Function at 0x18008ffe0
Capabilities:
Create service
Delete service
Enumerate services

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
movaps xmmword [rsp + 0x360], xmm6
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov r12, qword [rbp + 0x2d0]
mov r14, r8
mov rdi, qword [rbp + 0x2d8]
xor r8d, r8d
imul r15d, edx, 0x835
mov r13, r9
mov esi, edx
mov qword [rbp - 0x70], rcx
mov ebx, edx
cmp edx, r15d
ja 0x18009022d
movsd xmm6, qword [rbp - 0x30]
lea edx, [r8 + 0x62]
cmp ebx, 0x32de
ja 0x180090151
je 0x180090141
mov eax, ebx
sub eax, 0x15
je 0x180090289
sub eax, 0xd
je 0x180090112
sub eax, 0x7c
je 0x1800900ee
sub eax, 0x34
je 0x1800900cc
cmp eax, 0x18ae
jne 0x18009021c
mov eax, dword [0x1800d29ba]
lea rdx, [0x1800d2a40]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0xa]
movzx eax, word [0x1800d29be]
mov word [rbp + 0xa], r8w
mov r8d, 2
mov word [rbp + 8], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, qword [rbp - 0x70]
mov edx, 0x62
xor r8d, r8d
jmp 0x18009021c
movsd xmm0, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_frexp]
mov rcx, qword [rbp - 0x70]
mov edx, 0x62
movaps xmm6, xmm0
xor r8d, r8d
jmp 0x18009021c
mov rax, qword [rcx]
test rax, rax
je case.0x180090287.0
cmp dword [rax], 0x7f2bb701
jne case.0x180090287.0
mov qword [rax + 0xf8], rdi
jmp 0x18009021c
mov r8d, 4
lea rdx, [0x1800d2ab0]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, qword [rbp - 0x70]
mov edx, 0x62
xor r8d, r8d
mov dword [rbp], 0x690068
jmp 0x18009021c
mov dword [rbp + 0xe], 0x20
mov word [rbp + 0x18], dx
jmp 0x18009021c
cmp ebx, 0x4c3c
je 0x180090208
cmp ebx, 0x659a
je 0x1800901de
cmp ebx, 0x9d80
je 0x1800901c6
cmp ebx, 0x13a2e
je 0x1800901b6
cmp ebx, 0x1d6dc
jne 0x18009021c
movsd xmm0, qword [rdi]
mulsd xmm0, xmm0
mulsd xmm0, qword [r13]
movsd qword [r13], xmm0
mulsd xmm0, xmm6
mulsd xmm0, xmm6
mulsd xmm6, qword [r14]
addsd xmm6, qword [r12]
addsd xmm0, xmm6
movsd qword [rbp - 0x68], xmm0
jmp case.0x180090287.0
movsd xmm0, qword [rdi]
mulsd xmm0, qword [r14]
movsd qword [r14], xmm0
jmp 0x18009021c
mov eax, dword [rbp - 0x58]
addsd xmm6, xmm6
add eax, 0xfffffffe
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm6, xmm0
jmp 0x18009021c
mov word [rbp + 0x20], r8w
lea rdx, [0x1800d297e]
mov r8d, 2
lea rcx, [rbp + 0x18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov rcx, qword [rbp - 0x70]
mov edx, 0x62
xor r8d, r8d
jmp 0x18009021c
mov eax, dword [0x1800d2aec]
mov dword [rbp + 0x1a], eax
movzx eax, word [0x1800d2af0]
mov word [rbp + 0x1e], ax
imul eax, esi, 0xbf
add ebx, eax
cmp ebx, r15d
jbe 0x180090050
lea edi, [rsi - 0xa]
mov dword [rbp - 0x50], edi
cmp esi, edi
jbe case.0x180090287.0
movzx eax, byte [rsp + 0x70]
lea ebx, [rsi - 0x19]
mov r15d, dword [rbp - 0x74]
lea r9, [0x180000000]
movzx r12d, byte [rsp + 0x70]
mov edx, 0x74
mov esi, dword [rbp - 0x74]
movabs r10, 0x74002d00740065
mov r13d, dword [rbp - 0x80]
mov dword [rsp + 0x78], ebx
mov dword [rbp - 0x78], eax
cmp ebx, 9
ja case.default.0x180090287
mov ecx, dword [r9 + rbx*4 + 0x906f4]
add rcx, r9
mov eax, ebx
jmp rcx
mov eax, dword [rdi]
lea r8, [rbp - 0x60]
mov dword [rbp - 0x80], eax
lea rdx, [rbp - 0x80]
mov rax, qword [rcx]
mov r9, r12
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x78], 0x80
mov dword [rsp + 0x20], 0x28
call fcn.1800b7030
mov dword [rbp - 0x68], eax
jmp case.0x180090287.0
movzx eax, byte [rsp + 0x70]
lea rdx, [rbp - 8]
cmp dword [rbp - 0x74], 0
mov ecx, r8d
mov qword [rsp + 0x60], r8
mov r9d, 0xf01ff
mov qword [rsp + 0x58], r8
cmovne ecx, eax
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], r8
lea r8, [rbp + 0x18]
mov dword [rsp + 0x30], 1
mov byte [rsp + 0x70], cl
mov rcx, qword [rbp - 0x30]
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
mov edx, 0
mov eax, dword [rbp - 0x78]
test r14, r14
movzx eax, al
cmove eax, edx
mov dword [rbp - 0x78], eax
test al, al
je 0x18009068f
mov r13d, dword [rbp - 0x4c]
mov edi, 0x89
nop dword [rax + rax]
cmp edi, 0xaded
ja 0x180090435
je 0x180090417
cmp edi, 0x573b
ja 0x1800903ce
je 0x1800903c2
cmp edi, 0x89
je 0x1800903ad
cmp edi, 0x1d6f
je 0x180090396
cmp edi, 0x3a55
jne 0x18009056c
mov eax, 0x70
mov word [rbp - 0x21], ax
jmp 0x18009056c
mov eax, 0x74
mov word [rbp - 0x23], ax
mov eax, 0x6f
mov word [rbp - 0x22], ax
jmp 0x18009056c
mov eax, 0x53
mov dword [rbp - 0x28], 0x5f746567
mov word [rbp - 0x24], ax
jmp 0x18009056c
mov dword [rbp - 0x20], 0x556e4f
jmp 0x18009056c
cmp edi, 0x7421
je 0x180090409
cmp edi, 0x9107
jne 0x18009056c
mov eax, 0x6c
mov dword [rbp - 0x1b], 0x646e61
mov word [rbp - 0x18], ax
mov eax, 0x65
mov word [rbp - 0x17], ax
mov eax, 0x4564
mov word [rbp - 0x16], ax
jmp 0x18009056c
mov eax, 0x686e
mov word [rbp - 0x1d], ax
jmp 0x18009056c
mov eax, 0x70
mov dword [rbp - 0x14], 0x656378
mov word [rbp - 0x11], ax
mov eax, 0x74
mov word [rbp - 0x10], ax
jmp 0x18009056c
cmp edi, 0x12185
ja 0x1800904e5
je 0x1800904bf
cmp edi, 0xcad3
je 0x1800904b0
cmp edi, 0xe7b9
je 0x180090485
cmp edi, 0x1049f
jne 0x18009056c
lea rax, [rbp - 0x28]
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180090470
mov dword [rbp - 0x54], edx
mov qword [rbp - 0x38], rdx
jmp 0x18009056c
lea rax, [rbp - 0x44]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov edx, r13d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
xor edx, edx
jmp 0x18009056c
mov dword [rbp - 0xf], 0x6e6f69
mov r12b, 1
jmp 0x18009056c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DeleteService]
lea r9, [rbp - 0x38]
mov edx, esi
lea r8, [rbp - 0x54]
lea rcx, [rbp - 0x28]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r15d, eax
xor edx, edx
jmp 0x18009056c
cmp edi, 0x13e6b
je 0x180090502
cmp edi, 0x15b51
jne 0x18009056c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edx, edx
jmp 0x18009056c
test r15d, r15d
movzx eax, r12b
mov ecx, edx
cmove ecx, eax
movzx r12d, cl
test cl, cl
je 0x18009056c
mov ebx, 0xd
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xd
je 0x18009054a
cmp eax, 1
jne 0x180090560
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18009053a
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x180090560
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180090560
mov qword [rbp - 0x60], rdx
lea r8, [rbp - 0x60]
mov edx, esi
lea rcx, [rbp - 0x28]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov r15d, eax
inc ebx
mov edx, 0
cmp ebx, 0xf
jb 0x180090520
add edi, 0x1ce6
cmp edi, 0x177ae
jbe 0x180090350
mov r13d, dword [rbp - 0x80]
mov ebx, dword [rsp + 0x78]
mov edi, dword [rbp - 0x50]
jmp 0x18009068f
mov dword [rbp - 0x4c], 3
mov dword [rbp - 0x48], r8d
mov dword [rbp - 0x44], r8d
jmp case.default.0x180090287
movzx edx, byte [rsp + 0x70]
test dl, dl
je 0x180090621
mov ebx, 0xee
mov eax, ebx
sub eax, 0xec
je 0x1800905ed
sub eax, 1
je 0x1800905d8
cmp eax, 1
jne 0x180090609
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], r8d
xor ecx, ecx
call qword [sym.imp.WINMM.dll_waveInGetID]
mov r13d, eax
jmp 0x180090604
movzx eax, dl
test r13d, r13d
mov ecx, r8d
cmovne ecx, eax
movzx edx, cl
mov byte [rsp + 0x70], cl
jmp 0x180090609
test dl, dl
je 0x180090609
mov r8d, 0x104
lea rdx, [rbp + 0x40]
mov ecx, r13d
call qword [sym.imp.WINMM.dll_waveInGetErrorTextW]
movzx edx, byte [rsp + 0x70]
dec ebx
mov r8d, 0
cmp ebx, 0xeb
ja 0x1800905b0
mov ebx, dword [rsp + 0x78]
mov dword [rbp - 0x80], r13d
mov rax, qword [rbp - 0x70]
cmp qword [rax + 0x40], 0
setne byte [rbp - 0x68]
jmp 0x18009068f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, qword [rbp - 0x70]
mov qword [rcx + 0x40], rax
jmp 0x18009068f
mov word [rbp + 0x2c], r8w
lea rdx, [0x1800d2b56]
mov r8d, 4
mov qword [rbp + 0x24], r10
lea rcx, [rbp + 0x18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18009068f
mov word [rbp + 0x34], dx
jmp case.default.0x180090287
mov al, 1
mov word [rbp + 0x36], r8w
mov dword [rbp - 0x78], eax
mov qword [rbp - 0x30], r8
jmp case.default.0x180090287
mov byte [rsp + 0x70], 1
jmp case.default.0x180090287
call qword [sym.imp.WINMM.dll_waveInGetNumDevs]
mov dword [rbp - 0x74], eax
mov edx, 0x74
dec ebx
lea r9, [0x180000000]
mov dword [rsp + 0x78], ebx
mov r8d, 0
movabs r10, 0x74002d00740065
lea ecx, [rbx + 0x19]
cmp ecx, edi
ja 0x180090271
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1800c0ae0
mov rbx, qword [rsp + 0x3b8]
movaps xmm6, xmmword [rsp + 0x360]
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret