Function at 0x1800068e0
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Stop service

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1610]
mov eax, 0x1710
call fcn.1800074a0
sub rsp, rax
mov rax, qword [0x180044668]
xor rax, rsp
mov qword [rbp + 0x15f0], rax
mov rax, qword [rbp + 0x1670]
mov r14, r8
mov qword [rbp - 0x70], rax
lea r8, [0x18002f450]
mov rax, qword [rbp + 0x1678]
mov rdi, rdx
mov qword [rsp + 0x70], rcx
mov edx, 0x106
lea rcx, [rbp + 0x13e0]
mov qword [rbp - 0x68], rax
mov rsi, r9
call qword [sym.imp.VBoxRT.dll_RTUtf16CopyAscii]
mov ebx, eax
test eax, eax
js 0x1800070b2
mov r8, rdi
lea rcx, [rbp + 0x13e0]
mov edx, 0x106
call qword [sym.imp.VBoxRT.dll_RTUtf16Cat]
mov ebx, eax
test eax, eax
js 0x1800070b2
mov r8, r14
lea rcx, [rbp + 0x13e0]
mov edx, 0x106
call qword [sym.imp.VBoxRT.dll_RTUtf16Cat]
mov ebx, eax
test eax, eax
js 0x1800070b2
lea r8, [0x18002f450]
mov edx, 0x106
lea rcx, [rbp + 0x13e0]
call qword [sym.imp.VBoxRT.dll_RTUtf16CatAscii]
mov ebx, eax
test eax, eax
js 0x1800070b2
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x180007033
mov rbx, qword [rsp + 0x70]
lea r15, str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
mov qword [rsp + 0x1708], r13
lea r12, str.B:_bAntidetect_srcVBoxMain_src_allwinVBoxProxyStub.c
xor r14d, r14d
mov dil, 1
movzx r13d, byte [rbx + 0x79]
test r13b, r13b
je 0x180006d37
lea r8d, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x180006c8b
lea r9, [rsp + 0x78]
mov dword [rsp + 0x78], r14d
mov r8d, 0x1440
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x180006bf7
cmp dword [rbp - 0x58], r14d
je 0x180006d20
cmp dword [rbp - 0x60], 0x10
mov ebx, r14d
je 0x180006a9b
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006a96
mov ecx, dword [rbp - 0x60]
lea r9, str.update_service__ls:_dwServiceType__u__expected__u_n
mov dword [rsp + 0x30], 0x10
lea edx, [r14 + 0x10]
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ebx, 1
cmp dword [rbp - 0x5c], 3
je 0x180006ae2
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006ae0
mov ecx, dword [rbp - 0x5c]
lea r9, str.update_service__ls:_dwStartType__u__expected__u_n
mov dword [rsp + 0x30], 3
mov edx, 0x10
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
cmp dword [rbp - 0x58], 1
je 0x180006b29
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006b27
mov ecx, dword [rbp - 0x58]
lea r9, str.update_service__ls:_dwErrorControl__u__expected__u_n
mov dword [rsp + 0x30], 1
mov edx, 0x10
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp + 0x13e0]
call qword [sym.imp.VBoxRT.dll_RTUtf16ICmp]
test eax, eax
je 0x180006b85
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006b83
lea rcx, [rbp + 0x13e0]
mov edx, 0x10
mov qword [rsp + 0x30], rcx
lea r9, str.update_service__ls:_lpBinaryPathName__ls__expected__ls_n
mov rcx, qword [rbp - 0x50]
mov r8d, VarDecFix
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180006be8
cmp word [rcx], r14w
je 0x180006be8
lea rdi, str.LocalSystem
mov rdx, rdi
call qword [sym.imp.VBoxRT.dll_RTUtf16ICmp]
test eax, eax
je 0x180006be8
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006be6
mov rcx, qword [rbp - 0x50]
lea r9, str.update_service__ls:_lpServiceStartName__ls__expected__ls_n
mov qword [rsp + 0x30], rdi
mov edx, 0x10
mov qword [rsp + 0x28], rcx
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
inc ebx
test ebx, ebx
setne r13b
movzx edi, r13b
jmp 0x180006d1b
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006c39
mov qword [rsp + 0x38], r14
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], r15
mov edx, 0x10
mov dword [rsp + 0x28], 0x976
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x180006d1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsp + 0x78]
lea r9, str.QueryServiceConfigW_returned__u__cbNeeded_u_vs__zu__n
mov qword [rsp + 0x30], 0x1440
mov edx, 0x10
mov dword [rsp + 0x28], ecx
mov r8d, VarDecFix
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x180006d1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
mov ebx, eax
setne dil
je 0x180006d1b
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006ce7
lea rcx, str.dwErr__ERROR_SERVICE_DOES_NOT_EXIST
mov edx, 0x10
mov qword [rsp + 0x38], rcx
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], r15
mov r8d, VarDecFix
mov dword [rsp + 0x28], 0x97c
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006d1b
mov dword [rsp + 0x28], ebx
lea r9, str.OpenServiceW__ls______u_n
mov edx, 0x10
mov qword [rsp + 0x20], rsi
mov r8d, VarDecFix
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test dil, dil
je 0x180006ee8
mov rax, qword [rbp - 0x80]
mov r8d, 0x10020
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x180006e84
xor eax, eax
xorps xmm0, xmm0
mov ecx, 0x426
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x48], eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, [rbp - 0x60]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x180006daa
cmp eax, 0x426
je 0x180006daa
cmp eax, 0x425
jne 0x180006e67
cmp dword [rbp - 0x5c], 3
jne 0x180006e67
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov ecx, 0xb80010
test eax, eax
je 0x180006ded
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006e67
lea r9, str.update_service__ls:_deleted_n
mov qword [rsp + 0x20], rsi
mov edx, 0x10
mov r8d, VarDecFix
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
jmp 0x180006e67
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006e2a
mov qword [rsp + 0x38], r14
lea r9, str.AssertLogRel__s__d___s:__s_n
mov qword [rsp + 0x30], r15
mov edx, 0x10
mov dword [rsp + 0x28], 0x998
mov r8d, VarDecFix
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x180006e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
lea r9, str.Failed_to_not_delete_service__ls:__u_n
mov edx, 0x10
mov qword [rsp + 0x20], rsi
mov r8d, VarDecFix
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x70]
mov rcx, rdi
mov r15, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180006eec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb80010
mov dword [rbx + 0x64], eax
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006ec4
mov ecx, dword [rbx + 0x64]
lea r9, str.Failed_to_not_open_service__ls_for_stopdelete:__u_n
mov dword [rsp + 0x28], ecx
mov edx, 0x10
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r8d, VarDecFix
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov r15, qword [rbp - 0x80]
mov r8d, 2
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180006eec
mov r15, qword [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r13b, r13b
mov r13, qword [rsp + 0x1708]
je 0x180007138
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x180007003
mov r8, qword [rbp - 0x70]
lea rax, str.RPCSS
mov qword [rsp + 0x60], r14
mov r9d, 2
mov qword [rsp + 0x58], r14
mov rdx, rsi
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x48], r14
lea rax, [rbp + 0x13e0]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
test rax, rax
je 0x180006fe7
mov rax, qword [rbp - 0x68]
lea r8, [rbp - 0x60]
mov edx, 1
mov qword [rbp - 0x60], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x180006fd0
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180006fd0
lea r9, str.update_service__ls:_created_n
mov qword [rsp + 0x20], rsi
mov edx, 0x10
mov r8d, VarDecFix
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180007138
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x70]
mov dword [rcx + 0x64], eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180007138
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb80010
mov dword [rbx + 0x64], eax
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180007138
mov ecx, dword [rbx + 0x64]
lea r9, str.Failed_to_open_service_manager_with_create_service_access:__u_n
mov dword [rsp + 0x20], ecx
jmp 0x180007124
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180007085
xor r14d, r14d
lea r15, str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
mov qword [rsp + 0x38], r14
lea r12, str.B:_bAntidetect_srcVBoxMain_src_allwinVBoxProxyStub.c
mov qword [rsp + 0x30], r15
lea r9, str.AssertLogRel__s__d___s:__s_n
mov dword [rsp + 0x28], 0x9d9
mov r8d, VarDecFix
lea edx, [r14 + 0x10]
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x180007138
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.OpenSCManagerW_failed:__u_n
mov rcx, rbx
jmp 0x180007127
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180007109
lea rcx, str.RT_SUCCESS_NP_rc_
mov edx, 0x10
mov qword [rsp + 0x38], rcx
lea r15, str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
mov qword [rsp + 0x30], r15
lea r12, str.B:_bAntidetect_srcVBoxMain_src_allwinVBoxProxyStub.c
mov dword [rsp + 0x28], 0x92f
lea r9, str.AssertLogRel__s__d___s:__s_n
mov r8d, VarDecFix
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov ecx, 0xb80010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x180007138
mov dword [rsp + 0x20], ebx
lea r9, str._Rra_n
mov rcx, rax
mov r8d, VarDecFix
mov edx, 0x10
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov rcx, qword [rbp + 0x15f0]
xor rcx, rsp
call fcn.180007500
add rsp, 0x1710
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret