Function at 0x1400036f0
Capabilities:
Create service
Delete service
Persist via windows service
Query service status
Set current directory
Start service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x540
mov rax, qword [0x1400201b0]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea r8, str.PEGAGFN
lea rcx, [rsp + 0x90]
mov edx, 0x50
call fcn.140009e60
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rbx, rax
je 0x14000379b
lea rdx, [rsp + 0x90]
mov r8d, 0xf003f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov rdi, rax
je 0x140003792
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea r8, [rsp + 0x70]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, [rsp + 0x130]
mov r8d, 0x100
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasw ax, word [rdi]
not rcx
sub ecx, 2
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x130], 0x5c
je 0x1400037ed
lea rax, [rsp + rax*2 + 0x130]
nop
sub rax, 2
sub ecx, 1
cmp word [rax], 0x5c
jne 0x1400037e0
movsxd rax, ecx
lea rcx, [rsp + 0x130]
mov word [rsp + rax*2 + 0x132], 0
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x130]
lea r8, str._s_s.sys
lea rcx, [rsp + 0x330]
mov edx, 0x100
call fcn.140003520
lea rcx, [rsp + 0x330]
xor edx, edx
call fcn.140009f10
cmp eax, 2
jne 0x140003854
mov eax, 0x80000000
jmp 0x1400039a9
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x550], rsi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov rsi, rax
jne 0x14000387e
mov eax, 0x80000001
jmp 0x1400039a1
xor edi, edi
lea rax, str.ShellSvcGroup
lea r8, [rsp + 0x90]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x90]
mov r9d, 0xf01ff
mov rcx, rsi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
mov rbx, rax
je 0x140003993
lea r8, [rsp + 0x70]
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
cmp dword [rsp + 0x74], 4
je 0x14000397d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140003933
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x80000002
jmp 0x1400039a1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x70]
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14000395c
cmp dword [rsp + 0x74], 4
je 0x14000397d
add edi, 1
cmp edi, 0xa
jl 0x140003933
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x80000004
jmp 0x1400039a1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x1400039a1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x80000003
mov rsi, qword [rsp + 0x550]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140009d20
mov rbx, qword [rsp + 0x558]
add rsp, 0x540
pop rdi
ret