Function at 0x18005c390
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov r15d, dword [rbp + 0x7f]
lea r10, [0x180000000]
xor r11d, r11d
mov rsi, r9
mov r13, r8
mov r14, rdx
lea edi, [r15 + 0xe]
cmp r15d, edi
jae 0x18005c5d2
lea ebx, [r15 - 0x93]
lea edx, [r11 + 0x72]
lea r12d, [r11 + 0x4e]
lea r8d, [r11 + 0x63]
lea r9d, [r11 + 0x65]
cmp ebx, 0x1d
ja case.0x18005c405.6
mov ecx, dword [r10 + rbx*4 + 0x5ccd0]
add rcx, r10
jmp rcx
mov word [rbp - 0x1d], dx
mov dword [rbp - 0x1b], 0x690076
jmp case.0x18005c405.6
mov ecx, 2
call fcn.18007711c
lea rdx, str.This_API_does_not_support_disabling_of_histogram_buckets
mov rcx, rax
call fcn.1800010e0
mov edx, 0x72
lea r10, [0x180000000]
xor r11d, r11d
lea r8d, [rdx - 0xf]
lea r9d, [rdx - 0xd]
jmp case.0x18005c405.6
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.___optimize______Optimize_Huffman_table__smaller_file__but_slow_compression__n
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str._ArrayType___BY0L___CBU_ATL_INTMAP_ENTRY_ATL__
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.Switches_for_modifying_the_image:_n
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
lea rdx, str.GetPackagePoolsForAdminForOrg_:_Required_params_missing
jmp 0x18005c428
mov eax, 0x61
mov dword [rbp - 0x25], 0x65006d
mov word [rbp - 0x27], ax
mov dword [rbp - 0x21], 0x650053
jmp case.0x18005c405.6
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.HRESULT_ID3D11Texture1D::SetPrivateData_0x_I32x___u__0x_08Ix___0x_I32x
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
lea rdx, str.___rotate__90180270__________Rotate_image__degrees_clockwise__n
jmp 0x18005c428
mov word [rbp - 0x29], r12w
jmp case.0x18005c405.6
mov ecx, 2
call fcn.18007711c
lea rdx, str.Failed_with_a_generic_certificate_verification_error.
jmp 0x18005c428
mov ecx, 2
call fcn.18007711c
lea rdx, str.___copy_all______Copy_all_extra_markers_n
jmp 0x18005c428
mov word [rbp - 0x13], r11w
mov word [rbp - 1], r12w
mov dword [rbp + 1], 0x6d0061
mov dword [rbp + 5], 0x440065
jmp case.0x18005c405.6
mov word [rbp - 0x17], r8w
jmp case.0x18005c405.6
imul eax, dword [r14], 0x1fe
mov ecx, dword [rsi]
add eax, 0xff
add eax, ecx
add ecx, ecx
cdq
idiv ecx
mov edx, 0x72
mov dword [rbp + 0x5f], eax
jmp case.0x18005c405.6
mov ecx, 2
call fcn.18007711c
mov r8, qword [0x1800bd5f8]
lea rdx, str.hatafqamatswidehebrew
mov rcx, rax
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.a_TRUSTED_CERTIFICATE
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
lea rdx, str.Switches__names_may_be_abbreviated_:_n
jmp 0x18005c428
mov word [rbp - 0x15], r9w
inc ebx
lea eax, [rbx + 0x93]
cmp eax, edi
jb 0x18005c3f1
imul eax, r15d, 0xa72
mov ecx, r15d
mov dword [rbp - 0x59], ecx
mov dword [rbp - 0x3d], eax
cmp r15d, eax
ja case.0x18005c405.29
mov rbx, qword [rbp + 0x5f]
mov rsi, qword [rbp + 0x5f]
mov r12, qword [rbp + 0x5f]
mov qword [rbp - 9], rbx
nop dword [rax + rax]
cmp ecx, 0x168fe
ja 0x18005c7a4
je 0x18005c78b
cmp ecx, 0x78c0
ja 0x18005c6f0
je 0x18005c6da
mov eax, ecx
sub eax, 0x93
je 0x18005c6d1
sub eax, 0xe
je 0x18005c646
cmp eax, 0x6d9f
jne 0x18005c6ad
mov dword [rbp + 0xd], 0x6c0070
jmp 0x18005c6ad
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.Array_should_be_CvMat_or_IplImage
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.float2_delta__abs_sk_FragCoord.xy____s._s__
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.D3DCreateLinker_is_not_supported_for_serialization
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.__Unexpected_register_class._
call fcn.1800010e0
mov ecx, dword [rbp - 0x59]
imul eax, r15d, 0xbf
add ecx, eax
mov dword [rbp - 0x59], ecx
cmp ecx, dword [rbp - 0x3d]
ja 0x18005cca4
lea r10, [0x180000000]
xor r11d, r11d
jmp 0x18005c600
mov dword [rbp + 9], 0x730069
jmp 0x18005c6ad
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str._kernel__window_system__and_so_on__of_the_specific_operating_system
jmp 0x18005c6a5
cmp ecx, 0xdbed
je 0x18005c776
cmp ecx, 0xf0df
je 0x18005c712
cmp ecx, 0x1499a
jne 0x18005c6ad
mov qword [rbp + 0x17], r11
mov qword [rbp - 0x11], r11
jmp 0x18005c6ad
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.uchar___OVERLOADABLE___convert_uchar_sat_rte_char__
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.vim.ClusterComputeResource.applyRecommendation
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.uchar3___OVERLOADABLE___as_uchar3__uchar4__
call fcn.1800010e0
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str._CI_Ljava_lang_String_
jmp 0x18005c6a5
mov dword [rbp + 0x11], 0x790061
mov word [rbp + 0x15], r11w
mov byte [rbp - 0x5a], 1
jmp 0x18005c6ad
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str.___scans_file____Create_multi_scan_JPEG_per_script_file_n
jmp 0x18005c6a5
cmp ecx, 0x292a1
ja 0x18005cc52
je 0x18005cbea
cmp ecx, 0x1b747
je 0x18005cbc8
cmp ecx, 0x1e11d
je 0x18005ccc2
cmp ecx, 0x224f4
jne 0x18005c6ad
movzx eax, byte [r13]
mov rsi, r11
mov r14, r11
test al, al
je 0x18005c6ad
movzx ebx, byte [rbp - 0x5e]
mov dword [rbp - 0x59], ecx
cmp al, 0x5c
je 0x18005c804
mov byte [r12 + rsi], al
inc rsi
jmp case.0x18005c833.41
movsx edx, byte [r14 + r13 + 1]
inc r14
mov qword [rbp - 0x49], r14
lea eax, [rdx - 0x22]
cmp eax, 0x53
ja case.0x18005c833.41
cdqe
movzx eax, byte [r10 + rax + 0x5cd68]
mov ecx, dword [r10 + rax*4 + 0x5cd48]
add rcx, r10
jmp rcx
mov byte [r12 + rsi], dl
inc rsi
jmp case.0x18005c833.41
mov byte [r12 + rsi], 8
inc rsi
jmp case.0x18005c833.41
mov byte [r12 + rsi], reloc.oledlg.dll_OleUIChangeSourceA
inc rsi
jmp case.0x18005c833.41
mov byte [r12 + rsi], 0xa
inc rsi
jmp case.0x18005c833.41
mov byte [r12 + rsi], 0xd
inc rsi
jmp case.0x18005c833.41
mov byte [r12 + rsi], 9
inc rsi
jmp case.0x18005c833.41
mov eax, 0x37
mov dword [rbp - 0x41], eax
nop
sub eax, 0x37
je 0x18005cba1
sub eax, 1
je 0x18005cb8c
sub eax, 1
je 0x18005cb83
cmp eax, 1
jne 0x18005c8c9
xor edx, edx
lea r8d, [rax + 0xf]
lea rcx, [rbp - 0x55]
call fcn.180078dec
movsxd rdi, eax
cmp rdi, 0x80
jge 0x18005c8f4
mov byte [r12 + rsi], dil
inc rsi
lea r10, [0x180000000]
mov eax, dword [rbp - 0x41]
inc eax
mov dword [rbp - 0x41], eax
cmp eax, 0x3b
jb 0x18005c880
movzx eax, byte [r14 + r13 + 1]
inc r14
test al, al
jne 0x18005c7f4
mov rbx, qword [rbp - 9]
mov r15d, dword [rbp + 0x7f]
jmp 0x18005c6aa
cmp rdi, 0x800
jge 0x18005c96e
movzx r13d, byte [rbp - 0x5c]
mov ecx, 0x33
movzx ebx, byte [rbp - 0x5d]
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x30
je 0x18005c93e
sub eax, 1
je 0x18005c938
sub eax, 1
je 0x18005c92d
cmp eax, 1
jne 0x18005c953
mov bl, 0xc0
mov r13b, 0x80
jmp 0x18005c953
movzx eax, dil
and al, 0x3f
add r13b, al
jmp 0x18005c953
sar rdi, 6
jmp 0x18005c953
movzx eax, dil
and al, 0x1f
add bl, al
mov byte [r12 + rsi], bl
mov byte [r12 + rsi + 1], r13b
add rsi, 2
dec ecx
cmp ecx, 0x2f
ja 0x18005c910
mov byte [rbp - 0x5d], bl
movzx ebx, byte [rbp - 0x5e]
mov byte [rbp - 0x5c], r13b
mov r13, qword [rbp + 0x6f]
jmp 0x18005c8c2
cmp rdi, 0x10000
jge 0x18005c8c2
lea rax, [rdi - 0xd800]
cmp rax, 0x3ff
ja 0x18005caf7
mov r15d, OleUIChangeSourceA
lea r10, [0x180000000]
cmp r15d, 0xb
ja case.default.0x18005c9b3
mov eax, r15d
mov ecx, dword [r10 + rax*4 + 0x5cdbc]
add rcx, r10
jmp rcx
movzx eax, byte [r14 + r13 + 1]
lea rcx, [rbp - 0x55]
add r14, 2
mov byte [rbp - 0x53], al
xor edx, edx
mov qword [rbp - 0x49], r14
movzx eax, byte [r14 + r13]
lea r8d, [rdx + 0x10]
mov byte [rbp - 0x52], al
call fcn.180078dec
cdqe
lea r10, [0x180000000]
mov qword [rbp - 0x39], rax
jmp case.default.0x18005c9b3
sar rdi, 6
movzx eax, dil
and al, 7
add byte [rbp + 0x5f], al
jmp case.default.0x18005c9b3
sar rdi, 6
movzx eax, dil
sar rdi, 6
and al, 0x3f
add byte [rbp - 0x60], al
movzx eax, dil
and al, 0x3f
add byte [rbp - 0x61], al
jmp case.default.0x18005c9b3
movzx eax, byte [rbp + 0x5f]
mov byte [r12 + rsi], al
inc rsi
jmp case.default.0x18005c9b3
mov rax, qword [rbp - 0x31]
mov rdi, qword [rbp - 0x39]
shl rax, 0xa
add rdi, 0x10000
add rdi, rax
jmp case.default.0x18005c9b3
movzx eax, dil
and al, 0x3f
add byte [rbp - 0x5f], al
jmp case.default.0x18005c9b3
sub qword [rbp - 0x31], 0xd800
sub qword [rbp - 0x39], 0xdc00
jmp case.default.0x18005c9b3
mov byte [rbp + 0x5f], 0xf0
mov byte [rbp - 0x61], 0x80
mov byte [rbp - 0x60], 0x80
mov byte [rbp - 0x5f], 0x80
jmp case.default.0x18005c9b3
movzx eax, byte [rbp - 0x61]
mov byte [r12 + rsi], al
movzx eax, byte [rbp - 0x60]
mov byte [r12 + rsi + 1], al
movzx eax, byte [rbp - 0x5f]
mov byte [r12 + rsi + 2], al
add rsi, 3
jmp case.default.0x18005c9b3
movzx eax, byte [r14 + r13 + 1]
inc r14
mov byte [rbp - 0x54], al
jmp 0x18005cad9
mov qword [rbp - 0x31], rdi
jmp case.default.0x18005c9b3
inc r14
cmp byte [r14 + r13], 0x5c
jne case.0x18005c833.41
inc r14
cmp byte [r14 + r13], 0x75
jne case.0x18005c833.41
movzx eax, byte [r14 + r13 + 1]
inc r14
mov byte [rbp - 0x55], al
mov qword [rbp - 0x49], r14
dec r15d
lea eax, [r15 + 0x105]
cmp eax, 0x104
ja 0x18005c994
jmp 0x18005c8c9
movzx r13d, byte [rbp - 0x4d]
mov ecx, 0xaa
movzx r14d, byte [rbp - 0x5b]
cmp ecx, 0xaa
je 0x18005cb4d
cmp ecx, 0x13c
je 0x18005cb32
cmp ecx, 0x1ce
jne 0x18005cb5d
mov byte [r12 + rsi], bl
mov byte [r12 + rsi + 1], r14b
mov byte [r12 + rsi + 2], r13b
add rsi, 3
jmp 0x18005cb5d
sar rdi, 6
movzx eax, dil
sar rdi, 6
and al, 0x3f
add r14b, al
movzx eax, dil
and al, 0xf
add bl, al
jmp 0x18005cb5d
movzx r13d, dil
mov r14b, 0x80
and r13b, 0x3f
mov bl, 0xe0
add r13b, r14b
add ecx, 0x92
cmp ecx, 0x260
jb 0x18005cb06
mov byte [rbp - 0x5b], r14b
mov r14, qword [rbp - 0x49]
mov byte [rbp - 0x4d], r13b
mov r13, qword [rbp + 0x6f]
mov byte [rbp - 0x5e], bl
jmp 0x18005c8c2
mov byte [rbp - 0x51], 0
jmp 0x18005c8c9
movzx eax, byte [r14 + r13 + 1]
inc r14
mov byte [rbp - 0x52], al
mov qword [rbp - 0x49], r14
jmp 0x18005c8c9
movzx eax, byte [r14 + r13 + 1]
mov byte [rbp - 0x55], al
movzx eax, byte [r14 + r13 + 2]
add r14, 3
mov byte [rbp - 0x54], al
mov qword [rbp - 0x49], r14
movzx eax, byte [r14 + r13]
mov byte [rbp - 0x53], al
jmp 0x18005c8c9
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rcx + r13], 0
jne 0x18005cbd0
inc rcx
call fcn.180081e7c
mov r12, rax
jmp 0x18005c6aa
mov rcx, qword [rbp + 0x17]
lea r8, [rbp - 1]
mov qword [rsp + 0x60], r11
lea rdx, [rbp - 0x29]
mov qword [rsp + 0x58], r11
mov r9d, 0xf01ff
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rbp - 0x11], rax
mov byte [r12 + rsi], 0
test rax, rax
jne 0x18005c6aa
mov byte [rbp - 0x5a], al
jmp 0x18005c6aa
cmp ecx, 0x3004e
je 0x18005cc67
cmp ecx, 0x36dfb
je 0x18005cca4
jmp 0x18005c6ad
cmp byte [rbp - 0x5a], 0
je 0x18005cc94
mov rdi, qword [rbp - 0x11]
xor r8d, r8d
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [rbp - 0x59]
mov rbx, r12
mov qword [rbp - 9], rbx
jmp 0x18005c6ad
mov rbx, qword [rbp + 0x5f]
mov rax, rbx
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call fcn.180076a04
int3