Function at 0x140001640
Capabilities:
Create service
Modify service
Persist via windows service
Query service status
Start service

Disassembly:
jmp 0x14000c6f0
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x180
mov qword [r11 - 0x118], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400623f0]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov rdi, rcx
lea rax, str.InstallService
mov qword [r11 - 0x110], rax
lea r15, str.__InstallService_
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 3
lea r9, [0x14004b650]
mov r8d, 0x74
lea rdx, str.RMService.cpp
lea rcx, [r11 - 0x108]
call fcn.1400010c8
mov r8, qword [rsp + 0x88]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x90]
call fcn.1400016e5
nop
call fcn.14000136b
mov rdx, rax
xor r14d, r14d
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000c7ad
mov ecx, 0x80004005
call fcn.140001064
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea rax, str.dynabook_RMService
mov qword [rsp + 0x78], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x14000c82a
mov edi, 0x80004003
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
lea r9, [0x14004b650]
mov r8d, 0x81
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0xb8]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c9b3
lea r8, [0x140064ea0]
lea rdx, str.__s_
lea rcx, [rsp + 0x70]
call fcn.1400016b8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0x10000000
mov r8, rdi
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
test rax, rax
jne 0x14000c8de
mov r8d, 0x88
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x28], r15
lea rdx, str.RMService.cpp
lea r9, [0x14004b650]
mov dword [rsp + 0x20], r14d
mov edi, 0x80004003
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c9a9
lea r8, [rsp + 0x78]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
setne al
test al, al
jne 0x14000c93e
mov edi, 0x80004005
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
lea r9, [0x14004b650]
mov r8d, 0x8a
lea rdx, str.RMService.cpp
lea rcx, [rsp + 0xe0]
call fcn.1400010c8
mov rcx, rax
mov r8d, edi
lea rdx, str.Error_Code:_0x_x
call fcn.1400016e5
jmp 0x14000c9a0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14000c974
mov r8d, 0x92
lea rcx, [rsp + 0x108]
jmp 0x14000c8a5
lea rdx, [rsp + 0x158]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [rsp + 0x15c], 1
jne 0x14000c99d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000c9c9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
nop
mov r8, qword [rsp + 0x88]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x90]
call fcn.1400016e5
mov eax, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140011b90
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret