Function at 0x18003e3c0
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x180089b10]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rbx, qword [rbp - 0x49]
xor r10d, r10d
imul r15d, ecx, 0x4f1
mov edi, ecx
mov qword [rbp - 0x51], r9
mov esi, ecx
mov qword [rbp - 0x39], r8
mov qword [rbp - 0x31], rdx
mov dword [rbp - 0x69], ecx
cmp ecx, r15d
ja 0x18003e5e7
mov rdi, qword [rbp - 0x41]
movabs r12, 0x70005500790072
mov r14, qword [rbp - 0x41]
mov r13d, ecx
nop dword [rax]
cmp esi, 0x2d1e
ja 0x18003e566
je 0x18003e54d
mov eax, esi
sub eax, 0x23
je 0x18003e53b
sub eax, 0xf
je 0x18003e52f
sub eax, 0x73
je 0x18003e482
sub eax, 0xf37
je 0x18003e859
cmp eax, 0x6cc
jne 0x18003e5c6
mov dword [rbp - 0xf], 0x700065
mov word [rbp - 0xb], r10w
jmp 0x18003e5c6
cmp dword [r9 + 0x11c], 0xc0
jne 0x18003e520
mov ebx, 0xa3
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xa3
je 0x18003e4e4
sub eax, 1
je 0x18003e4c7
sub eax, 1
je 0x18003e4c1
cmp eax, 1
jne 0x18003e50a
mov dword [rdi + 0x28], 0x69000000
jmp 0x18003e50a
mov qword [rdi + 8], r14
jmp 0x18003e50a
mov r8, r9
mov dword [rbp - 0x61], 0x15
lea rdx, [rbp - 0x61]
mov ecx, 0x133
call fcn.180026250
mov rdi, rax
jmp 0x18003e506
lea r8, [rbp - 0x61]
mov dword [rbp - 0x61], 0x20
mov rdx, r9
mov ecx, 0xbb
call fcn.180031510
mov r14, rax
mov dword [rax + 0x18], 4
mov r9, qword [rbp - 0x51]
inc ebx
cmp ebx, 0xa7
jb 0x18003e4a0
mov rbx, rdi
mov qword [rbp - 0x49], rbx
jmp 0x18003e5c6
mov rbx, r10
mov rdi, r10
mov qword [rbp - 0x49], rbx
jmp 0x18003e5c6
mov dword [rbp - 0x11], 0x52
jmp 0x18003e5c6
mov rcx, r9
call qword [0x180092a28]
mov byte [rbp - 0x49], al
mov rbx, qword [rbp - 0x49]
jmp 0x18003e5c6
mov r8d, 3
lea rdx, [0x18007dd16]
lea rcx, [rbp - 0x11]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18003e5c6
cmp esi, 0x4394
je 0x18003e5ba
cmp esi, 0x4ac4
je 0x18003e859
cmp esi, 0x5a0a
je 0x18003e5af
cmp esi, 0x7080
je 0x18003e599
cmp esi, 0x86f6
jne 0x18003e5c6
mov word [rbp + 0xd], r10w
jmp 0x18003e5c6
mov eax, dword [0x18007dcac]
mov dword [rbp + 7], eax
movzx eax, word [0x18007dcb0]
mov word [rbp + 0xb], ax
jmp 0x18003e5c6
mov qword [rbp - 1], r12
mov word [rbp + 7], r10w
jmp 0x18003e5c6
mov dword [rbp - 5], 0x6f0074
mov word [rbp - 1], r10w
mov r9, qword [rbp - 0x51]
xor r10d, r10d
imul eax, r13d, 0x73
add esi, eax
cmp esi, r15d
jbe 0x18003e430
mov r8, qword [rbp - 0x39]
mov edi, r13d
mov rdx, qword [rbp - 0x31]
lea r13d, [rdi + 0x44c]
cmp edi, r13d
jae 0x18003e859
mov rsi, qword [rbp - 0x41]
lea rcx, [0x180017a50]
movzx r15d, byte [rbp - 0x69]
mov r12, qword [rbp - 0x41]
mov ebx, dword [rbp - 0x59]
nop
cmp edi, 0x226
ja 0x18003e6c1
je 0x18003e6bb
mov eax, edi
sub eax, 0x32
je 0x18003e676
sub eax, 0x64
je 0x18003e66c
sub eax, 0x64
je 0x18003e663
sub eax, 0x64
je 0x18003e642
cmp eax, 0x64
jne 0x18003e697
lea ebx, [rax - 0x63]
jmp 0x18003e697
movzx eax, word [rdx]
lea r8, [rbp - 0x69]
mov rdx, r9
mov word [rbp - 0x69], ax
mov ecx, 0xd4
call fcn.18000bea0
xor r10d, r10d
mov dword [rbp - 0x61], r10d
jmp 0x18003e690
mov qword [rbp - 0x19], r10
mov rsi, r10
jmp 0x18003e697
mov word [rbp + 0xf], r10w
mov r15b, 1
jmp 0x18003e697
mov r8d, 1
lea rdx, [0x18007dd34]
lea rcx, [rbp + 0xd]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r10d, r10d
lea rcx, [0x180017a50]
mov r9, qword [rbp - 0x51]
add edi, 0x64
mov r8, qword [rbp - 0x39]
mov rdx, qword [rbp - 0x31]
mov dword [rbp - 0x69], edi
cmp edi, r13d
jb 0x18003e610
mov rax, qword [rbp - 0x49]
jmp 0x18003e85c
mov qword [rbp - 0x21], r10
jmp 0x18003e697
mov eax, edi
sub eax, 0x28a
je 0x18003e84d
sub eax, 0x64
je 0x18003e82c
sub eax, 0x64
je 0x18003e754
sub eax, 0x64
je 0x18003e707
cmp eax, 0x64
jne 0x18003e697
lea rcx, [r9 + 0xa]
cmp rcx, r8
je 0x18003e690
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x18003e6fc
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
call fcn.180020ed0
jmp 0x18003e68d
mov r8d, dword [rbp - 0x61]
lea rax, [rbp - 0x41]
mov rdx, qword [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov eax, dword [rbp - 0x59]
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x21]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_CDefFolderMenu_Create2]
test eax, eax
jne 0x18003e68d
mov rcx, qword [rbp - 0x41]
mov rax, qword [rcx]
call qword [rax + reloc.SHELL32.dll_ILFindLastID]
jmp 0x18003e68d
test r15b, r15b
je 0x18003e697
mov r14d, 0xcc
mov eax, r14d
sub eax, 0xcc
je 0x18003e7c8
cmp eax, 1
jne 0x18003e814
test r15b, r15b
je 0x18003e814
mov edi, 0x86
mov eax, edi
sub eax, 0x86
je 0x18003e797
cmp eax, 1
jne 0x18003e7bc
mov rcx, rsi
jmp 0x18003e7b6
xor r9d, r9d
lea rax, [rbp - 0x29]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r12
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc edi
cmp edi, 0x88
jb 0x18003e784
jmp 0x18003e814
mov r8d, 0xf01ff
lea rdx, [rbp - 0x11]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x18003e814
mov edi, 0xa5
cmp edi, 0xa5
je 0x18003e7fd
cmp edi, 0x6afe
jne 0x18003e806
xor r15b, r15b
jmp 0x18003e806
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add edi, 0x6a59
cmp edi, 0xd4b2
jbe 0x18003e7e8
inc r14d
cmp r14d, 0xce
jb 0x18003e763
mov edi, dword [rbp - 0x69]
jmp 0x18003e68d
mov r8d, ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x18003e68d
xor r15b, r15b
jmp 0x18003e68d
mov qword [r9], rcx
mov dword [rbp - 0x59], r10d
jmp 0x18003e697
mov rax, rbx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.18006fee0
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret