Function at 0x1800055c0
Capabilities:
Check mutex on windows
Create service
Delete file
Generate random numbers via winapi
Get common file path
Modify service
Start service

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7c8
mov rax, qword [0x1805560a0]
xor rax, rsp
mov qword [rsp + 0x7c0], rax
test rcx, rcx
je 0x180005684
mov r14, rdx
mov rdi, rcx
movups xmm0, xmmword [0x18054b1cf]
movaps xmmword [rsp + 0x6c0], xmm0
movups xmm0, xmmword [0x18054b1bf]
movaps xmmword [rsp + 0x6b0], xmm0
mov qword [rsp + 0x6d0], 0
mov rdx, qword [0x180556b90]
test rdx, rdx
jne 0x18000564d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtDrawText
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
mov qword [0x180556b90], rax
mov dword [rsp + 0x6d8], 0
mov byte [rsp + 0x6dc], 0
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call rdx
cmp byte [rsp + 0x6dc], 0
je 0x1800056ca
xor esi, esi
xor ebp, ebp
jmp 0x18000568b
mov ebp, 0xffffffff
xor esi, esi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x7c0]
xor rcx, rsp
call fcn.18001a3d0
mov eax, ebp
add rsp, 0x7c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.CAgumiTome
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x180005731
mov rsi, rax
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebp, 0xfffffffa
test eax, eax
jne 0x18000568b
xor eax, eax
xor ecx, ecx
cpuid
cmp edx, 0x69746e65
jne 0x18000573b
cmp ebx, 0x68747541
jne 0x18000573b
cmp ecx, 0x444d4163
jne 0x18000573b
mov eax, 0x80000001
xor ecx, ecx
cpuid
mov ebp, 0x157ff
test cl, 4
je 0x18000568b
jmp 0x180005752
mov ebp, 0xfffffffb
jmp 0x180005689
mov eax, 1
xor ecx, ecx
cpuid
mov ebp, 0x15800
test cl, 0x20
je 0x18000568b
lea rcx, [rsp + 0x4a0]
mov r8d, 0x208
xor edx, edx
call fcn.1800093f0
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x6b0]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800057f4
xor ebp, ebp
lea r15, [rsp + 0x68]
mov rbx, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
jmp 0x1800057aa
add rbp, 1
cmp rbp, 0xa
je 0x1800057e4
mov rcx, qword [rsp + 0x6b0]
mov edx, 1
mov r8, r15
call rbx
test eax, eax
je 0x1800057a0
movzx eax, byte [rsp + 0x68]
imul ecx, eax, 0x4f
shr ecx, 0xb
lea edx, [rcx + rcx*4]
lea edx, [rdx + rdx*4]
add edx, ecx
sub al, dl
add al, 0x41
movzx eax, al
mov word [rsp + rbp*2 + 0x4a0], ax
jmp 0x1800057a0
mov rcx, qword [rsp + 0x6b0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [0x180556b98]
mov edx, 2
call fcn.180007230
lea rbx, [rsp + 0x280]
mov r8d, 0x104
mov rcx, rbx
xor edx, edx
call fcn.1800093f0
mov rcx, rbx
call fcn.180004370
test eax, eax
je 0x18000588f
lea rcx, [0x180556b98]
lea rdx, str.SOFTWARENK
lea r8, [0x18054b12e]
lea r15, [rsp + 0x390]
mov r9, r15
call fcn.180007940
mov ebx, eax
lea rbp, [rsp + 0x280]
mov rcx, rbp
call fcn.18000b720
lea r8, [rax + 1]
mov rcx, r15
mov rdx, rbp
call fcn.1800088c0
lea rcx, [0x180556b98]
test bl, bl
je 0x180005899
lea rdx, str.SOFTWARENK
lea r8, [0x18054b12e]
call fcn.180007710
jmp 0x1800058ac
mov ebp, 0xfffffff8
jmp 0x18000568b
lea rdx, str.SOFTWARE
lea r8, [0x18054b13d]
call fcn.180007290
lea rbx, [0x180556b98]
lea rbp, str.SOFTWARENK
lea r8, [0x18054b12e]
lea r15, [rsp + 0x390]
mov rcx, rbx
mov rdx, rbp
mov r9, r15
call fcn.1800074c0
lea r8, str.VALUE
mov rcx, rbx
mov rdx, rbp
mov r9, r15
call fcn.180007940
test al, al
je 0x18000590a
lea rcx, [0x180556b98]
lea rdx, str.SOFTWARENK
lea r8, str.VALUE
call fcn.180007710
lea rbx, [0x180556b98]
lea rbp, str.SOFTWARENK
lea r8, str.VALUE
mov rcx, rbx
mov rdx, rbp
mov r9, r14
call fcn.1800074c0
lea r8, [0x18054b14f]
lea r9, [rsp + 0x390]
mov rcx, rbx
mov rdx, rbp
call fcn.180007940
test al, al
je 0x180005965
lea rcx, [0x180556b98]
lea rdx, str.SOFTWARENK
lea r8, [0x18054b14f]
call fcn.180007710
lea rcx, [0x180556b98]
lea rdx, str.SOFTWARENK
lea r8, [0x18054b14f]
lea r9, str._A_8C8__8BB
call fcn.1800074c0
lea rdx, [rsp + 0x70]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x180005ae7
lea r8, [0x18054b160]
lea r15, [rsp + 0x70]
mov edx, 0x104
mov rcx, r15
call fcn.18000cd64
mov edx, 0x104
mov rcx, r15
mov r8, rdi
call fcn.18000cd64
lea r8, [0x18054b164]
mov edx, 0x104
mov rcx, r15
call fcn.18000cd64
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x180005ae0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
lea r14, [rsp + 0x4a0]
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
jne 0x180005a68
mov ebp, eax
cmp eax, 0x431
jne 0x18000568b
test rbx, rbx
jne 0x180005a92
lea rdx, [rsp + 0x4a0]
mov rcx, rdi
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x180005ae0
mov qword [rsp + 0x50], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x48], 0
mov rcx, rbx
mov edx, 1
mov r8d, 3
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x18000568b
mov ebp, 0xfffffffe
jmp 0x18000568b