Function at 0x180010730
Capabilities:
Check if file exists
Delete file
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1800680c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14d, dword [0x18006b454]
mov r15, r8
mov edi, ecx
xor r13d, r13d
mov r8d, 0x104
lea rcx, [rsp + 0x70]
xor edx, edx
mov esi, r13d
mov rbx, r9
call fcn.18004c430
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1800107c2
mov ecx, 1
call fcn.180005f20
mov r8, rax
lea rcx, [rsp + 0x70]
mov edx, 0x104
call fcn.180030008
lea r12, [0x18006b350]
mov qword [rsp + 0x20], rbx
mov rcx, r12
lea r9, [rsp + 0x70]
lea r8, [0x18005ae9c]
mov edx, 0x104
call fcn.18000f2c0
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
lea r8, [0x18005ae9c]
mov edx, 0x104
lea rcx, [0x18006b240]
call fcn.18000f2c0
mov r8, r15
lea rcx, [0x18006b480]
mov edx, 0x32
call fcn.180030008
nop dword [rax]
test r14d, r14d
je 0x180010910
cmp r14d, 1
jne 0x180010a0d
lea rcx, [rsp + 0x38]
call fcn.1800053d0
cmp qword [rax + 0x18], 0xf
jbe 0x180010847
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.2.8.7.6
call fcn.1800054d0
mov rdx, qword [rsp + 0x50]
mov ebx, eax
cmp rdx, 0xf
jbe 0x180010895
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180010890
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180010d91
call fcn.18002368c
cmp ebx, 1
jne 0x1800108a2
mov rcx, r12
call fcn.180006570
lea rcx, [0x18005aec0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x18005aea8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010a00
xorps xmm0, xmm0
lea rcx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call rax
movzx eax, word [rsp + 0x38]
cmp ax, 6
je 0x1800108f6
cmp ax, 9
jne 0x180010a00
cmp dword [0x180068d28], r13d
mov r8, r12
je 0x1800109f9
mov ecx, 0x69
jmp 0x180010a08
call fcn.1800047e0
test al, al
je 0x180010833
lea rcx, [rsp + 0x38]
call fcn.1800053d0
cmp qword [rax + 0x18], 0xf
jbe 0x180010931
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.2.6.2.6
call fcn.1800054d0
mov rdx, qword [rsp + 0x50]
mov ebx, eax
cmp rdx, 0xf
jbe 0x18001097f
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001097a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180010d97
call fcn.18002368c
cmp ebx, 1
jne 0x18001098c
mov rcx, r12
call fcn.180006570
lea rcx, [0x18005aec0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x18005aea8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800109f2
xorps xmm0, xmm0
lea rcx, [rsp + 0x38]
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call rax
movzx eax, word [rsp + 0x38]
cmp ax, 6
je 0x1800109d8
cmp ax, 9
jne 0x1800109f2
cmp dword [0x180068d28], r13d
mov r8, r12
je 0x1800109eb
mov ecx, WSAGetLastError
jmp 0x180010a08
mov ecx, reloc.WS2_32.dll_WSAStartup
jmp 0x180010a08
mov ecx, 0x6a
jmp 0x180010a05
mov ecx, reloc.WS2_32.dll_WSACleanup
jmp 0x180010a08
mov ecx, 0x68
mov r8, r12
call fcn.180004f20
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x180010cf7
cmp dword [0x18006b454], r13d
mov ebx, r13d
jne 0x180010a5e
call fcn.18000fc50
mov ebx, eax
test eax, eax
jne 0x180010a5e
mov edx, 0x2710
lea rcx, [0x180010590]
call fcn.180005310
lea rcx, [0x18006b480]
call fcn.180001d50
lea rcx, [0x18006b480]
call fcn.180001e60
lea rcx, [0x18006b480]
call fcn.1800057c0
test al, al
je 0x180010a83
