Function at 0x1400017c0
Capabilities:
Create process on windows
Delete file
Delete service
Enumerate processes
Get common file path
Terminate process

Disassembly:
push rbx
sub rsp, 0x6a0
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov qword [rsp + 0x6b0], rbp
mov r8d, 0xf003f
mov ebp, edx
xor ecx, ecx
lea rdx, str.ServicesActive
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [0x140034e10], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x140034e10], 0
mov ebx, eax
jne 0x140001831
xor r9d, r9d
lea r8, str.TqAgent
lea rdx, str.OpenSCManager
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001b55
xor ebx, ebx
mov qword [rsp + 0x6c0], rdi
xor edx, edx
mov dword [rsp + 0x30], 0x238
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400018f8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400018f8
nop dword [rax]
lea rdx, str.TqAgent.exe
lea rcx, [rsp + 0x5c]
call fcn.14000f0bc
test eax, eax
je 0x1400018b2
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001880
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001909
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x6b8], rsi
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400018f0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
mov ecx, 5
cmove ebx, ecx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x6b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140001b4d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.TqSvc
call fcn.140001340
mov ebx, eax
test eax, eax
jne 0x140001b4d
mov dword [rsp + 0x28], eax
lea r9, [0x14002cb08]
lea r8, str.whoami
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [0x14002c9a8]
call fcn.140001340
mov ebx, eax
test eax, eax
jne 0x140001b4d
lea rcx, str.TqNet
call fcn.140001340
mov ebx, eax
test eax, eax
jne 0x140001b4d
test ebp, ebp
jne 0x140001a41
mov rcx, qword [0x140034e10]
lea rdx, str.TqNet
mov r8d, 0x10024
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x1400019b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x1400019c3
cmp eax, 0x424
jne 0x140001a39
mov rcx, qword [0x140034e10]
lea rdx, [0x14002c9a8]
mov r8d, 0x10024
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x1400019eb
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x1400019fe
cmp eax, 0x424
jne 0x140001a39
mov rcx, qword [0x140034e10]
lea rdx, str.TqSvc
mov r8d, 0x10024
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140001a26
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x140001a41
cmp eax, 0x424
je 0x140001a41
test ebx, ebx
jne 0x140001b4d
call fcn.140001520
mov ebx, eax
test eax, eax
jne 0x140001b4d
call fcn.140001b90
mov ebx, eax
test eax, eax
je 0x140001a79
xor r9d, r9d
lea r8, str.TqAgent
lea rdx, [0x14002cb30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001b4d
xor edx, edx
lea rcx, [rsp + 0x480]
mov r8d, 0x208
call fcn.14000a990
xor r9d, r9d
lea rdx, [rsp + 0x480]
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x208
call fcn.14000a990
lea rcx, [rsp + 0x270]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001ad0
lea r8, [rsp + 0x480]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001af0
lea rcx, [rsp + 0x270]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001b10
movups xmm0, xmmword [str.TqAgent.lnk]
movzx eax, word [0x14002d070]
movsd xmm1, qword [0x14002d068]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov word [rcx + 0x18], ax
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ebx, ebx
mov rdi, qword [rsp + 0x6c0]
mov rcx, qword [0x140034e10]
mov rbp, qword [rsp + 0x6b0]
test rcx, rcx
je 0x140001b6f
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.1400086b0
add rsp, 0x6a0
pop rbx
ret