Function at 0x140003db0
Capabilities:
Delete file
Get common file path
Query service status
Read file on windows
Start service
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x748
mov dword [rsp + 0x4f0], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x3a0], 0
mov edx, 0x105
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, str.Temp
mov edx, 0x105
lea rcx, [rsp + 0x180]
call fcn.140005b24
lea r8, [rsp + 0x180]
mov edx, 0x105
lea rcx, [rsp + 0x3e0]
call fcn.140005ab0
lea r8, str.lc7agent.dmp
mov edx, 0x105
lea rcx, [rsp + 0x3e0]
call fcn.140005b24
lea r8, [rsp + 0x180]
mov edx, 0x105
lea rcx, [rsp + 0x290]
call fcn.140005ab0
lea r8, str.lc7agent.dmp.status
mov edx, 0x105
lea rcx, [rsp + 0x290]
call fcn.140005b24
lea rcx, [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8, qword [rsp + 0x750]
mov edx, 0x105
lea rcx, [rsp + 0x70]
call fcn.140005ab0
mov r8, qword [rsp + 0x750]
mov edx, 0x105
lea rcx, [rsp + 0x500]
call fcn.140005ab0
lea r8, str..status
mov edx, 0x105
lea rcx, [rsp + 0x500]
call fcn.140005b24
mov r8d, 0x10000000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x140003efb
mov eax, 1
jmp 0x140004261
mov r8d, 0x10000000
lea rdx, [0x140011da8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x3a0], rax
cmp qword [rsp + 0x3a0], 0
jne 0x140003f3b
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 2
jmp 0x140004261
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [rsp + 0x3a8], eax
cmp dword [rsp + 0x3a8], 0
jne 0x140003fa3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x140003fa3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_with_error__d_n
call fcn.140005008
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 3
jmp 0x140004261
lea rax, [rsp + 0x3ac]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x3b8]
xor edx, edx
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140004016
cmp dword [rsp + 0x3bc], 4
je 0x140004016
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x3bc], 2
je 0x140004014
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 4
jmp 0x140004261
jmp 0x140003fa3
lea r8, [rsp + 0x40]
mov edx, 0x8a
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [rsp + 0x3b4], eax
cmp dword [rsp + 0x3b4], 0
jne 0x14000407a
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 5
jmp 0x140004261
mov byte [rsp + 0x3b0], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x628], rax
cmp qword [rsp + 0x628], 0xffffffffffffffff
je 0x1400041f7
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x610]
mov r8d, 0xc
lea rdx, [rsp + 0x618]
mov rcx, qword [rsp + 0x628]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000412d
cmp dword [rsp + 0x610], 0xc
jne 0x14000412d
cmp dword [rsp + 0x620], 1
jne 0x14000412d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x3e0]
call fcn.140003590
mov byte [rsp + 0x3b0], 1
mov rcx, qword [rsp + 0x628]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rsp + 0x620]
mov dword [rsp + 0x28], r11d
mov eax, dword [rsp + 0x61c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x618]
lea r8, str.Cur:__d_Total:__d_Finished:_d
mov edx, 0x100
lea rcx, [rsp + 0x640]
call fcn.14000619c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
lea rcx, [rsp + 0x500]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x630], rax
cmp qword [rsp + 0x630], 0
je 0x1400041f7
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x610]
mov r8d, 0xc
lea rdx, [rsp + 0x618]
mov rcx, qword [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rsp + 0x3b0]
test eax, eax
je 0x140004082
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x3a0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add rsp, 0x748
ret