Function at 0x140007a50
Capabilities:
Create service
Persist via windows service
Query service status
Start service

Disassembly:
push r15
xor eax, eax
mov r8d, 0x103
push r14
push r13
push r12
push rbp
push rdi
push rsi
mov rsi, rdx
xor edx, edx
push rbx
mov rbx, rcx
mov ecx, 0x3d
sub rsp, 0x1a8
lea rdi, [rsp + 0xac]
mov qword [rsp + 0xa4], rdx
lea rdx, [rsp + 0x9d]
rep stosd dword [rdi], eax
mov qword [rsp + 0x9c], 0x22
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140007abc
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Cannot_install_service___d__n
mov edx, eax
jmp 0x140007bb7
lea rdi, [rsp + 0x9c]
lea rdx, [0x14000ff5a]
mov ebp, 1
mov rcx, rdi
lea r15, [0x14000ff5c]
call sub.msvcrt.dll_strcat
mov r14, qword [0x140011010]
mov rax, qword [0x140011000]
cmp dword [rax], ebp
jle 0x140007b95
mov rdx, qword [r14]
movsxd rax, ebp
lea r12, [rdx + rax*8]
mov rdx, r15
mov r13, qword [r12]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140007b8e
lea rdx, [0x14000ff5f]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140007b38
lea rdx, [0x14000ff62]
mov rcx, r13
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140007b3c
inc ebp
jmp 0x140007b8e
lea rdx, [0x14000ff65]
mov rcx, rdi
call sub.msvcrt.dll_strcat
mov r13, qword [r12]
mov edx, 0x20
mov rcx, r13
call sub.msvcrt.dll_strchr
mov rdx, r13
test rax, rax
je 0x140007b86
lea rdx, [0x14000ff5a]
mov rcx, rdi
call sub.msvcrt.dll_strcat
mov rdx, qword [r12]
mov rcx, rdi
call sub.msvcrt.dll_strcat
lea rdx, [0x14000ff5a]
mov rcx, rdi
call sub.msvcrt.dll_strcat
inc ebp
jmp 0x140007ae6
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x74]
call fcn.140007440
test al, al
jne 0x140007bc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Service_removal_failed___d__n
mov edx, eax
call fcn.140008830
jmp 0x140007dcc
xor ebp, ebp
test rbx, rbx
je 0x140007c46
mov rcx, rbx
mov r12, qword [sym.imp.msvcrt.dll__stricmp]
lea rdx, [0x14000ff84]
call r12
lea rdx, [0x14000ff87]
test eax, eax
lea rax, str.NT_AUTHORITYLocalService
cmove rbx, rax
mov rcx, rbx
call r12
mov edx, 0x5c
test eax, eax
lea rax, str.NT_AUTHORITYNetworkService
cmove rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x140007c46
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea rcx, [rax + 3]
call fcn.14000c6c0
lea rdx, [0x14000ff8a]
mov rbp, rax
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rdx, rbx
mov rcx, rbp
mov rbx, rbp
call sub.msvcrt.dll_strcat
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x78]
lea rax, str.tcpip
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rax
xor eax, eax
lea r8, str.Key_Management_Server
lea rdx, str.vlmcsd
mov qword [rsp + 0x38], rdi
mov rdi, rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rcx, rsi
mov rbx, rax
call sub.msvcrt.dll_strlen
mov rcx, rax
xor eax, eax
rep stosb byte [rdi], al
test rbp, rbp
je 0x140007cc6
mov rcx, rbp
call sub.msvcrt.dll_free
mov rdi, qword [rsp + 0x78]
test rbx, rbx
jne 0x140007cf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateService_failed___u__n
mov edx, eax
call fcn.140008830
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140007dcc
lea rcx, str.Service_installed_successfully_n
call fcn.140008830
cmp dword [rsp + 0x74], 4
jne 0x140007dbb
lea rcx, str.Restarting_vlmcsd_service__
call fcn.14000ab50
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x84], 1
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x140007da7
mov r13, qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0xa
lea r12, [rsp + 0x80]
mov rdx, r12
mov rcx, rbx
call r13
test eax, eax
jne 0x140007d6f
mov eax, dword [rsp + 0x84]
cmp eax, 4
jne 0x140007d86
lea rcx, str.Success_n
jmp 0x140007d92
cmp dword [rsp + 0x84], 2
jne 0x140007d5a
mov ecx, 0x64
call rbp
dec esi
jne 0x140007d4d
jmp 0x140007d5a
cmp eax, 2
jne 0x140007d99
lea rcx, str.Not_ready_within_a_second_n
call fcn.14000ab50
jmp 0x140007dbb
lea rcx, str.Error_n
call fcn.140008830
jmp 0x140007dbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__u_n
mov edx, eax
call fcn.140008830
mov rcx, rbx
mov rbx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rbx
mov rcx, rdi
call rbx
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret