Function at 0x1400025d0
Capabilities:
Create service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x140086080]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r12, r9
mov r15, r8
mov rsi, rdx
mov r14, qword [rbp + 0x290]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10]
call fcn.14003a810
mov r8d, 0x104
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000276c
cmp qword [0x14008a328], 0
je 0x1400026de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1400065f0
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x140002668
mov rsi, qword [rax]
mov rcx, qword [0x14008a328]
mov rdi, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
lea r8, str._ERROR___d___get_module_file_name_failed__error__d___s_.
mov edx, 1
mov rcx, qword [0x14008a328]
call qword [rdi]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400026de
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c03
call fcn.140038090
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1400065f0
mov rbx, rax
lea rdx, str.GetModuleFileName_error:
lea rcx, [0x1400885c0]
call fcn.140005690
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140002713
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140006070
mov rcx, rax
call fcn.140005900
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002bcd
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bfd
jmp 0x140002bc8
xor r13d, r13d
mov qword [rbp - 0x10], r13
mov qword [rbp], r13
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r13w
lea r8d, [r13 + 1]
lea rdx, [0x14007a37c]
lea rcx, [rbp - 0x10]
call fcn.140004f60
nop
lea rax, [rbp + 0x10]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400027a4
mov rcx, qword [rbp]
mov r8, qword [rbp + 8]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400027ee
lea rdi, [rcx + rdx]
mov qword [rbp], rdi
lea rbx, [rbp - 0x10]
cmp r8, 8
cmovae rbx, qword [rbp - 0x10]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x10]
call fcn.14003a160
mov word [rbx + rdi*2], r13w
jmp 0x140002800
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x10]
lea rcx, [rbp - 0x10]
call fcn.140005b20
mov rdx, qword [rbp]
mov r8, qword [rbp + 8]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x14000283b
lea rcx, [rdx + 1]
mov qword [rbp], rcx
lea rax, [rbp - 0x10]
cmp r8, 8
cmovae rax, qword [rbp - 0x10]
mov r8d, 0x22
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], r13w
jmp 0x140002859
mov qword [rsp + 0x20], 1
lea r9, [0x14007a37c]
mov edx, 1
lea rcx, [rbp - 0x10]
call fcn.140005b20
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rax, qword [rbp - 0x10]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
mov r8, r15
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x140002a67
mov rbx, qword [0x14008a328]
test rbx, rbx
je 0x1400028eb
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea r8, str._INFO___d___create_service_success.
mov edx, 3
mov rcx, qword [0x14008a328]
call qword [rbx]
lea rdx, str.Service_created.
lea rcx, [0x1400885c0]
call fcn.140005690
mov rcx, rax
call fcn.140005900
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_1f44c9355453767ec32f8ea9824ac61f___bool__struct_SC_HANDLE______ptr64_.0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r12
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov r8d, 0x1a
lea rdx, str.Service_description_added.
lea rcx, [rsp + 0x70]
call fcn.140005100
nop
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov r8d, 0x14
lea rdx, str.ChangeServiceConfig2
lea rcx, [rbp - 0x70]
call fcn.140005100
nop
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8, r14
mov rdx, rsi
call fcn.1400030b0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400029e8
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c09
call fcn.140038090
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002a34
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c0f
call fcn.140038090
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140002b91
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140002b91
cmp qword [0x14008a328], 0
je 0x140002b0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1400065f0
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x140002a94
mov rsi, qword [rax]
mov rcx, qword [0x14008a328]
mov rdi, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
lea r8, str._ERROR___d___create_service_failed__error__d___s_.
mov edx, 1
mov rcx, qword [0x14008a328]
call qword [rdi]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002b0a
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c15
call fcn.140038090
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1400065f0
mov rbx, rax
lea rdx, str.CreateService_error:
lea rcx, [0x1400885c0]
call fcn.140005690
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140002b3f
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140006070
mov rcx, rax
call fcn.140005900
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002b91
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002c1b
call fcn.140038090
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140002bcd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002bf7
call fcn.140038090
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140038070
mov rbx, qword [rsp + 0x370]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14003eae4
int3
call fcn.14003eae4
int3
call fcn.14003eae4
nop
call fcn.14003eae4
nop
call fcn.14003eae4
nop
call fcn.14003eae4
int3
call fcn.14003eae4
int3