Function at 0x1800fd6b0
Capabilities:
Get file size
Modify service
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x300
mov rax, qword [0x1801094f8]
xor rax, rsp
mov qword [rbp + 0x1e8], rax
movzx ebx, byte [rbp - 0x80]
lea eax, [r8 + 0xc52]
mov qword [rbp - 8], rdx
mov r13d, r8d
mov qword [rbp + 0x60], rcx
mov rsi, rdx
mov dword [rbp - 0x7c], eax
mov rdi, rcx
cmp r8d, eax
jae case.0x1800fdd5b.0
mov r12d, dword [rbp - 0x60]
xor r14d, r14d
lea r15d, [r14 + 0x46]
lea rdx, [0x180000000]
mov r11d, 0x64
mov r10d, 0x6e6f
movabs rcx, 0x61006200670072
lea r8d, [r11 - 3]
cmp r13d, 0x497
ja 0x1800fda13
je 0x1800fda06
cmp r13d, 0x1ff
ja 0x1800fd958
je 0x1800fd917
mov eax, r13d
sub eax, 0xb3
je 0x1800fd8da
sub eax, 3
je 0x1800fd794
sub eax, 0xa3
je 0x1800fd787
cmp eax, 3
mov eax, dword [rbp - 0x7c]
jne 0x1800fe027
mov bl, 1
jmp 0x1800fe027
mov word [rbp + 0x1b8], r14w
jmp 0x1800fe024
mov r15d, r14d
lea r14, [0x180100778]
nop
mov eax, dword [r14 - 8]
mov edi, 0xfc
mov esi, dword [r14 - 4]
mov dword [rbp - 0x78], eax
mov eax, edi
sub eax, 0xf1
je 0x1800fd815
sub eax, 1
je 0x1800fd7da
sub eax, 5
je 0x1800fd808
sub eax, 4
je 0x1800fd800
cmp eax, 1
jne 0x1800fd7ed
mov eax, dword [rbp - 0x78]
add eax, esi
mov dword [rbp - 0x5c], eax
mov dword [rbp - 0x70], eax
jmp 0x1800fd818
xor r8d, r8d
lea rdx, [rbp - 0x78]
lea ecx, [r8 + 0x3d]
call fcn.1800f9c50
mov byte [rbp - 0x70], al
dec edi
cmp edi, 0xf7
ja 0x1800fd7b0
jmp 0x1800fd815
mov eax, dword [rbp - 0x5c]
mov dword [rbp - 0x70], eax
jmp 0x1800fd818
lea rcx, [rbp - 0x78]
call qword [0x180109cd8]
mov byte [rbp - 0x70], al
mov eax, dword [rbp - 0x70]
cmp eax, dword [r14]
jne 0x1800fe03c
add r14, 0xc
inc r15d
cmp r15d, 0xff
jl 0x1800fd7a0
xor r15d, r15d
lea r14, [0x180101378]
nop
mov eax, dword [r14 - 8]
mov edi, 0xfc
mov esi, dword [r14 - 4]
mov dword [rbp - 0x78], eax
mov eax, edi
sub eax, 0xf1
je 0x1800fd8aa
sub eax, 1
je 0x1800fd87e
sub eax, 5
je 0x1800fd89d
sub eax, 4
je 0x1800fd875
cmp eax, 1
jne 0x1800fd891
mov r12d, dword [rbp - 0x78]
imul r12d, esi
mov dword [rbp - 0x6c], r12d
mov eax, r12d
jmp 0x1800fd8ad
xor r8d, r8d
lea rdx, [rbp - 0x78]
lea ecx, [r8 + 0x3d]
call fcn.1800f9c50
mov byte [rbp - 0x6c], al
dec edi
cmp edi, 0xf7
ja 0x1800fd850
jmp 0x1800fd8aa
lea rcx, [rbp - 0x78]
call qword [0x180109cd8]
mov byte [rbp - 0x6c], al
mov eax, dword [rbp - 0x6c]
cmp eax, dword [r14]
jne 0x1800fe03c
add r14, 0xc
inc r15d
cmp r15d, 0xff
jl 0x1800fd840
mov rsi, qword [rbp - 8]
xor r14d, r14d
lea r15d, [r14 + 0x46]
jmp 0x1800fe024
movzx eax, word [0x180104518]
movsd xmm0, qword [0x180104510]
mov word [rbp + 0x1b0], ax
mov eax, dword [0x1801045ac]
mov dword [rbp + 0x1b2], eax
movzx eax, word [0x1801045b0]
mov word [rbp + 0x1b6], ax
movsd qword [rbp + 0x1a8], xmm0
jmp 0x1800fe024
mov r8d, 3
lea rdx, [0x18010434e]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x18010437a]
mov dword [rbp + 0x1be], eax
movzx eax, word [0x18010437e]
mov word [rbp + 0x1c2], ax
mov word [rbp + 0x1c4], r14w
jmp 0x1800fe024
cmp r13d, 0x202
je case.0x1800fdd5b.0
cmp r13d, 0x2a5
je 0x1800fd9df
cmp r13d, 0x34b
je 0x1800fd9c9
cmp r13d, 0x3f1
jne 0x1800fe027
mov r8d, 4
lea rdx, [0x1801041c0]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 1
lea rdx, [0x180104222]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x6e
mov word [rbp + 0x1de], ax
jmp 0x1800fe024
mov qword [rbp + 0x1ca], rcx
mov dword [rbp + 0x1d2], 0x20
jmp 0x1800fe027
mov eax, dword [0x1801044b8]
mov dword [rbp + 0x1c4], eax
movzx eax, word [0x1801044bc]
mov word [rbp + 0x1c8], ax
mov word [rbp + 0x1ca], r14w
jmp 0x1800fe024
mov word [rbp + 0x1e0], r14w
jmp 0x1800fe027
cmp r13d, 0x87b
ja 0x1800fdcf5
je 0x1800fdc81
cmp r13d, 0x53d
je 0x1800fdc26
cmp r13d, 0x5e3
je 0x1800fda83
cmp r13d, 0x72f
je 0x1800fda77
cmp r13d, 0x7d5
jne 0x1800fe027
mov rcx, qword [rbp - 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, rsi
mov dword [rbp - 0x68], eax
call fcn.1800fd610
mov qword [rbp + 0x30], r14
jmp 0x1800fe024
mov dword [rbp - 0x40], 1
jmp 0x1800fe027
cmp qword [rbp - 0x28], 0xffffffffffffffff
mov qword [rbp + 0x38], 0xffffffffffffffff
jne 0x1800fdc1d
mov edi, r14d
nop dword [rax]
cmp edi, 0xa
ja case.default.0x1800fdab5
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0xfe070]
add rcx, rdx
jmp rcx
mov r8d, dword [rbp - 0x54]
lea rax, [rbp + 0x28]
mov edx, dword [rbp - 0x50]
lea r9, [rbp]
mov rcx, qword [rbp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
mov dword [rbp - 0x58], eax
jmp 0x1800fdc00
mov r9d, dword [rbp - 0x48]
lea rax, [rbp - 0x20]
mov r8, qword [rbp + 0x18]
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x50], rax
xor edx, edx
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x68]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultList]
movzx eax, byte [rbp - 0x80]
mov ecx, r14d
cmp dword [rbp - 0x58], 0
cmove ecx, eax
mov byte [rbp - 0x80], cl
jmp 0x1800fdc00
xor bl, bl
jmp case.default.0x1800fdab5
xorps xmm0, xmm0
mov qword [rbp], r14
xor eax, eax
movups xmmword [rbp + 0xb0], xmm0
mov dword [rbp + 0xc0], eax
jmp case.default.0x1800fdab5
xorps xmm0, xmm0
mov dword [rbp - 0x54], 4
movups xmmword [rbp + 0xc8], xmm0
jmp case.default.0x1800fdab5
xorps xmm0, xmm0
mov qword [rbp + 8], r14
movups xmmword [rbp + 0x68], xmm0
mov dword [rbp - 0x50], 1
jmp case.default.0x1800fdab5
mov qword [rbp + 0x10], r14
mov dword [rbp - 0x4c], 0x14
jmp case.default.0x1800fdab5
mov qword [rbp + 0x18], 0xffffffffffffffff
mov dword [rbp - 0x48], 0x2000000
jmp case.default.0x1800fdab5
xorps xmm0, xmm0
mov byte [rbp - 0x80], 1
xor eax, eax
mov qword [rbp + 0x20], r14
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x1a0], rax
movups xmmword [rbp + 0x190], xmm0
jmp case.default.0x1800fdab5
cmp byte [rbp - 0x80], 0
je case.default.0x1800fdab5
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x180000000]
inc edi
lea eax, [rdi + 0xf0]
cmp eax, 0xfb
jb 0x1800fdaa0
mov eax, dword [rbp - 0x7c]
mov dword [rbp - 0x64], r14d
jmp 0x1800fe027
mov r8d, 1
lea rdx, [0x18010426a]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x1800fdc4d
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x58], r14
jmp 0x1800fe024
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x1800fdc8e
mov rdx, qword [rsi]
mov r8d, dword [rbp - 0x68]
lea r9, [rbp - 0x64]
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov dword [rbp - 0x44], r14d
xor eax, eax
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x160], rax
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
jmp 0x1800fe024
cmp r13d, 0x921
je 0x1800fdd35
cmp r13d, 0x9c7
je 0x1800fdd1b
cmp r13d, 0xa6d
jne 0x1800fe027
mov al, 1
jmp 0x1800fe043
mov r9d, dword [rbp - 0x44]
mov r8, qword [rbp + 0x30]
mov edx, dword [rbp - 0x40]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_SetTokenInformation]
jmp 0x1800fe024
mov eax, dword [rbp - 0x68]
cmp eax, dword [rbp - 0x64]
je 0x1800fe00c
mov edi, 0x11
cmp edi, 0x11
ja case.default.0x1800fdd5b
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0xfe09c]
add rcx, rdx
jmp rcx
mov word [rbp + 0xbf], 0x74
jmp case.default.0x1800fdd5b
mov eax, 0x53
mov word [rbp + 0x180], ax
mov eax, 0x70
mov word [rbp + 0x181], ax
mov word [rbp + 0x182], r8w
jmp case.default.0x1800fdd5b
mov qword [rsi + 0x10], r14
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
mov dword [rbp - 0x38], 0x2000000
mov dword [rbp - 0x3c], r14d
jb 0x1800fddac
mov rax, qword [rsi]
mov byte [rax], 0
jmp case.default.0x1800fdd5b
mov byte [rbp + 0xbf], 0
jmp case.default.0x1800fdd5b
mov r8, qword [rbp + 0x48]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x80], rax
lea r9, [rbp + 0xb0]
lea rax, [rbp - 0x14]
xor edx, edx
mov qword [rsp + 0x78], rax
lea rcx, [rbp + 0x170]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x70], rax
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x68], eax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x78]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x50], rax
mov eax, dword [rbp - 0x3c]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x38]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0x88]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultListAndAuditAlarmByHandleA]
mov r8d, 0x61
lea rdx, [0x180000000]
mov r10d, 0x6e6f
lea r11d, [r8 + 3]
jmp case.default.0x1800fdd5b
xor bl, bl
jmp case.default.0x1800fdd5b
mov r8d, 2
lea rdx, [0x180104398]
lea rcx, [rbp + 0x170]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 3
lea rdx, [0x18010439c]
lea rcx, [rbp + 0x171]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [str.__]
mov dword [rbp + 0x173], eax
movzx eax, byte [0x1801043a4]
mov byte [rbp + 0x177], al
jmp 0x1800fde4e
mov edx, dword [rbp - 0x30]
lea r8, [rbp + 0x40]
mov rcx, qword [rbp + 0x50]
mov dword [rbp - 0x34], r14d
mov qword [rbp + 0x40], r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
jmp 0x1800fde4e
xorps xmm0, xmm0
mov dword [rbp - 0x30], 1
xor eax, eax
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0xa8], rax
movups xmmword [rbp + 0x98], xmm0
jmp case.default.0x1800fdd5b
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0xd8], xmm1
jmp case.default.0x1800fdd5b
mov dword [rbp - 0x60], r14d
jmp case.default.0x1800fdd5b
mov word [rbp + 0x18d], r10w
jmp case.default.0x1800fdd5b
mov r8d, 4
lea rdx, [0x1801043bb]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x1801043fe]
mov dword [rbp + 0xba], eax
movzx eax, byte [0x180104402]
mov byte [rbp + 0xbe], al
mov byte [rbp + 0xb9], 0x6d
jmp 0x1800fde4e
mov word [rbp + 0x18f], r8w
mov dword [rbp + 0x190], 0x644f6c
mov word [rbp + 0x193], r11w
jmp case.default.0x1800fdd5b
mov qword [rbp + 0x48], 0xffffffffffffffff
mov qword [rbp + 0x50], r14
jmp case.default.0x1800fdd5b
mov eax, 0x29
mov dword [rbp + 0x177], 0x312820
mov word [rbp + 0x17a], ax
mov eax, dword [0x180104417]
mov dword [rbp + 0xb0], eax
movzx eax, byte [0x18010441b]
mov byte [rbp + 0xb4], al
mov byte [rbp + 0xb5], 0
jmp case.default.0x1800fdd5b
mov word [rbp + 0x187], r15w
mov eax, 0x6974
mov dword [rbp + 0x188], 0x636172
mov word [rbp + 0x18b], ax
mov dword [rbp + 0x183], 0x676e6963
dec edi
lea eax, [rdi + 0xbc]
cmp eax, 0xbb
ja 0x1800fdd46
mov rcx, qword [rbp + 0x58]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_FlushTraceW]
mov eax, dword [rbp - 0x7c]
add r13d, 0xa6
cmp r13d, eax
jae case.0x1800fdd5b.0
mov rdi, qword [rbp + 0x60]
jmp 0x1800fd713
xor al, al
jmp 0x1800fe043
movzx eax, bl
mov rcx, qword [rbp + 0x1e8]
xor rcx, rsp
call fcn.1800fe830
mov rbx, qword [rsp + 0x350]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret