Function at 0x14001f048
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r15d, edx
mov rbx, rcx
mov r13b, 1
mov bpl, r13b
mov byte [rsp + 0x150], r13b
xor r12d, r12d
mov r14b, r12b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], r12
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0xa0], 0x68
mov qword [rsp + 0xa8], r12
xor edx, edx
lea r8d, [r12 + 0x58]
lea rcx, [rsp + 0xb0]
call fcn.14010c6c0
mov rcx, rbx
call fcn.14001d49c
mov qword [rsp + 0x50], rax
mov ebx, r12d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x64], r12d
mov byte [rsp + 0x160], r12b
mov byte [rsp + 0x168], r12b
mov qword [rsp + 0x90], r12
mov byte [rsp + 0x60], r12b
lea r8d, [r12 + 0x10]
mov rdx, rax
lea rcx, str._Service
call fcn.14010cc50
lea edx, [r12 + 9]
lea esi, [rdx + 0x17]
mov rcx, qword [rsp + 0x50]
cmp eax, r12d
jne 0x14001f15a
cmp dx, word [rcx + 0x10]
ja 0x14001f149
cmp word [rcx + 0x10], 0xd
jbe 0x14001f14f
cmp si, word [rcx + 0x10]
jne 0x14001f15a
add rcx, 0x12
mov qword [rsp + 0x50], rcx
jmp 0x14001f1ba
mov edi, 0x1e
mov r8, rdi
mov rdx, rcx
lea rcx, str._InstallService
call fcn.14010cc50
mov rcx, qword [rsp + 0x50]
cmp eax, r12d
jne 0x14001f227
lea edx, [rdi - 0x15]
cmp dx, word [rcx + 0x1e]
ja 0x14001f18f
cmp word [rcx + 0x1e], 0xd
jbe 0x14001f199
cmp si, word [rcx + 0x1e]
jne 0x14001f227
mov r8, rdi
lea rdx, [0x140146808]
call fcn.14010cd30
mov rcx, qword [rsp + 0x50]
add rcx, rsi
mov qword [rsp + 0x50], rcx
mov edx, 9
call fcn.14001d278
mov qword [rsp + 0x50], rax
mov al, byte [0x1401958af]
cmp al, 1
jne 0x14001f1e1
mov rcx, qword [rsp + 0x50]
call fcn.1400296d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx]
cmp ax, r12w
je 0x14001f2c7
cmp dx, ax
ja 0x14001f202
cmp ax, 0xd
jbe 0x14001f2d5
cmp si, ax
je 0x14001f2ce
add rcx, 2
mov qword [rsp + 0x50], rcx
mov ax, word [rcx]
cmp ax, r12w
jne 0x14001f1f3
mov edi, 9
jmp 0x14001f2da
mov r8d, 0x1c
mov rdx, rcx
lea rcx, str._RemoveService
call fcn.14010cc50
cmp eax, r12d
jne 0x14001f2bb
mov rcx, qword [rsp + 0x50]
mov edi, 9
cmp di, word [rcx + 0x1c]
ja 0x14001f258
cmp word [rcx + 0x1c], 0xd
jbe 0x14001f25e
cmp si, word [rcx + 0x1c]
jne 0x14001f2da
add rcx, 0x1e
call fcn.14001d278
mov qword [rsp + 0x50], rax
mov al, byte [0x1401958af]
cmp al, 1
jne 0x14001f289
mov rcx, qword [rsp + 0x50]
call fcn.14001ff80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx]
cmp ax, r12w
je 0x14001f2da
cmp di, ax
ja 0x14001f2a2
cmp ax, 0xd
jbe 0x14001f2da
cmp si, ax
je 0x14001f2da
add rcx, 2
mov qword [rsp + 0x50], rcx
mov ax, word [rcx]
cmp ax, r12w
jne 0x14001f297
jmp 0x14001f2da
mov rcx, qword [rsp + 0x50]
mov edi, 9
jmp 0x14001f2da
mov edi, 9
jmp 0x14001f2da
mov edi, 9
jmp 0x14001f2da
mov edi, 9
call fcn.14001d278
mov qword [rsp + 0x50], rax
cmp word [rax], r12w
je 0x14001f755
mov r8d, 2
lea rdx, [rsp + 0x50]
lea rcx, [0x140146978]
call fcn.140065780
cmp al, r12b
jne 0x14001f736
mov r8d, 5
lea rdx, [rsp + 0x50]
lea rcx, str.__job
call fcn.140065780
cmp al, r12b
je 0x14001f33e
mov bpl, 1
mov byte [rsp + 0x150], bpl
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, 7
lea rdx, [rsp + 0x50]
lea rcx, str.__nojob
call fcn.140065780
cmp al, r12b
je 0x14001f36e
mov bpl, r12b
mov byte [rsp + 0x150], r12b
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, 6
lea rdx, [rsp + 0x50]
lea rcx, [0x14014695c]
call fcn.140065780
cmp al, r12b
je 0x14001f3a3
mov byte [rsp + 0x160], 1
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, 6
lea rdx, [rsp + 0x50]
lea rcx, str.__wait
call fcn.140065780
cmp al, r12b
je 0x14001f3d3
mov r13b, 1
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, 8
lea rdx, [rsp + 0x50]
lea rcx, str.__nowait
call fcn.140065780
cmp al, r12b
je 0x14001f403
mov r13b, r12b
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov ebx, 0xa
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea rcx, str.__idlewait
call fcn.140065780
cmp al, r12b
je 0x14001f43a
mov byte [rsp + 0x168], 1
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, 6
lea rdx, [rsp + 0x50]
lea rcx, str.__idle
call fcn.140065780
cmp al, r12b
je 0x14001f488
mov dword [rsp + 0x64], r12d
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x50]
call fcn.14001d4bc
cmp eax, r12d
je 0x14001f5cc
mov ebx, dword [rsp + 0x64]
mov dword [rsp + 0x58], ebx
mov bpl, byte [rsp + 0x150]
jmp 0x14001f6ed
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea rcx, str.__killwin2
call fcn.140065780
cmp al, r12b
je 0x14001f4b5
mov r14b, 1
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, edi
lea rdx, [rsp + 0x50]
lea rcx, str.__killwin
call fcn.140065780
cmp al, r12b
je 0x14001f52b
mov rax, qword [rsp + 0x50]
mov rdx, rax
movzx ecx, word [rax]
cmp cx, r12w
je 0x14001f501
cmp di, cx
ja 0x14001f4ea
cmp cx, 0xd
jbe 0x14001f501
cmp si, cx
je 0x14001f501
add rax, 2
mov qword [rsp + 0x50], rax
mov cx, word [rax]
cmp cx, r12w
jne 0x14001f4df
sub rax, rdx
sar rax, 1
or r9d, 0xffffffff
mov r8d, eax
lea rcx, [0x14019bd78]
call fcn.140063440
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, 0xe
lea rdx, [rsp + 0x50]
lea rcx, str.__delayservice
call fcn.140065780
cmp al, r12b
je 0x14001f5dd
mov dword [rsp + 0x64], r12d
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x50]
call fcn.14001d4bc
cmp eax, r12d
je 0x14001f5cc
cmp r15d, 1
jne 0x14001f5cc
mov ecx, dword [rsp + 0x64]
add ecx, 0x63
mov eax, 0x51eb851f
imul ecx
mov ebx, edx
sar ebx, 5
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov al, byte [0x1401958af]
cmp al, r12b
jle 0x14001f5ab
sub ebx, 1
js 0x14001f5ab
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11b, byte [0x1401958af]
cmp r11b, r12b
jg 0x14001f58f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x64]
mov dword [0x14019bd04], eax
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f6ed
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea rcx, str.__idlequit
call fcn.140065780
cmp al, r12b
je 0x14001f703
mov rax, qword [rsp + 0x50]
mov rdi, rax
movzx ecx, word [rax]
cmp cx, r12w
je 0x14001f637
mov edx, 9
cmp dx, cx
ja 0x14001f61b
cmp cx, 0xd
jbe 0x14001f637
cmp si, cx
je 0x14001f637
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
mov cx, word [rax]
cmp cx, r12w
jne 0x14001f610
mov rbx, qword [rsp + 0x50]
sub rbx, rdi
sar rbx, 1
cmp ebx, r12d
jle 0x14001f6e1
lea ebp, [rbx + rbx + 4]
lea eax, [rbp + 8]
movsxd r12, eax
mov r8, r12
xor edx, edx
mov rcx, qword [0x14019c338]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x14001f67c
lea ecx, [rax + 2]
call fcn.140063030
cmp eax, 4
je 0x14001f655
mov dword [rsi + 4], 0xaa55
mov dword [rsi], ebp
add rsi, 8
mov qword [rsp + 0x90], rsi
mov eax, 0x2a
cmp ax, word [rdi]
je 0x14001f6a5
mov eax, 0x21
cmp ax, word [rdi]
jne 0x14001f6b1
mov al, byte [rdi]
mov byte [rsp + 0x60], al
add rdi, 2
dec ebx
movsxd rax, ebx
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14010cd30
xor r12d, r12d
mov word [rbx + rsi], r12w
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
lea esi, [r12 + 0x20]
jmp 0x14001f6ed
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.14001d278
mov qword [rsp + 0x50], rax
mov edi, 9
jmp 0x14001f72a
mov rax, qword [rsp + 0x50]
mov ecx, 0x3d
cmp cx, word [rax]
jne 0x14001f749
add rax, 2
mov qword [rsp + 0x50], rax
mov r13b, 1
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
cmp word [rax], r12w
jne 0x14001f2ee
jmp 0x14001f755
mov rax, qword [rsp + 0x50]
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
jmp 0x14001f755
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
mov rcx, rax
call fcn.14001d278
mov qword [rsp + 0x50], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r15d, r15d
cmp ebx, r15d
jbe 0x14001f7a3
mov ecx, ebx
call fcn.14001d1a8
mov rbx, qword [0x14019bd70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x11
cmp eax, ecx
cmovge eax, ecx
movsxd rcx, eax
lea rdi, [rbx + rcx*2]
lea edx, [rax + rsi + 0xa0]
lea rcx, [rsp + 0x88]
call fcn.140063580
nop
mov eax, 0x3d
cmp ax, word [rdi]
jne 0x14001f7ea
add rdi, 2
mov r13b, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea ecx, [rbx + 1]
movsxd r8, ecx
add r8, r8
mov rdx, rdi
mov rcx, qword [rsp + 0x88]
call fcn.14010cd30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x88]
lea rcx, [rcx + rbx*2]
inc eax
movsxd r8, eax
add r8, r8
mov rdx, qword [rsp + 0x50]
call fcn.14010cd30
cmp byte [rsp + 0x160], r15b
je 0x14001f853
or dword [rsp + 0xdc], 1
mov word [rsp + 0xe0], r15w
lea rdx, [0x1401468d8]
mov rcx, qword [rsp + 0x88]
call fcn.14001d388
cmp rax, r15
je 0x14001f893
movzx eax, word [rax + 0x10]
cmp ax, r15w
je 0x14001f890
mov edx, 9
cmp dx, ax
ja 0x14001f886
cmp ax, 0xd
jbe 0x14001f890
mov ecx, 0x20
cmp cx, ax
jne 0x14001f893
mov r12b, 1
or dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x68], 8
mov dword [rsp + 0x6c], r15d
mov al, byte [0x1401958af]
cmp al, r15b
jle 0x14001fc92
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r15d
je 0x14001fc92
cmp r14b, r15b
je 0x14001f94c
mov al, byte [0x14019c661]
test al, 8
jne 0x14001f92f
or al, 8
mov byte [0x14019c661], al
mov edx, 2
lea rcx, str.SeShutdownPrivilege
call fcn.14002e788
mov al, byte [0x14019c661]
test al, 4
jne 0x14001f94c
or al, 4
mov byte [0x14019c661], al
mov edx, 2
lea rcx, str.SeDebugPrivilege
call fcn.14002e788
cmp bpl, r15b
je 0x14001f970
mov rax, qword [0x14019bdb0]
cmp rax, r15
jne 0x14001f97c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov qword [0x14019bdb0], rax
jmp 0x14001f977
mov rax, qword [0x14019bdb0]
cmp rax, r15
je 0x14001f98a
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rbx, 0xffffffffffffffff
mov r8, rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov r11, qword [0x14019bd08]
cmp r11, r15
je 0x14001f9d7
mov rcx, qword [0x14019bd08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14019bd08], r15
