Function at 0x180156160
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 8], rax
movzx r14d, r8b
movzx edi, dl
mov rsi, rcx
xor ebx, ebx
xor r15b, r15b
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000001
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r13, rax
test rax, rax
je 0x180156424
mov rcx, rsi
call fcn.1801572a0
mov rdx, qword [0x18029b2d8]
test al, al
cmovne rdx, qword [0x18029b2e0]
mov r8d, 0x80000000
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x18015640e
mov dword [rbp - 0x38], ebx
lea r9, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x180156405
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180156405
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x180156405
mov ecx, eax
call fcn.180113ab0
mov rbx, rax
test rax, rax
je 0x180156405
lea r9, [rbp - 0x38]
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x180156405
mov ecx, dword [rbx + 4]
cmp ecx, 2
jne 0x180156264
test dil, dil
jne 0x180156276
jmp 0x180156405
cmp ecx, 3
jne 0x180156405
test r14b, r14b
je 0x180156405
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1800f2f00
nop
lea rcx, [rbp - 0x28]
mov r15, qword [rbp - 0x28]
mov r12, qword [rbp - 0x10]
cmp r12, 0x10
cmovae rcx, r15
mov r14, qword [rbp - 0x18]
add rcx, r14
mov qword [rbp - 0x40], rcx
lea rdi, [rbp - 0x28]
cmp r12, 0x10
cmovae rdi, r15
add rdi, r14
lea rcx, [rbp - 0x28]
cmp r12, 0x10
cmovae rcx, r15
mov r8, rdi
sub r8, rcx
mov edx, 0x22
call fcn.18020c170
mov rcx, rdi
test rax, rax
cmovne rcx, rax
mov r8, rcx
cmp rcx, rdi
je 0x180156309
inc rcx
cmp rcx, rdi
je 0x180156309
movzx eax, byte [rcx]
cmp al, 0x22
je 0x1801562f5
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rdi
jne 0x1801562e8
mov r12, qword [rbp - 0x10]
mov r14, qword [rbp - 0x18]
mov r15, qword [rbp - 0x28]
lea rax, [rbp - 0x28]
cmp r12, 0x10
cmovae rax, r15
mov rdx, r8
sub rdx, rax
mov r9, qword [rbp - 0x40]
sub r9, r8
mov rax, r14
sub rax, rdx
cmp rax, r9
cmovb r9, rax
lea rcx, [rbp - 0x28]
cmp r12, 0x10
cmovae rcx, r15
add rcx, rdx
sub r14, r9
mov qword [rbp - 0x18], r14
sub r14, rdx
lea r8, [r14 + 1]
lea rdx, [rcx + r9]
call fcn.18020b840
lea rcx, [rbp - 0x30]
call fcn.1800f3a40
test al, al
jne 0x1801563ae
lea rax, [0x1800567d8]
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1801563a9
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801563a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180156458
call fcn.1801e61d0
nop
xor r15b, r15b
jmp 0x1801563f4
mov r15b, 1
lea rax, [0x1800567d8]
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1801563f4
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801563ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180156452
call fcn.1801e61d0
nop
movdqa xmm0, xmmword [0x180056d80]
mov byte [rbp - 0x28], 0
movdqu xmmword [rbp - 0x18], xmm0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x180156424
mov rcx, rbx
call fcn.18010fbc0
movzx eax, r15b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18010fa40
nop
call fcn.18010fa40
int3