Function at 0x18001a210
Capabilities:
Copy file
Create service
Delete service
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x1800bf580]
xor rax, rsp
mov qword [rbp + 0x4e8], rax
mov r12d, ecx
mov qword [rbp - 0x60], rdx
xor ecx, ecx
mov rdi, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [0x180000000]
mov qword [rbp - 0x48], rcx
lea r9d, [r12 - 0xd]
cmp r12d, r9d
jbe 0x18001a411
movzx eax, word [0x180097100]
lea r8d, [r12 - 0x8b]
movzx r10d, word [0x180097948]
lea esi, [rcx + 0x72]
mov r11d, dword [str.WSASt]
lea ebx, [rcx + 0x74]
movabs r14, 0x64002e00320033
nop
cmp r8d, 0x17
ja case.default.0x18001a2bc
mov edx, dword [rdx + r8*4 + 0x1ae38]
lea rcx, [0x180000000]
add rdx, rcx
jmp rdx
xor ecx, ecx
mov dword [rbp + 0x3c8], 0x610046
mov word [rbp + 0x4e4], cx
mov ecx, 0x69
mov word [rbp + 0x3cc], cx
mov dword [rbp + 0x3ce], 0x65006c
jmp case.0x18001a2bc.11
lea rcx, [rbp + 0x390]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001a2f6
mov word [rcx], ax
movabs rcx, 0x5f003200730077
mov qword [rbp + 0x4d0], rcx
mov word [rbp + 0x399], 0x70
jmp case.0x18001a2bc.11
mov dword [rbp + 0x3e6], 0x650073
mov dword [rbp + 0x3ea], 0x760072
jmp case.0x18001a2bc.11
mov word [rbp + 0x397], bx
jmp case.0x18001a2bc.11
mov ecx, 0x65
mov dword [rbp + 0x3dc], 0x70006f
mov word [rbp + 0x3e0], cx
jmp case.0x18001a2bc.11
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x18001a36f
mov rcx, qword [rdi]
mov qword [rbp - 0x50], rcx
mov rcx, qword [rdi + 0x10]
mov qword [rbp - 0x48], rcx
jmp case.0x18001a2bc.11
mov qword [rbp + 0x4d8], r14
mov dword [rbp + 0x4e0], 0x6c006c
jmp case.0x18001a2bc.11
mov dword [rbp + 0x3d2], 0x200064
mov word [rbp + 0x3d6], bx
jmp case.0x18001a2bc.11
mov dword [rbp + 0x3d8], 0x20006f
jmp case.0x18001a2bc.11
mov ecx, 0x65
mov dword [rbp + 0x3ee], 0x630069
mov word [rbp + 0x3f2], cx
jmp case.0x18001a2bc.11
mov dword [rbp + 0x3e2], 0x20006e
jmp case.0x18001a2bc.11
mov ecx, 0x61
mov word [rbp + 0x394], r10w
mov word [rbp + 0x395], cx
mov word [rbp + 0x396], si
mov dword [rbp + 0x390], r11d
lea rdx, [0x180000000]
dec r8d
lea ecx, [r8 + 0x8b]
cmp ecx, r9d
ja 0x18001a2a0
xor ecx, ecx
movzx ebx, byte [rsp + 0x70]
mov esi, r12d
imul eax, r12d, 0x9c
mov dword [rbp - 0x68], eax
cmp r12d, eax
ja case.0x18001aba4.12
movzx r15d, byte [rsp + 0x70]
mov edx, 0x3d
mov r14, qword [rbp - 0x60]
movabs r8, 0x79007200650075
mov r13, qword [rbp - 0x60]
lea r9d, [rdx + 0x17]
lea r10d, [rdx + 5]
cmp esi, 0x2a7d
ja 0x18001a59a
je 0x18001a574
cmp esi, 0x1589
ja 0x18001a535
je 0x18001a50b
cmp esi, 0x95
je 0x18001a4f5
cmp esi, 0x791
je 0x18001a4d7
cmp esi, 0xe8d
jne 0x18001adf0
mov r8d, 2
lea rdx, [0x180097b54]
lea rcx, [rbp + 0x400]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor ecx, ecx
mov word [rbp + 0x404], cx
jmp 0x18001add8
mov eax, 0x65
lea r8, [rbp - 0x50]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call fcn.180013ff0
jmp 0x18001ae08
mov word [rbp + 0x3fa], r9w
mov dword [rbp + 0x3fc], 0x460048
mov word [rbp + 0x400], cx
jmp 0x18001adf0
mov word [rbp + 0x3f4], cx
mov dword [rbp + 0x3f8], 0x42
jmp 0x18001adf0
movsd xmm0, qword [0x180097b72]
movzx eax, word [0x180097b7a]
movsd qword [rbp + 0x40c], xmm0
mov word [rbp + 0x414], ax
mov qword [rbp + 0x404], r8
jmp 0x18001adf0
cmp esi, 0x1c85
je 0x18001a568
cmp esi, 0x2381
jne 0x18001adf0
mov r8d, 5
lea rdx, [0x180097bfc]
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18001add6
mov word [rbp + 0x416], cx
jmp 0x18001adf0
mov eax, dword [0x180097bd6]
mov dword [rbp + 0x420], eax
movzx eax, word [0x180097bda]
mov word [rbp + 0x424], ax
mov word [rbp + 0x426], cx
jmp 0x18001adf0
cmp esi, 0x466d
ja 0x18001ab48
je 0x18001a63f
cmp esi, 0x3179
je 0x18001a633
cmp esi, 0x3875
je 0x18001a60a
cmp esi, 0x3f71
jne 0x18001adf0
lea rax, [rbp + 0x390]
mov dword [rsp + 0x28], 0x96
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x4d0]
xor ecx, ecx
call fcn.1800295d0
mov edx, 0x28
mov qword [rbp - 0x38], rax
lea ecx, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
jmp 0x18001add6
mov word [rbp + 0x428], cx
lea rdx, [0x1800979d2]
lea rcx, [rbp + 0x3f8]
mov r8d, 3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r15b, 1
jmp 0x18001add6
mov word [rbp + 0x426], dx
jmp 0x18001adf0
mov ecx, 0x202
lea rdx, [rbp - 0x10]
call qword [rbp - 0x38]
test eax, eax
je 0x18001ab31
xor edx, edx
mov edi, edx
cmp edi, 0x1b
ja case.0x18001a674.22
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x1ae98]
add rcx, r8
jmp rcx
mov r8d, 3
lea rdx, [0x1800979dc]
lea rcx, [rbp + 0x48a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movabs rax, 0x6800740076
xor edx, edx
mov qword [rbp + 0x48e], rax
jmp case.0x18001a674.22
movzx eax, word [0x180097a00]
movsd xmm0, qword [0x1800979f8]
mov word [rbp + 0x3b2], ax
movabs rax, 0x6e007500660076
mov qword [rbp + 0x3b4], rax
movsd qword [rbp + 0x3aa], xmm0
jmp case.0x18001a674.22
mov eax, 0x56
mov dword [rbp + 0x4a8], eax
jmp case.0x18001a674.22
movsd xmm0, qword [str.t_in]
mov eax, 0x20
mov dword [rbp + 0x450], eax
mov eax, 0x65
mov dword [rbp + 0x452], eax
movsd qword [rbp + 0x448], xmm0
jmp case.0x18001a674.22
mov r8d, 5
lea rdx, str..pd2
lea rcx, [rbp + 0x494]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x69
mov dword [rbp + 0x49c], 0x70
lea rdx, [0x180097a6a]
mov dword [rbp + 0x49e], eax
lea rcx, [rbp + 0x3a0]
lea r8d, [rax - 0x66]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
jmp case.0x18001a674.22
mov byte [rsp + 0x71], 1
mov qword [rbp - 0x30], rdx
jmp case.0x18001a674.22
mov r8d, 0xa
lea rdx, [rbp + 0x474]
lea ecx, [r8 - 2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov r8d, 0xa
lea rdx, [rbp + 0x476]
lea ecx, [r8 - 4]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
mov eax, dword [0x180097aa4]
xor edx, edx
mov dword [rbp + 0x478], eax
movzx eax, word [0x180097aa8]
mov word [rbp + 0x47c], ax
jmp case.0x18001a674.22
mov r8d, 1
lea rdx, [0x180097a5c]
lea rcx, [rbp + 0x468]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 6
lea rdx, str.c.mask
lea rcx, [rbp + 0x468]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor edx, edx
jmp case.0x18001a674.22
mov rcx, qword [rbp - 0x30]
lea r8, [rbp + 0x468]
mov qword [rsp + 0x60], rdx
mov r9d, 0xf01ff
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x74], edx
lea rdx, [rbp + 0x4a8]
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x7c], 3
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r13, rax
xor edx, edx
jmp case.0x18001a674.22
movsd xmm0, qword [str.tryin]
mov eax, dword [0x180097ac8]
mov dword [rbp + 0x438], eax
movsd qword [rbp + 0x430], xmm0
mov dword [rbp + 0x43a], 0x67
mov word [rbp + 0x3bc], dx
jmp case.0x18001a674.22
cmp byte [rsp + 0x71], 0
je 0x18001a8dd
mov edx, dword [rsp + 0x7c]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x78]
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r8d, r8d
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x430]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor bl, bl
xor edx, edx
jmp case.0x18001a674.22
mov r8d, 0xa
lea rdx, [rbp + 0x4c2]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
lea rcx, [rbp + 0x4a8]
sub rcx, 2
nop
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18001a920
mov eax, dword [0x180097ad8]
xor edx, edx
movsd xmm0, qword [str._V8d9]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
mov eax, 0x6c
mov word [rbp + 0x468], ax
jmp case.0x18001a674.22
mov word [rbp + 0x46a], dx
jmp case.0x18001a674.22
mov eax, dword [0x180097adc]
mov dword [rbp + 0x454], 0x6d
mov dword [rbp + 0x456], eax
movzx eax, word [0x180097ae0]
mov word [rbp + 0x45a], ax
jmp case.0x18001a674.22
mov eax, dword [0x180097ae4]
mov dword [rbp + 0x45a], eax
movzx eax, word [0x180097ae8]
mov word [rbp + 0x45e], ax
jmp case.0x18001a674.22
mov dword [rbp + 0x3a6], 0x720074
jmp case.0x18001a674.22
mov r8d, 3
lea rdx, [0x180097aec]
lea rcx, [rbp + 0x46e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
jmp case.0x18001a674.22
mov r13, rdx
jmp case.0x18001a674.22
mov r8d, 0xa
lea rdx, [rbp + 0x4bc]
lea ecx, [r8 + 0x24]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov r8d, 0xa
lea rdx, [rbp + 0x4c0]
lea ecx, [r8 - 9]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
xor edx, edx
jmp case.0x18001a674.22
mov r8d, 0xa
lea rdx, [rbp + 0x4aa]
lea ecx, [r8 + 0x55]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
movabs rax, 0x44005f0034
lea rcx, [rbp + 0x4a8]
mov qword [rbp + 0x4ae], rax
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18001aa50
mov eax, dword [0x180097af4]
xor edx, edx
mov dword [rcx], eax
movabs rax, 0x34005f0074
mov qword [rbp + 0x4b6], rax
jmp case.0x18001a674.22
movzx eax, byte [rsp + 0x71]
test r13, r13
mov ecx, edx
cmovne ecx, eax
mov byte [rsp + 0x71], cl
jmp case.0x18001a674.22
movabs rax, 0x3c006c0073
lea rcx, [rbp + 0x430]
mov qword [rbp + 0x45e], rax
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18001aab0
mov eax, dword [0x180097af8]
mov dword [rcx], eax
jmp case.0x18001a674.22
mov dword [rbp + 0x472], 0x78
jmp case.0x18001a674.22
mov r8d, 5
lea rdx, [0x180097b00]
lea rcx, [rbp + 0x43c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x180097b0c]
xor edx, edx
mov dword [rbp + 0x444], eax
movzx eax, word [0x180097b10]
mov word [rbp + 0x448], ax
jmp case.0x18001a674.22
mov eax, dword [0x180097b14]
mov dword [rbp + 0x46a], eax
movzx eax, word [0x180097b18]
mov word [rbp + 0x46e], ax
inc edi
lea eax, [rdi + 0x62]
cmp eax, 0x7e
jb 0x18001a657
xor eax, eax
mov ecx, eax
test r14, r14
movzx eax, r15b
cmovne ecx, eax
movzx r15d, cl
jmp 0x18001add6
cmp esi, 0x4d69
je 0x18001ab6e
cmp esi, 0x5465
jne 0x18001adf0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x41]
call fcn.18001c5f0
jmp 0x18001ae08
mov edx, 0x71
mov rcx, rdi
call fcn.180072320
test al, al
jne 0x18001ad49
xor edx, edx
mov edi, edx
cmp edi, 0xc
ja case.default.0x18001aba4
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x1af08]
add rcx, r8
jmp rcx
mov eax, dword [0x18009794c]
mov dword [rbp + 0x3ae], eax
movzx eax, word [0x180097950]
mov word [rbp + 0x3b2], ax
jmp case.default.0x18001aba4
mov r9d, dword [rbp - 0x7c]
lea rax, [rbp + 0x190]
mov r8d, dword [rbp - 0x80]
lea rcx, [rbp + 0x3a0]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov edx, dword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_GetInheritanceSourceW]
mov dword [rbp - 0x74], eax
jmp 0x18001ad34
mov eax, 8
mov qword [rbp - 0x58], rdx
mov word [rbp - 0x56], ax
jmp case.default.0x18001aba4
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
jmp case.default.0x18001aba4
lea rcx, [rbp + 0x3a0]
mov dword [rbp + 0x3a8], 0x3a
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18001ac44
mov eax, dword [0x180097954]
mov dword [rcx], eax
mov eax, 0x6f
mov dword [rbp + 0x3ac], eax
jmp case.default.0x18001aba4
xor bl, bl
jmp case.default.0x18001aba4
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
jmp 0x18001ad34
mov dword [rbp - 0x80], 4
mov dword [rbp - 0x7c], edx
jmp case.default.0x18001aba4
mov eax, dword [0x180097958]
movsd xmm0, qword [0x180097960]
mov dword [rbp + 0x3b2], eax
mov eax, dword [0x180097968]
mov dword [rbp + 0x3be], eax
movsd qword [rbp + 0x3b6], xmm0
mov byte [rsp + 0x70], 1
jmp case.default.0x18001aba4
mov dword [rbp - 0x78], 1
jmp case.default.0x18001aba4
mov eax, 0x56
mov dword [rbp + 0x3a6], 0x49
mov word [rbp + 0x3a0], ax
mov eax, dword [0x18009796c]
mov dword [rbp + 0x3a2], eax
jmp case.default.0x18001aba4
cmp dword [rbp - 0x74], 0
mov ecx, edx
movzx eax, byte [rsp + 0x70]
cmove ecx, eax
mov byte [rsp + 0x70], cl
cmp cl, 0
je 0x18001ad1e
mov edx, 0x20
lea rcx, [rbp + 0x190]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_FreeInheritedFromArray]
mov edx, 0xd431
mov ecx, 0x3039
mov r8d, 0x10932
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor edx, edx
inc edi
lea eax, [rdi + 0xf8]
cmp eax, 0x105
jb 0x18001ab87
test r15b, r15b
je 0x18001adbf
mov edi, 0x4c
mov eax, edi
sub eax, 0x4c
je 0x18001ad9a
cmp eax, 1
jne 0x18001adb8
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x6c]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
test eax, eax
je 0x18001ad81
mov edx, dword [rbp - 0x70]
mov ecx, dword [rbp - 0x6c]
call qword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
test r15b, r15b
je 0x18001adb8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18001adb8
mov edx, 1
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x18001adb8
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r15b, r15b
inc edi
cmp edi, 0x4e
jb 0x18001ad53
xor r8d, r8d
lea rdx, [rbp + 0x3c8]
lea rcx, [rbp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor ecx, ecx
mov r10d, 0x42
movabs r8, 0x79007200650075
lea r9d, [r10 + 0x12]
lea edx, [r10 - 5]
lea eax, [r12 + r12*2]
lea esi, [rsi + rax*4]
cmp esi, dword [rbp - 0x68]
ja case.0x18001aba4.12
mov rdi, qword [rbp - 0x60]
jmp 0x18001a451
movzx eax, bl
mov rcx, qword [rbp + 0x4e8]
xor rcx, rsp
call fcn.1800938b0
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret