Function at 0x140011210
Capabilities:
Create process on windows
Create service
Modify service

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x360
mov rax, qword [0x140018010]
xor rax, rsp
mov qword [rsp + 0x340], rax
xor ebx, ebx
mov esi, ecx
mov ebp, ebx
test edx, edx
jne 0x140011353
call fcn.140010b10
test eax, eax
je 0x140011353
lea rdx, str._s__r
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp esi, 1
jne 0x140011267
lea eax, [rbx + 0x61]
jmp 0x140011270
test esi, esi
jne 0x140011278
mov eax, 0x6d
mov word [rsp + 0xfa], ax
mov r8d, 0x104
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rax, str.runas
mov dword [rsp + 0x80], 0x70
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x80]
lea rax, [rsp + 0x130]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x84], 0x540
mov dword [rsp + 0xb0], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140011328
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140011349
mov edx, eax
mov ecx, 0x801
call fcn.140010d80
xor eax, eax
jmp 0x140011596
mov rcx, qword [rsp + 0xe8]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140011596
mov qword [rsp + 0x380], rdi
mov qword [rsp + 0x390], r13
mov r13d, 3
cmp esi, 1
jne 0x140011373
lea edi, [rsi + 1]
jmp 0x14001137b
test esi, esi
mov edi, ebx
cmove edi, r13d
xor edx, edx
mov qword [rsp + 0x388], r12
xor ecx, ecx
mov r8d, 0x2000b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140011568
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov r12, rax
test rax, rax
jne 0x1400113d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x801
call fcn.140010d80
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14001157e
mov r8d, 0x104
mov qword [rsp + 0x358], r14
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x140015740]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8d, r13d
lea rdx, str.ZuluServer_Agent
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x1400114cb
test edi, edi
jne 0x140011474
mov ecx, 0x1000
mov qword [rsp + 0x350], r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rsp + 0x70]
mov r8d, 0x1000
mov rdx, rax
mov rcx, r14
mov r15, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14001145d
mov edi, dword [r15 + 4]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x350]
test edi, edi
cmove edi, r13d
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x130]
mov qword [rsp + 0x48], rbx
mov r9d, 0xffffffff
mov qword [rsp + 0x40], rbx
mov r8d, edi
mov qword [rsp + 0x38], rbx
mov edx, r9d
mov qword [rsp + 0x30], rbx
mov rcx, r14
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140011530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140011548
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x130]
mov qword [rsp + 0x58], rbx
lea r8, str.ZuluServer_Agent
mov qword [rsp + 0x50], rbx
lea rdx, str.ZuluServer_Agent
mov qword [rsp + 0x48], rbx
test edi, edi
mov qword [rsp + 0x40], rbx
mov r9d, 0xf01ff
mov qword [rsp + 0x38], rax
cmove edi, r13d
mov dword [rsp + 0x30], 1
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
test rax, rax
je 0x140011540
mov rcx, r14
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140011548
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14, qword [rsp + 0x358]
test ebx, ebx
jne 0x14001157c
jmp 0x140011570
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov edx, ebp
mov ecx, 0x801
call fcn.140010d80
mov eax, ebx
mov r12, qword [rsp + 0x388]
mov rdi, qword [rsp + 0x380]
mov r13, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140013630
add rsp, 0x360
pop rsi
pop rbp
pop rbx
ret