Function at 0x14000a830
Capabilities:
Create service
Enumerate processes
Persist via windows service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140082090]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov rdi, rcx
xor r14d, r14d
mov r8d, 0x104
lea rdx, [rbp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x290]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14000a894
call fcn.140025668
lea rcx, [rbp + 0x290]
mov qword [rbp], rcx
mov qword [rbp + 8], rbx
lea r8, [rbp]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140003f50
nop
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x70]
call fcn.1400046c0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000a912
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a90d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000af66
call fcn.140026f60
movdqa xmm0, xmmword [0x140078980]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r14w
call fcn.140025668
lea rcx, str.wsc_proxy.exe
mov qword [rbp], rcx
mov qword [rbp + 8], 0xd
lea r8, [rbp]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.140003f50
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x28]
call fcn.1400041a0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000a99b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a996
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000af6c
call fcn.140026f60
lea rdx, str._loading_the_wsc_proxy
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x28]
call fcn.1400044a0
nop
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000a9de
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp], rcx
mov qword [rbp + 8], rax
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x78], xmm0
movabs rax, 0xc000000000000000
mov qword [rsp + 0x70], rax
mov qword [rbp], 1
lea rax, [rsp + 0x70]
mov qword [rbp + 8], rax
lea rax, str.____runassvc__rpcserver
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], 0x19
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
movaps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm1
lea r8, [rbp]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.1400190f0
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rax, qword [rbp - 0x60]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, str.wsc_proxy
lea rdx, str.wsc_proxy
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x14000aacd
mov r8d, 0xf01ff
lea rdx, str.wsc_proxy
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rbx, rbx
je 0x14000ab06
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x14000aaf1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x14000ab06
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rbx
mov byte [rbp + 0x20], 1
jmp 0x14000ab0a
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000ab45
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ab40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000af72
call fcn.140026f60
movdqa xmm0, xmmword [0x140078990]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000ab91
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ab8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000af78
call fcn.140026f60
movdqa xmm0, xmmword [0x140078990]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
cmp byte [rbp + 0x20], 0
je 0x14000af7e
lea rdx, str._waiting_for_wsc_proxy__this_could_take_some_time_
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
movabs rsi, 0x311cdad160000
movabs r13, 0x7fffffffc46535fe
movabs r12, 0x7fffffffffffffff
movabs r15, 0x112e0be826d694b3
movsd xmm6, qword [0x140078978]
nop word [rax + rax]
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x38]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.1400040b0
cmp rax, r11
je 0x14000ac5e
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14000ac35
cmp cx, 0x2f
jne 0x14000ac3e
add rax, 2
cmp rax, r11
jne 0x14000ac26
cmp rax, r11
je 0x14000ac5e
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14000ac5e
cmp cx, 0x2f
je 0x14000ac5e
mov r10, rdx
cmp rax, rdx
jne 0x14000ac43
mov qword [rbp - 0x70], r10
sub r11, r10
sar r11, 1
mov qword [rbp - 0x68], r11
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x20]
call fcn.1400183e0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x20]
call fcn.140004590
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x14000ac95
mov rdi, qword [rax]
mov qword [rbp + 0x50], 0x238
mov dword [rbp + 0x58], r14d
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x70], r14
mov dword [rbp + 0x78], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x7c]
call fcn.1400294c0
xor eax, eax
mov dword [rbp + 0x284], eax
xor edx, edx
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000ad3b
nop dword [rax]
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000ad3b
lea rax, [rbp + 0x7c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ad24
add rax, 2
test ecx, ecx
jne 0x14000ad10
test edx, edx
jne 0x14000acf0
test rbx, rbx
je 0x14000ad37
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov bl, 1
jmp 0x14000ad4c
test rbx, rbx
je 0x14000ad4a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor bl, bl
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000ad8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000afa1
call fcn.140026f60
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14000addf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000afa7
call fcn.140026f60
test bl, bl
je 0x14000aedc
call fcn.140025b94
mov rbx, rax
call fcn.140025b78
cmp rbx, 0x989680
jne 0x14000ae03
imul rax, rax, 0x64
jmp 0x14000ae21
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, r13
lea rdi, [rax + 0x3b9aca00]
jle 0x14000ae30
mov rdi, r12
call fcn.140025b94
mov rbx, rax
call fcn.140025b78
cmp rbx, 0x989680
jne 0x14000ae4c
imul rbx, rax, 0x64
jmp 0x14000ae6d
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rdi, rbx
je 0x14000ac00
jl 0x14000ac00
call fcn.140025cc8
imul rcx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x14000aea2
mov rax, rsi
lea r8, [rcx + rsi]
jmp 0x14000aea6
lea r8, [rax + rcx]
add rcx, rax
mov rax, r15
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp], rdx
imul eax, edx, 0x3b9aca00
sub r8d, eax
mov dword [rbp + 8], r8d
lea rcx, [rbp]
call fcn.1400269a4
jmp 0x14000ae30
cmp byte [rbp + 0x20], 0
je 0x14000aeef
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14000aeef
call qword [rbp + 0x10]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x14000af2b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000af60
call fcn.140026f60
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140026f40
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140031cf4
nop
call fcn.140031cf4
nop
call fcn.140031cf4
nop
call fcn.140031cf4
nop
call fcn.140031cf4
int3
lea rdx, str.unable_to_load_wsc_proxy
lea rcx, [rsp + 0x70]
call fcn.140002e10
lea rdx, [0x140080490]
lea rcx, [rsp + 0x70]
call fcn.140028d28
nop
call fcn.140031cf4
nop
call fcn.140031cf4
int3