Function at 0x180043e30
Capabilities:
Enumerate services
Modify service
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x268]
sub rsp, 0x368
mov ebx, dword [rbp + 0x2b0]
lea eax, [rcx - 0x13]
mov dword [rbp - 0x44], eax
mov rsi, r8
mov r13, rdx
mov r15d, ecx
cmp ecx, eax
jbe 0x180043f45
mov r12, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
lea eax, [r15 - 0xca]
movabs r9, 0x3ff0000000000000
lea rdx, [0x180000000]
mov r8d, 0x4f67
cmp eax, 0x2d
ja case.0x180043eb9.221
movzx eax, byte [rdx + rax + 0x44ed0]
mov ecx, dword [rdx + rax*4 + 0x44e80]
add rcx, rdx
jmp rcx
mov ecx, 0xda
mov eax, ecx
sub eax, 0xd9
je 0x180044619
cmp eax, 1
jne 0x180044435
mov rdi, qword [rsp + 0x50]
cmp qword [rdi + 0x18], 0
je 0x180043fe5
cmp rdi, rsi
je 0x180043fe5
mov r8, r12
mov byte [rbp + 0x2b0], 0x2c
mov edx, 0xb5
lea rcx, [rbp + 0x2b0]
call fcn.18005fbe0
cmp eax, 1
je 0x180043fde
mov edi, 0x11f
nop dword [rax + rax]
mov eax, edi
sub eax, 0x11f
je 0x180043faf
sub eax, 0x32
je 0x180043f9f
sub eax, 0x32
je 0x180043f62
sub eax, 0x32
je 0x180043f5b
cmp eax, 0x32
jne 0x180043fca
mov eax, ebx
add rsp, 0x368
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ebx, 6
jmp 0x180043fca
mov eax, dword [rbp - 0x5c]
xor r8d, r8d
mov r9, qword [rbp + 8]
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_GrayStringW]
jmp 0x180043fca
mov dword [rbp - 0x60], 0
mov dword [rbp - 0x5c], 0
jmp 0x180043fca
lea rax, [0x1800aee84]
mov qword [rbp - 8], 0
mov qword [rbp + 8], rax
mov qword [rbp], 0
add edi, 0x32
cmp edi, 0x219
jb 0x180043f20
mov rdi, qword [rsp + 0x50]
lea rdx, [0x180000000]
movsxd rax, dword [rdi]
cmp eax, 6
ja case.default.0x180043ffb
mov ecx, dword [rdx + rax*4 + 0x44f00]
add rcx, rdx
jmp rcx
mov r14d, 0xc1
cmp r14d, 0xbf
jbe case.0x180043ffb.1
mov eax, r14d
sub eax, 0xc0
je 0x180044422
cmp eax, 1
jne 0x180044213
mov r8, r12
mov byte [rbp + 0x2b0], 0x22
mov edx, 0xb5
lea rcx, [rbp + 0x2b0]
call fcn.18005fbe0
cmp eax, 1
jne 0x18004412b
mov r8, qword [rdi + 8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x180044056
mov r9d, 0xae
mov qword [rbp + 0x10], rax
mov rdx, r12
lea rcx, [rbp + 0x10]
call fcn.180024b20
cmp eax, 1
jne 0x18004412b
mov r8, r12
mov byte [rbp + 0x2b0], 0x22
mov edx, 0xb5
lea rcx, [rbp + 0x2b0]
call fcn.18005fbe0
cmp eax, 1
jne 0x18004412b
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x1800441c1
cmp dword [rax], 2
jne 0x180044213
mov esi, 0xae
nop
cmp esi, 0xae
je 0x18004419e
cmp esi, 0x6cc
je 0x180044195
cmp esi, 0xcea
jne 0x1800441a7
mov r9d, dword [rbp - 0x58]
xor eax, eax
mov edx, dword [rbp - 0x54]
xor r8d, r8d
mov rcx, qword [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenGroups]
cmp qword [rdi + 0x28], 0
je 0x180044135
mov r8, r12
mov byte [rbp + 0x2b0], 0x3a
mov edx, 0xb5
lea rcx, [rbp + 0x2b0]
call fcn.18005fbe0
cmp eax, 1
je 0x1800441a7
mov eax, 6
jmp 0x180043f47
mov edi, 0x4b
nop word [rax + rax]
cmp edi, 0x4b
je 0x180044162
cmp edi, 0x1725
je 0x18004415b
cmp edi, 0x2dff
je 0x180043f45
jmp 0x18004417b
mov ebx, 8
jmp 0x18004417b
lea rdx, [rsp + 0x58]
mov ecx, 0x117
call fcn.180020110
xor r13d, r13d
mov qword [rbp + 0x2b8], r13
add edi, 0x16da
cmp edi, 0x448e
jbe 0x180044140
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
jmp 0x1800441a7
mov dword [rbp - 0x58], 0
jmp 0x1800441a7
xor eax, eax
mov qword [rbp + 0x18], rax
mov dword [rbp - 0x54], eax
add esi, 0x61e
cmp esi, 0x125a
jbe 0x1800440c0
dec r14d
jmp 0x180044003
cmp qword [rdi + 0x28], 0
je 0x1800441f4
mov r8, r12
mov byte [rbp + 0x2b0], 0x3a
mov edx, 0xb5
lea rcx, [rbp + 0x2b0]
call fcn.18005fbe0
cmp eax, 1
jne 0x18004412b
dec r14d
jmp 0x180044003
mov eax, 0x1c
nop dword [rax]
cmp eax, 0x1c
je 0x180044def
add eax, 0x7c
cmp eax, 0x98
jb 0x180044200
dec r14d
jmp 0x180044003
mov esi, 0x17
mov eax, esi
sub eax, 0x15
je 0x180044422
sub eax, 1
je 0x18004426d
cmp eax, 1
jne 0x180044365
mov r8, r12
mov byte [rbp + 0x2b0], 0x5b
mov edx, 0xb5
lea rcx, [rbp + 0x2b0]
call fcn.18005fbe0
cmp eax, 1
jne 0x18004412b
mov rax, qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov qword [rbp + 0x20], rax
jmp 0x180044365
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x18004454a
mov edi, 0xe1
nop
cmp edi, 0xe1
je 0x1800442a0
cmp edi, 0x456f
jne 0x1800442bb
mov r14, qword [rsp + 0x50]
mov r15d, 0xdf
jmp case.0x180043eb9.221
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], 0
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
add edi, 0x448e
cmp edi, 0x891c
jbe 0x180044280
mov r12, qword [rbp + 0x20]
mov edi, 0xfa
cmp edi, 0xfa
je 0x18004432f
cmp edi, 0x510e
je 0x1800442fc
cmp edi, 0xa122
jne 0x180044349
mov r8, r12
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x60]
call fcn.180001130
jmp 0x180044349
lea rcx, [rbp - 0x28]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180044303
movzx eax, word [0x1800aee94]
lea rdx, str.atch__p_n
mov word [rcx], ax
mov r8d, 9
lea rcx, [rbp - 0x1f]
call fcn.18007b500
jmp 0x180044349
mov r8d, 8
mov byte [rbp - 0x28], 0
lea rdx, str.GetWrite
lea rcx, [rbp - 0x28]
call fcn.18007c4e0
add edi, 0x5014
cmp edi, 0xf03c
jbe 0x1800442d2
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
dec esi
cmp esi, 0x14
ja 0x180044220
mov edi, 0x4c
cmp edi, 0x4c
je 0x1800443bc
cmp edi, 0x1d64
je 0x180044390
cmp edi, 0x3a7c
je 0x180044290
jmp 0x1800443ce
mov r9d, 0xae
mov qword [rsp + 0x60], 4
lea r8, [rsp + 0x74]
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.180024b20
cmp eax, 1
jne 0x18004412b
jmp 0x1800443ce
mov eax, 0x74
mov word [rsp + 0x74], ax
mov dword [rsp + 0x75], 0x657572
add edi, 0x1d18
cmp edi, 0x5748
jbe 0x180044375
mov edi, 0x1e
cmp edi, 0x6306
ja case.0x180043ffb.6
cmp edi, 0x1e
je 0x1800444ae
cmp edi, 0x13ec
je 0x180044482
