Function at 0x140006278
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Create process on windows
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov r13b, 1
xor esi, esi
mov r15d, edx
mov byte [rsp + 0x160], r13b
mov r14b, sil
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor eax, eax
lea r8d, [rsi + 0x58]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0xa0], 0x68
mov qword [rsp + 0xa8], rsi
call fcn.1400b93b0
mov rcx, rbx
call fcn.140004230
lea r8d, [rsi + 0x10]
lea rcx, str._Service
mov ebx, esi
mov rdx, rax
mov dword [rsp + 0x64], esi
mov qword [rsp + 0x50], rax
mov bpl, sil
mov byte [rsp + 0x150], sil
mov dword [rsp + 0x58], ebx
mov byte [rsp + 0x168], sil
mov qword [rsp + 0x98], rsi
mov byte [rsp + 0x60], sil
call fcn.1400b9740
mov rcx, qword [rsp + 0x50]
lea edx, [rsi + 9]
lea r12d, [rsi + 0x20]
cmp eax, esi
jne 0x140006371
cmp dx, word [rcx + 0x10]
ja 0x140006364
cmp word [rcx + 0x10], 0xd
jbe 0x14000636b
cmp r12w, word [rcx + 0x10]
jne 0x140006371
add rcx, 0x12
jmp 0x1400063ca
mov rdx, rcx
mov edi, 0x1e
lea rcx, str._InstallService
mov r8, rdi
call fcn.1400b9740
mov rcx, qword [rsp + 0x50]
cmp eax, esi
jne 0x140006427
lea r10d, [rdi - 0x15]
cmp r10w, word [rcx + 0x1e]
ja 0x1400063a7
cmp word [rcx + 0x1e], 0xd
jbe 0x1400063ae
cmp r12w, word [rcx + 0x1e]
jne 0x140006427
lea rdx, [0x1400d69f8]
mov r8, rdi
call fcn.1400177f8
mov rcx, qword [rsp + 0x50]
mov edx, 9
add rcx, r12
mov qword [rsp + 0x50], rcx
call fcn.140004084
mov qword [rsp + 0x50], rax
mov al, byte [0x1400ef217]
mov rcx, qword [rsp + 0x50]
cmp al, 1
jne 0x140006410
call fcn.140011474
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dx, ax
ja 0x140006401
cmp ax, 0xd
jbe 0x140006418
cmp r12w, ax
je 0x140006418
add rcx, 2
mov qword [rsp + 0x50], rcx
movzx eax, word [rcx]
cmp ax, si
jne 0x1400063f6
mov edi, 9
call fcn.140004084
jmp 0x140006857
mov rdx, rcx
lea rcx, str._RemoveService
mov r8d, 0x1c
call fcn.1400b9740
mov rcx, qword [rsp + 0x50]
mov edi, 9
cmp eax, esi
jne 0x14000641d
cmp di, word [rcx + 0x1c]
ja 0x140006457
cmp word [rcx + 0x1c], 0xd
jbe 0x14000645e
cmp r12w, word [rcx + 0x1c]
jne 0x14000641d
add rcx, 0x1e
call fcn.140004084
mov qword [rsp + 0x50], rax
mov al, byte [0x1400ef217]
mov rcx, qword [rsp + 0x50]
cmp al, 1
jne 0x1400064a3
call fcn.140007130
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp di, ax
ja 0x140006494
cmp ax, 0xd
jbe 0x14000641d
cmp r12w, ax
je 0x14000641d
add rcx, 2
mov qword [rsp + 0x50], rcx
movzx eax, word [rcx]
cmp ax, si
jne 0x140006489
jmp 0x14000641d
lea rdx, [rsp + 0x50]
lea rcx, [0x1400d6b40]
mov r8d, 2
call fcn.14004e558
cmp al, sil
jne 0x140006867
lea rdx, [rsp + 0x50]
lea rcx, str.__job
mov r8d, 5
call fcn.14004e558
cmp al, sil
je 0x1400064f9
mov byte [rsp + 0x160], 1
jmp 0x14000681d
lea rdx, [rsp + 0x50]
lea rcx, str.__nojob
mov r8d, 7
call fcn.14004e558
cmp al, sil
je 0x140006522
mov byte [rsp + 0x160], sil
jmp 0x14000681d
lea rdx, [rsp + 0x50]
lea rcx, [0x1400d6b24]
mov r8d, 6
call fcn.14004e558
cmp al, sil
je 0x14000654e
mov bpl, 1
mov byte [rsp + 0x150], bpl
jmp 0x140006825
lea rdx, [rsp + 0x50]
lea rcx, str.__wait
mov r8d, 6
call fcn.14004e558
cmp al, sil
je 0x140006572
mov r13b, 1
jmp 0x14000681d
lea rdx, [rsp + 0x50]
lea rcx, str.__nowait
mov r8d, 8
call fcn.14004e558
cmp al, sil
je 0x140006596
mov r13b, sil
jmp 0x14000681d
mov ebx, 0xa
lea rdx, [rsp + 0x50]
lea rcx, str.__idlewait
mov r8d, ebx
call fcn.14004e558
cmp al, sil
je 0x1400065c1
mov byte [rsp + 0x168], 1
jmp 0x14000681d
lea rdx, [rsp + 0x50]
lea rcx, str.__idle
mov r8d, 6
call fcn.14004e558
cmp al, sil
je 0x14000660d
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x64], esi
call fcn.140004250
cmp eax, esi
je 0x14000681d
mov ebx, dword [rsp + 0x64]
mov bpl, byte [rsp + 0x150]
mov dword [rsp + 0x58], ebx
jmp 0x140006829
lea rdx, [rsp + 0x50]
lea rcx, str.__killwin2
mov r8d, ebx
call fcn.14004e558
cmp al, sil
je 0x14000662e
mov r14b, 1
jmp 0x14000681d
lea rdx, [rsp + 0x50]
lea rcx, str.__killwin
mov r8d, edi
call fcn.14004e558
cmp al, sil
je 0x140006691
mov rax, qword [rsp + 0x50]
mov rdx, rax
jmp 0x14000666b
cmp di, cx
ja 0x14000665c
cmp cx, 0xd
jbe 0x140006673
cmp r12w, cx
je 0x140006673
add rax, 2
mov qword [rsp + 0x50], rax
movzx ecx, word [rax]
cmp cx, si
jne 0x140006651
sub rax, rdx
lea rcx, [0x1400f19a8]
or r9d, 0xffffffff
sar rax, 1
mov r8d, eax
call fcn.14004bdac
jmp 0x14000681d
lea rdx, [rsp + 0x50]
lea rcx, str.__delayservice
mov r8d, 0xe
call fcn.14004e558
cmp al, sil
je 0x140006728
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x64], esi
call fcn.140004250
cmp eax, esi
je 0x14000681d
cmp r15d, 1
jne 0x14000681d
mov ecx, dword [rsp + 0x64]
mov eax, 0x51eb851f
add ecx, 0x63
imul ecx
mov ebx, edx
sar ebx, 5
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov al, byte [0x1400ef217]
cmp al, sil
jle 0x140006713
sub ebx, 1
js 0x140006713
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11b, byte [0x1400ef217]
cmp r11b, sil
jg 0x1400066f7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsp + 0x64]
mov dword [0x1400f1928], eax
jmp 0x14000681d
lea rdx, [rsp + 0x50]
lea rcx, str.__idlequit
mov r8d, ebx
call fcn.14004e558
cmp al, sil
mov rax, qword [rsp + 0x50]
je 0x14000683a
movzx ecx, word [rax]
mov rdi, rax
cmp cx, si
je 0x140006783
mov r10d, 9
cmp r10w, cx
ja 0x140006767
cmp cx, 0xd
jbe 0x140006783
cmp r12w, cx
je 0x140006783
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000675b
mov rbx, qword [rsp + 0x50]
sub rbx, rdi
sar rbx, 1
cmp ebx, esi
jle 0x14000681d
lea ebp, [rbx + rbx + 4]
lea eax, [rbp + 8]
movsxd r12, eax
mov rcx, qword [0x1400f1ff0]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1400067c7
lea ecx, [rax + 2]
call fcn.14004b9a0
cmp eax, 4
je 0x1400067a0
mov dword [rsi + 4], 0xaa55
mov dword [rsi], ebp
add rsi, 8
mov eax, 0x2a
mov qword [rsp + 0x98], rsi
cmp ax, word [rdi]
je 0x1400067f0
mov eax, 0x21
cmp ax, word [rdi]
jne 0x1400067fc
mov al, byte [rdi]
add rdi, 2
dec ebx
mov byte [rsp + 0x60], al
movsxd rax, ebx
mov rdx, rdi
mov rcx, rsi
lea rbx, [rax + rax]
mov r8, rbx
call fcn.1400177f8
xor eax, eax
mov word [rbx + rsi], ax
xor esi, esi
lea r12d, [rax + 0x20]
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.140004084
mov edi, 9
jmp 0x140006857
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
mov ecx, 0x3d
cmp cx, word [rax]
jne 0x140006878
add rax, 2
mov r13b, 1
mov qword [rsp + 0x50], rax
cmp word [rax], si
jne 0x1400064b0
jmp 0x140006878
mov rax, qword [rsp + 0x50]
mov bpl, byte [rsp + 0x150]
mov ebx, dword [rsp + 0x58]
mov rcx, rax
call fcn.140004084
mov rcx, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r15d, r15d
xor ecx, ecx
mov esi, eax
mov r12b, r15b
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
cmp ebx, r15d
jbe 0x1400068c9
mov ecx, ebx
call fcn.140003fb4
mov rbx, qword [0x1400f19a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x11
cmp eax, ecx
cmovge eax, ecx
movsxd rcx, eax
lea edx, [rax + rsi + 0xa0]
lea rdi, [rbx + rcx*2]
lea rcx, [rsp + 0x88]
call fcn.14004bedc
mov eax, 0x3d
cmp ax, word [rdi]
jne 0x14000690f
add rdi, 2
mov r13b, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rdi
movsxd rbx, eax
lea ecx, [rbx + 1]
movsxd r8, ecx
mov rcx, qword [rsp + 0x88]
add r8, r8
call fcn.1400177f8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x50]
inc eax
movsxd r8, eax
mov rax, qword [rsp + 0x88]
lea rcx, [rax + rbx*2]
add r8, r8
call fcn.1400177f8
cmp bpl, r15b
je 0x140006973
or dword [rsp + 0xdc], 1
mov word [rsp + 0xe0], r15w
mov rcx, qword [rsp + 0x88]
lea rdx, [0x1400d6aa0]
call fcn.14000411c
mov r10d, 9
cmp rax, r15
je 0x1400069c1
movzx eax, word [rax + 0x10]
cmp ax, r15w
je 0x1400069b6
cmp r10w, ax
ja 0x1400069a8
cmp ax, 0xd
jbe 0x1400069b6
mov r9d, 0x20
cmp r9w, ax
jne 0x1400069c7
jmp 0x1400069bc
mov r9d, 0x20
mov r12b, 1
jmp 0x1400069c7
mov r9d, 0x20
mov al, byte [0x1400ef217]
or dword [rsp + 0x5c], 0xffffffff
mov dword [rsp + 0x68], 8
cmp al, r15b
mov dword [rsp + 0x6c], r15d
jle 0x140006e14
mov rdx, qword [rsp + 0x88]
mov ecx, r15d
movzx eax, word [rdx]
mov r8, rdx
jmp 0x140006a13
or ax, r9w
sub ax, 0x61
cmp ax, 0x19
ja 0x140006a19
inc ecx
add r8, 2
mov ax, word [r8]
cmp ax, r15w
jne 0x1400069fb
cmp r10w, word [r8]
ja 0x140006a26
cmp word [r8], 0xd
jbe 0x140006a2e
cmp r9w, word [r8]
cmovne ecx, r15d
mov ebx, 4
cmp ecx, ebx
jne 0x140006a7c
lea rdx, [0x1400d6a78]
lea rcx, [rsp + 0x90]
call fcn.140058920
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.14004bfa8
mov rcx, qword [rsp + 0x90]
call fcn.140003e98
lea rcx, [rsp + 0x90]
call fcn.140044f24
jmp 0x140006e14
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r15d
je 0x140006e14
cmp r14b, r15b
je 0x140006b08
mov al, byte [0x1400f2ccc]
test al, 8
jne 0x140006aeb
or al, 8
lea rcx, str.SeShutdownPrivilege
mov edx, 2
mov byte [0x1400f2ccc], al
call fcn.140016130
mov al, byte [0x1400f2ccc]
test bl, al
jne 0x140006b08
or al, bl
lea rcx, str.SeDebugPrivilege
mov edx, 2
mov byte [0x1400f2ccc], al
call fcn.140016130
mov rax, qword [0x1400f19c0]
cmp byte [rsp + 0x160], r15b
je 0x140006b2f
cmp rax, r15
jne 0x140006b34
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov qword [0x1400f19c0], rax
cmp rax, r15
je 0x140006b42
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or rbx, 0xffffffffffffffff
mov rcx, rax
mov r8, rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov r11, qword [0x1400f1930]
cmp r11, r15
je 0x140006b8f
mov rcx, qword [0x1400f1930]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x70]
mov qword [0x1400f1930], r15
mov qword [0x1400f1930], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbx
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
cmp dword [rsp + 0x58], r15d
jbe 0x140006dae
lea rcx, [rsp + 0x68]
mov ebx, 0x103
mov dword [rsp + 0x5c], ebx
call qword [sym.imp.USER32.dll_GetLastInputInfo]
cmp byte [rsp + 0x168], r15b
jne 0x140006cef
mov al, byte [0x1400ef217]
cmp r12b, r15b
je 0x140006d4e
cmp al, r15b
jle 0x140006e14
lea edi, [rbx - 0x3b]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, r15d
mov ebp, eax
mov ebx, eax
mov cl, byte [0x1400ef217]
cmp cl, r15b
jle 0x140006c73
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov r11d, dword [rsp + 0x6c]
sub r11d, dword [0x1400f1928]
cmp r11d, r15d
jg 0x140006c73
cmp r13b, r15b
je 0x140006c73
mov rcx, qword [rsp + 0x70]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov ebx, eax
sub ecx, ebp
cmp ecx, 0x64
jae 0x140006c73
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 3
jl 0x140006c17
mov cl, byte [0x1400ef217]
mov edx, dword [0x1400f1928]
mov r8d, dword [rsp + 0x6c]
sub ebx, ebp
cmp cl, r15b
jle 0x140006cff
mov eax, r8d
sub eax, edx
cmp eax, r15d
jg 0x140006cff
cmp r13b, r15b
je 0x140006c9f
cmp ebx, 0x64
jb 0x140006cff
cmp ebx, edi
jae 0x140006cad
mov ecx, edi
sub ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x1400ef217]
cmp al, r15b
jg 0x140006c0a
jmp 0x140006e14
mov rcx, qword [rsp + 0x70]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x5c]
mov dword [rsp + 0x5c], ebx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x5c], ebx
jne 0x140006dfd
mov al, byte [0x1400ef217]
cmp al, r15b
jge 0x140006cc1
jmp 0x140006dfd
mov eax, r8d
lea rcx, [rsp + 0x70]
mov r9b, r12b
sub eax, edx
cmp eax, r15d
cmovg edx, r8d
lea r8, [0x1400f19c0]
mov dword [0x1400f1928], edx
mov dl, r14b
call fcn.1400061b8
mov rax, qword [rsp + 0x98]
cmp rax, r15
je 0x140006d44
mov dl, byte [rsp + 0x60]
mov r8b, 1
mov rcx, rax
call fcn.140004358
mov dword [rsp + 0x5c], r15d
jmp 0x140006e14
cmp al, r15b
jl 0x140006da9
mov edi, 0xc8
mov rcx, qword [rsp + 0x70]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140006d77
cmp eax, r15d
jne 0x140006d77
cmp dword [rsp + 0x5c], ebx
jne 0x140006da9
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov r11d, dword [rsp + 0x6c]
mov eax, r11d
sub eax, dword [0x1400f1928]
cmp eax, r15d
jg 0x140006da2
mov al, byte [0x1400ef217]
cmp al, r15b
jge 0x140006d58
jmp 0x140006da9
mov dword [0x1400f1928], r11d
xor r9d, r9d
jmp 0x140006e00
mov dword [rsp + 0x5c], r15d
cmp r13b, r15b
je 0x140006e14
mov al, byte [0x1400ef217]
cmp al, r15b
jl 0x140006dfd
mov ebx, 0x103
mov rcx, qword [rsp + 0x70]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x5c]
mov dword [rsp + 0x5c], ebx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x5c], ebx
jne 0x140006dfd
mov al, byte [0x1400ef217]
cmp al, r15b
jge 0x140006dc8
mov r9b, r12b
lea r8, [0x1400f19c0]
lea rcx, [rsp + 0x70]
mov dl, r14b
call fcn.1400061b8
mov ebx, dword [rsp + 0x5c]
lea rcx, [rsp + 0x88]
call fcn.140044f24
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret