Function at 0x14000b520
Capabilities:
Copy file
Create service
Delete service
Get common file path
Get startup folder
Modify service
Persist via windows service
Query service status
Start service
Stop service
Write file to startup folder

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x6e8]
sub rsp, 0x7d0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1400b6088]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
mov rdi, rdx
xor r14d, r14d
mov dword [rsp + 0x74], r14d
cmp ecx, 1
jle 0x14000bca6
mov rdx, qword [rdx + 8]
movzx eax, word [rdx]
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x14000bca6
add rdx, 2
lea rcx, str.install
call fcn.140063f24
test eax, eax
jne 0x14000b72d
mov r8d, 0x104
lea rdx, [rbp + 0x280]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000b5d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetModuleFileName_failed_w_err_0x_08lx_n
call fcn.14000b4a0
jmp 0x14000bd80
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14000b770
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x280]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], SafeArrayUnaccessData
mov r9d, 0xf01ff
lea r8, str.ULSTER_Update_Service
lea rbx, str.Update_Service
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x14000b66e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateService_failed_w_err_0x_08lx_n
call fcn.14000b4a0
jmp 0x14000b884
mov rdx, rbx
lea rcx, str._s_is_installed._n
call fcn.14000b4a0
mov r8d, 0xf003f
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14000b6b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.14000b4a0
jmp 0x14000b884
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x80], 1
mov dword [rbp - 0x7c], 0x1d4c0
mov dword [rbp - 0x78], 1
mov qword [rbp - 0x74], 0x1d4c0
mov dword [rbp - 0x6c], 0x1d4c0
mov dword [rbp - 0x60], 0x15180
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x58], r14
mov dword [rbp - 0x48], 3
lea rax, [rbp - 0x80]
mov qword [rbp - 0x40], rax
lea r8, [rbp - 0x60]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x14000b884
mov rdx, qword [rdi + 8]
add rdx, 2
lea rcx, str.remove
call fcn.140063f24
test eax, eax
jne 0x14000b8a4
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], eax
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000b789
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
call fcn.14000b4a0
jmp 0x14000bd80
mov r8d, 0x10024
lea rbx, str.Update_Service
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14000b7c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
call fcn.14000b4a0
jmp 0x14000b884
lea r8, [rbp - 0x80]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14000b852
mov rdx, rbx
lea rcx, str.Stopping__s.
call fcn.14000b4a0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14000b834
mov eax, dword [rbp - 0x7c]
cmp eax, 3
jne 0x14000b837
lea rcx, [0x14009fe84]
call fcn.14000b4a0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000b804
mov eax, dword [rbp - 0x7c]
mov rdx, rbx
cmp eax, 1
lea rcx, [0x14009fe88]
je 0x14000b84d
lea rcx, str._n_s_failed_to_stop._n
call fcn.14000b4a0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14000b875
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DeleteService_failed_w_err_0x_08lx_n
call fcn.14000b4a0
jmp 0x14000b884
mov rdx, rbx
lea rcx, str._s_is_removed._n
call fcn.14000b4a0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x14000bd80
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000bd80
mov rdx, qword [rdi + 8]
add rdx, 2
lea rcx, str.update
call fcn.140063f24
test eax, eax
jne 0x14000bd80
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x490]
call fcn.14005d770
mov edx, 0x104
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r14w
lea rax, [rbp + 0x490]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14000b910
lea rdx, [rbp + 0x490]
lea rcx, [rbp - 0x38]
call fcn.14000aad0
nop
movdqa xmm0, xmmword [0x1400a07e0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r14w
mov dword [rsp + 0x74], 1
mov rdx, qword [rbp - 0x28]
add rdx, 6
lea rcx, [rbp - 0x60]
call fcn.14000ad10
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
lea rcx, [rbp - 0x60]
call fcn.140005500
mov r8d, 6
lea rdx, str.Temp_
lea rcx, [rbp - 0x60]
call fcn.140005500
mov rdx, qword [rdi + 0x10]
mov r8, rbx
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000b990
lea rcx, [rbp - 0x60]
call fcn.140005500
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x38]
call fcn.140003370
movups xmmword [rbp - 0x38], xmm6
movups xmmword [rbp - 0x28], xmm7
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000ba0c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bdd0
call fcn.14003e9b0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x280]
call fcn.14005d770
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rbp + 0x280]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
lea rax, [rbp + 0x280]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14000ba51
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x80]
call fcn.14000aad0
nop
movdqa xmm0, xmmword [0x1400a07e0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r14w
mov dword [rsp + 0x74], 6
mov rdx, qword [rbp - 0x70]
add rdx, 6
lea rcx, [rbp - 0x60]
call fcn.14000ad10
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.140005500
mov r8d, 6
lea rdx, str.Temp_
lea rcx, [rbp - 0x60]
call fcn.140005500
mov rdx, qword [rdi + 0x10]
nop dword [rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14000bad0
mov r8, rbx
lea rcx, [rbp - 0x60]
call fcn.140005500
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x80]
call fcn.140003370
movups xmmword [rbp - 0x80], xmm6
movups xmmword [rbp - 0x70], xmm7
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000bb4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bdd6
call fcn.14003e9b0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x70], r14d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x40]
call fcn.1400125d0
nop
movdqa xmm0, xmmword [0x1400a07e0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r14w
mov r8d, inet_ntoa
lea rdx, str._verysilent
lea rcx, [rbp - 0x60]
call fcn.14000aad0
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x38]
call fcn.140015f00
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000bc02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bddc
call fcn.14003e9b0
nop
lea rcx, [rbp + 0x40]
call fcn.140012a40
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000bc4c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bddc
call fcn.14003e9b0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14000bd80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bddc
call fcn.14003e9b0
jmp 0x14000bd80
lea rcx, str.Parameters:_n
call fcn.14000b4a0
lea rcx, str.__install__to_install_the_service._n
call fcn.14000b4a0
lea rcx, str.__remove___to_remove_the_service._n
call fcn.14000b4a0
lea rbx, str.Update_Service
mov qword [rbp - 8], rbx
mov qword [rbp + 0x20], r14
mov dword [rbp], 0x110
mov dword [rbp + 4], 2
mov qword [rbp + 8], 5
mov qword [rbp + 0x10], r14
mov dword [rbp + 0x18], r14d
lea rbx, vtable.CSampleService.0
mov qword [rbp - 0x10], rbx
mov dword [rbp + 0x28], r14d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x14000bdb3
lea rax, [rbp - 0x10]
mov qword [0x1400bbdd0], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x60], rax
lea rax, [0x1400113b0]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000bd6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Service_failed_to_run_w_err_0x_08lx_n
call fcn.14000b4a0
mov qword [rbp - 0x10], rbx
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14000bd80
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.14003e950
lea r11, [rsp + 0x7d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rsp + 0x70], eax
lea rdx, [0x1400b3618]
lea rcx, [rsp + 0x70]
call fcn.14005d238
nop
call fcn.140060238
nop
call fcn.140060238
nop
call fcn.140060238
int3