Function at 0x1400100a0
Capabilities:
Check if file exists
Create process on windows
Delete service
Get file attributes
Start service
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x890]
sub rsp, 0x990
mov rax, qword [0x140018010]
xor rax, rsp
mov qword [rbp + 0x880], rax
movdqa xmm0, xmmword [0x140015840]
lea rax, vtable.CCustomCommandLineInfo.0
xor ebx, ebx
mov qword [0x140018820], rcx
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rbx
movdqa xmmword [rbp + 0x30], xmm0
lea r15d, [rbx + 1]
mov dword [rbp + 0x40], ebx
mov word [rbp + 0x44], bx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], r15d
jle 0x140010177
lea r14d, [rbx + 8]
mov r12d, 0xfffd
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov esi, ebx
mov rcx, qword [rax]
mov rdi, qword [r14 + rcx]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
inc r15d
mov r9d, ebx
cmp r15d, dword [rax]
movzx eax, word [rdi]
sete r9b
sub ax, 0x2d
test r12w, ax
jne 0x140010158
mov esi, 1
add rdi, 2
mov rax, qword [rbp + 0x20]
lea rcx, [rbp + 0x20]
mov r8d, esi
mov rdx, rdi
call qword [rax]
add r14, 8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp r15d, dword [rax]
jl 0x140010120
cmp word [rbp + 0x44], bx
je 0x140010190
lea rcx, [rbp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140010627
mov eax, dword [rbp + 0x3c]
test eax, eax
jns 0x1400101a7
lea rcx, [rbp + 0x20]
call fcn.140010ec0
mov ebx, eax
jmp 0x140010627
jle 0x14001030a
lea rdx, [rbp + 0x44]
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdi, [rbp + 0x250]
cmp word [rbp + 0x250], bx
jne 0x1400101ea
mov r8d, 0x104
lea rdx, [rbp + 0x460]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdi, [rbp + 0x460]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x1400156f0]
mov dword [rsp + 0x20], 0x70
lea rsi, str.runas
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x24], 0x540
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x50], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140010253
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140010627
jmp 0x14001026c
mov rcx, qword [rbp - 0x78]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rbp + 0x250]
cmp word [rbp + 0x250], bx
jne 0x140010298
mov r8d, 0x104
lea rdx, [rbp + 0x670]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdi, [rbp + 0x670]
xor edx, edx
lea rcx, [rbp - 0x70]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x1400156f8]
mov dword [rbp - 0x70], 0x70
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x6c], 0x540
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x40], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400102ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140010627
mov rcx, qword [rbp - 8]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010627
call fcn.1400108d0
mov eax, dword [rbp + 0x2c]
cmp eax, 1
jne 0x140010327
mov edx, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x30]
call fcn.140011210
jmp 0x140010627
cmp eax, 0xffffffff
jne 0x140010453
mov r15d, ebx
mov edi, ebx
cmp dword [rbp + 0x28], ebx
jne 0x14001036a
call fcn.140010b10
test eax, eax
je 0x14001036a
lea r8, str._s__u
xor edx, edx
call fcn.140010c90
test eax, eax
je 0x140010627
mov edx, eax
mov ecx, 0x802
call fcn.140010d80
jmp 0x140010627
xor edx, edx
xor ecx, ecx
mov r8d, 0x2000b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14001043a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov r12, rax
test rax, rax
jne 0x1400103b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 0x802
call fcn.140010d80
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140010627
mov r8d, 0x10000
lea rdx, str.ZuluServer_Agent
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r14, rax
test rax, rax
je 0x140010406
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1400103f3
mov rcx, r14
mov r15d, 1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001040e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001040e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r15d, r15d
jne 0x140010627
mov edx, edi
mov ecx, 0x802
call fcn.140010d80
jmp 0x140010627
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, edi
mov ecx, 0x802
call fcn.140010d80
jmp 0x140010627
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x1400105d2
cmp eax, 0xffffffff
jne 0x14001050d
cmp dword [rbp + 0x28], ebx
jne 0x14001049c
call fcn.140010b10
test eax, eax
je 0x14001049c
lea r8, str._s__t_
xor edx, edx
call fcn.140010c90
test eax, eax
je 0x140010627
mov edx, eax
mov ecx, 0x804
call fcn.140010d80
jmp 0x140010627
xor edx, edx
xor ecx, ecx
mov r8d, 0x20009
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400102e1
mov r8d, 0x20
lea rdx, str.ZuluServer_Agent
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400105c1
lea r8, [rbp]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400104f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140010627
cmp eax, 0x2a
jne 0x140010526
mov edx, dword [rbp + 0x28]
lea rcx, str.ZuluServer_Agent
call fcn.1400115c0
jmp 0x140010627
cmp dword [rbp + 0x28], ebx
jne 0x14001055b
call fcn.140010b10
test eax, eax
je 0x14001055b
lea r8, [0x140015758]
xor edx, edx
call fcn.140010c90
test eax, eax
je 0x140010627
mov edx, eax
mov ecx, 0x803
call fcn.140010d80
jmp 0x140010627
xor edx, edx
xor ecx, ecx
mov r8d, 0x2000b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400102e1
mov r8d, 0x10
lea rdx, str.ZuluServer_Agent
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400105c1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400105ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140010627
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140010627
cmp dword [rbp + 0x28], ebx
jne 0x1400105ff
cmp dword [rbp + 0x34], ebx
jne 0x1400105f8
mov edx, 5
lea rcx, str.ZuluSrvm.exe__f
call qword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [rbp + 0x28], ebx
jne 0x1400105ff
cmp dword [rbp + 0x34], ebx
je 0x140010627
call fcn.140011d10
jmp 0x140010627
lea rax, str.ZuluServer_Agent
mov qword [rbp + 0x10], rbx
mov qword [rbp], rax
lea rcx, [rbp]
lea rax, [0x140011770]
mov qword [rbp + 0x18], rbx
mov qword [rbp + 8], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
mov eax, ebx
mov rcx, qword [rbp + 0x880]
xor rcx, rsp
call fcn.140013630
lea r11, [rsp + 0x990]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret