Function at 0x140003280
Capabilities:
Create directory
Create process on windows
Create service
Persist via windows service
Query service status
Start service

Disassembly:
push rbp
sub rsp, 0xc0
mov rax, qword [0x140033018]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r8d, 0xf003f
lea rdx, str.ServicesActive
xor ecx, ecx
xor bpl, bpl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [0x140034f28], rax
test rax, rax
jne 0x1400032df
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, str.OpenSCManager
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x1400038b8
mov qword [rsp + 0xd0], rbx
mov ecx, 0x65
mov qword [rsp + 0xd8], rsi
lea rbx, str.C:WindowsSystem32driversTqNet.sys
lea rsi, [0x14002d088]
mov r8, rbx
mov rdx, rsi
call fcn.140002e00
test eax, eax
je 0x14000332f
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, str._eQ
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003892
mov rcx, qword [0x140034f28]
lea r8, str.TqNet
mov qword [rsp + 0xe8], r12
lea rdx, str.TqNet
mov qword [rsp + 0xb8], r14
mov r12d, 1
xor r14d, r14d
mov r9d, 0xf01ff
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x1400033cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x1400033d6
test eax, eax
je 0x1400033d6
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002d0d0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003882
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rbx, str.C:WindowsSystem32driversTqProc.sys
mov rdx, rsi
mov r8, rbx
mov ecx, 0x66
call fcn.140002e00
test eax, eax
je 0x14000340f
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, str._e_vzq
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003882
mov rcx, qword [0x140034f28]
lea r8, [0x14002c9a8]
mov qword [rsp + 0x60], r14
lea rdx, [0x14002c9a8]
mov qword [rsp + 0x58], r14
mov r9d, 0xf01ff
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140003494
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x14000349d
test eax, eax
je 0x14000349d
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002d100]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003882
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
lea rcx, str.C:TqAgent_
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.140002f10
test eax, eax
je 0x1400034d3
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002d118]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003882
mov qword [rsp + 0xb0], r15
lea r8, str.C:TqAgentlicense.bin
lea r15, [0x14002d0b0]
mov ecx, 0x70
mov rdx, r15
call fcn.140002e00
test eax, eax
je 0x140003518
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, str._eL
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000387a
mov qword [rsp + 0xe0], rdi
mov rax, 0xffffffffffffffff
lea rdi, [0x140034e20]
nop
inc rax
cmp byte [rdi + rax], bpl
jne 0x140003530
test rax, rax
je 0x140003597
lea rdx, [0x14002d170]
lea rcx, str.C:TqAgentlicense.bin
call fcn.140013c5c
mov rbx, rax
test rax, rax
je 0x140003597
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.140013af4
mov rdx, rbx
lea rcx, [0x14002d174]
call fcn.140014148
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.140013af4
mov rdx, rbx
mov rcx, rdi
call fcn.140014148
mov rcx, rbx
call fcn.1400137ec
mov qword [rsp + 0x60], r14
lea rcx, [0x14002d178]
mov qword [rsp + 0x58], r14
lea r8, str.TqSvc
mov qword [rsp + 0x50], rcx
lea rdx, str.TqSvc
mov qword [rsp + 0x48], r14
lea rcx, str.C:TqAgentTqSvc.exe
mov qword [rsp + 0x40], r14
mov eax, 0x10
mov qword [rsp + 0x38], rcx
cmp r15, rsi
mov rcx, qword [0x140034f28]
mov r9d, 0xf01ff
mov dword [rsp + 0x30], r14d
cmove eax, r12d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
test rax, rax
jne 0x140003635
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
je 0x14000363e
test eax, eax
je 0x14000363e
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002d1c8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003872
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x140034f28]
lea rdx, str.TqSvc
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400037dc
lea rax, [rsp + 0x70]
mov r9d, 0x24
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400037ba
mov eax, dword [rsp + 0x7c]
dec eax
test eax, 0xfffffffd
jne 0x1400037d3
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1400037d3
lea rax, [rsp + 0x70]
mov r9d, 0x24
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400037ba
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp dword [rsp + 0x7c], 2
mov rdi, rax
mov ebx, dword [rsp + 0x8c]
jne 0x1400037aa
mov r15d, 0x2710
nop dword [rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x90]
shr edx, 3
cmp edx, 0x3e8
jae 0x14000371e
mov edx, 0x3e8
jmp 0x140003725
cmp edx, r15d
cmova edx, r15d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x70]
mov r9d, 0x24
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140003791
cmp dword [rsp + 0x8c], ebx
jbe 0x14000376c
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ebx, dword [rsp + 0x8c]
mov rdi, rax
jmp 0x140003784
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
mov eax, dword [rsp + 0x90]
sub rcx, rdi
cmp rcx, rax
ja 0x1400037aa
cmp dword [rsp + 0x7c], 2
je 0x140003700
jmp 0x1400037aa
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002c970]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [rsp + 0x7c], 4
je 0x1400037d3
lea rdx, [0x14002d0a0]
jmp 0x1400037c1
lea rdx, [0x14002c970]
xor r9d, r9d
lea r8, [0x14002d090]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140003801
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002d1d8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003872
call fcn.140001f40
test eax, eax
je 0x140003825
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002d1e8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003872
call fcn.140002bb0
test eax, eax
je 0x140003847
xor r9d, r9d
lea r8, [0x14002d090]
lea rdx, [0x14002d1f8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x28], r14d
lea r9, str._run__tn_TqAgent__I
lea r8, str.schtasks
mov qword [rsp + 0x20], r14
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx ebp, r12b
mov rdi, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xb8]
mov rcx, qword [0x140034f28]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
test rcx, rcx
je 0x1400038b4
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bpl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400086b0
add rsp, 0xc0
pop rbp
ret