Function at 0x180011e30
Capabilities:
Enumerate services
Query or enumerate registry key
Start service

Disassembly:
mov rax, rsp
sub rsp, 0x148
movsd xmm0, qword [0x1800b37e8]
ucomisd xmm0, qword [0x18009a578]
jp 0x18000d264
jne 0x18000d264
mov qword [rax + 8], rbx
lea rdx, str.dumhepio
mov qword [rax - 8], rdi
lea rcx, [rsp + 0x30]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
call fcn.18000a440
movsd xmm2, qword [0x1800b3878]
mov rdx, rax
mov ecx, 0x3bc734fb
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
movsd xmm6, qword [0x180099e58]
mov r8d, 0x1e14fdf3
movsd xmm1, qword [0x180099038]
mov ecx, 0xf5d9828
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x50]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3878]
mov r9, rax
mov ecx, 0x8f16a73
movsd xmm2, qword [0x1800b3910]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, xmm7
movsd xmm7, qword [0x180099478]
subsd xmm7, xmm1
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
movsd xmm1, qword [0x1800b3910]
mov r8d, 0x221400b
movsd xmm0, qword [0x1800b3870]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x18009a150]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rdx, str.fyjoccadomaatuc
lea rcx, [rsp + 0x70]
divsd xmm6, xmm0
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movaps xmm8, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x90]
cvttsd2si rbx, qword [0x1800b3848]
cvttsd2si edi, qword [0x1800b3870]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, xmm6
mulsd xmm8, xmm1
addsd xmm8, xmm7
call fcn.18002f2d0
movsd xmm2, qword [0x180099e08]
mov rcx, rax
mov r9d, 0xdcb8211
mov qword [rsp + 0x20], rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov ecx, 0x185e5a16
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099be0]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
lea rdx, str.muhyyfmusaiz
lea rcx, [rsp + 0xb0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
mov r8, rax
mov edx, 0x29866dc0
mov ecx, 0x16754762
mov r9d, 0x5c5f075
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0xd0]
cvttsd2si ebx, qword [0x1800b37e8]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
addsd xmm7, xmm8
call fcn.18002f2f0
movsd xmm0, qword [0x1800b3878]
mov rdx, rax
cvttsd2si ecx, qword [0x1800b3848]
mov r9d, ebx
mov r8d, 0x235b9474
movsd qword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0xf0]
movsd xmm6, qword [0x1800994a0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movaps xmm8, xmmword [rsp + 0x110]
mov rdi, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x150]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x130]
movsd qword [0x1800b37e8], xmm7
movaps xmm7, xmmword [rsp + 0x120]
call fcn.18000e1f0
add rsp, 0x148
jmp 0x18000e710
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x98]
sub rsp, 0x190
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
call fcn.18000ef70
movsd xmm0, qword [0x1800b3910]
mov edi, 0x4e077
movsd xmm8, qword [0x18009a4b8]
ucomisd xmm0, xmm8
jp 0x18000edcf
jne 0x18000edcf
movaps xmmword [rsp + 0x150], xmm9
movsd xmm9, qword [0x1800999d8]
movaps xmmword [rsp + 0x140], xmm10
movsd xmm10, qword [0x1800998e8]
movaps xmmword [rsp + 0x130], xmm11
movsd xmm11, qword [0x180098a00]
movaps xmmword [rsp + 0x120], xmm12
movsd xmm12, qword [0x1800989f8]
movaps xmmword [rsp + 0x110], xmm13
movsd xmm13, qword [0x180099978]
movaps xmmword [rsp + 0x100], xmm14
movsd xmm14, qword [0x180098af8]
movaps xmmword [rsp + 0xf0], xmm15
movsd xmm15, qword [0x180098f08]
cmp edi, 0x4e078
jge 0x18000ed90
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x30]
cvttsd2si rbx, qword [0x1800b3870]
call fcn.18002f2f0
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov ecx, 0x7c6a753
mov r9d, 0x2ac0fdb8
mov r8d, 0x5a02311
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x50]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm9
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movaps xmm6, xmm14
subsd xmm6, xmm0
movaps xmm0, xmm10
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm7, xmm7
lea rdx, str.oukhimw
lea rcx, [rsp + 0x70]
cvtsi2sd xmm7, rax
mulsd xmm7, xmm11
call fcn.1800090b0
lea rdx, str.wavymuiv
mov rbx, rax
lea rcx, [rbp - 0x70]
call fcn.1800090b0
cvttsd2si edx, qword [0x1800b3910]
mov r8, rax
mov qword [rsp + 0x20], rbx
mov r9d, 0x32754b56
movaps xmm0, xmm12
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si ebx, qword [0x1800b3878]
lea rdx, str.zerucihoiwujo
lea rcx, [rbp - 0x50]
divsd xmm7, xmm0
addsd xmm7, xmm6
call fcn.18000a440
mov rcx, rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x30]
xorps xmm0, xmm0
movaps xmm6, xmm13
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2d0
mov r8, rax
movsd xmm1, qword [0x1800b37e8]
movsd xmm0, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rbx, qword [0x1800b3870]
lea rcx, [rbp - 0x30]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
addsd xmm0, xmm7
cvttsd2si rdx, xmm0
movsd qword [0x1800b3848], xmm0
call fcn.18002f2f0
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov ecx, 0x7c6a753
mov r9d, 0x2ac0fdb8
mov r8d, 0x5a02311
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
movd xmm7, eax
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x50]
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm9
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movaps xmm6, xmm15
subsd xmm6, xmm0
movaps xmm0, xmm10
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm7, xmm7
lea rdx, str.oukhimw
lea rcx, [rbp - 0x70]
cvtsi2sd xmm7, rax
mulsd xmm7, xmm11
call fcn.1800090b0
lea rdx, str.wavymuiv
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.1800090b0
cvttsd2si edx, qword [0x1800b3910]
mov r8, rax
mov qword [rsp + 0x20], rbx
mov r9d, 0x32754b56
movaps xmm0, xmm12
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si ebx, qword [0x1800b3878]
lea rdx, str.zerucihoiwujo
lea rcx, [rsp + 0x50]
divsd xmm7, xmm0
addsd xmm7, xmm6
call fcn.18000a440
mov rcx, rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
movaps xmm6, xmm13
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2d0
mov r8, rax
movsd xmm1, qword [0x1800b37e8]
movsd xmm0, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rbx, qword [0x1800b3870]
lea rcx, [rbp - 0x30]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
addsd xmm0, xmm7
cvttsd2si rdx, xmm0
movsd qword [0x1800b3848], xmm0
call fcn.18002f2f0
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov ecx, 0x7c6a753
mov r9d, 0x2ac0fdb8
mov r8d, 0x5a02311
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x50]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm9
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movsd xmm6, qword [0x180098be8]
subsd xmm6, xmm0
movaps xmm0, xmm10
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm7, xmm7
lea rdx, str.oukhimw
lea rcx, [rbp - 0x70]
cvtsi2sd xmm7, rax
mulsd xmm7, xmm11
call fcn.1800090b0
lea rdx, str.wavymuiv
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.1800090b0
cvttsd2si edx, qword [0x1800b3910]
mov r8, rax
mov qword [rsp + 0x20], rbx
mov r9d, 0x32754b56
movaps xmm0, xmm12
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si ebx, qword [0x1800b3878]
lea rdx, str.zerucihoiwujo
lea rcx, [rsp + 0x50]
divsd xmm7, xmm0
addsd xmm7, xmm6
call fcn.18000a440
mov rcx, rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
movaps xmm6, xmm13
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2d0
mov r8, rax
movsd xmm1, qword [0x1800b37e8]
movsd xmm0, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x30]
cvttsd2si rbx, qword [0x1800b3870]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
addsd xmm0, xmm7
movsd qword [0x1800b3910], xmm0
call fcn.18002f2f0
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov ecx, 0x7c6a753
mov r9d, 0x2ac0fdb8
mov r8d, 0x5a02311
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x50]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm9
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movsd xmm6, qword [0x18009a020]
subsd xmm6, xmm0
movaps xmm0, xmm10
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm7, xmm7
lea rdx, str.oukhimw
cvtsi2sd xmm7, rax
mulsd xmm7, xmm11
lea rcx, [rbp - 0x70]
call fcn.1800090b0
lea rdx, str.wavymuiv
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.1800090b0
cvttsd2si edx, qword [0x1800b3910]
mov r8, rax
mov qword [rsp + 0x20], rbx
mov r9d, 0x32754b56
movaps xmm0, xmm12
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si ebx, qword [0x1800b3878]
lea rdx, str.zerucihoiwujo
lea rcx, [rsp + 0x50]
divsd xmm7, xmm0
addsd xmm7, xmm6
call fcn.18000a440
mov rcx, rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
movaps xmm6, xmm13
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2d0
mov r8, rax
movsd xmm1, qword [0x1800b37e8]
movsd xmm0, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm0, xmm0
inc edi
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
addsd xmm0, xmm7
movsd qword [0x1800b37e8], xmm0
movsd xmm0, qword [0x1800b3910]
ucomisd xmm0, xmm8
jp 0x18000ed90
je 0x18000e7e1
movaps xmm14, xmmword [rsp + 0x100]
movaps xmm13, xmmword [rsp + 0x110]
movaps xmm12, xmmword [rsp + 0x120]
movaps xmm11, xmmword [rsp + 0x130]
movaps xmm10, xmmword [rsp + 0x140]
movaps xmm9, xmmword [rsp + 0x150]
movaps xmm15, xmmword [rsp + 0xf0]
call fcn.18000fac0
movsd xmm0, qword [0x1800b3878]
ucomisd xmm0, qword [0x18009a390]
movaps xmm8, xmmword [rsp + 0x160]
jp 0x18000ef3e
jne 0x18000ef3e
cvttsd2si rdx, qword [0x1800b3870]
mov qword [rsp + 0x1a0], rsi
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x1a8], r14
call fcn.18002f2f0
cvttsd2si r14, qword [0x1800b3848]
lea rdx, str.qiuvpiepae
mov rsi, rax
lea rcx, [rbp - 0x50]
call fcn.1800090b0
lea rdx, str.Icieexwuevegal
mov rdi, rax
lea rcx, [rbp - 0x70]
call fcn.18000a440
lea rcx, [rsp + 0x70]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3848]
call fcn.18002f2d0
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
movsd xmm7, qword [0x180099af8]
lea rdx, str.emaikahuv
cvttsd2si rdi, qword [0x1800b3848]
lea rcx, [rsp + 0x50]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x180099308]
subsd xmm7, xmm0
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rdi
mov r8d, 0x311a501c
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cvttsd2si rcx, qword [0x1800b3848]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180098a60]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edx, 0x278abd7e
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movsd xmm0, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r14, qword [rsp + 0x1a8]
xorps xmm0, xmm0
mov rsi, qword [rsp + 0x1a0]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm7, xmm6
movsd qword [0x1800b3848], xmm7
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
jmp 0x180011480
mov rax, rsp
sub rsp, 0x98
movsd xmm0, qword [0x1800b3910]
ucomisd xmm0, qword [str._dPK7]
jp 0x180011753
jne 0x180011753
cvttsd2si r8d, qword [0x1800b37e8]
mov qword [rax - 8], rbx
mov ecx, 0x369c1b70
cvttsd2si rdx, qword [0x1800b37e8]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x20]
movsd xmm8, qword [0x1800997f0]
movd xmm0, eax
movaps xmm6, xmm8
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2d0
lea rcx, [rsp + 0x40]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3848]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
movsd xmm7, qword [0x1800999f8]
mov edx, 0x21ebf8e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movaps xmm0, xmm7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsd xmm1, qword [0x180099b80]
mov ecx, 0x369c1b70
cvttsd2si r8d, qword [0x1800b37e8]
cvttsd2si rdx, qword [0x1800b37e8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm1, xmm6
movsd qword [0x1800b3910], xmm1
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x40]
movd xmm0, eax
movaps xmm6, xmm8
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2d0
lea rcx, [rsp + 0x20]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3848]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov edx, 0x21ebf8e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movaps xmm0, xmm7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsd xmm1, qword [0x180098e10]
mov ecx, 0x369c1b70
cvttsd2si r8d, qword [0x1800b37e8]
cvttsd2si rdx, qword [0x1800b37e8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm1, xmm6
movsd qword [0x1800b3848], xmm1
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x40]
movd xmm0, eax
movaps xmm6, xmm8
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2d0
lea rcx, [rsp + 0x20]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3848]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov edx, 0x21ebf8e0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movaps xmm0, xmm7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsd xmm1, qword [0x180098fd0]
mov ecx, 0x369c1b70
cvttsd2si r8d, qword [0x1800b37e8]
cvttsd2si rdx, qword [0x1800b37e8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm1, xmm6
movsd qword [0x1800b3870], xmm1
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x40]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm8, xmm0
call fcn.18002f2d0
lea rcx, [rsp + 0x20]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3848]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov edx, 0x21ebf8e0
movaps xmm0, xmm7
movd xmm1, eax
cvtdq2pd xmm1, xmm1
divsd xmm8, xmm1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsd xmm1, qword [0x18009a0f0]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm8, xmm0
subsd xmm1, xmm8
movaps xmm8, xmmword [rsp + 0x60]
movsd qword [0x1800b37e8], xmm1
add rsp, 0x98
jmp 0x180011760
sub rsp, 0x138
call fcn.180011c70
movsd xmm0, qword [0x1800b3910]
ucomisd xmm0, qword [0x18009a608]
jp 0x180011c5d
jne 0x180011c5d
mov qword [rsp + 0x140], rbx
lea rdx, str.tumv
mov qword [rsp + 0x130], rdi
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm7
movaps xmmword [rsp + 0x100], xmm8
movaps xmmword [rsp + 0xf0], xmm14
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.18002f2f0
movsd xmm0, qword [0x1800993a0]
mov rdx, rax
mov r9, rbx
mov r8d, 0x53fccf7
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea rdx, str.ypoe
lea rcx, [rsp + 0x70]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099168]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x90]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3878]
call fcn.18002f2d0
mov rdx, rax
mov r9, rdi
mov ecx, 0x21efe210
mov qword [rsp + 0x20], rbx
movsd xmm2, qword [0x18009a168]
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm8, qword [0x180099bc8]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
mov ecx, 0x359ca383
mov qword [rsp + 0x20], 0x328831e3
movsd xmm14, qword [0x180099b00]
movsd xmm3, qword [0x1800b3848]
movaps xmm6, xmm14
movsd xmm2, qword [0x1800989c0]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0xb0]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call fcn.18002f2f0
movsd xmm0, qword [0x1800b3848]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
lea rdx, str.ijryexha
lea rcx, [rsp + 0xd0]
divsd xmm7, xmm0
call fcn.1800090b0
mov rcx, rax
mov edx, 0x12f8ad21
movsd xmm3, qword [0x1800b3910]
movsd xmm2, qword [0x18009a008]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
xorps xmm0, xmm0
lea rdx, str.tumv
lea rcx, [rsp + 0xd0]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
subsd xmm8, xmm7
movsd qword [0x1800b3870], xmm8
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0xb0]
mov rbx, rax
call fcn.18002f2f0
mov rdx, rax
movsd xmm0, qword [0x1800993a0]
mov r9, rbx
mov r8d, 0x53fccf7
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea rdx, str.ypoe
lea rcx, [rsp + 0x90]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099168]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x70]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3878]
call fcn.18002f2d0
mov rdx, rax
mov r9, rdi
mov ecx, 0x21efe210
mov qword [rsp + 0x20], rbx
movsd xmm2, qword [0x18009a168]
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm8, qword [0x180098e58]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
mov ecx, 0x359ca383
mov qword [rsp + 0x20], 0x328831e3
movsd xmm3, qword [0x1800b3848]
movaps xmm6, xmm14
movsd xmm2, qword [0x1800989c0]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x50]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call fcn.18002f2f0
movsd xmm0, qword [0x1800b3848]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
lea rdx, str.ijryexha
lea rcx, [rsp + 0x30]
divsd xmm7, xmm0
call fcn.1800090b0
mov rcx, rax
mov edx, 0x12f8ad21
movsd xmm3, qword [0x1800b3910]
movsd xmm2, qword [0x18009a008]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
xorps xmm1, xmm1
lea rdx, str.tumv
lea rcx, [rsp + 0xd0]
cvtsi2sd xmm1, rax
divsd xmm7, xmm1
subsd xmm8, xmm7
movsd qword [0x1800b3878], xmm8
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0xb0]
mov rbx, rax
call fcn.18002f2f0
movsd xmm0, qword [0x1800993a0]
mov rdx, rax
mov r9, rbx
mov r8d, 0x53fccf7
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea rdx, str.ypoe
lea rcx, [rsp + 0x90]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099168]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x70]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3878]
call fcn.18002f2d0
movsd xmm2, qword [0x18009a168]
mov rdx, rax
mov r9, rdi
mov qword [rsp + 0x20], rbx
mov ecx, 0x21efe210
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm7, qword [0x180099da8]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
mov ecx, 0x359ca383
mov qword [rsp + 0x20], 0x328831e3
movsd xmm3, qword [0x1800b3848]
movsd xmm2, qword [0x1800989c0]
divsd xmm14, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x50]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm14
call fcn.18002f2f0
movsd xmm0, qword [0x1800b3848]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
lea rdx, str.ijryexha
lea rcx, [rsp + 0x30]
divsd xmm6, xmm0
call fcn.1800090b0
mov rcx, rax
mov edx, 0x12f8ad21
movsd xmm3, qword [0x1800b3910]
movsd xmm2, qword [0x18009a008]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movaps xmm14, xmmword [rsp + 0xf0]
xorps xmm0, xmm0
movaps xmm8, xmmword [rsp + 0x100]
mov rdi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x140]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x120]
movsd qword [0x1800b3848], xmm7
movaps xmm7, xmmword [rsp + 0x110]
add rsp, 0x138
jmp 0x180011e30
mov rax, rsp
sub rsp, 0xb8
movsd xmm0, qword [0x1800b3878]
ucomisd xmm0, qword [0x18009a348]
jp 0x180012088
jne 0x180012088
mov qword [rax - 8], rbx
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cvttsd2si rcx, qword [0x1800b37e8]
movsd xmm7, qword [0x180099020]
movsd xmm1, qword [0x180099c60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x180099008]
subsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
lea rdx, str.Iquryogawebe
lea rcx, [rsp + 0x30]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x1800999d0]
call fcn.1800090b0
lea rdx, str.oyosark
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1800090b0
movsd xmm3, qword [0x180099778]
mov rcx, rax
mov r8, rbx
mov edx, 0x2357127d
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
mov edx, 0x1672744
mov ecx, 0x307a0149
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x70]
cvttsd2si ebx, qword [0x1800b3878]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2f0
mov r8, rax
mov r9d, ebx
mov ecx, 0x12b07945
mov qword [rsp + 0x20], 0x2abe3bd9
cvttsd2si rdx, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm7, xmm6
movsd qword [0x1800b3848], xmm7
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cvttsd2si rcx, qword [0x1800b37e8]
movsd xmm7, qword [0x180099888]
movsd xmm1, qword [0x180099c60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x180099008]
subsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
lea rdx, str.Iquryogawebe
lea rcx, [rsp + 0x70]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x1800999d0]
call fcn.1800090b0
lea rdx, str.oyosark
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1800090b0
movsd xmm3, qword [0x180099778]
mov rcx, rax
mov r8, rbx
mov edx, 0x2357127d
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
mov edx, 0x1672744
mov ecx, 0x307a0149
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x30]
cvttsd2si ebx, qword [0x1800b3878]
divsd xmm6, xmm0
call fcn.18002f2f0
mov r8, rax
mov r9d, ebx
mov ecx, 0x12b07945
mov qword [rsp + 0x20], 0x2abe3bd9
cvttsd2si rdx, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0xb0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0xa0]
movsd qword [0x1800b3910], xmm7
movaps xmm7, xmmword [rsp + 0x90]
add rsp, 0xb8
ret