Function at 0x180006320
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Stop service

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1610]
mov eax, 0x1710
call fcn.180006ee0
sub rsp, rax
mov rax, qword [0x18005f8e8]
xor rax, rsp
mov qword [rbp + 0x15f0], rax
mov rax, qword [rbp + 0x1670]
mov r14, r8
mov qword [rbp - 0x70], rax
lea r8, [0x180050f20]
mov rax, qword [rbp + 0x1678]
mov rdi, rdx
mov qword [rsp + 0x70], rcx
mov edx, 0x106
lea rcx, [rbp + 0x13e0]
mov qword [rbp - 0x68], rax
mov rsi, r9
call qword [sym.imp.VBoxRT.dll_RTUtf16CopyAscii]
mov ebx, eax
test eax, eax
js 0x180006af2
mov r8, rdi
lea rcx, [rbp + 0x13e0]
mov edx, 0x106
call qword [sym.imp.VBoxRT.dll_RTUtf16Cat]
mov ebx, eax
test eax, eax
js 0x180006af2
mov r8, r14
lea rcx, [rbp + 0x13e0]
mov edx, 0x106
call qword [sym.imp.VBoxRT.dll_RTUtf16Cat]
mov ebx, eax
test eax, eax
js 0x180006af2
lea r8, [0x180050f20]
mov edx, 0x106
lea rcx, [rbp + 0x13e0]
call qword [sym.imp.VBoxRT.dll_RTUtf16CatAscii]
mov ebx, eax
test eax, eax
js 0x180006af2
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x180006a73
mov rbx, qword [rsp + 0x70]
lea r15, str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
mov qword [rsp + 0x1708], r13
lea r12, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
xor r14d, r14d
mov dil, 1
movzx r13d, byte [rbx + 0x79]
test r13b, r13b
je 0x180006777
lea r8d, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1800066cb
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], r14d
mov r8d, 0x1440
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x180006637
cmp dword [rbp - 0x58], r14d
je 0x180006760
cmp dword [rbp - 0x60], 0x10
mov ebx, r14d
je 0x1800064db
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1800064d6
mov ecx, dword [rbp - 0x60]
lea r9, str.update_service__ls:_dwServiceType__u__expected__u_n
mov dword [rsp + 0x30], 0x10
lea edx, [r14 + 0x10]
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ebx, 1
cmp dword [rbp - 0x5c], 3
je 0x180006522
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006520
mov ecx, dword [rbp - 0x5c]
lea r9, str.update_service__ls:_dwStartType__u__expected__u_n
mov dword [rsp + 0x30], 3
mov edx, 0x10
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
cmp dword [rbp - 0x58], 1
je 0x180006569
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006567
mov ecx, dword [rbp - 0x58]
lea r9, str.update_service__ls:_dwErrorControl__u__expected__u_n
mov dword [rsp + 0x30], 1
mov edx, 0x10
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp + 0x13e0]
call qword [sym.imp.VBoxRT.dll_RTUtf16ICmp]
test eax, eax
je 0x1800065c5
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1800065c3
lea rcx, [rbp + 0x13e0]
mov edx, 0x10
mov qword [rsp + 0x30], rcx
lea r9, str.update_service__ls:_lpBinaryPathName__ls__expected__ls_n
mov rcx, qword [rbp - 0x50]
mov r8d, VarDecFix
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180006628
cmp word [rcx], r14w
je 0x180006628
lea rdi, str.LocalSystem
mov rdx, rdi
call qword [sym.imp.VBoxRT.dll_RTUtf16ICmp]
test eax, eax
je 0x180006628
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006626
mov rcx, qword [rbp - 0x50]
lea r9, str.update_service__ls:_lpServiceStartName__ls__expected__ls_n
mov qword [rsp + 0x30], rdi
mov edx, 0x10
mov qword [rsp + 0x28], rcx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
test ebx, ebx
setne r13b
movzx edi, r13b
jmp 0x18000675b
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006679
mov qword [rsp + 0x38], r14
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], r15
mov edx, 0x10
mov dword [rsp + 0x28], 0x976
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x18000675b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsp + 0x78]
lea r9, str.QueryServiceConfigW_returned__u__cbNeeded_u_vs__zu__n
mov qword [rsp + 0x30], 0x1440
mov edx, 0x10
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x18000675b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
mov ebx, eax
setne dil
je 0x18000675b
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006727
lea rcx, str.dwErr__ERROR_SERVICE_DOES_NOT_EXIST
mov edx, 0x10
mov qword [rsp + 0x38], rcx
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], r15
mov r8d, VarDecFix
mov dword [rsp + 0x28], 0x97c
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x18000675b
mov dword [rsp + 0x28], ebx
lea r9, str.OpenServiceW__ls______u_n
mov edx, 0x10
mov qword [rsp + 0x20], rsi
mov r8d, VarDecFix
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test dil, dil
je 0x180006928
mov rax, qword [rbp - 0x80]
mov r8d, 0x10020
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1800068c4
xor eax, eax
xorps xmm0, xmm0
mov ecx, 0x426
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x48], eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rbp - 0x60]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x1800067ea
cmp eax, 0x426
je 0x1800067ea
cmp eax, 0x425
jne 0x1800068a7
cmp dword [rbp - 0x5c], 3
jne 0x1800068a7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, 0xb80010
test eax, eax
je 0x18000682d
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1800068a7
lea r9, str.update_service__ls:_deleted_n
mov qword [rsp + 0x20], rsi
mov edx, 0x10
mov r8d, VarDecFix
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x1800068a7
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x18000686a
mov qword [rsp + 0x38], r14
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], r15
mov edx, 0x10
mov dword [rsp + 0x28], 0x998
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x1800068a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r9, str.Failed_to_not_delete_service__ls:__u_n
mov edx, 0x10
mov qword [rsp + 0x20], rsi
mov r8d, VarDecFix
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x70]
mov rcx, rdi
mov r15, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000692c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb80010
mov dword [rbx + 0x64], eax
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006904
mov ecx, dword [rbx + 0x64]
lea r9, str.Failed_to_not_open_service__ls_for_stopdelete:__u_n
mov dword [rsp + 0x28], ecx
mov edx, 0x10
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8d, VarDecFix
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov r15, qword [rbp - 0x80]
mov r8d, 2
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000692c
mov r15, qword [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r13b, r13b
mov r13, qword [rsp + 0x1708]
je 0x180006b78
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x180006a43
mov r8, qword [rbp - 0x70]
lea rax, str.RPCSS
mov qword [rsp + 0x60], r14
mov r9d, 2
mov qword [rsp + 0x58], r14
mov rdx, rsi
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x48], r14
lea rax, [rbp + 0x13e0]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
je 0x180006a27
mov rax, qword [rbp - 0x68]
lea r8, [rbp - 0x60]
mov edx, 1
mov qword [rbp - 0x60], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x180006a10
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006a10
lea r9, str.update_service__ls:_created_n
mov qword [rsp + 0x20], rsi
mov edx, 0x10
mov r8d, VarDecFix
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180006b78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0x64], eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180006b78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb80010
mov dword [rbx + 0x64], eax
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006b78
mov ecx, dword [rbx + 0x64]
lea r9, str.Failed_to_open_service_manager_with_create_service_access:__u_n
mov dword [rsp + 0x20], ecx
jmp 0x180006b64
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006ac5
xor r14d, r14d
lea r15, str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
mov qword [rsp + 0x38], r14
lea r12, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
mov qword [rsp + 0x30], r15
lea r9, str.AssertLogRel__s__d___s:__s_n
mov dword [rsp + 0x28], 0x9d9
mov r8d, VarDecFix
lea edx, [r14 + 0x10]
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x180006b78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.OpenSCManagerW_failed:__u_n
mov rcx, rbx
jmp 0x180006b67
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006b49
lea rcx, str.RT_SUCCESS_NP_rc_
mov edx, 0x10
mov qword [rsp + 0x38], rcx
lea r15, str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
mov qword [rsp + 0x30], r15
lea r12, str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
mov dword [rsp + 0x28], 0x92f
lea r9, str.AssertLogRel__s__d___s:__s_n
mov r8d, VarDecFix
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006b78
mov dword [rsp + 0x20], ebx
lea r9, str._Rra_n
mov rcx, rax
mov r8d, VarDecFix
mov edx, 0x10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, qword [rbp + 0x15f0]
xor rcx, rsp
call fcn.180006f40
add rsp, 0x1710
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret