Function at 0x18002fa10
Capabilities:
Create service
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
lea eax, [rdx + 0x10]
mov esi, edx
mov dword [rbp - 0x38], eax
mov r15, rcx
cmp edx, eax
jae 0x180030136
movzx r14d, byte [rbp + 0x308]
lea eax, [rdx - 0xab]
mov r13, qword [rbp + 0x318]
lea r9, [0x180000000]
mov rdi, qword [rbp + 0x318]
xor ebx, ebx
mov r12, qword [rbp + 0x318]
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x7c], r14d
lea edx, [rbx + 0x10]
lea r10d, [rbx + 0x5f]
lea r11d, [rbx + 0x4f]
nop word [rax + rax]
cmp eax, 0x40
ja case.0x18002faad.16
movzx eax, byte [r9 + rax + 0x3019c]
mov ecx, dword [r9 + rax*4 + 0x30158]
add rcx, r9
jmp rcx
cmp qword [r15 + 0x18], 0x10
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov rdx, r15
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
jb 0x18002fad1
mov rdx, qword [r15]
mov r8d, dword [rsp + 0x78]
lea r9, [rbp - 0x70]
mov rcx, qword [rbp - 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8, qword [rbp + 0x310]
lea r9, [0x180000000]
mov edx, 0x10
lea r10d, [rdx + 0x4f]
lea r11d, [rdx + 0x3f]
jmp case.0x18002faad.16
cmp qword [r8 + 0x18], 8
mov eax, 0x31
mov word [rbp - 0x4d], ax
mov rcx, r8
jb 0x18002fb1f
mov rcx, qword [r8]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x18002fcd2
mov esi, 0xa6
nop dword [rax]
cmp esi, 0x24f
ja 0x18002fbf4
je 0x18002fbda
mov eax, esi
sub eax, 0xa6
je 0x18002fbcd
sub eax, 0x55
je 0x18002fbc1
sub eax, 0x55
je 0x18002fbb0
sub eax, 0x55
je 0x18002fba5
cmp eax, 0x55
jne 0x18002fcbd
mov dword [rbp - 0x40], ebx
mov word [rsp + 0x74], bx
mov qword [rbp - 0x30], rbx
mov word [rsp + 0x70], bx
jmp 0x18002fcbd
mov dword [rbp - 0x3c], ebx
mov r13, rbx
jmp 0x18002fcbd
mov qword [rbp + 0x10], 0xffffffffffffffff
mov qword [rbp + 0x18], rbx
jmp 0x18002fcbd
mov byte [rbp + 0x318], 1
jmp 0x18002fcbd
mov r14b, 1
mov dword [rsp + 0x7c], r14d
jmp 0x18002fcbd
mov r8d, dword [rbp - 0x40]
lea r9, [rbp - 0x30]
mov edx, dword [rbp - 0x3c]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
jmp 0x18002fcbd
mov eax, esi
sub eax, 0x2a4
je 0x18002fc6a
sub eax, 0x55
je 0x18002fc1d
sub eax, 0x55
je 0x18002fc15
cmp eax, 0x55
je 0x180030136
jmp 0x18002fcbd
mov byte [rbp - 0x78], bl
jmp 0x18002fcbd
movzx eax, byte [rbp + 0x318]
mov edx, ebx
mov rcx, qword [rbp - 0x30]
test rcx, rcx
movzx r14d, r14b
cmove r14d, ebx
test r13, r13
mov dword [rsp + 0x7c], r14d
cmovne edx, eax
mov byte [rbp + 0x318], dl
movzx eax, dl
test r14b, r14b
je 0x18002fc5b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rbp + 0x318]
test al, al
je 0x18002fcbd
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18002fcbd
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x74]
mov qword [rsp + 0x58], rbx
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r13, rax
add esi, 0x55
cmp esi, 0x3f8
jb 0x18002fb60
mov esi, dword [rbp + 0x308]
xorps xmm0, xmm0
mov dword [rbp - 0x70], ebx
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
jmp 0x18002fae9
mov eax, 0x535f
mov dword [rbp - 0x5e], 0x414e4749
mov word [rbp - 0x60], ax
mov eax, 0x54
mov word [rbp - 0x5a], ax
mov dword [rbp - 0x59], 0x455255
jmp case.0x18002faad.16
mov eax, 0x53
mov word [rbp - 0x56], r10w
mov dword [rbp - 0x55], 0x524556
mov word [rbp - 0x52], ax
mov eax, 0x49
mov word [rbp - 0x51], ax
jmp case.0x18002faad.16
mov eax, 0x4e
mov word [rbp - 0x50], r11w
mov word [rbp - 0x4f], ax
mov word [rbp - 0x4e], r10w
jmp case.0x18002faad.16
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
cmp eax, dword [rbp - 0x70]
je 0x18002fec9
mov esi, 4
cmp esi, 0x7b4
ja 0x18002fe44
je 0x18002fe3b
cmp esi, 4
je 0x18002fe2b
cmp esi, 0x1f0
je 0x18002fde0
cmp esi, 0x3dc
je 0x18002fdc0
cmp esi, 0x5c8
jne 0x18002feb1
mov r8d, 2
mov word [rbp + 2], bx
lea rdx, [0x18009d47a]
lea rcx, [rbp + 2]
call fcn.18006f0ec
mov eax, 0x65
mov word [rbp + 6], ax
jmp 0x18002feb1
mov eax, dword [0x18009d302]
mov dword [rbp - 8], eax
movzx eax, word [0x18009d306]
mov word [rbp - 4], ax
mov dword [rbp - 2], 0x4f005c
jmp 0x18002feb1
movsd xmm0, qword [0x18009d3d2]
lea rdx, [0x18009d426]
movzx eax, word [0x18009d3da]
lea rcx, [rbp - 0x28]
mov r8d, 4
movsd qword [rbp - 0x20], xmm0
mov word [rbp - 0x18], ax
mov word [rbp - 0x16], bx
call fcn.18006f0a4
mov eax, dword [0x18009d458]
mov dword [rbp - 0xe], eax
movzx eax, word [0x18009d45c]
mov word [rbp - 0xa], ax
jmp 0x18002feb1
movabs rax, 0x52007400650047
mov qword [rbp - 0x28], rax
jmp 0x18002feb1
mov dword [rbp + 8], 0x72
jmp 0x18002feb1
cmp esi, 0x9a0
je 0x18002fe9a
cmp esi, 0xb8c
je 0x18002fe64
cmp esi, 0xd78
jne 0x18002feb1
mov byte [rbp - 0x78], bl
jmp 0x180030136
xor eax, eax
lea rdx, [rbp + 0xb0]
xorps xmm0, xmm0
mov qword [rbp + 0x48], rax
mov r8d, 0x104
mov dword [rbp + 0x50], eax
lea rcx, [rbp - 0x28]
movups xmmword [rbp + 0x38], xmm0
call qword [sym.imp.SHLWAPI.dll_PathSearchAndQualifyW]
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x38]
call sub.IMM32.dll_ImmGetCompositionWindow
jmp 0x18002feb1
mov qword [r15 + 0x10], rbx
mov rax, r15
cmp qword [r15 + 0x18], 0x10
mov qword [rbp + 0x20], rbx
jb 0x18002feaf
mov rax, qword [r15]
mov byte [rax], bl
add esi, 0x1ec
cmp esi, 0xf60
jbe 0x18002fd61
mov esi, dword [rbp + 0x308]
xor eax, eax
lea rcx, [rbp - 0x68]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x30], eax
call qword [sym.imp.SHLWAPI.dll_PathIsLFNFileSpecA]
jmp 0x18002fae9
lea rax, [rbp + 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_BuildTrusteeWithObjectsAndSidW]
jmp 0x18002fae9
mov edx, dword [rsp + 0x78]
xor r8d, r8d
mov rcx, r15
call fcn.180043cd0
jmp 0x18002fae9
mov eax, 0x52
mov dword [rbp - 0x68], 0x5f443344
mov word [rbp - 0x64], ax
mov eax, 0x544f
mov word [rbp - 0x63], r11w
mov word [rbp - 0x62], ax
jmp case.0x18002faad.16
mov rsi, qword [r8]
test rsi, rsi
je 0x180030036
nop word [rax + rax]
mov rdx, qword [rsi + 0x18]
mov rcx, qword [r15]
call qword [r8 + 8]
test eax, eax
je 0x18003005d
jns 0x18002ff6a
mov rsi, qword [rsi]
jmp 0x18002ff6e
mov rsi, qword [rsi + 8]
mov r8, qword [rbp + 0x310]
test rsi, rsi
jne 0x18002ff50
jmp 0x18003001a
mov rcx, qword [rbp - 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x78], eax
jmp 0x18002fae9
mov esi, ebx
mov r14d, 0xb3
nop dword [rax]
mov eax, r14d
sub eax, 0xb1
je 0x18003000a
sub eax, 1
je 0x18002ffcb
sub eax, 1
jne 0x18002fff1
test esi, esi
mov rcx, rdx
cmove esi, edx
call fcn.18006f754
mov r12, rax
test rax, rax
je 0x180030007
jmp 0x18002ffec
mov ecx, esi
shl rcx, 3
mov dword [r12 + 0xc], esi
mov dword [r12 + 8], ebx
call fcn.18006f754
mov qword [r12], rax
test rax, rax
je 0x18002ffff
mov rdi, r12
mov edx, 0x10
dec r14d
cmp r14d, 0xae
ja 0x18002ffa0
jmp 0x18003000a
mov rcx, r12
call fcn.18006f74c
mov rdi, rbx
xor edx, edx
mov r8d, 0x95
mov rcx, rdi
call fcn.180047770
mov r8, qword [rbp + 0x310]
lea r9, [0x180000000]
mov r11d, 0x4f
lea r10d, [r11 + 0x10]
lea edx, [r11 - 0x3f]
mov esi, dword [rbp + 0x308]
inc dword [rbp - 0x80]
inc esi
mov dword [rbp + 0x308], esi
cmp esi, dword [rbp - 0x38]
jae 0x180030136
mov r14d, dword [rsp + 0x7c]
mov eax, dword [rbp - 0x80]
jmp 0x18002fa90
mov rax, rsi
jmp 0x18003013a
mov byte [rbp - 0x78], 1
jmp 0x180030136
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x100
call fcn.180028b70
mov rbx, rax
lea rsi, [0x18071a854]
mov edi, 0x3e8
lea r14, [0x18071a858]
lea r15, [0x18071a85c]
lea r12, [0x18071a860]
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
mov qword [rbp + 0x318], rsi
mov rdx, rbx
lea rcx, [rbp + 0x318]
lea r8d, [r9 + 0x2b]
call fcn.1800198f0
xor r9d, r9d
mov qword [rbp + 0x318], r14
mov rdx, rbx
lea rcx, [rbp + 0x318]
lea r8d, [r9 + 0x2b]
call fcn.1800198f0
xor r9d, r9d
mov qword [rbp + 0x318], r15
mov rdx, rbx
lea rcx, [rbp + 0x318]
lea r8d, [r9 + 0x2b]
call fcn.1800198f0
xor r9d, r9d
mov qword [rbp + 0x318], r12
mov rdx, rbx
lea rcx, [rbp + 0x318]
lea r8d, [r9 + 0x2b]
call fcn.1800198f0
sub rdi, 1
jne 0x1800300b0
mov rax, rbx
jmp 0x18003013a
mov eax, dword [r8 + 0x3c]
mov dword [rbp - 0x78], eax
mov rax, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x400]
add rsp, 0x3c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret