Function at 0x1800f9430
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x1801094f8]
xor rax, rsp
mov qword [rbp + 0x298], rax
lea edi, [rcx + 0xb90]
mov qword [rbp - 0x68], r9
mov qword [rbp - 0x78], r8
mov r12, r8
mov qword [rbp - 0x70], rdx
mov eax, ecx
mov dword [rsp + 0x74], ecx
mov ebx, ecx
cmp ecx, edi
jae 0x1800f970f
mov esi, 0x63
mov r9d, 0x5524
mov r10d, 0x6e6e
mov r12d, 0x6f53
lea ecx, [rsi - 0x20]
lea edx, [rsi + 0x11]
lea r15d, [rsi + 1]
lea r13d, [rsi - 0x10]
lea r14d, [rsi - 0xc]
lea r11d, [rsi - 0x22]
lea eax, [rsi - 0x31]
lea r8d, [rsi - 0x30]
nop dword [rax]
cmp ebx, 0x3e5
ja 0x1800f95ce
je 0x1800f95b8
cmp ebx, 0x273
ja 0x1800f9554
je 0x1800f953f
mov eax, ebx
sub eax, 0x101
je 0x1800f9532
sub eax, 0x1f
je 0x1800f9523
sub eax, 0x9a
je 0x1800f9516
cmp eax, 0x1f
mov eax, 0x32
jne 0x1800f96f1
mov dword [rbp + 0x264], 0x656d61
mov word [rbp + 0x267], r15w
jmp 0x1800f96f1
mov word [rbp + 0x231], r13w
jmp 0x1800f96ec
mov dword [rbp + 0x260], 0x6e6e5524
jmp 0x1800f96ec
mov word [rbp + 0x230], r14w
jmp 0x1800f96ec
mov word [rbp + 0x232], r11w
mov word [rbp + 0x233], r12w
jmp 0x1800f96f1
mov eax, ebx
sub eax, 0x292
je 0x1800f95ac
sub eax, 0x9a
je 0x1800f9594
cmp eax, 0x1f
jne 0x1800f96ec
mov eax, 0x24
mov dword [rbp + 0x269], 0x7373616c
mov word [rbp + 0x26d], ax
mov eax, 0x30
mov word [rbp + 0x26e], ax
jmp 0x1800f96ec
mov eax, 0x6b
mov word [rbp + 0x235], si
mov word [rbp + 0x236], ax
jmp 0x1800f96ec
mov word [rbp + 0x268], cx
jmp 0x1800f96ec
mov edx, 0x65
mov word [rbp + 0x237], dx
mov edx, 0x74
jmp 0x1800f96f1
cmp ebx, 0x557
ja 0x1800f9673
je 0x1800f963d
mov eax, ebx
sub eax, 0x404
je 0x1800f962e
sub eax, 0x9a
je 0x1800f9622
cmp eax, 0x1f
mov eax, 0x32
jne 0x1800f96f1
mov word [rbp + 0x273], si
mov word [rbp + 0x274], r15w
mov dword [rbp + 0x275], 0x24636265
mov dword [rbp + 0x279], 0x24373133
jmp 0x1800f96f1
mov word [rbp + 0x238], dx
jmp 0x1800f96ec
mov dword [rbp + 0x26f], 0x65663678
jmp 0x1800f96ec
mov r8d, 0x77
mov word [rbp + 0x239], r14w
mov word [rbp + 0x280], r8w
mov r8d, 0x5f
mov word [rbp + 0x286], r8w
mov r8d, 0x33
mov dword [rbp + 0x282], 0x320073
jmp 0x1800f96f1
cmp ebx, 0x576
je 0x1800f969e
cmp ebx, 0x610
je 0x1800f9694
cmp ebx, 0x6c9
jne 0x1800f96f1
mov word [rbp + 0x28a], ax
jmp 0x1800f96f1
mov word [rbp + 0x288], r8w
jmp 0x1800f96f1
mov r8d, 2
mov byte [rbp + 0x27d], 0
lea rdx, [0x1801026bc]
mov byte [rbp + 0x240], 0
lea rcx, [rbp + 0x240]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x6e
mov r9d, 0x5524
mov word [rbp + 0x242], ax
mov r10d, 0x6e6e
lea ecx, [rax - 0x2b]
lea edx, [rax + 6]
lea r8d, [rax - 0x3b]
lea r11d, [rax - 0x2d]
mov eax, 0x32
add ebx, 0xb9
cmp ebx, edi
jb 0x1800f94c0
mov r12, qword [rbp - 0x78]
mov eax, dword [rsp + 0x74]
mov rdx, qword [rbp - 0x70]
mov r9, qword [rbp - 0x68]
lea r15d, [rax + 0x260]
cmp eax, r15d
jae 0x1800f9afc
mov rbx, qword [rsp + 0x78]
lea r8, [0x180000000]
mov r13, qword [rsp + 0x78]
xor edi, edi
mov rsi, qword [rsp + 0x78]
movzx r14d, byte [rsp + 0x70]
lea r10d, [rdi + 0x6c]
lea r11d, [rdi + 8]
cmp eax, 0x204
ja 0x1800f997b
je 0x1800f9949
add eax, 0xfffffeff
cmp eax, 0xdd
ja case.0x1800f977a.268
movzx eax, byte [r8 + rax + 0xf9b5c]
mov ecx, dword [r8 + rax*4 + 0xf9b2c]
add rcx, r8
jmp rcx
mov ebx, 0xc7
mov eax, ebx
sub eax, 0xc6
je 0x1800f9ab5
cmp eax, 1
jne 0x1800f97a9
xor r8d, r8d
lea ecx, [rax + 0x3c]
mov rdx, r12
call fcn.1800f9c50
test al, al
je 0x1800f9ae5
dec ebx
cmp ebx, 0xc5
ja 0x1800f9781
lea r8, [rbp + 0x280]
mov word [rbp + 0x294], di
lea rdx, [rbp + 0x230]
mov ecx, 0x7a
call fcn.1800fafd0
mov rbx, rax
mov qword [rsp + 0x78], rdi
jmp 0x1800f9a87
xor eax, eax
lock cmpxchg dword [r12 + 0x11c], edi
mov r13, rdi
cmp eax, 1
je 0x1800f9ac8
mov rsi, rdi
jmp case.0x1800f977a.268
mov eax, dword [str.327_]
mov r14b, 1
mov dword [rbp + 0x259], eax
movzx eax, byte [0x1801026c4]
mov byte [rbp + 0x25d], al
jmp case.0x1800f977a.268
mov dword [rbp + 0x290], 0x6c006c
jmp case.0x1800f977a.268
movsd xmm0, qword [str.5c0279e_]
movzx eax, byte [0x1801026d0]
movsd qword [rbp + 0x251], xmm0
mov byte [rbp + 0x259], al
jmp case.0x1800f977a.268
mov r8d, 4
lea rdx, [0x1801026d4]
lea rcx, [rbp + 0x243]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x1801026d8]
mov word [rbp + 0x246], ax
movzx eax, word [0x1801026dc]
mov word [rbp + 0x248], ax
movzx eax, byte [0x1801026de]
mov byte [rbp + 0x24a], al
jmp 0x1800f9a87
mov r8d, 0xa
lea rdx, [rbp + 0x250]
lea ecx, [r8 - 5]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
jmp 0x1800f9a87
mov dword [rbp + 0x28c], 0x64002e
jmp case.0x1800f977a.268
mov eax, dword [rdx]
lea r8, [rbp - 0x50]
mov dword [rbp - 0x78], eax
lea rdx, [rbp - 0x78]
mov eax, dword [r9]
mov ecx, 0x65
lea r9, [rbp - 0x80]
mov word [rsp + 0x7a], r11w
mov dword [rbp - 0x80], eax
call fcn.1800ec270
test al, al
je 0x1800f9ae5
mov dword [rsp + 0x28], 1
lea r9, [rbp - 0x50]
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call rbx
mov qword [r12], rax
jmp 0x1800f9a87
mov r8d, 5
lea rdx, str.ass_
lea rcx, [rbp + 0x24a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x30
mov word [rbp + 0x24e], ax
mov word [rbp + 0x24f], 0x78
jmp 0x1800f9a87
xor eax, eax
lock cmpxchg dword [r12 + 0x120], edi
cmp eax, 1
jne case.0x1800f977a.268
xor r8d, r8d
mov rdx, r12
mov ecx, 0x111
call fcn.1800ecdf0
xchg dword [r12 + 0x120], edi
jmp 0x1800f9afc
sub eax, 0x22a
je 0x1800f9a77
sub eax, 0x26
je 0x1800f9a1f
sub eax, 0x26
je 0x1800f9a0a
cmp eax, 0x26
jne case.0x1800f977a.268
test rsi, rsi
movzx eax, r14b
mov ecx, edi
cmovne ecx, eax
movzx r14d, cl
test cl, cl
je 0x1800f99d1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, r12
mov ecx, 0x11c
call fcn.1800f6d40
xor edx, edx
test al, al
je 0x1800f99f8
lea r9d, [rdx + 0x66]
xor r8d, r8d
mov rcx, r12
call fcn.1800e8520
jmp 0x1800f9a87
mov r9d, 0x104
mov r8, r12
xor ecx, ecx
call fcn.1800e75f0
jmp 0x1800f9a87
xor edx, edx
xor ecx, ecx
mov r8d, 0xac
call fcn.1800f3cc0
cmp rax, 2
jmp 0x1800f9a85
mov qword [rsp + 0x60], rdi
lea r8, [rbp + 0x240]
mov qword [rsp + 0x58], rdi
lea rdx, [rbp + 0x260]
mov qword [rsp + 0x50], rdi
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rdi
mov rcx, r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
jmp 0x1800f9a87
mov edx, 0x58
xor ecx, ecx
call fcn.1800e7cf0
test al, al
je 0x1800f9ae9
mov r10d, 0x6c
lea r8, [0x180000000]
lea r11d, [r10 - 0x64]
mov eax, dword [rsp + 0x74]
add eax, 0x26
mov dword [rsp + 0x74], eax
cmp eax, r15d
jae 0x1800f9afc
mov rdx, qword [rbp - 0x70]
mov r9, qword [rbp - 0x68]
jmp 0x1800f9745
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FindFirstFreeAce]
mov al, 1
jmp 0x1800f9b01
mov r9d, 0x66
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800e8520
xchg dword [r12 + 0x11c], edi
jmp 0x1800f9afc
xor al, al
jmp 0x1800f9b01
mov r9d, 0x66
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800e8520
movzx eax, byte [rsp + 0x70]
mov rcx, qword [rbp + 0x298]
xor rcx, rsp
call fcn.1800fe830
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret