Function at 0x14000d618
Capabilities:
Create service
Modify service
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x650
mov qword [r11 - 0x560], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov rdi, rcx
xor r8d, r8d
lea rdx, str.CServiceModule::RegisterServer
lea rcx, [r11 - 0x4c8]
call fcn.14002de00
nop
xor ebx, ebx
lea rcx, [rsp + 0x100]
call fcn.1400039b8
nop
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x100]
call fcn.140009b88
cmp dword [rdi + 0xec], ebx
je 0x14000dbf1
call fcn.14000f4a8
xor edx, edx
xor ecx, ecx
mov r8d, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
mov qword [rsp + 0x150], rax
test rax, rax
jne 0x14000d6e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x14000d6d4
mov ecx, eax
call fcn.140032390
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
mov dword [rsp + 0xb8], 0x10
mov esi, 1
mov dword [rsp + 0xbc], esi
mov dword [rsp + 0xc0], 5
xor eax, eax
mov qword [rsp + 0xc4], rax
mov qword [rsp + 0xcc], rax
movups xmm0, xmmword [rsp + 0xb8]
movups xmmword [rdi + 0xd0], xmm0
movsd xmm1, qword [rsp + 0xc8]
movsd qword [rdi + 0xe0], xmm1
mov eax, dword [rsp + 0xd0]
mov dword [rdi + 0xe8], eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x220]
call fcn.140034b00
xor r8d, r8d
xor edx, edx
lea r13d, [rsi + 5]
mov ecx, r13d
call fcn.14000ae14
test al, al
je 0x14000d7aa
cmp qword [rdi + 0x70], 8
jb 0x14000d77f
mov r9, qword [rdi + 0x58]
jmp 0x14000d783
lea r9, [rdi + 0x58]
mov dword [rsp + 0x20], 0x80
lea r8, str.__ls___d
mov r15d, 0x104
mov edx, r15d
lea rcx, [rsp + 0x220]
call fcn.1400100fc
jmp 0x14000d7ce
lea r9, str.DigitalPersona_Authentication_Service
lea r8, [0x1400521d0]
mov r15d, 0x104
mov edx, r15d
lea rcx, [rsp + 0x220]
call fcn.1400100fc
lea rdx, [0x140051aa0]
lea rcx, [rsp + 0x128]
call fcn.140002f30
nop
cmp qword [rdi + 0x70], 8
jb 0x14000d7f0
mov r8, qword [rdi + 0x58]
jmp 0x14000d7f4
lea r8, [rdi + 0x58]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x188]
call fcn.1400022d8
nop
lea r8, [0x140051aa0]
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.140002268
mov r14, rax
lea rax, [rsp + 0x128]
cmp rax, r14
je 0x14000d855
xor r8d, r8d
mov dl, sil
lea rcx, [rsp + 0x128]
call fcn.140011b58
mov rdx, r14
lea rcx, [rsp + 0x128]
call fcn.1400111b0
nop
xor r8d, r8d
mov dl, sil
lea rcx, [rsp + 0x160]
call fcn.140011b58
nop
mov r14d, 0x10
mov r8d, r14d
mov rdx, rsi
mov rcx, qword [rsp + 0x160]
call fcn.140011434
mov qword [rsp + 0x160], rbx
xor r8d, r8d
mov dl, sil
lea rcx, [rsp + 0x188]
call fcn.140011b58
nop
mov r8d, r14d
mov rdx, rsi
mov rcx, qword [rsp + 0x188]
call fcn.140011434
mov qword [rsp + 0x188], rbx
lea rax, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rax, qword [rsp + 0x130]
cmp qword [rdi + 0x98], 8
jb 0x14000d8e6
mov rdx, qword [rdi + 0x80]
jmp 0x14000d8ed
lea rdx, [rdi + 0x80]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
lea rcx, str.RPCSS
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
lea rcx, str.BiometricGroup
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 2
mov eax, dword [rdi + 0xd0]
mov dword [rsp + 0x20], eax
mov r9d, 0xf01ff
lea r8, [rsp + 0x220]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
mov qword [rsp + 0xe0], rax
test rax, rax
jne 0x14000d97d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x14000d96a
mov ecx, eax
call fcn.140032390
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x430]
call fcn.140034b00
xor r8d, r8d
xor edx, edx
mov ecx, r13d
call fcn.14000ae14
test al, al
je 0x14000d9d5
cmp qword [rdi + 0x70], 8
jb 0x14000d9b0
mov r9, qword [rdi + 0x58]
jmp 0x14000d9b4
lea r9, [rdi + 0x58]
mov dword [rsp + 0x20], 0x81
lea r8, str.__ls___d
mov rdx, r15
lea rcx, [rsp + 0x430]
call fcn.1400100fc
jmp 0x14000d9f3
lea r9, str.Provides_user_authentication_services.
lea r8, [0x1400521d0]
mov rdx, r15
lea rcx, [rsp + 0x430]
call fcn.1400100fc
mov qword [rsp + 0x80], rbx
lea rax, [rsp + 0x430]
mov qword [rsp + 0x80], rax
lea r8, [rsp + 0x80]
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
xor r8d, r8d
xor edx, edx
mov ecx, r13d
call fcn.14000ae14
test al, al
je 0x14000da7f
lea r8, str.Add_Per_Service_SID_and_Privilagies.
xor edx, edx
lea rcx, [rsp + 0x1b0]
call fcn.140030824
mov dword [rsp + 0x74], esi
lea r8, [rsp + 0x74]
mov edx, 5
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
lea rax, [0x140052270]
mov qword [rsp + 0xd8], rax
lea r8, [rsp + 0xd8]
mov edx, r13d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
xor r8d, r8d
xor edx, edx
mov ecx, r13d
call fcn.14000ae14
test al, al
jne 0x14000dba2
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xa8], ebx
mov qword [rsp + 0xb0], rbx
mov r14d, 0x2001f
mov r9d, r14d
lea r8, str.SYSTEMCurrentControlSetControlSafeBootNetwork
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xa0]
call fcn.14000bad4
test eax, eax
jne 0x14000db7d
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x90], ebx
mov qword [rsp + 0x98], rbx
cmp qword [rdi + 0x98], 8
jb 0x14000db01
mov r8, qword [rdi + 0x80]
jmp 0x14000db08
lea r8, [rdi + 0x80]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r14, qword [rsp + 0xa0]
mov rdx, r14
lea rcx, [rsp + 0x88]
call fcn.1400081d0
test eax, eax
jne 0x14000db59
mov r9d, esi
lea r8, str.Service
lea rdx, [0x14004e958]
lea rcx, [rsp + 0x88]
call fcn.14000fea4
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14000db74
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x90], ebx
jmp 0x14000db85
mov r14, qword [rsp + 0xa0]
test r14, r14
je 0x14000db9b
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xa8], ebx
lea rcx, [rsp + 0xe0]
call fcn.140007cfc
nop
xor r8d, r8d
mov dl, sil
lea rcx, [rsp + 0x128]
call fcn.140011b58
nop
mov r8d, 0x10
mov rdx, rsi
mov rcx, qword [rsp + 0x128]
call fcn.140011434
mov qword [rsp + 0x128], rbx
lea rcx, [rsp + 0x150]
call fcn.140007cfc
jmp 0x14000dbf6
mov esi, 1
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.14000d4c8
test eax, eax
jns 0x14000dc0e
mov ecx, eax
call fcn.140032390
lea rdx, [rdi + 0xa0]
xor r8d, r8d
lea rcx, [rsp + 0xe8]
call fcn.140003744
nop
cmp qword [rdi + 0x98], 8
jb 0x14000dc39
mov r8, qword [rdi + 0x80]
jmp 0x14000dc40
lea r8, [rdi + 0x80]
mov r9d, esi
lea rdx, str.LocalService
lea rcx, [rsp + 0xe8]
call fcn.14000fea4
test eax, 0x1fff0000
je 0x14000dc6c
cmp eax, 0x80000000
jb 0x14000dc83
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14000dc83
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x70], ebx
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x78]
mov edx, esi
lea rcx, str.O:BAG:BAD:_A__CCDCLCSWRP___SY__A__CCDCLCSWRP___BA__A__CCSW___WD__A__CCDCLCSWRP___IU_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000dce5
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
lea rdx, str.LaunchPermission
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000dd00
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xe8], rbx
mov dword [rsp + 0xf0], ebx
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x14000dd22
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x100], rbx
mov dword [rsp + 0x108], ebx
jmp 0x14000dd2f
mov r8d, ebx
lea rdx, [0x14004ee5e]
lea rcx, [rsp + 0x1b0]
call fcn.140030b9c
nop
lea rcx, [rsp + 0x1b0]
call fcn.14002e7a8
mov eax, ebx
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.140033cb0
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret