Function at 0x1ccbd051f20
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x1ccbd070cb8], 0
jne 0x1ccbd052255
mov qword [rsp + 0x20], rbx
mov byte [0x1ccbd070cb8], 1
call fcn.1ccbd0569c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1ccbd056ee0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x1ccbd051f95
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070cb0], rax
test rax, rax
je 0x1ccbd051f9c
lea rdx, [0x1ccbd052260]
lea rcx, [0x1ccbd070cb0]
call fcn.1ccbd055fa0
jmp 0x1ccbd051f9c
mov qword [0x1ccbd070cb0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd051fdf
lea rdx, str.NtResumeThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070c98], rax
test rax, rax
je 0x1ccbd051fe6
lea rdx, [0x1ccbd0524f0]
lea rcx, [0x1ccbd070c98]
call fcn.1ccbd055fa0
jmp 0x1ccbd051fe6
mov qword [0x1ccbd070c98], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd052029
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070ce8], rax
test rax, rax
je 0x1ccbd052030
lea rdx, [0x1ccbd052630]
lea rcx, [0x1ccbd070ce8]
call fcn.1ccbd055fa0
jmp 0x1ccbd052030
mov qword [0x1ccbd070ce8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd052073
lea rdx, str.NtQueryDirectoryFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070ca8], rax
test rax, rax
je 0x1ccbd05207a
lea rdx, [0x1ccbd052a10]
lea rcx, [0x1ccbd070ca8]
call fcn.1ccbd055fa0
jmp 0x1ccbd05207a
mov qword [0x1ccbd070ca8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd0520bd
lea rdx, str.NtEnumerateKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070ca0], rax
test rax, rax
je 0x1ccbd0520c4
lea rdx, [0x1ccbd053030]
lea rcx, [0x1ccbd070ca0]
call fcn.1ccbd055fa0
jmp 0x1ccbd0520c4
mov qword [0x1ccbd070ca0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd052107
lea rdx, str.NtEnumerateValueKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070cc0], rax
test rax, rax
je 0x1ccbd05210e
lea rdx, [0x1ccbd053120]
lea rcx, [0x1ccbd070cc0]
call fcn.1ccbd055fa0
jmp 0x1ccbd05210e
mov qword [0x1ccbd070cc0], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd052151
lea rdx, str.EnumServiceGroupW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070cc8], rax
test rax, rax
je 0x1ccbd052158
lea rdx, [0x1ccbd053210]
lea rcx, [0x1ccbd070cc8]
call fcn.1ccbd055fa0
jmp 0x1ccbd052158
mov qword [0x1ccbd070cc8], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd05219b
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070cd0], rax
test rax, rax
je 0x1ccbd0521a2
lea rdx, [0x1ccbd0532a0]
lea rcx, [0x1ccbd070cd0]
call fcn.1ccbd055fa0
jmp 0x1ccbd0521a2
mov qword [0x1ccbd070cd0], rbx
lea rcx, str.sechost.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd0521e5
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070cd8], rax
test rax, rax
je 0x1ccbd0521ec
lea rdx, [0x1ccbd053330]
lea rcx, [0x1ccbd070cd8]
call fcn.1ccbd055fa0
jmp 0x1ccbd0521ec
mov qword [0x1ccbd070cd8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1ccbd05223b
lea rdx, str.NtDeviceIoControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1ccbd070ce0], rax
test rax, rax
je 0x1ccbd052242
lea rdx, [0x1ccbd0533c0]
lea rcx, [0x1ccbd070ce0]
call fcn.1ccbd055fa0
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.1ccbd056a30
mov qword [0x1ccbd070ce0], rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.1ccbd056a30
add rsp, 0x28
ret