Function at 0x14004c340
Capabilities:
Create service
Install driver
Start service

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov rbx, rdx
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rcx, rdx
jb 0x14004c37f
mov rcx, qword [rbx]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rax
call fcn.1400d2708
lea rdi, [rsp + 0x70]
lea rsi, [rsp + 0xb0]
mov rcx, rdi
mov edx, eax
mov r8, rsi
call fcn.1400317e0
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x88], 8
jb 0x14004c3c6
mov rdi, qword [rsp + 0x70]
lea r14, [rdi + rax*2]
mov rcx, rdi
mov rdx, r14
call fcn.140031d30
mov rdx, r14
cmp rax, r14
je 0x14004c40b
mov rdx, rax
jmp 0x14004c3f9
add rdx, 2
cmp rdx, r14
je 0x14004c408
movzx eax, word [rdx]
cmp eax, 0x5c
je 0x14004c3f0
cmp eax, 0x2f
je 0x14004c3f0
jmp 0x14004c40b
mov rdx, r14
mov rax, r14
nop
cmp rax, rdx
je 0x14004c42e
movzx ecx, word [rax - 2]
add rax, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x14004c427
cmp ecx, 0x2f
jne 0x14004c410
add rax, 2
mov rdx, rax
movabs r15, 0x7ffffffffffffffe
sub r14, rdx
sar r14, 1
xorps xmm6, xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov r8, r14
call fcn.14002fbb0
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
mov r14, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
cmp rax, 8
jb 0x14004c492
mov rdi, qword [rsp + 0x90]
cmp r14, r15
ja 0x14004c9aa
cmp r14, 7
ja 0x14004c4cf
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], 7
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0xb0], xmm0
cmp rax, 8
jae 0x14004c56c
jmp 0x14004c5ac
mov qword [rsp + 0xc8], 7
mov rax, r14
or rax, 7
cmp rax, r15
ja 0x14004c9af
cmp rax, 0xb
mov r12d, 0xa
cmovae r12, rax
lea rcx, [r12 + r12]
cmp r12, 0x7ff
jb 0x14004c52a
add r15, 0xffffffffffffffee
cmp r12, r15
jae 0x14004c9af
add rcx, 0x29
call fcn.1400d1e28
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x14004c536
add rcx, 2
call fcn.1400d1e28
mov rcx, rax
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], r12
lea r8, [r14 + r14]
add r8, 2
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0xa8]
cmp rax, 8
jb 0x14004c5ac
mov rcx, qword [rsp + 0x90]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14004c5a7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004c9a4
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], 0
mov rax, qword [rsp + 0x88]
cmp rax, 8
jb 0x14004c619
mov rcx, qword [rsp + 0x70]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14004c614
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004c9a4
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x14004c92d
mov rdi, rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx]
mov r9, qword [rbx + 0x10]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
test r9, r9
je 0x14004c757
cmp rcx, 0x10
cmovae rbx, rax
lea r8, [rbx + r9]
lea r14, [rsp + 0x90]
mov rcx, r14
mov rdx, rbx
call fcn.14004caf0
cmp qword [rsp + 0xa8], 8
jb 0x14004c691
mov r14, qword [rsp + 0x90]
cmp qword [rsp + 0xc8], 8
jb 0x14004c6a4
mov rsi, qword [rsp + 0xb0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov rcx, rdi
mov rdx, rsi
mov r8, rsi
mov r9d, 0x10030
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
mov rax, qword [rsp + 0xa8]
cmp rax, 8
jb 0x14004c73d
mov rcx, qword [rsp + 0x90]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14004c738
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004c9a4
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
test rsi, rsi
jne 0x14004c7ac
cmp qword [rsp + 0xc8], 8
jb 0x14004c789
mov rdx, qword [rsp + 0xb0]
jmp 0x14004c791
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], 0
lea r14, [rsp + 0x90]
cmp qword [rsp + 0xc8], 8
jae 0x14004c69c
jmp 0x14004c6a4
lea rdx, [rsp + 0xb0]
mov rcx, rdi
mov r8d, 0x10030
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x14004c893
mov ecx, 4
call fcn.1400d1e28
mov qword [rsp + 0x90], rax
lea rcx, [rax + 4]
mov qword [rsp + 0xa0], rcx
mov dword [rax], 0xa
mov qword [rsp + 0x98], rcx
lea rbx, [rsp + 0x90]
mov rcx, rbx
call fcn.14003d930
mov ebp, eax
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14004c82c
mov rdx, qword [rsp + 0xa0]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14004c827
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14004c9a4
add rdx, 0x27
mov rcx, rax
call fcn.1400d1e6c
test bpl, bpl
je 0x14004c88b
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov r14b, 1
test eax, eax
jne 0x14004c91b
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea r8, [rsp + 0xb0]
mov rcx, rbx
call fcn.14004c9c0
cmp qword [rsp + 0xa8], 8
jb 0x14004c874
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x14004c89b
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea ecx, [rax + rax]
add ecx, 2
add eax, eax
jmp 0x14004c89f
xor r14d, r14d
jmp 0x14004c91b
xor r14d, r14d
jmp 0x14004c924
xor eax, eax
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x72], cx
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov ebx, eax
mov rax, qword [rsp + 0xa8]
cmp rax, 8
jb 0x14004c909
mov rcx, qword [rsp + 0x90]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14004c904
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004c9a4
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
cmp ebx, 0xc000010e
sete al
test ebx, ebx
setns r14b
or r14b, al
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, qword [rsp + 0xc8]
cmp rax, 8
jb 0x14004c977
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14004c972
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004c9a4
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400d2000
mov eax, r14d
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.140001300
call fcn.1400037c0
int3