Function at 0x10007800
Capabilities:
Create service
Delete service
Modify service
Persist via windows service
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1650
call fcn.100081b0
mov eax, dword [0x1002f2a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1644], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x164c], eax
mov eax, dword [ebp + 0x1c]
push 0x10024220
mov dword [ebp - 0x1650], eax
lea eax, [ebp - 0x210]
push 0x106
mov dword [ebp - 0x163c], edi
mov edi, dword [ebp + 0x14]
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTUtf16CopyAscii]
mov esi, eax
add esp, 0xc
test esi, esi
js 0x10007ef5
push ebx
lea eax, [ebp - 0x210]
push 0x106
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTUtf16Cat]
mov esi, eax
add esp, 0xc
test esi, esi
js 0x10007ef5
push dword [ebp - 0x1644]
lea eax, [ebp - 0x210]
push 0x106
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTUtf16Cat]
mov esi, eax
add esp, 0xc
test esi, esi
js 0x10007ef5
push 0x10024220
lea eax, [ebp - 0x210]
push 0x106
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTUtf16CatAscii]
mov esi, eax
add esp, 0xc
test esi, esi
js 0x10007ef5
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1640], eax
test eax, eax
je 0x10007e92
mov esi, dword [ebp - 0x163c]
mov bl, 1
mov bh, byte [esi + 0x49]
mov byte [ebp - 0x1635], bh
test bh, bh
je 0x10007bdb
push 1
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x1648], eax
test eax, eax
je 0x10007b42
lea ecx, [ebp - 0x1644]
mov dword [ebp - 0x1644], 0
push ecx
push 0x1424
lea ecx, [ebp - 0x1634]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x10007ac7
cmp dword [ebp - 0x162c], 0
je 0x10007bc1
xor esi, esi
cmp dword [ebp - 0x1634], 0x10
je 0x10007996
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007991
push 0x10
push dword [ebp - 0x1634]
push edi
push str.update_service__ls:_dwServiceType__u__expected__u_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x1c
mov esi, 1
cmp dword [ebp - 0x1630], 3
je 0x100079d1
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x100079d0
push 3
push dword [ebp - 0x1630]
push edi
push str.update_service__ls:_dwStartType__u__expected__u_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x1c
inc esi
cmp dword [ebp - 0x162c], 1
je 0x10007a0c
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007a0b
push 1
push dword [ebp - 0x162c]
push edi
push str.update_service__ls:_dwErrorControl__u__expected__u_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x1c
inc esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x1628]
call dword [sym.imp.VBoxRT_x86.dll_RTUtf16ICmp]
add esp, 8
test eax, eax
je 0x10007a5d
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007a5c
lea ecx, [ebp - 0x210]
push ecx
push dword [ebp - 0x1628]
push edi
push str.update_service__ls:_lpBinaryPathName__ls__expected__ls_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x1c
inc esi
mov eax, dword [ebp - 0x1618]
test eax, eax
je 0x10007ab5
cmp word [eax], 0
je 0x10007ab5
push str.LocalSystem
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTUtf16ICmp]
add esp, 8
test eax, eax
je 0x10007ab5
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007ab4
push str.LocalSystem
push dword [ebp - 0x1628]
push edi
push str.update_service__ls:_lpServiceStartName__ls__expected__ls_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x1c
inc esi
test esi, esi
setne al
mov byte [ebp - 0x1635], al
mov bl, al
jmp 0x10007bbb
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007b00
push 0
push str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
push 0x976
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
push str.AssertLogRel__s__d___s:__s_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x20
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
mov esi, eax
add esp, 4
test esi, esi
je 0x10007bbb
push 0x1424
push dword [ebp - 0x1644]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.QueryServiceConfigW_returned__u__cbNeeded_u_vs__zu__n
push 0xb8
push 0x10
push esi
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x1c
jmp 0x10007bbb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x424
setne bl
je 0x10007bbb
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007b91
push str.dwErr__ERROR_SERVICE_DOES_NOT_EXIST
push str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
push 0x97c
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
push str.AssertLogRel__s__d___s:__s_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x20
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007bbb
push esi
push edi
push str.OpenServiceW__ls______u_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x18
mov esi, dword [ebp - 0x163c]
push dword [ebp - 0x1648]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x10007d71
mov eax, dword [ebp - 0x1640]
push 0x10020
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
je 0x10007d21
xorps xmm0, xmm0
mov dword [ebp - 0x161c], 0
push 0x426
movups xmmword [ebp - 0x1634], xmm0
movq qword [ebp - 0x1624], xmm0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x1634]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x10007c54
cmp eax, 0x426
je 0x10007c54
cmp eax, 0x425
jne 0x10007d0b
cmp dword [ebp - 0x1630], 3
jne 0x10007d0b
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0xb80010
test eax, eax
je 0x10007ca5
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007d0b
push edi
push str.update_service__ls:_deleted_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x14
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x1640]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10007d77
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007cd9
push 0
push str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
push 0x998
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
push str.AssertLogRel__s__d___s:__s_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x20
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
mov esi, eax
add esp, 4
test esi, esi
je 0x10007d0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.Failed_to_not_delete_service__ls:__u_n
push 0xb8
push 0x10
push esi
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x18
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x1640]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10007d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xb80010
mov dword [esi + 0x34], eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007d56
push dword [esi + 0x34]
push edi
push str.Failed_to_not_open_service__ls_for_stopdelete:__u_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x18
mov esi, dword [ebp - 0x1640]
push 2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10007d77
mov esi, dword [ebp - 0x1640]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [ebp - 0x1635], 0
je 0x10007f5a
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x10007e60
push 0
push 0
push str.RPCSS
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push 1
push 3
push 0x10
push 2
push dword [ebp - 0x164c]
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, eax
test ebx, ebx
je 0x10007e39
mov eax, dword [ebp - 0x1650]
mov dword [ebp - 0x1634], eax
lea eax, [ebp - 0x1634]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x10007e1a
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007e1a
push edi
push str.update_service__ls:_created_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x14
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008170
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x163c]
push esi
mov dword [edi + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008170
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x163c]
push 0xb80010
mov dword [edi + 0x34], eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007f5a
push dword [edi + 0x34]
push str.Failed_to_open_service_manager_with_create_service_access:__u_n
jmp 0x10007f49
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007ecb
push 0
push str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
push 0x9d9
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
push str.AssertLogRel__s__d___s:__s_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x20
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
mov esi, eax
add esp, 4
test esi, esi
je 0x10007f5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenSCManagerW_failed:__u_n
push 0xb8
push 0x10
push esi
jmp 0x10007f51
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007f31
push str.RT_SUCCESS_NP_rc_
push str.void___cdecl_vbpsUpdateWindowsService_struct_VBPSREGSTATE__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__const_unsigned_short__
push 0x92f
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
push str.AssertLogRel__s__d___s:__s_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x20
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10007f5a
push esi
push str._Rra_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008170
mov esp, ebp
pop ebp
ret