Function at 0x14000b350
Capabilities:
Create service
Delete service
Modify service
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
xor esi, esi
cmp ecx, 2
jne 0x14000b669
mov rdx, qword [rdx + 8]
lea r8, str.install
mov ecx, esi
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000b52b
cmp rcx, 8
jne 0x14000b390
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000b3d4
lea rcx, [0x14002cc98]
call fcn.14000b0f0
jmp 0x14000b6b2
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000b44f
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rsi
mov r9d, 0x409
mov ebx, eax
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0x70]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rsp + 0x70]
lea rdx, str.OpenSCManager
mov r8d, ebx
lea rcx, str._ls_failed___d_:__ls
call fcn.140001010
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
jmp 0x14000b6b2
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rsi
lea r8, str.ART_Plan_Connect_Service
mov qword [rsp + 0x50], rsi
lea rdx, str.artconnect
mov qword [rsp + 0x48], rsi
mov r9d, 0xf01ff
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14000b4ce
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.CreateService
call fcn.14000b0f0
mov ebx, eax
jmp 0x14000b6b2
lea rcx, str.Service_installed_successfully_n
call fcn.140001010
lea rax, str.Consult_the_log_file_in_ProgramDataARTPlanConnectlog_for_more_information_about_the_service_and_cloud_versions_or_the_about_page_of_the_web_application_of_your_domain
mov edx, 1
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14000b510
lea rcx, [0x14002cbd8]
call fcn.14000b0f0
mov ebx, eax
jmp 0x14000b6b2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, esi
mov eax, ebx
jmp 0x14000b6b2
lea r8, str.uninstall
mov rcx, rsi
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
jne 0x14000b669
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x14000b669
add rcx, 2
cmp rcx, 0xa
jne 0x14000b540
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000b5e5
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rsi
mov r9d, 0x409
mov ebx, eax
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0x70]
mov r8d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r9, qword [rsp + 0x70]
lea rdx, str.OpenSCManager
mov r8d, ebx
lea rcx, str._ls_failed___d_:__ls
call fcn.140001010
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
jmp 0x14000b6b2
mov r8d, 0x10000
lea rdx, str.artconnect
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000b61f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.OpenService
call fcn.14000b0f0
mov ebx, eax
jmp 0x14000b6b2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14000b645
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [0x14002cc20]
call fcn.14000b0f0
mov ebx, eax
jmp 0x14000b6b2
lea rcx, str.Service_uninstalled_successfully_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, esi
mov eax, ebx
jmp 0x14000b6b2
lea rax, str.artconnect
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
lea rax, [0x14000b250]
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x88], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000b6b0
call fcn.14000b6e0
jmp 0x14000b6b2
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14000bc70
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret