Function at 0x140003830
Capabilities:
Delete file
Get common file path
Query service status
Read file on windows
Start service
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x868
mov dword [rsp + 0x4f0], 0
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x4b0], 0
mov edx, 0x105
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea r8, [0x140011cc8]
mov edx, 0x105
lea rcx, [rsp + 0x180]
call fcn.140005b24
lea r8, [rsp + 0x180]
mov edx, 0x105
lea rcx, [rsp + 0x60]
call fcn.140005ab0
lea r8, str.lc7agent.rem.in
mov edx, 0x105
lea rcx, [rsp + 0x60]
call fcn.140005b24
lea r8, [rsp + 0x180]
mov edx, 0x105
lea rcx, [rsp + 0x3a0]
call fcn.140005ab0
lea r8, str.lc7agent.rem.out
mov edx, 0x105
lea rcx, [rsp + 0x3a0]
call fcn.140005b24
lea r8, [rsp + 0x180]
mov edx, 0x105
lea rcx, [rsp + 0x290]
call fcn.140005ab0
lea r8, str.lc7agent.rem.status
mov edx, 0x105
lea rcx, [rsp + 0x290]
call fcn.140005b24
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8, qword [rsp + 0x870]
mov edx, 0x105
lea rcx, [rsp + 0x620]
call fcn.140005ab0
mov r8, qword [rsp + 0x870]
mov edx, 0x105
lea rcx, [rsp + 0x500]
call fcn.140005ab0
lea r8, [0x140011d18]
mov edx, 0x105
lea rcx, [rsp + 0x500]
call fcn.140005b24
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x870]
call fcn.140003590
mov r8d, 0x10000000
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x170], rax
cmp qword [rsp + 0x170], 0
jne 0x1400039d1
mov eax, 1
jmp 0x140003d97
mov r8d, 0x10000000
lea rdx, [0x140011d20]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x4b0], rax
cmp qword [rsp + 0x4b0], 0
jne 0x140003a17
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 2
jmp 0x140003d97
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [rsp + 0x4b8], eax
cmp dword [rsp + 0x4b8], 0
jne 0x140003a82
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x140003a82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140011d30]
call fcn.140005008
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 3
jmp 0x140003d97
lea rax, [rsp + 0x4bc]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x4c8]
xor edx, edx
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140003af8
cmp dword [rsp + 0x4cc], 4
je 0x140003af8
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsp + 0x4cc], 2
je 0x140003af6
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 4
jmp 0x140003d97
jmp 0x140003a82
lea r8, [rsp + 0x40]
mov edx, 0x8b
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [rsp + 0x4c4], eax
cmp dword [rsp + 0x4c4], 0
jne 0x140003b5f
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 5
jmp 0x140003d97
mov byte [rsp + 0x4c0], 0
mov byte [rsp + 0x4c1], 0
mov dword [rsp + 0x610], 0x14
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x748], rax
cmp qword [rsp + 0x748], 0xffffffffffffffff
je 0x140003cfc
mov byte [rsp + 0x4c1], 1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x730]
mov r8d, 0xc
lea rdx, [rsp + 0x738]
mov rcx, qword [rsp + 0x748]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140003c30
cmp dword [rsp + 0x730], 0xc
jne 0x140003c30
cmp dword [rsp + 0x740], 1
jne 0x140003c30
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x3a0]
call fcn.140003590
mov byte [rsp + 0x4c0], 1
mov rcx, qword [rsp + 0x748]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11d, dword [rsp + 0x740]
mov dword [rsp + 0x28], r11d
mov eax, dword [rsp + 0x73c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x738]
lea r8, str.Cur:__d__Total:__d__Finished:__d
mov edx, 0x100
lea rcx, [rsp + 0x760]
call fcn.14000619c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
lea rcx, [rsp + 0x500]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x750], rax
cmp qword [rsp + 0x750], 0
je 0x140003cfa
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x730]
mov r8d, 0xc
lea rdx, [rsp + 0x738]
mov rcx, qword [rsp + 0x750]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x750]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003d1f
cmp dword [rsp + 0x610], 0
jne 0x140003d0e
mov byte [rsp + 0x4c0], 1
mov eax, dword [rsp + 0x610]
sub eax, 1
mov dword [rsp + 0x610], eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rsp + 0x4c0]
test eax, eax
je 0x140003b7a
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add rsp, 0x868
ret