Function at 0x14001e610
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov ecx, 0x240
call qword [sym.imp.msvcrt.dll_malloc]
xor ebx, ebx
lea r14, str.HwRwDrv
lea r15, str..HwRwDrv
mov rdi, rax
test rax, rax
je 0x14001e845
xor edx, edx
mov r8d, 0x240
mov rcx, rax
call sub.msvcrt.dll_memset
lea rbp, [rdi + 0x18]
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edx, 0x104
mov rcx, rbp
call qword [0x1400386b8]
lea rsi, str.HwRwDrvx64.sys
mov edx, 0x104
mov r8, rsi
mov rcx, rbp
call qword [0x1400386c0]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 3]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001e82c
mov rcx, rax
mov qword [rdi + 8], r14
mov qword [rdi], rsi
mov qword [rdi + 0x10], r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edx, edx
lea esi, [rbx + 1]
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rdi + 0x220], rax
test rax, rax
je 0x14001e83c
mov rdx, qword [rdi + 8]
mov r9d, 0xf01ff
mov rcx, qword [rdi + 0x220]
mov r8, rdx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rdi + 0x228], rax
test rax, rax
jne 0x14001e77c
mov rdx, qword [rdi + 8]
mov r8d, 0xf01ff
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rdi + 0x228], rax
test rax, rax
je 0x14001e7c7
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14001e7d6
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x420
je 0x14001e7d6
mov rcx, qword [rdi + 0x228]
cmp esi, 1
jne 0x14001e7c1
mov esi, ebx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001e701
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001e83c
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [rdi + 0x230], rax
cmp rax, 0xffffffffffffffff
je 0x14001e83c
mov rax, rdi
jmp 0x14001ec74
xor edx, edx
mov r8d, 0x208
mov rcx, rbp
call sub.msvcrt.dll_memset
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov ecx, 0x240
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14001ea54
xor edx, edx
mov r8d, 0x240
mov rcx, rax
call sub.msvcrt.dll_memset
lea rbp, [rdi + 0x18]
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edx, 0x104
mov rcx, rbp
call qword [0x1400386b8]
lea rsi, str.HwRwDrvWin7x64.sys
mov edx, 0x104
mov r8, rsi
mov rcx, rbp
call qword [0x1400386c0]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov rcx, rbp
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001ea3b
mov rcx, rax
mov qword [rdi + 8], r14
mov qword [rdi], rsi
mov qword [rdi + 0x10], r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov esi, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rdi + 0x220], rax
test rax, rax
je 0x14001ea4b
mov rdx, qword [rdi + 8]
mov r9d, 0xf01ff
mov rcx, qword [rdi + 0x220]
mov r8, rdx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rdi + 0x228], rax
test rax, rax
jne 0x14001e98b
mov rdx, qword [rdi + 8]
mov r8d, 0xf01ff
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rdi + 0x228], rax
test rax, rax
je 0x14001e9d6
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14001e9e5
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x420
je 0x14001e9e5
mov rcx, qword [rdi + 0x228]
cmp esi, 1
jne 0x14001e9d0
mov esi, ebx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001e910
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001ea4b
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [rdi + 0x230], rax
cmp rax, 0xffffffffffffffff
je 0x14001ea4b
mov rax, rdi
jmp 0x14001ec74
xor edx, edx
mov r8d, 0x208
mov rcx, rbp
call sub.msvcrt.dll_memset
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov ecx, 0x240
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14001ec71
xor edx, edx
mov r8d, 0x240
mov rcx, rax
call sub.msvcrt.dll_memset
lea rbp, [rdi + 0x18]
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edx, 0x104
mov rcx, rbp
call qword [0x1400386b8]
lea rsi, str.WinRing0x64.sys
mov edx, 0x104
mov r8, rsi
mov rcx, rbp
call qword [0x1400386c0]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
mov rcx, rbp
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14001ec58
lea rcx, str.WinRing0_1_2_0
mov qword [rdi], rsi
mov qword [rdi + 8], rcx
lea rcx, str..WinRing0_1_2_0
mov qword [rdi + 0x10], rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov esi, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rdi + 0x220], rax
test rax, rax
je 0x14001ec68
nop dword [rax]
mov rdx, qword [rdi + 8]
mov r9d, 0xf01ff
mov rcx, qword [rdi + 0x220]
mov r8, rdx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rdi + 0x228], rax
test rax, rax
jne 0x14001ebab
mov rdx, qword [rdi + 8]
mov r8d, 0xf01ff
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rdi + 0x228], rax
test rax, rax
je 0x14001ebf6
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14001ec05
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x420
je 0x14001ec05
mov rcx, qword [rdi + 0x228]
cmp esi, 1
jne 0x14001ebf0
mov esi, ebx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001eb30
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001ec68
mov rcx, qword [rdi + 0x228]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x220]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rdi + 0x10]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [rdi + 0x230], rax
cmp rax, 0xffffffffffffffff
je 0x14001ec68
mov rbx, rdi
jmp 0x14001ec71
xor edx, edx
mov r8d, 0x208
mov rcx, rbp
call sub.msvcrt.dll_memset
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret