Function at 0x14002e860
Capabilities:
Create service
Modify service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2fb0]
mov eax, 0x30b0
call fcn.14003f630
sub rsp, rax
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rbp + 0x2fa0], rax
mov r14, r9
mov rsi, r8
mov r12, rdx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x14002edff
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14002ee34
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x80], rbx
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14002ee3f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov rdi, 0xffffffffffffffff
test rsi, rsi
je 0x14002ea0a
cmp word [rsi], 0
je 0x14002ea0a
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x14002e920
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.140002da0
mov rbx, qword [rbp - 0x80]
cmp dword [rbx - 0x10], 0
jl 0x14002e963
lea rdx, [0x14006dba4]
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14002e963
sub rax, rbx
sar rax, 1
cmp eax, edi
jne 0x14002e9eb
lea r8, [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.1400035c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14002e9c9
cmp dword [rbx + 0x10], 0
jl 0x14002e9bb
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002e9bb
call fcn.140004a00
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14002e9b1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x80], rax
jmp 0x14002e9c9
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x80]
call fcn.140002da0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002e9e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x80]
test r14, r14
je 0x14002ea0a
mov r8, rdi
inc r8
cmp word [r14 + r8*2], 0
jne 0x14002e9f3
mov rdx, r14
lea rcx, [rbp - 0x70]
call fcn.140002da0
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14002ee4a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0xfa0]
call fcn.14005fd20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0xfff
lea rdx, [rbp + 0xfa0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r13d, r13d
test eax, eax
je 0x14002eaa5
lea rcx, [rbp + 0xfa0]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14002ea70
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14002eaa5
cmp word [rbp + rcx*2 + 0xfa0], 0x5c
je 0x14002ea9a
dec eax
dec rcx
test rcx, rcx
jg 0x14002ea83
jmp 0x14002eaa5
cdqe
mov word [rbp + rax*2 + 0xfa0], r13w
lea r9, str.srvstub.exe
lea r8, [rbp + 0xfa0]
lea rdx, str.__s_s_
lea rcx, [rbp - 0x78]
call fcn.140002f70
lea rax, str.GlobalProcessGovernorExitEvent
mov qword [rsp + 0x20], rax
lea r9, str.ProcessGovernor
mov r8, r12
lea rdx, str.___s____s___exitevent:_s
lea rcx, [rbp - 0x78]
call fcn.140015580
xor r14b, r14b
mov rax, qword [rbp - 0x70]
cmp dword [rax - 0x10], r13d
cmove rax, r13
cmp dword [rbx - 0x10], r13d
cmove rbx, r13
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], InitCommonControls
mov r9d, 0xf01ff
lea r8, str.Process_Lasso_Core__Process_Governor_
lea rdx, str.ProcessGovernor
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
je 0x14002ec0f
mov r14b, 1
mov word [rbp + 0x7a0], r13w
mov r9d, 0x3ff
lea r8, [rbp + 0x7a0]
mov edx, 0x8f
mov rcx, qword [0x1400862e0]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14002ebe2
cmp byte [0x14007fca8], r13b
je 0x14002ebae
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r13b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp + 0x7a0]
mov edx, 0x8f
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14002ebe2
mov word [rbp + 0x7a0], r13w
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14002ed99
cmp byte [rbp + 0x3010], r13b
jne 0x14002ed99
mov rsi, qword [0x1400862e0]
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14002ee29
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rsp + 0x30], r13
mov r9d, 0x400
xor edx, edx
mov ecx, 0x1200
mov dword [rsp + 0x28], 0x1000
cmp eax, 0x42d
lea rax, [rbp + 0xfa0]
mov qword [rsp + 0x20], rax
je 0x14002ecd5
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov word [rbp - 0x60], r13w
mov r9d, 0x3ff
lea r8, [rbp - 0x60]
mov edx, 0x12b
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14002ed4c
cmp byte [0x14007fca8], al
je 0x14002ecc1
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], 0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x12b
jmp 0x14002ed30
mov r8d, 0x42d
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov word [rbp - 0x60], r13w
mov r9d, 0x3ff
lea r8, [rbp - 0x60]
mov edx, 0x12a
mov rcx, rsi
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14002ed4c
cmp byte [0x14007fca8], al
je 0x14002ed1e
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], 0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0x12a
mov r9d, 0x3ff
lea r8, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14002ed4c
mov word [rbp - 0x60], r13w
lea r9, [rbp + 0xfa0]
mov r8d, ebx
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x68]
call fcn.140002f70
mov r9d, InitCommonControls
lea r8, [0x14006d5e8]
mov rbx, qword [rbp - 0x68]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002ed99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002edc1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002eddf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14002edfb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, r14b
mov rcx, qword [rbp + 0x2fa0]
xor rcx, rsp
call fcn.14003f1d0
mov rbx, qword [rsp + 0x30f0]
add rsp, 0x30b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
int3