cmp edi, 0x27ba
je 0x18004444d
cmp edi, 0x3b88
je 0x180044290
cmp edi, 0x4f56
jne 0x1800444ca
mov rsi, qword [rbp + 0x2c0]
lea rdx, [0x180000000]
mov ecx, 0xda
dec ecx
cmp ecx, 0xd8
ja 0x180043ec0
mov r14, qword [rsp + 0x50]
jmp case.0x180043eb9.221
mov r9d, 0xae
mov qword [rsp + 0x60], 5
lea r8, [rsp + 0x6c]
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.180024b20
cmp eax, 1
jne 0x18004412b
add edi, 0x13ce
jmp 0x1800443e1
mov r8d, 2
mov byte [rsp + 0x6f], 0
lea rdx, [0x1800aeed4]
lea rcx, [rsp + 0x6f]
call fcn.18007b500
add edi, 0x13ce
mov byte [rsp + 0x71], 0
jmp 0x1800443e1
mov r8d, 2
lea rdx, [0x1800aeeac]
lea rcx, [rsp + 0x6c]
call fcn.18007b500
mov byte [rsp + 0x6e], 0x6c
add edi, 0x13ce
jmp 0x1800443e1
mov r8, qword [rdi + 8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x1800444e0
mov r9d, 0xae
mov qword [rbp + 0x28], rax
mov rdx, r12
lea rcx, [rbp + 0x28]
call fcn.180024b20
cmp eax, 1
jne 0x18004412b
mov r14, qword [rsp + 0x50]
mov r15d, 0xdf
jmp case.0x180043eb9.221
mov r8, r12
mov byte [rbp + 0x2b0], 0x7b
mov edx, 0xb5
lea rcx, [rbp + 0x2b0]
call fcn.18005fbe0
cmp eax, 1
jne 0x18004412b
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x180044290
mov r14, rax
mov qword [rsp + 0x50], rax
mov r15d, 0xe2
mov dword [rbp - 0x34], OleUIChangeSourceA
jmp case.0x180043eb9.221
mov edi, 0xbe
nop dword [rax]
mov eax, edi
sub eax, 0xbe
je 0x180044584
cmp eax, 0x47
je 0x180044290
jmp 0x1800445c0
mov eax, dword [str.null]
lea r8, [rbp - 0x68]
mov dword [rbp - 0x68], eax
lea rcx, [rsp + 0x60]
movzx eax, byte [0x1800aeedc]
mov r9d, 0xae
mov rdx, r12
mov byte [rbp - 0x64], al
mov qword [rsp + 0x60], 4
call fcn.180024b20
cmp eax, 1
jne 0x18004412b
add edi, 0x47
cmp edi, 0x14c
jb 0x180044570
mov r14, qword [rsp + 0x50]
mov edi, 0x65
lea r15d, [rdi + 0x78]
nop dword [rax]
cmp edi, 0x65
je 0x180044a35
cmp edi, 0x8ae
je 0x180044a13
cmp edi, 0x10f7
jne 0x180044a3d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, 0xa
jmp 0x180043f47
mov r14, qword [rsp + 0x50]
mov rax, qword [r14 + 0x28]
test rax, rax
je case.0x180043eb9.213
mov r14, rax
mov qword [rsp + 0x50], rax
mov r15d, 0xe2
mov dword [rbp - 0x34], OleUIChangeSourceA
jmp case.0x180043eb9.221
lea rdx, [rsp + 0x58]
mov dword [rbp - 0x30], 0
mov ecx, 0x7d
mov qword [rsp + 0x58], 8
call fcn.180036d40
mov r12, rax
mov qword [rsp + 0x58], rax
mov r15d, 0xe2
mov dword [rbp - 0x34], OleUIChangeSourceA
jmp case.0x180043eb9.221
mov rax, qword [rsi]
mov dword [rax + 0x6c], 0
mov rax, qword [rsi]
mov dword [rax + 0x70], 2
mov rax, qword [rsi]
mov dword [rax + 0x74], 1
jmp case.0x180043eb9.221
mov qword [rbp + 0x48], 0
jmp case.0x180043eb9.221
mov rax, qword [rsi]
mov dword [rax + 0x68], 1
jmp case.0x180043eb9.221
mov rax, qword [rsi]
mov dword [rax + 0x80], 0
mov rax, qword [rsi]
mov dword [rax + 0x84], 0
jmp case.0x180043eb9.221
mov rax, qword [rsi]
mov dword [rax + 0x64], 1
jmp case.0x180043eb9.221
mov rax, qword [rsi]
mov dword [rax + 0x44], 1
mov rax, qword [rsi]
mov dword [rax + 0x48], 1
jmp case.0x180043eb9.221
mov rax, qword [rsi]
mov dword [rax + 0x78], 0x100
mov rax, qword [rsi]
mov qword [rax + 0xa0], 0
mov rax, qword [rsi]
mov dword [rax + 0x7c], 0
jmp case.0x180043eb9.221
mov r15d, 0x2b
mov dword [rsp + 0x60], r15d
nop word [rax + rax]
mov eax, r15d
sub eax, 0x2b
je 0x18004495a
sub eax, 0x33
je case.0x180044970.0
cmp eax, 0x33
jne 0x1800449bc
mov rdi, qword [rsp + 0x50]
cmp qword [rdi + 0x20], 0
je case.0x180043eb9.210
cmp rdi, rsi
je case.0x180043eb9.210
cmp qword [rdi + 0x10], 0
je 0x1800449fc
mov r14d, 9
cmp r14d, 9
ja case.0x18004479b.2
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0x44f1c]
add rcx, rdx
jmp rcx
mov byte [rbp - 0x7f], 0
jmp case.0x18004479b.2
xor r9d, r9d
lea rax, [rbp - 0x80]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
jne 0x180044804
mov byte [rbp + 0x2c8], al
lea rdx, [0x180000000]
mov r8d, 0x4f67
dec r14d
lea eax, [r14 + 0x105]
cmp eax, 0x104
ja 0x180044788
mov r14, qword [rsp + 0x50]
mov rsi, qword [rbp + 0x2c0]
jmp 0x1800449bc
cmp byte [rbp + 0x2c8], 0
je 0x1800447d5
mov r12, qword [rbp + 0x30]
mov edi, pe_nt_image_headers64
mov r15d, dword [rbp - 0x50]
nop word [rax + rax]
cmp edi, 0x110
je 0x180044879
cmp edi, 0x3fc0
je 0x180044842
cmp edi, 0x7e70
jne 0x18004489d
mov rcx, r12
call fcn.180072898
jmp 0x18004489d
lea rax, [rbp + 0x38]
mov r8d, r15d
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x10]
mov dword [rsp + 0x28], 0
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_BackupRead]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004489d
mov ecx, 0x19
mov r15d, ecx
call fcn.180072c5c
mov r12, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], rax
mov byte [r12 + 0x18], al
add edi, 0x3eb0
cmp edi, 0xbc10
jbe 0x180044820
mov rdi, qword [rsp + 0x50]
mov dword [rbp - 0x50], r15d
mov r15d, dword [rsp + 0x60]
mov qword [rbp + 0x30], r12
mov r12, qword [rsp + 0x58]
jmp 0x1800447d5
mov r8d, 1
lea rdx, [0x1800aeee2]
lea rcx, [rbp - 0x80]
call fcn.18007b500
jmp 0x1800447d5
mov r8d, 5
lea rdx, [0x1800aef00]
lea rcx, [rbp - 0x80]
call fcn.18007c4e0
mov eax, dword [0x1800aef26]
mov dword [rbp - 0x7a], eax
movzx eax, byte [0x1800aef2a]
mov byte [rbp - 0x76], al
mov byte [rbp - 0x75], 0x6e
jmp 0x1800447d5
mov dword [rbp - 0x71], 0x7463656a
mov byte [rbp - 0x6d], 0
jmp case.0x18004479b.2
mov qword [rbp + 0x38], 0
mov rdi, qword [rdi + 0x10]
mov qword [rsp + 0x50], rdi
mov byte [rbp + 0x2c8], 1
jmp case.0x18004479b.2
mov dword [rbp - 0x74], 0x624f67
jmp case.0x18004479b.2
mov byte [rbp - 0x74], 0
jmp case.0x18004479b.2
movsxd rax, dword [r14]
cmp eax, 6
ja case.0x180043eb9.211
mov ecx, dword [rdx + rax*4 + 0x44f44]
add rcx, rdx
jmp rcx
mov byte [rbp + 0x2b0], 0x7d
jmp 0x180044982
mov byte [rbp + 0x2b0], 0x5d
mov r8, r12
lea rcx, [rbp + 0x2b0]
mov edx, 0xb5
call fcn.18005fbe0
cmp eax, 1
jne 0x18004412b
mov r8d, 0x4f67
lea rdx, [0x180000000]
mov r15d, 0x5e
mov dword [rbp + 0x2b0], 0xde
add r15d, 0x33
mov dword [rsp + 0x60], r15d
cmp r15d, 0xc4
jb 0x180044740
mov r15d, dword [rbp + 0x2b0]
mov dword [rbp - 0x3c], 0
jmp case.0x180043eb9.221
mov r14, qword [rsp + 0x50]
mov r15d, 0xe2
mov dword [rbp - 0x34], OleUIChangeSourceA
jmp case.0x180043eb9.221
mov rdi, qword [rdi + 0x20]
mov r15d, 0xdf
mov qword [rsp + 0x50], rdi
mov r14, rdi
jmp case.0x180043eb9.221
lea rdx, [rsp + 0x58]
mov ecx, 0x117
call fcn.180020110
xorps xmm0, xmm0
lea rcx, [rbp + 0x50]
movups xmmword [rbp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x180044a3d
mov qword [rbp + 0x40], 0
add edi, 0x849
cmp edi, 0x18db
jbe 0x1800445e0
mov r12, qword [rsp + 0x58]
mov dword [rbp - 0x40], 0
jmp case.0x180043eb9.221
mov rax, qword [rsi]
mov qword [rax + 0x50], r9
mov rax, qword [rsi]
mov dword [rax + 0x58], 0
mov rax, qword [rsi]
mov dword [rax + 0x5c], 0
mov rax, qword [rsi]
mov dword [rax + 0x60], 0
jmp case.0x180043eb9.221
mov r14, rsi
mov qword [rsp + 0x50], rsi
jmp case.0x180043eb9.221
mov dword [rbp - 0x38], 1
jmp case.0x180043eb9.221
mov rcx, qword [rsi]
mov r10, qword [r13]
mov edx, dword [rcx + 0x40]
sub edx, 1
je 0x180044ad7
cmp edx, 1
je 0x180044ace
mov rax, qword [rcx]
mov dword [rax + 0x28], 0x401
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax]
jmp case.0x180043eb9.221
lea rdx, str.Ik4bCn3o_._JO
jmp 0x180044ade
lea rdx, str.escDisplayMask
mov r9d, dword [rcx + 0x8c]
mov r8d, dword [rcx + 0x88]
mov rcx, qword [r10 + 0x18]
mov dword [rsp + 0x20], 0xff
call fcn.1800010e0
mov r15d, 0xf6
jmp case.0x180043eb9.221
mov rcx, qword [rsi]
mov edx, dword [rcx + 0x38]
sub edx, 1
je 0x180044db8
sub edx, 2
je 0x180044bc3
cmp edx, 1
je 0x180044b3b
mov dword [rcx + 0x3c], 0
mov rax, qword [rsi]
mov dword [rax + 0x40], 0
jmp 0x180044dc9
cmp dword [rcx + 0x1b8], 0
je 0x180044bad
movzx eax, word [rcx + 0x1bc]
test ax, ax
je 0x180044bad
cmp ax, 2
je 0x180044b97
mov rax, qword [rcx]
mov edx, 0xffffffff
mov dword [rax + 0x28], 0x72
mov rax, qword [rsi]
movsx ecx, word [rax + 0x1bc]
mov rax, qword [rax]
mov dword [rax + 0x2c], ecx
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + OleUIPromptUserA]
mov rax, qword [rsi]
mov dword [rax + 0x3c], 5
mov rax, qword [rsi]
mov dword [rax + 0x40], 4
jmp 0x180044dc9
mov dword [rcx + 0x3c], 5
mov rax, qword [rsi]
mov dword [rax + 0x40], 4
jmp 0x180044dc9
mov dword [rcx + 0x3c], 4
mov rax, qword [rsi]
mov dword [rax + 0x40], 4
jmp 0x180044dc9
cmp dword [rcx + 0x1a4], 0
je 0x180044be2
mov dword [rcx + 0x3c], 3
mov rax, qword [rsi]
mov dword [rax + 0x40], 2
jmp 0x180044dc9
cmp dword [rcx + 0x1b8], 0
je 0x180044c52
movsx edx, word [rcx + 0x1bc]
test edx, edx
je 0x180044c3c
cmp edx, 1
je 0x180044bcc
mov rax, qword [rcx]
mov edx, 0xffffffff
mov dword [rax + 0x28], 0x72
mov rax, qword [rsi]
movsx ecx, word [rax + 0x1bc]
mov rax, qword [rax]
mov dword [rax + 0x2c], ecx
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + OleUIPromptUserA]
mov rax, qword [rsi]
mov dword [rax + 0x3c], 3
mov rax, qword [rsi]
mov dword [rax + 0x40], 2
jmp 0x180044dc9
mov dword [rcx + 0x3c], 2
mov rax, qword [rsi]
mov dword [rax + 0x40], 2
jmp 0x180044dc9
mov r12, qword [rbp + 0x2c0]
mov esi, 0x10b
mov r14d, dword [rbp - 0x48]
mov r13d, dword [rsp + 0x68]
mov dword [rbp + 0x2b0], esi
nop dword [rax]
mov eax, esi
sub eax, 0x10b
je 0x180044d6b
sub eax, 0x1c
je 0x180044d4e
cmp eax, 0x1c
jne 0x180044d7b
mov r15d, dword [rbp - 0x4c]
cmp r15d, 1
jne 0x180044cb2
cmp r14d, 2
jne 0x180044cd4
cmp r13d, 3
jne 0x180044cd4
mov rax, qword [r12]
mov dword [rax + 0x3c], r13d
jmp 0x180044d7b
cmp r15d, 0x52
jne 0x180044cd4
cmp r14d, 0x47
jne 0x180044cd4
cmp r13d, 0x42
jne 0x180044cd4
mov rax, qword [r12]
mov dword [rax + 0x3c], 2
jmp 0x180044d7b
mov esi, dword [rsp + 0x68]
mov edi, 0x3d
nop dword [rax]
cmp edi, 0x3d
je 0x180044d16
cmp edi, 0xc0
je 0x180044d06
cmp edi, 0x143
jne 0x180044d28
mov rcx, qword [r12]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + OleUIPromptUserA]
jmp 0x180044d28
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x6f
jmp 0x180044d28
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x2c], r15d
mov dword [rcx + 0x30], r14d
mov dword [rcx + 0x34], esi
add edi, 0x83
cmp edi, 0x1c6
jb 0x180044ce0
mov rax, qword [r12]
mov esi, dword [rbp + 0x2b0]
mov r13d, dword [rsp + 0x68]
mov dword [rax + 0x3c], 3
jmp 0x180044d7b
mov rax, qword [r12]
mov rcx, qword [rax + 0x130]
mov r13d, dword [rcx + 0xc0]
mov r14d, dword [rcx + 0x60]
mov dword [rsp + 0x68], r13d
jmp 0x180044d7b
mov rax, qword [r12]
mov rcx, qword [rax + 0x130]
mov eax, dword [rcx]
mov dword [rbp - 0x4c], eax
add esi, 0x1c
mov dword [rbp + 0x2b0], esi
cmp esi, 0x15f
jb 0x180044c70
mov r12, qword [rsp + 0x58]
mov r13, qword [rbp + 0x2b8]
mov rsi, qword [rbp + 0x2c0]
mov dword [rbp - 0x48], r14d
mov r14, qword [rsp + 0x50]
mov rax, qword [rsi]
mov dword [rax + 0x40], 2
jmp 0x180044dc9
mov dword [rcx + 0x3c], 1
mov rax, qword [rsi]
mov dword [rax + 0x40], 1
mov r15d, 0xd1
dec r15d
mov dword [rbp + 0x2b0], r15d
cmp r15d, dword [rbp - 0x44]
jbe 0x180043f45
mov rsi, qword [rbp + 0x2c0]
jmp 0x180043e80
lea rdx, [rsp + 0x58]
mov ecx, 0x117
call fcn.180020110
mov eax, 8
jmp 0x180043f47
mov r9d, dword [rbp - 0x38]
lea rax, [rbp - 0x40]
mov r8d, dword [rbp - 0x34]
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp + 0x48]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov r8, r12
mov dword [rsp + 0x20], 0xaa
xor edx, edx
xor ecx, ecx
call fcn.1800120c0
mov qword [r13], rax
mov eax, 1
jmp 0x180043f47