cmp dword [0x18006b454], r13d
jne 0x180010cec
test ebx, ebx
jne 0x180010cec
test edi, edi
jne 0x180010ae0
mov rdx, r12
call fcn.180021040
mov ebx, eax
test eax, eax
jne 0x180010aa2
call fcn.180020fc0
test al, al
je 0x180010cec
cmp ebx, 0xfffffffd
jne 0x180010cec
lea rcx, [0x180068d60]
inc esi
call fcn.180001d50
lea rcx, [0x180068d60]
call fcn.180001e60
cmp esi, 2
jge 0x180010ad6
mov dword [0x180068d28], r13d
jmp 0x180010820
mov eax, 0xfffffffd
jmp 0x180010d67
sub edi, 1
je 0x180010c76
sub edi, 1
je 0x180010bd1
sub edi, 1
je 0x180010bb4
cmp edi, 1
jne 0x180010cec
call fcn.1800018d0
test eax, eax
je 0x180010cec
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x180010b3f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ecx, ecx
call fcn.1800105b0
xor eax, eax
jmp 0x180010d67
mov r8d, 0xf01ff
lea rdx, [0x18006b480]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x180010b7c
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ecx, ecx
call fcn.1800105b0
xor eax, eax
jmp 0x180010d67
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, rdi
test eax, eax
jne 0x180010b5f
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call fcn.1800105b0
xor eax, eax
jmp 0x180010d67
mov r8, r12
lea rdx, [0x18006b480]
call fcn.180001f70
xor ecx, ecx
call fcn.1800105b0
xor eax, eax
jmp 0x180010d67
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x104
call fcn.18004c430
mov r9, r12
lea r8, str._s.bat
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.18000f2c0
lea rdx, [0x18005bd60]
lea rcx, [rsp + 0x70]
call fcn.180032310
mov rbx, rax
test rax, rax
je 0x180010c53
mov r9, r12
lea rdx, str.sc_create__s_binPath_____s__type__kernel__start__system_
mov r8, r15
mov rcx, rax
call fcn.180019dc0
mov r8, r15
lea rdx, str._n_sc_start__s___filelog.log
mov rcx, rbx
call fcn.180019dc0
lea rdx, str._n_del___0
mov rcx, rbx
call fcn.180019dc0
mov rcx, rbx
call fcn.18002a150
lea rcx, [rsp + 0x70]
call fcn.1800063a0
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ecx, ecx
call fcn.1800105b0
xor eax, eax
jmp 0x180010d67
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x1f4
call fcn.18004c430
mov r9, r15
mov qword [rsp + 0x20], r12
lea r8, str.sc.exe_create__s_binPath_____s__type__kernel__start__system_
mov edx, 0x1f4
lea rcx, [rsp + 0x70]
call fcn.18000f2c0
lea rcx, [rsp + 0x70]
call fcn.1800063a0
xorps xmm0, xmm0
lea r8, str.sc.exe_start__s___filelog.log
xor eax, eax
lea rcx, [rsp + 0x38]
mov r9, r15
mov word [rsp + 0x68], ax
mov edx, 0x32
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call fcn.18000f2c0
lea rcx, [rsp + 0x38]
call fcn.1800063a0
xor ecx, ecx
call fcn.1800105b0
xor eax, eax
jmp 0x180010d67
mov rbx, qword [0x18006b968]
test rbx, rbx
jne 0x180010d4d
lea rdx, [0x180050d6e]
mov ecx, 8
call fcn.180023cf0
mov rbx, rax
test rax, rax
je 0x180010d28
lea rax, vtable.BoosterLog.0
mov qword [rbx], rax
jmp 0x180010d2b
mov rbx, r13
mov rcx, qword [0x18006b968]
cmp rbx, rcx
je 0x180010d46
test rcx, rcx
je 0x180010d46
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x18006b968], rbx
mov edx, dword [0x18006b688]
lea r8, [0x18005bde0]
mov rcx, rbx
call fcn.18000f4b0
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.180023640
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800299a4
int3
call fcn.1800299a4
int3