Function at 0x1400e8a80
Capabilities:
Create service
Delete service
Start service

Disassembly:
push r15
sub rsp, 0xc0
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r15, rcx
mov rcx, qword [rcx + 0x58]
call fcn.1400e8860
test eax, eax
jns 0x1400e8ab3
lfence
jmp 0x1400e8e78
mov qword ss:[rsp + 0xb8], rdi
call sym.SystemInformer.exe_PhGetApplicationFileNameWin32
mov rdi, rax
test rax, rax
jne 0x1400e8ad7
mov eax, 0xc0000229
jmp 0x1400e8e70
mov r8, qword [r15 + 0x48]
lea rcx, str.__s___ras___s_
mov rdx, qword [rax + 8]
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xa0], r14
call sym.SystemInformer.exe_PhFormatString
xor r12d, r12d
mov rsi, rax
test rax, rax
je 0x1400e8b24
mov rbx, qword [rax + 8]
jmp 0x1400e8b27
mov rbx, r12
mov rbp, qword [r15 + 0x48]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x1400e8bd7
lea rax, [0x140231658]
mov r9d, 0xf01ff
mov qword [rsp + 0x60], rax
mov r8, rbp
lea rax, str.LocalSystem
mov rdx, rbp
mov qword [rsp + 0x58], rax
mov rcx, r14
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbp, rax
test rax, rax
je 0x1400e8bb5
mov rcx, r14
mov ebx, r12d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400e8bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov rbp, qword [rsp + 0x78]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400e8bec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.SystemInformer.exe_PhDosErrorToNtStatus
mov rbp, qword [rsp + 0x78]
mov ebx, eax
lea rcx, ds:[rsi - 0x10]
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400e8c0a
call fcn.14013d2a0
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400e8c1f
call fcn.14013d2a0
nop
test ebx, ebx
jns 0x1400e8c2c
lfence
jmp 0x1400e8e46
xor r8d, r8d
mov qword [rsp + 0xa8], r13
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400e8c50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400e8c66
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword ds:[r15 + 0x48]
lea r8, str.BaseNamedObjects_
mov rdx, r8
mov rcx, r8
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1400e8ca7
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x70], ecx
je 0x1400e8ca3
mov edx, ecx
shr rdx, 1
jmp 0x1400e8ce8
add rdx, 0x10
movdqu xmm0, xmmword [rdx]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x70], ecx
jne 0x1400e8cda
nop dword [rax]
movdqu xmm0, xmmword [rdx + 0x10]
add rdx, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x70], ecx
je 0x1400e8cc0
sub rdx, r8
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
mov rdi, r12
lea r13, [rdx + rdx]
and rdi, 0xfffffffffffffff1
mov ecx, r12d
and ecx, 0xf
je 0x1400e8d1d
movdqu xmm0, xmmword [rdi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
shr eax, cl
bsf ecx, eax
mov dword [rsp + 0x74], ecx
je 0x1400e8d19
mov edi, ecx
shr rdi, 1
jmp 0x1400e8d5a
add rdi, 0x10
movdqu xmm0, xmmword [rdi]
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x74], ecx
jne 0x1400e8d4c
movdqu xmm0, xmmword [rdi + 0x10]
add rdi, 0x10
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rsp + 0x74], ecx
je 0x1400e8d32
sub rdi, r12
mov eax, ecx
sar rdi, 1
shr rax, 1
add rdi, rax
mov rdx, qword [0x1402bfcf8]
add rdi, rdi
lea rbx, [rdi + r13]
lea rcx, [rbx + 0x12]
call sym.SystemInformer.exe_PhCreateObject
mov r14, rax
lea rdx, str.BaseNamedObjects_
mov r8, r13
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [r14 + 8]
call fcn.1401e3aa0
mov rcx, qword [r14 + 8]
mov r8, rdi
add rcx, r13
mov rdx, r12
call fcn.1401e3aa0
movzx eax, word [r14]
mov edi, 0x32
mov r13, qword [rsp + 0xa8]
mov word [rsp + 0x88], ax
movzx eax, word [r14]
add ax, 2
mov word [rsp + 0x8a], ax
mov rax, qword [r14 + 8]
mov qword [rsp + 0x90], rax
nop
lea rcx, [rsp + 0x88]
call fcn.1400a0740
mov ebx, eax
test eax, eax
jns 0x1400e8e11
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x80], 0xfffffffffff0bdc0
call fcn.14013c120
add edi, 0xffffffff
jne 0x1400e8de0
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], esi
cmp esi, 1
jne 0x1400e8e25
nop
call fcn.14013d2a0
test ebx, ebx
js 0x1400e8e3d
mov rdx, r15
mov ecx, 0xc
call fcn.1400a0ac0
mov ebx, eax
call fcn.1400a0920
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r12, qword [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0xc0
pop r15
ret