Function at 0x40175b
Capabilities:
Accept command line arguments
Create process on windows
Impersonate user
Query service status
Start service

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
call rax
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0xa4]
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call rax
mov qword [rbp + 0xd0], rax
lea rax, [rbp + 0xa3]
mov r9, rax
mov r8d, 0
mov edx, 1
mov ecx, 0x14
mov rax, qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call rax
mov r8d, 1
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call rax
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x401823
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.OpenSCManager
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
mov rax, qword [rbp + 0xc8]
mov r8d, 0x14
lea rdx, str.TrustedInstaller
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenServiceW]
call rax
mov qword [rbp + 0xc0], rax
cmp qword [rbp + 0xc0], 0
jne 0x401889
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.OpenServiceW
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
mov rax, qword [rbp + 0xc0]
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_StartServiceW]
call rax
test eax, eax
sete al
test al, al
je 0x401903
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0xbc], eax
cmp dword [rbp + 0xbc], 0x420
je 0x401903
mov eax, dword [rbp + 0xbc]
mov ecx, eax
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.StartServiceW
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
lea rcx, [rbp + 0x70]
mov rax, qword [rbp + 0xc0]
lea rdx, [rbp + 0x6c]
mov qword [rsp + 0x20], rdx
mov r9d, 0x24
mov r8, rcx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
call rax
test eax, eax
sete al
test al, al
je 0x401954
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x401903
mov eax, dword [rbp + 0x8c]
mov dword [rbp + 0xb8], eax
call sym.getSysToken__
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call rax
test eax, eax
sete al
test al, al
je 0x4019bd
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.ImpersonateLoggedOnUser
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
lea rax, [rbp + 0xa3]
mov r9, rax
mov r8d, 0
mov edx, 1
mov ecx, 0x14
mov rax, qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call rax
mov eax, dword [rbp + 0xb8]
mov r8d, eax
mov edx, 0
mov ecx, 0x1000
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x401a42
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.OpenProcess_TrustedInstaller
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
lea rdx, [rbp + 0x98]
mov rax, qword [rbp + 0xa8]
mov r8, rdx
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call rax
test eax, eax
sete al
test al, al
je 0x401aa2
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.OpenProcessToken_TrustedInstaller
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
mov rax, qword [rbp + 0x98]
lea rdx, [rbp + 0x60]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
mov r9d, 2
mov r8d, 0
mov edx, 0x2000000
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call rax
test eax, eax
sete al
test al, al
je 0x401b15
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.DuplicateTokenEx_TrustedInstaller
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
lea rax, [rbp - 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x10], 0x68
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, str.WinSta0Default
mov qword [rbp], rax
mov eax, dword [rbp + 0xa4]
cmp eax, 1
jle 0x401b6d
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax + 8]
jmp 0x401b74
lea rax, str.C:Windows_system32cmd.exe
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
call rax
test eax, eax
sete al
test al, al
je 0x401bf6
mov ecx, 0xfffe40ae
call sym.PrintLastError_unsigned_long_
mov r9d, 0
mov r8d, 0
lea rdx, str.CreateProcessWithTokenW
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov eax, 0
jmp 0x401bfb
mov eax, 0
add rsp, 0x160
pop rbp
ret