 4], 0x1797320
mov dword [rbx], 0x3f591376
lea rcx, [0x1400ec870]
call fcn.1400e72f0
nop
jmp 0x14002ed9b
lea rbx, [rdx + rdi]
cmp byte [rbx + 7], 0
je 0x14002edc0
xor byte [rbx], 0x41
xor byte [rbx + 1], 0x25
xor byte [rbx + 2], 0x6b
xor byte [rbx + 3], 0xd
xor byte [rbx + 4], 0x11
xor byte [rbx + 5], 0x41
xor byte [rbx + 6], 0x79
mov byte [rbx + 7], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x14002edd6
mov rdx, rbx
lea rcx, [rbp + 0x28]
call fcn.140004c90
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x48]
lea rcx, [0x1401448d0]
call fcn.140012980
nop
cmp byte [0x140144b00], 0
jne 0x14002ee3b
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002f420
mov rcx, rax
call fcn.140032960
mov rdx, rax
mov rcx, rbx
call fcn.140036200
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
movdqa xmm0, xmmword [0x14011e770]
movdqa xmm1, xmmword [0x14011e7d0]
mov dword [rbp - 0x10], 0x4b87a793
mov dword [rbp - 0xc], 0x1beba6c
mov ecx, 0x6ac
mov eax, dword [rcx + rdi]
mov ebx, 0x268
test al, 1
jne 0x14002eed0
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [rdi + rbx]
mov byte [rax + 0x28], 1
lea rcx, [rax + 0x27]
lea rdx, [rbp - 9]
cmp rax, rdx
ja 0x14002eeb2
lea rdx, [rbp - 0x30]
cmp rcx, rdx
jb 0x14002eeb2
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp - 0x10]
movsd qword [rax + 0x20], xmm0
jmp 0x14002eec3
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp - 0x10]
movsd qword [rax + 0x20], xmm0
lea rcx, [0x1400ec810]
call fcn.1400e72f0
nop
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
lea r11, [rbx + rdi]
mov rcx, r11
call fcn.140034040
mov r8d, Ordinal_35
mov rdx, r11
lea rcx, [rbp + 0x60]
call fcn.14001abd0
nop
mov r8, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
sub r8, rdx
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x68]
call fcn.14001add0
test rax, rax
jne 0x14002ef3b
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor edx, edx
xor ecx, ecx
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
jne 0x14002ef96
lea rdx, [0x14002ba60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
call fcn.14002f500
mov rcx, rax
call fcn.140032940
mov rdx, rax
mov rcx, rbx
call fcn.140036200
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x14011e7a0]
movdqa xmm1, xmmword [0x14011e740]
mov dword [rbp + 0x18], 0x93e755a5
mov dword [rbp + 0x1c], 0xf0804c2
mov ecx, 0x5ec
mov eax, dword [rcx + rdi]
mov ebx, 0x1f0
test al, 1
jne 0x14002f01a
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [rdi + rbx]
mov byte [rax + 0x28], 1
lea rcx, [rax + 0x27]
lea rdx, [rbp + 0x1f]
cmp rax, rdx
ja 0x14002effc
lea rdx, [rbp - 8]
cmp rcx, rdx
jb 0x14002effc
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp + 0x18]
movsd qword [rax + 0x20], xmm0
jmp 0x14002f00d
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [rbp + 0x18]
movsd qword [rax + 0x20], xmm0
lea rcx, [0x1400ec750]
call fcn.1400e72f0
nop
lea r15, [rbx + rdi]
mov rcx, r15
call fcn.140033a30
movdqa xmm0, xmmword [0x14011ec40]
mov word [rbp - 0x68], 0xb7c6
mov ecx, 0x3c0
mov eax, dword [rcx + rdi]
mov ebx, 0x348
test al, 1
jne 0x14002f096
or eax, 1
mov dword [rcx + rdi], eax
lea rcx, [rdi + rbx]
mov byte [rcx + 0x13], 1
lea rax, [rcx + 0x12]
lea rdx, [rbp - 0x66]
cmp rcx, rdx
ja 0x14002f07a
lea rdx, [rbp - 0x78]
cmp rax, rdx
jb 0x14002f07a
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x68]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], Ordinal_143
jmp 0x14002f089
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x68]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], Ordinal_143
lea rcx, [0x1400ec780]
call fcn.1400e72f0
nop
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
lea rdi, [rbx + rsi]
mov rcx, rdi
call fcn.140033bc0
movdqa xmm0, xmmword [0x14011ec20]
mov word [rbp - 0x50], 0x515a
mov ecx, 0x578
mov eax, dword [rcx + rsi]
mov ebx, 0x5d8
test al, 1
jne 0x14002f11e
or eax, 1
mov dword [rcx + rsi], eax
lea rcx, [rsi + rbx]
mov byte [rcx + 0x13], 1
lea rax, [rcx + 0x12]
lea rdx, [rbp - 0x4e]
cmp rcx, rdx
ja 0x14002f102
lea rdx, [rbp - 0x60]
cmp rax, rdx
jb 0x14002f102
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x50]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], 0x99
jmp 0x14002f111
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x50]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], 0x99
lea rcx, [0x1400ec7b0]
call fcn.1400e72f0
nop
lea r11, [rbx + rsi]
mov rcx, r11
call fcn.140033d40
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0x10030
mov r8, rdi
mov rdx, r11
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rdi, rax
test rax, rax
jne 0x14002f2cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x14002f280
movdqa xmm0, xmmword [0x14011e830]
mov word [rbp - 0x38], 0x8952
mov ecx, 0x1e8
mov eax, dword [rcx + rsi]
mov ebx, 0x6b0
test al, 1
jne 0x14002f1ff
or eax, 1
mov dword [rcx + rsi], eax
lea rcx, [rsi + rbx]
mov byte [rcx + 0x13], 1
lea rax, [rcx + 0x12]
lea rdx, [rbp - 0x36]
cmp rcx, rdx
ja 0x14002f1e3
lea rdx, [rbp - 0x48]
cmp rax, rdx
jb 0x14002f1e3
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x38]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], Ordinal_79
jmp 0x14002f1f2
movups xmmword [rcx], xmm0
movzx eax, word [rbp - 0x38]
mov word [rcx + 0x10], ax
mov byte [rcx + 0x12], Ordinal_79
lea rcx, [0x1400ec720]
call fcn.1400e72f0
nop
mov rax, qword gs:[0x58]
mov r11, qword [rax]
add r11, rbx
mov rcx, r11
call fcn.1400338b0
mov r8d, 0x10030
mov rdx, r11
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x14002f2cc
lea rdx, [0x14002ba60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
call fcn.14002f5c0
mov rcx, rax
call fcn.140032920
mov rdx, rax
mov rcx, rbx
call fcn.140036200
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [0x14002ba60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
call fcn.14002f680
mov rcx, rax
call fcn.140032900
mov rdx, rax
mov rcx, rbx
call fcn.140036200
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x14002f354
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x14002f354
lea rdx, [0x14002ba60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, rax
call fcn.14002f740
mov rcx, rax
call fcn.1400328e0
mov rdx, rax
mov rcx, rbx
call fcn.140036200
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x60], rax
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x5c], edx
lea rcx, [rbp + 0x68]
call fcn.140018ac0
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14002f3eb
mov rdx, qword [rbp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f3e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002f3e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e71ac
mov al, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400e6df0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret