Function at 0x180006f90
Capabilities:
Create thread
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x180045338]
xor rax, rsp
mov qword [rbp + 0x2b8], rax
mov r12, rdx
mov edi, ecx
mov dword [rsp + 0x34], ecx
movdqa xmm0, xmmword [0x18003ea40]
movdqa xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], 0
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
xor ecx, ecx
mov qword [rbp + 0x20], rcx
mov word [rbp + 0x28], cx
movdqu xmmword [rbp + 0x3a], xmm0
mov byte [rbp + 0x2a], cl
mov qword [rbp - 0x10], rcx
mov word [rbp - 8], cx
movdqu xmmword [rbp + 0xa], xmm0
mov byte [rbp - 6], cl
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rcx
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], rcx
mov ecx, 0x30
call fcn.1800397b0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x58], rax
xor edx, edx
mov qword [rbp + 0x68], rdx
xorps xmm2, xmm2
movsd qword [rbp + 0x70], xmm2
mov qword [rbp + 0x78], rdx
mov dword [rbp + 0x80], 1
mov qword [rbp + 0x88], rdx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rdx
mov qword [rbp + 0xc8], 0xffffffffffffffff
mov dword [rbp + 0xd0], edx
xor eax, eax
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rax
movdqa xmm0, xmmword [0x18003ea40]
movdqa xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], al
mov word [rbp + 0x140], dx
mov dword [rbp + 0x144], edx
mov qword [rbp + 0x148], rdx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x150], xmm0
movsd qword [rbp + 0x160], xmm2
mov byte [rbp + 0x168], al
mov qword [rbp + 0x16c], rdx
mov ebx, edi
lea r13d, [rdi + 0x7f8]
cmp edi, r13d
jae 0x18000743f
mov ecx, 0x697a
mov rdi, qword [rsp + 0x50]
mov esi, dword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x50]
nop dword [rax + rax]
cmp ebx, 0x1e9
ja 0x1800072fe
je 0x1800072be
cmp ebx, 0x11f
ja 0x180007219
je 0x180007211
mov eax, ebx
sub eax, 0x51
je 0x1800071ea
sub eax, 0x6e
je 0x1800071cd
cmp eax, 0x1a
jne 0x18000742c
mov byte [rbp + 0x2ad], 0
jmp 0x18000742c
cmp byte [0x180049519], 0
je 0x1800074b2
call qword [0x1800494f0]
mov qword [rsp + 0x48], rax
jmp 0x180007425
mov word [rbp + 0x2a8], cx
movzx eax, word [0x18003caef]
mov word [rbp + 0x2aa], ax
movzx eax, byte [0x18003caf1]
mov byte [rbp + 0x2ac], al
jmp 0x18000742c
mov r15, rdx
jmp 0x18000742c
mov eax, ebx
sub eax, 0x147
je case.0x1800075e9.7
sub eax, 0x1a
je 0x180007263
cmp eax, 0x46
jne 0x18000742c
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x53]
call fcn.18002a020
mov rdi, rax
jmp 0x180007425
mov r8d, 5
lea rdx, [0x18003ca85]
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 1
lea rdx, [0x18003ca9b]
lea rcx, [rbp + 0x2a8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18003cab1]
mov word [rbp + 0x290], ax
movzx eax, byte [0x18003cab3]
mov byte [rbp + 0x292], al
mov byte [rbp + 0x293], 0
jmp 0x180007425
mov r8d, 1
lea rdx, [0x18003ca45]
lea rcx, [rbp + 0x293]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x294], 0
mov r8d, 2
lea rdx, [0x18003ca69]
lea rcx, [rbp + 0x294]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180007425
cmp ebx, 0x2f9
ja 0x1800073a1
je 0x180007395
mov eax, ebx
sub eax, 0x22f
je 0x180007363
sub eax, 0x42
je 0x180007331
cmp eax, 0x46
jne 0x18000742c
mov esi, 0x2000000
jmp 0x18000742c
mov byte [rbp + 0x296], 0
mov r8d, 5
lea rdx, [0x18003ca21]
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x2861
mov word [rbp + 0x29b], ax
jmp 0x180007425
mov r14, 0xffffffffffffffff
test rdi, rdi
je 0x18000742c
mov qword [rsp + 0x20], rdx
mov r9d, 0x107
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call fcn.180014ac0
mov byte [rsp + 0x48], 1
jmp case.0x1800075e9.7
mov byte [rbp + 0x29d], 0x26
jmp 0x18000742c
cmp ebx, 0x33f
je 0x1800073e7
cmp ebx, 0x3c7
je 0x1800073c0
cmp ebx, 0x44f
jne 0x18000742c
mov byte [rsp + 0x48], 0
jmp 0x18000742c
mov dword [rsp + 0x28], 1
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, r14
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ObjectPrivilegeAuditAlarmW]
jmp 0x180007425
mov dword [rsp + 0x40], edx
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x53]
call fcn.18002a020
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0x180], xmm0
mov dword [rbp + 0x190], ecx
test rax, rax
jne 0x1800074ba
xor edx, edx
mov ecx, 0x697a
add ebx, 0x88
cmp ebx, r13d
jb 0x180007190
mov edi, dword [rsp + 0x34]
lea ebx, [rdi - 0x10]
mov dword [rsp + 0x38], ebx
cmp edi, ebx
jbe case.0x1800075e9.7
lea ebx, [rdi - 0x43]
mov dword [rsp + 0x40], ebx
lea r8, [0x180000000]
mov r9d, 0x1bb
movzx edi, byte [rsp + 0x30]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x50]
movzx r15d, byte [rsp + 0x30]
mov r13, qword [rsp + 0x50]
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
nop dword [rax]
cmp ebx, 0xdc
ja case.default.0x1800074b0
movzx eax, byte [r8 + rbx + 0x7c58]
mov ecx, dword [r8 + rax*4 + 0x7c14]
add rcx, r8
jmp rcx
mov rbx, rdx
jmp 0x1800079b2
mov rdx, rax
mov ecx, 0xe6
call fcn.180015530
mov byte [rsp + 0x48], al
jmp case.0x1800075e9.7
mov edx, 0xc
lea rcx, [rsp + 0x70]
call fcn.180029580
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, qword [rbp - 0x80]
je 0x180007502
lea rax, [rbp + 0x20]
mov qword [rdx], rax
add qword [rsp + 0x78], 8
jmp 0x180007511
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1800011a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
mov dword [rbp + 0x240], eax
jmp 0x180007913
mov r8d, 1
lea rdx, [0x18003cb04]
lea rcx, [rbp + 0x1d0]
call fcn.18001c630
xor edx, edx
mov qword [rsp + 0x60], rdx
jmp 0x180007915
mov byte [rsp + 0x30], 1
lea rax, [rbp + 0x2a8]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180007570
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x1b0]
call fcn.18001c630
jmp 0x180007913
mov r8d, 1
lea rdx, [0x18003cb4f]
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
lea rdx, [0x180044248]
lea ecx, [r8 + 0x43]
call fcn.18000a910
xor edx, edx
test al, al
jne 0x180007915
mov ebx, edx
nop dword [rax + rax]
lea r8, [0x180000000]
cmp ebx, 7
ja case.0x1800075e9.3
mov eax, ebx
mov ecx, dword [r8 + rax*4 + 0x7d38]
add rcx, r8
jmp rcx
mov dword [rsp + 0x48], 1
jmp case.0x1800075e9.3
test dil, dil
je case.0x1800075e9.3
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
lea r8, [0x180000000]
jmp case.0x1800075e9.3
mov ecx, edx
movzx eax, dil
test r14, r14
cmovne ecx, eax
movzx edi, cl
jmp case.0x1800075e9.3
mov dil, 1
jmp case.0x1800075e9.3
mov edx, 0x64
mov r8d, edx
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r14, rax
xor edx, edx
lea r8, [0x180000000]
jmp case.0x1800075e9.3
mov r12, rdx
inc ebx
lea eax, [rbx + 0x11]
cmp eax, 0x19
jb 0x1800075d0
mov ebx, dword [rsp + 0x40]
jmp 0x18000791c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x180007913
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x1800076ff
mov ebx, 0xbf
nop
mov eax, ebx
sub eax, 0xbd
je case.0x1800075e9.7
sub eax, 1
je 0x1800076ba
cmp eax, 1
jne 0x1800076e7
movzx r15d, al
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
mov r13, rdx
lea rcx, [rbp + 0x198]
call qword [sym.imp.GDI32.dll_CreatePenIndirect]
mov rsi, rax
jmp 0x1800076e7
mov ecx, edx
movzx eax, r15b
test rsi, rsi
cmovne ecx, eax
movzx r15d, cl
test cl, cl
je 0x1800076d7
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r13
call sub.IMM32.dll_ImmIsIME
mov dword [rsp + 0x48], 1
dec ebx
cmp ebx, 0xbc
mov edx, 0
ja 0x180007680
mov ebx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180007913
mov word [rsp + 0x40], r9w
lea r9, [rbp + 0x20]
lea r8, [rsp + 0x40]
lea rdx, [0x1800442a8]
mov ecx, 0x7b
call fcn.18001b1f0
mov dword [rsp + 0x5c], 1
mov eax, 0x1bb
mov word [rsp + 0x40], ax
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x10]
lea rdx, [0x1800442c8]
mov ecx, 0x1a
call fcn.180018e80
xor edx, edx
mov dword [rsp + 0x58], edx
jmp 0x180007915
mov r8d, dword [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x60], rax
lea rax, [0x1800080f0]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov ecx, 0x103
call fcn.180004ed0
jmp 0x180007913
mov eax, dword [0x18003cb5a]
mov dword [rbp + 0x2a0], eax
movzx eax, byte [0x18003cb5e]
mov byte [rbp + 0x2a4], al
mov byte [rbp + 0x2a5], 0
mov r8d, 1
lea rdx, [0x18003cb87]
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180007913
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
cmp rax, qword [rbp - 0x80]
je 0x1800077fa
lea rcx, [rbp - 0x10]
mov qword [rax], rcx
add qword [rsp + 0x78], 8
jmp 0x18000780e
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.1800011a0
mov eax, dword [0x1800442f0]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x70]
mov edx, 0x7b
lea rcx, [rsp + 0x40]
call fcn.18002a840
lea rax, [rsp + 0x70]
mov qword [rbp - 0x30], rax
mov eax, dword [0x1800442f0]
mov dword [rbp - 0x28], eax
mov eax, dword [0x1800442f4]
mov dword [rbp - 0x24], eax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x20], xmm0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x20]
lea r8, [0x180017630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x50], rax
jmp 0x180007913
mov word [rbp + 0x210], r9w
xor r9d, r9d
lea r8, [rbp + 0x1f0]
xor edx, edx
lea ecx, [rdx + 0x15]
call fcn.180037ea0
jmp 0x180007913
mov r8d, 0xfa
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x1b0]
call fcn.18000a6a0
jmp 0x180007913
lea r9, [0x180044240]
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x50]
mov ecx, 0x76
call fcn.180017b00
mov edx, 0xa9
lea rcx, [rbp + 0x50]
call fcn.180005ad0
xor edx, edx
mov ecx, edx
movzx eax, byte [rsp + 0x30]
cmp qword [rsp + 0x60], rcx
cmovne ecx, eax
mov byte [rsp + 0x30], cl
jmp 0x180007915
mov byte [rbp + 0x29e], 0
mov r8d, 2
lea rdx, [0x18003cbdd]
lea rcx, [rbp + 0x29e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
lea r8, [0x180000000]
mov r9d, 0x1bb
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
dec ecx
mov dword [rsp + 0x34], ecx
dec ebx
mov dword [rsp + 0x40], ebx
cmp ecx, eax
jbe case.0x1800075e9.7
jmp 0x180007490
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
cmp byte [rsp + 0x30], 0
je 0x1800079a7
mov r8d, 0xf01ff
lea rdx, [rbp + 0x290]
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x18000799e
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x220]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov dword [rsp + 0x48], eax
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0xc8]
call fcn.180003220
mov rdi, qword [rbp + 0xb0]
test rdi, rdi
je 0x180007a22
mov rsi, qword [rbp + 0xb8]
cmp rdi, rsi
je 0x1800079ee
mov rcx, rdi
call fcn.18001b9f0
add rdi, 0x20
cmp rdi, rsi
jne 0x1800079d6
mov rdi, qword [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
sub r8, rdi
sar r8, 5
mov rdx, rdi
lea rcx, [rbp + 0xb0]
call fcn.180021130
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
xor r14d, r14d
mov qword [rbp + 0xc0], r14
jmp 0x180007a25
xor r14d, r14d
mov rdx, qword [rbp + 0x98]
test rdx, rdx
je 0x180007a5d
mov r8, qword [rbp + 0xa8]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x98]
call fcn.180021090
mov qword [rbp + 0x98], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
lea rcx, [rbp + 0x58]
call fcn.180003150
nop
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x180007afb
mov rsi, qword [rbp - 0x70]
cmp rdi, rsi
je 0x180007a95
nop dword [rax]
mov rcx, rdi
call fcn.180002a60
add rdi, 0x28
cmp rdi, rsi
jne 0x180007a80
mov rdi, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x180007ae7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180007ae7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1800397ec
mov qword [rbp - 0x78], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x180007b27
mov r8, qword [rbp - 0x80]
sub r8, rdx
sar r8, 3
lea rcx, [rsp + 0x70]
call fcn.180021040
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov rdx, qword [rbp + 0x12]
cmp rdx, 0x10
jb 0x180007b65
inc rdx
mov rcx, qword [rbp - 6]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007b60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180007b60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800397ec
movdqa xmm0, xmmword [0x18003ea40]
movdqu xmmword [rbp + 0xa], xmm0
mov byte [rbp - 6], 0
mov rdx, qword [rbp + 0x42]
cmp rdx, 0x10
jb 0x180007bb4
inc rdx
mov rcx, qword [rbp + 0x2a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007baf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180007baf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800397ec
movdqa xmm0, xmmword [0x18003ea40]
movdqu xmmword [rbp + 0x3a], xmm0
mov byte [rbp + 0x2a], 0
lea rcx, [rbp + 0x250]
call fcn.180002dc0
nop
lea rcx, [rbp + 0x1b0]
call fcn.180002e70
mov rax, rbx
mov rcx, qword [rbp + 0x2b8]
xor rcx, rsp
call fcn.180039fa0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret