Function at 0x18002ab30
Capabilities:
Enumerate services
Query or enumerate registry value
Start service

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xd8]
sub rsp, 0x1d0
movsd xmm0, qword [0x1800b3878]
ucomisd xmm0, qword [str.3mr__]
jp 0x18002b3dc
jne 0x18002b3dc
cvttsd2si rdx, qword [0x1800b3870]
mov qword [rax + 8], rbx
lea rcx, [rsp + 0x20]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
movaps xmmword [rax - 0x98], xmm14
call fcn.18002f2f0
lea rdx, str.Sirjehsaviaruqi
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.18000a440
mov r8, rax
mov r9, rbx
mov edx, 0x1387bbfd
mov ecx, 0x6352adc
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3910]
mov ecx, 0x31d28300
movsd xmm13, qword [0x180099af0]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm6, qword [0x180099b10]
lea rdx, str.natrov
mulsd xmm0, xmm7
lea rcx, [rsp + 0x60]
subsd xmm6, xmm0
call fcn.1800090b0
lea rdx, str.okyfefuwuobeyz
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.1800090b0
movsd xmm12, qword [0x180098fc0]
mov rdx, rax
movsd xmm0, qword [0x1800b3878]
movaps xmm2, xmm12
mov r9, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
movsd xmm11, qword [0x1800991e0]
lea rdx, str.Ohbenyjbigeuruh
xorps xmm8, xmm8
lea rcx, [rbp - 0x60]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm11
addsd xmm8, xmm6
call fcn.1800090b0
cvttsd2si rcx, qword [0x1800b3848]
mov rdx, rax
mov r8d, 0x282cb8f8
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x40]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
movsd xmm10, qword [0x180099878]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm10
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
divsd xmm7, xmm0
lea rdx, str.ydueyygyf
lea rcx, [rbp - 0x20]
subsd xmm8, xmm7
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si ecx, qword [0x1800b3848]
movsd xmm14, qword [0x180099698]
movd xmm0, eax
movaps xmm6, xmm14
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
cvttsd2si ebx, qword [0x1800b3910]
lea rdx, str.iyiquyoibaa
lea rcx, [rbp]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
mov r8, rax
mov r9d, ebx
cvttsd2si edx, qword [0x1800b3870]
movsd xmm9, qword [0x180099eb8]
movaps xmm0, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x20]
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x20]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm8, xmm6
movsd qword [0x1800b3910], xmm8
call fcn.18002f2f0
lea rdx, str.Sirjehsaviaruqi
mov rbx, rax
lea rcx, [rbp]
call fcn.18000a440
mov r8, rax
mov r9, rbx
mov edx, 0x1387bbfd
mov ecx, 0x6352adc
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3910]
mov ecx, 0x31d28300
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm6, qword [0x180099240]
lea rdx, str.natrov
mulsd xmm0, xmm7
lea rcx, [rbp - 0x20]
subsd xmm6, xmm0
call fcn.1800090b0
lea rdx, str.okyfefuwuobeyz
mov rbx, rax
lea rcx, [rbp - 0x40]
call fcn.1800090b0
movsd xmm0, qword [0x1800b3878]
mov rdx, rax
mov r9, rbx
movaps xmm2, xmm12
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm8, xmm8
lea rdx, str.Ohbenyjbigeuruh
lea rcx, [rbp - 0x60]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm11
addsd xmm8, xmm6
call fcn.1800090b0
cvttsd2si rcx, qword [0x1800b3848]
mov rdx, rax
mov r8d, 0x282cb8f8
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x80]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm10
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
divsd xmm7, xmm0
lea rdx, str.ydueyygyf
lea rcx, [rsp + 0x60]
subsd xmm8, xmm7
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si ecx, qword [0x1800b3848]
movd xmm0, eax
movaps xmm6, xmm14
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
cvttsd2si ebx, qword [0x1800b3910]
lea rdx, str.iyiquyoibaa
lea rcx, [rsp + 0x40]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
mov r8, rax
mov r9d, ebx
cvttsd2si edx, qword [0x1800b3870]
movaps xmm0, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x20]
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x20]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm8, xmm6
movsd qword [0x1800b3878], xmm8
call fcn.18002f2f0
lea rdx, str.Sirjehsaviaruqi
mov rbx, rax
lea rcx, [rbp]
call fcn.18000a440
mov r8, rax
mov r9, rbx
mov edx, 0x1387bbfd
mov ecx, 0x6352adc
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3910]
mov ecx, 0x31d28300
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm6, qword [0x180098838]
lea rdx, str.natrov
mulsd xmm0, xmm7
lea rcx, [rbp - 0x20]
subsd xmm6, xmm0
call fcn.1800090b0
mov rbx, rax
lea rdx, str.okyfefuwuobeyz
lea rcx, [rbp - 0x40]
call fcn.1800090b0
movsd xmm0, qword [0x1800b3878]
mov rdx, rax
mov r9, rbx
movaps xmm2, xmm12
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm8, xmm8
lea rdx, str.Ohbenyjbigeuruh
lea rcx, [rbp - 0x60]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm11
addsd xmm8, xmm6
call fcn.1800090b0
cvttsd2si rcx, qword [0x1800b3848]
mov rdx, rax
mov r8d, 0x282cb8f8
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x80]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm10
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
divsd xmm7, xmm0
lea rdx, str.ydueyygyf
lea rcx, [rsp + 0x60]
subsd xmm8, xmm7
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si ecx, qword [0x1800b3848]
movd xmm0, eax
movaps xmm6, xmm14
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
cvttsd2si ebx, qword [0x1800b3910]
lea rdx, str.iyiquyoibaa
lea rcx, [rsp + 0x40]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
mov r8, rax
mov r9d, ebx
cvttsd2si edx, qword [0x1800b3870]
movaps xmm0, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x20]
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
xorps xmm0, xmm0
lea rcx, [rbp + 0x20]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm8, xmm6
cvttsd2si rdx, xmm8
movsd qword [0x1800b3870], xmm8
call fcn.18002f2f0
lea rdx, str.Sirjehsaviaruqi
mov rbx, rax
lea rcx, [rbp]
call fcn.18000a440
mov r8, rax
mov r9, rbx
mov edx, 0x1387bbfd
mov ecx, 0x6352adc
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
cvttsd2si rdx, qword [0x1800b3910]
mov ecx, 0x31d28300
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm6, qword [0x18009a248]
lea rdx, str.natrov
mulsd xmm0, xmm7
lea rcx, [rbp - 0x20]
subsd xmm6, xmm0
call fcn.1800090b0
lea rdx, str.okyfefuwuobeyz
mov rbx, rax
lea rcx, [rbp - 0x40]
call fcn.1800090b0
movsd xmm0, qword [0x1800b3878]
mov rdx, rax
mov r9, rbx
movaps xmm2, xmm12
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm8, xmm8
lea rdx, str.Ohbenyjbigeuruh
lea rcx, [rbp - 0x60]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm11
addsd xmm8, xmm6
call fcn.1800090b0
cvttsd2si rcx, qword [0x1800b3848]
mov rdx, rax
mov r8d, 0x282cb8f8
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x80]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm10
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
divsd xmm7, xmm0
lea rdx, str.ydueyygyf
lea rcx, [rsp + 0x60]
subsd xmm8, xmm7
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si ecx, qword [0x1800b3848]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm14, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
cvttsd2si ebx, qword [0x1800b3910]
lea rdx, str.iyiquyoibaa
lea rcx, [rsp + 0x40]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm14, xmm1
call fcn.18000a440
mov r8, rax
mov r9d, ebx
cvttsd2si edx, qword [0x1800b3870]
movaps xmm0, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x20]
divsd xmm14, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm14, xmm0
movaps xmm13, xmmword [rsp + 0x150]
subsd xmm8, xmm14
movaps xmm14, xmmword [rsp + 0x140]
movaps xmm12, xmmword [rsp + 0x160]
movaps xmm11, xmmword [rsp + 0x170]
movaps xmm10, xmmword [rsp + 0x180]
movaps xmm9, xmmword [rsp + 0x190]
movaps xmm7, xmmword [rsp + 0x1b0]
movaps xmm6, xmmword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1e0]
movsd qword [0x1800b3910], xmm8
movaps xmm8, xmmword [rsp + 0x1a0]
add rsp, 0x1d0
pop rbp
ret