Function at 0x18006be70
Capabilities:
Create service
Delete service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1800923a0]
xor rax, rsp
mov qword [rbp + 0xb8], rax
mov esi, r8d
mov qword [rbp - 0x68], rdx
mov r12, rcx
mov r13, r9
mov rcx, qword [rbp + 0x120]
mov r8, rdx
mov qword [rbp - 0x70], rcx
lea eax, [rsi + 0x591]
mov dword [rbp - 0x80], eax
cmp esi, eax
jae 0x18006c149
movzx r14d, byte [rsp + 0x70]
xor ebx, ebx
lea r15d, [rbx + 6]
movabs rdx, 0x5f004e004f
cmp esi, 0x1fd
ja 0x18006c03e
je 0x18006c01b
cmp esi, 0x15a
ja 0x18006bfa1
je 0x18006c149
mov eax, esi
sub eax, 0xa2
je 0x18006c28d
sub eax, 0x6d
je 0x18006bf92
sub eax, 4
je 0x18006bf5d
cmp eax, 9
jne 0x18006c274
mov eax, dword [0x180089396]
lea rdx, [0x180089424]
mov dword [rbp + 0x50], eax
lea rcx, [rbp + 0x58]
movzx eax, word [0x18008939a]
mov r8d, 2
mov word [rbp + 0x54], ax
mov dword [rbp + 0x56], 0x5f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18006c274
mov rdx, qword [rbp + 0x128]
mov rax, qword [rdx]
add qword [r13], rax
mov rax, qword [r13]
cmp rax, qword [rdx]
jb 0x18006c3ad
add qword [r12], rax
mov rax, qword [r12]
cmp rax, qword [r13]
jb 0x18006c3ad
add qword [rcx], rax
jmp 0x18006c274
mov rax, qword [r8]
mov ecx, dword [rax + 0x18]
mov dword [rsp + 0x78], ecx
jmp 0x18006c274
mov eax, esi
sub eax, 0x15e
je 0x18006bffb
sub eax, 9
je 0x18006bfca
sub eax, 0x42
je 0x18006c149
cmp eax, 9
jne 0x18006c274
mov word [rbp + 0x6c], bx
jmp 0x18006c274
movzx eax, word [0x18008929e]
movsd xmm0, qword [0x180089296]
mov word [rbp + 0x64], ax
mov eax, dword [0x1800892ee]
mov dword [rbp + 0x66], eax
movzx eax, word [0x1800892f2]
mov word [rbp + 0x6a], ax
movsd qword [rbp + 0x5c], xmm0
jmp 0x18006c274
mov rdx, qword [rcx]
cmp rdx, qword [r12]
jb 0x18006c3ad
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [rsp + 0x78], rax
jmp 0x18006c274
mov r8d, 3
lea rdx, [0x180089326]
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0x72], 0x20
jmp 0x18006c274
cmp esi, 0x374
ja 0x18006c125
je 0x18006c0e0
mov eax, esi
sub eax, 0x248
je 0x18006c0c4
sub eax, 0x4b
je 0x18006c094
sub eax, 0x4b
je 0x18006c07b
cmp eax, 0x4b
jne 0x18006c274
mov dword [rbp + 0xa6], 0x56
jmp 0x18006c274
mov r8, r15
lea rdx, [0x180089358]
lea rcx, [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18006c274
movups xmm0, xmmword [str.BUF_IDX]
mov eax, dword [0x180089330]
movsd xmm1, qword [str._REC]
movups xmmword [rbp + 0x7e], xmm0
mov dword [rbp + 0x7a], eax
movsd qword [rbp + 0x8c], xmm1
mov qword [rbp + 0x94], rdx
jmp 0x18006c274
mov r8d, 2
lea rdx, [0x180089354]
lea rcx, [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18006c274
mov r8d, 0xa
lea rdx, [rbp + 0xa8]
lea ecx, [r8 + 0x13]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov r8d, 0xa
mov dword [rbp + 0xac], 0x64
lea rdx, [rbp + 0xae]
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
mov byte [rsp + 0x70], 1
mov qword [rbp - 0x78], rbx
jmp 0x18006c274
mov eax, esi
sub eax, 0x3bf
je 0x18006c274
sub eax, 0x4b
je 0x18006c219
sub eax, 0x4b
je 0x18006c178
cmp eax, 0x4b
jne 0x18006c274
mov rax, qword [rsp + 0x78]
mov rcx, qword [rbp + 0xb8]
xor rcx, rsp
call fcn.180077c10
mov rbx, qword [rsp + 0x210]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x78]
mov qword [rsp + 0x60], rbx
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x58], rbx
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x18006c1e2
mov byte [rsp + 0x70], bl
call qword [0x1800924f8]
mov qword [rsp + 0x78], rax
jmp 0x18006c274
cmp byte [rsp + 0x70], bl
je 0x18006c20c
lea r8, [rbp - 0x58]
mov edx, 4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [0x1800924f8]
mov qword [rsp + 0x78], rax
jmp 0x18006c274
cmp byte [0x180092521], bl
jne 0x18006c263
mov edi, 0x127
mov eax, edi
sub eax, 0x126
je 0x18006c29c
cmp eax, 1
jne 0x18006c259
xor edx, edx
mov qword [rbp - 0x60], 0xffffffffffffffff
xor r8d, r8d
movzx r14d, al
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
movzx r14d, r14b
cmove r14d, ebx
dec edi
cmp edi, 0x125
ja 0x18006c226
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x38], rax
movups xmmword [rbp - 0x48], xmm0
add esi, 0x4b
cmp esi, dword [rbp - 0x80]
jae 0x18006c149
mov rcx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
jmp 0x18006bed8
mov rax, qword [r8]
mov ecx, dword [rax + 0x14]
mov dword [rsp + 0x78], ecx
jmp 0x18006c149
test r14b, r14b
je 0x18006c3ad
mov rsi, qword [rbp - 0x60]
lea r14, [0x180000000]
mov edi, 5
mov edx, 0x6567
mov r10d, 0x6361
lea r12d, [rdi + 0x6d]
lea r11d, [rdi + 0x66]
lea r8d, [rdi + 0x41]
lea r9d, [rdi + 0x4f]
lea ebx, [rdi + 0x3e]
cmp edi, 5
ja case.default.0x18006c2e9
mov eax, edi
mov ecx, dword [r14 + rax*4 + 0x6c3b8]
add rcx, r14
jmp rcx
mov dword [rbp + 0x42], 0x4f726f
jmp case.default.0x18006c2e9
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 0x58
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x20], 0x7d0
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymFromName]
mov rcx, rsi
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov r8d, 0x46
mov edx, 0x6567
mov r10d, 0x6361
lea r9d, [r8 + 0xe]
lea r11d, [r8 + 0x25]
jmp case.default.0x18006c2e9
xorps xmm0, xmm0
mov word [rbp + 0x45], r12w
xor eax, eax
mov dword [rbp + 0x46], 0x6e696769
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x20], rax
movups xmmword [rbp - 0x20], xmm0
mov byte [rbp + 0x4a], 0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
jmp case.default.0x18006c2e9
mov word [rbp + 0x34], r11w
mov word [rbp + 0x35], bx
mov dword [rbp + 0x36], 0x65686361
mov dword [rbp + 0x3a], 0x6f743f
jmp case.default.0x18006c2e9
mov dword [rbp + 0x3d], 0x65676172
mov word [rbp + 0x41], r8w
jmp case.default.0x18006c2e9
mov word [rbp + 0x30], r9w
mov word [rbp + 0x31], r12w
mov word [rbp + 0x32], r10w
dec edi
sub r15, 1
jne 0x18006c2d3
xor ebx, ebx
mov rax, rbx
jmp 0x18006c14e