mov rax, qword [rsp + 0x70]
mov qword [0x14019bd08], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8, rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
cmp dword [rsp + 0x58], r15d
jbe 0x14001fc2c
mov ebx, 0x103
mov dword [rsp + 0x5c], ebx
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
cmp byte [rsp + 0x168], r15b
je 0x14001fa8f
mov al, byte [0x1401958af]
cmp al, r15b
jl 0x14001fa73
mov edx, 0x64
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5c], ebx
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x5c], ebx
jne 0x14001fa73
mov al, byte [0x1401958af]
cmp al, r15b
jge 0x14001fa3e
mov r9b, r12b
lea r8, [0x14019bdb0]
mov dl, r14b
lea rcx, [rsp + 0x70]
call fcn.14001ef88
jmp 0x14001fc92
cmp r12b, r15b
je 0x14001fbb2
mov al, byte [0x1401958af]
cmp al, r15b
jle 0x14001fc92
mov edi, 0xc8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov ebx, eax
mov esi, r15d
mov cl, byte [0x1401958af]
cmp cl, r15b
jle 0x14001fb15
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov r11d, dword [rsp + 0x6c]
sub r11d, dword [0x14019bd04]
cmp r11d, r15d
jg 0x14001fb15
cmp r13b, r15b
je 0x14001fb15
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov ecx, eax
sub ecx, ebp
cmp ecx, 0x64
jae 0x14001fb15
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 3
jl 0x14001fab9
sub ebx, ebp
mov cl, byte [0x1401958af]
mov edx, dword [0x14019bd04]
mov r8d, dword [rsp + 0x6c]
cmp cl, r15b
jle 0x14001fb63
mov eax, r8d
sub eax, edx
cmp eax, r15d
jg 0x14001fb63
cmp r13b, r15b
je 0x14001fb41
cmp ebx, 0x64
jb 0x14001fb63
cmp ebx, edi
jae 0x14001fb4f
mov ecx, edi
sub ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x1401958af]
cmp al, r15b
jg 0x14001faac
jmp 0x14001fc92
mov eax, r8d
sub eax, edx
cmp eax, r15d
cmovg edx, r8d
mov dword [0x14019bd04], edx
mov r9b, r12b
lea r8, [0x14019bdb0]
mov dl, r14b
lea rcx, [rsp + 0x70]
call fcn.14001ef88
mov rax, qword [rsp + 0x90]
cmp rax, r15
je 0x14001fba8
mov r8b, 1
mov dl, byte [rsp + 0x60]
mov rcx, rax
call fcn.14001d5c4
mov dword [rsp + 0x5c], r15d
jmp 0x14001fc92
mov al, byte [0x1401958af]
cmp al, r15b
jl 0x14001fc13
mov edi, 0xc8
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14001fbe1
cmp eax, r15d
jne 0x14001fbe1
cmp dword [rsp + 0x5c], ebx
jne 0x14001fc13
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov r11d, dword [rsp + 0x6c]
mov eax, r11d
sub eax, dword [0x14019bd04]
cmp eax, r15d
jg 0x14001fc0c
mov al, byte [0x1401958af]
cmp al, r15b
jge 0x14001fbc2
jmp 0x14001fc13
mov dword [0x14019bd04], r11d
xor r9d, r9d
lea r8, [0x14019bdb0]
mov dl, r14b
lea rcx, [rsp + 0x70]
call fcn.14001ef88
jmp 0x14001fc92
mov dword [rsp + 0x5c], r15d
cmp r13b, r15b
je 0x14001fc92
mov al, byte [0x1401958af]
cmp al, r15b
jl 0x14001fc7b
mov ebx, 0x103
mov edx, 0x64
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x5c], ebx
lea rdx, [rsp + 0x5c]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x5c], ebx
jne 0x14001fc7b
mov al, byte [0x1401958af]
cmp al, r15b
jge 0x14001fc46
mov r9b, r12b
lea r8, [0x14019bdb0]
mov dl, r14b
lea rcx, [rsp + 0x70]
call fcn.14001ef88
mov ebx, dword [rsp + 0x5c]
lea rcx, [rsp + 0x88]
call fcn.14005b520
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret