Function at 0x180006cc0
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
mov qword [rax + 8], rbp
mov qword [rax + 0x20], rdi
mov qword [rax - 0x10], r12
mov r12d, ecx
xor ebx, ebx
call fcn.180007600
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x70], ebx
call fcn.18001c0d0
mov ecx, 0x1002
call fcn.1800251fc
mov rdi, rax
test rax, rax
je 0x180006d1d
mov word [rax + 0x1000], bx
mov r8, qword [rsp + 0x88]
lea rdx, str.__s___d__d
mov r9d, 0xc8
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x180006d65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180006fab
cmp qword [0x180033c68], rbx
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0x90], r13
jne 0x180006da3
mov ecx, 0x1994
call fcn.1800251fc
test rax, rax
je 0x180006d9c
mov dword [rax + 0x1990], ebx
mov qword [0x180033c68], rax
jmp 0x180006da3
mov qword [0x180033c68], rbx
lea rdx, [0x180036dcc]
mov r8d, 0xf01ff
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea r13, [0x180036fcc]
mov rsi, rax
test rax, rax
jne 0x180006e7f
cmp qword [0x180033c68], rbx
jne 0x180006e1f
mov ecx, 0x1994
call fcn.1800251fc
test rax, rax
je 0x180006df3
mov dword [rax + 0x1990], ebx
mov qword [0x180033c68], rax
jmp 0x180006e1f
mov ecx, 0x1994
mov qword [0x180033c68], rbx
call fcn.1800251fc
test rax, rax
je 0x180006e18
mov dword [rax + 0x1990], ebx
mov qword [0x180033c68], rax
jmp 0x180006e1f
mov qword [0x180033c68], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ebx
lea rdx, [0x180036dcc]
mov r9d, 0xf01ff
mov r8, r13
mov rcx, rbp
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x110
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x180006e7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180006f92
mov rax, qword [0x180033c68]
test rax, rax
jne 0x180006eb3
mov ecx, 0x1994
call fcn.1800251fc
test rax, rax
je 0x180006ea9
mov dword [rax + 0x1990], ebx
mov qword [0x180033c68], rax
jmp 0x180006eb3
mov rax, rbx
mov qword [0x180033c68], rbx
mov qword [rsp + 0xb8], r13
test rax, rax
jne 0x180006ee8
mov ecx, 0x1994
call fcn.1800251fc
test rax, rax
je 0x180006ede
mov dword [rax + 0x1990], ebx
mov qword [0x180033c68], rax
jmp 0x180006ee8
mov rax, rbx
mov qword [0x180033c68], rbx
mov qword [rsp + 0xb8], r13
test rax, rax
jne 0x180006f1a
mov ecx, 0x1994
call fcn.1800251fc
test rax, rax
je 0x180006f13
mov dword [rax + 0x1990], ebx
mov qword [0x180033c68], rax
jmp 0x180006f1a
mov qword [0x180033c68], rbx
lea r8, [rsp + 0xb8]
mov edx, 1
mov rcx, rsi
mov qword [rsp + 0xb8], r13
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
cmp qword [0x180033c68], rbx
jne 0x180006f66
mov ecx, 0x1994
call fcn.1800251fc
test rax, rax
je 0x180006f5f
mov dword [rax + 0x1990], ebx
mov qword [0x180033c68], rax
jmp 0x180006f66
mov qword [0x180033c68], rbx
cmp dword [0x1800362f0], ebx
jne 0x180006f7c
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, r12d
call fcn.1800071b0
test rsi, rsi
je 0x180006f92
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xc0]
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xb0]
test rdi, rdi
je 0x180006fc8
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0xc8]
test rcx, rcx
je 0x180006fdf
call sub.KERNEL32.dll_LocalFree
mov eax, ebx
add rsp, 0xa0
pop rbx
ret