Function at 0x180044470
Capabilities:
Modify service

Disassembly:
sub rsp, 0xc8
mov eax, 4
imul rax, rax, 2
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
xor eax, 0xfffff307
mov ecx, 4
imul rcx, rcx, 2
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
cmp eax, 0x98c8d79
jne 0x1800444e5
lea r8, str.Local88589893633032191521563494404718386483728654017974688x
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0xa8], rax
jmp 0x18004450d
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
cmp qword [rsp + 0x70], 0
jne 0x1800445b3
mov dword [rsp + 0x78], 0
mov eax, dword [rsp + 0x78]
cmp eax, 0x5602b29
jne 0x180044547
lea r8, str.Local40469030413619547261227046419072439041230546060738542440x
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0x98], rax
jmp 0x18004456f
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
mov eax, 7
mov word [rsp + 0x60], ax
movsx rax, word [rsp + 0x60]
lea rcx, [0x180093db0]
cmp dword [rcx + rax*4], 1
jne 0x1800445ae
movsx rax, word [rsp + 0x60]
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x60]
lea rdx, [0x180093db0]
mov dword [rdx + rcx*4], eax
jmp 0x1800447f3
mov r8d, 2
lea rdx, [0x180081098]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x80], rax
mov eax, 0x11
mov word [rsp + 0x64], ax
movsx rax, word [rsp + 0x64]
lea rcx, [0x180093db0]
cmp dword [rcx + rax*4], 1
jne 0x180044612
movsx rax, word [rsp + 0x64]
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax*4]
inc eax
movsx rcx, word [rsp + 0x64]
lea rdx, [0x180093db0]
mov dword [rdx + rcx*4], eax
cmp qword [rsp + 0x80], 0
jne 0x1800446ad
mov eax, 4
imul rax, rax, 3
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
add eax, 0x9ddca3c
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
mov dword [rsp + 0x8c], 0
mov eax, dword [rsp + 0x8c]
cmp eax, 0xc6645c1
jne 0x180044680
lea r8, str.Local3020345260213715908070598067214103506401116052704356325596x
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0xa0], rax
jmp 0x1800446a8
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
jmp 0x1800447e8
mov dword [rsp + 0x88], 0
mov eax, dword [rsp + 0x88]
cmp eax, 0x52e9fb9
jne 0x1800446e1
lea r8, str.Local1836891700498227580531311521356735456991138356453073456x
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsp + 0xb0], rax
jmp 0x180044709
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093db0]
mov eax, dword [rcx + rax]
inc eax
mov ecx, 4
imul rcx, rcx, 0xb
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8d, 2
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1800447da
lea rax, [0x180080e44]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x90]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x61
jne 0x1800447da
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x1800447da
mov eax, 4
imul rax, rax, 0xb
lea rcx, [0x180093db0]
mov edx, dword [rcx + rax]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, 4
imul rcx, rcx, 0xc
lea rdx, [0x180093db0]
mov dword [rdx + rcx], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add rsp, 0xc8
ret