Function at 0x180001f20
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x180020cb8], 0
jne 0x180002255
mov qword [rsp + 0x20], rbx
mov byte [0x180020cb8], 1
call fcn.1800069c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180006ee0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x180001f95
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cb0], rax
test rax, rax
je 0x180001f9c
lea rdx, [0x180002260]
lea rcx, [0x180020cb0]
call fcn.180005fa0
jmp 0x180001f9c
mov qword [0x180020cb0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001fdf
lea rdx, str.NtResumeThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020c98], rax
test rax, rax
je 0x180001fe6
lea rdx, [0x1800024f0]
lea rcx, [0x180020c98]
call fcn.180005fa0
jmp 0x180001fe6
mov qword [0x180020c98], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002029
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ce8], rax
test rax, rax
je 0x180002030
lea rdx, [0x180002630]
lea rcx, [0x180020ce8]
call fcn.180005fa0
jmp 0x180002030
mov qword [0x180020ce8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002073
lea rdx, str.NtQueryDirectoryFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ca8], rax
test rax, rax
je 0x18000207a
lea rdx, [0x180002a10]
lea rcx, [0x180020ca8]
call fcn.180005fa0
jmp 0x18000207a
mov qword [0x180020ca8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800020bd
lea rdx, str.NtEnumerateKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ca0], rax
test rax, rax
je 0x1800020c4
lea rdx, [0x180003030]
lea rcx, [0x180020ca0]
call fcn.180005fa0
jmp 0x1800020c4
mov qword [0x180020ca0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002107
lea rdx, str.NtEnumerateValueKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cc0], rax
test rax, rax
je 0x18000210e
lea rdx, [0x180003120]
lea rcx, [0x180020cc0]
call fcn.180005fa0
jmp 0x18000210e
mov qword [0x180020cc0], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002151
lea rdx, str.EnumServiceGroupW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cc8], rax
test rax, rax
je 0x180002158
lea rdx, [0x180003210]
lea rcx, [0x180020cc8]
call fcn.180005fa0
jmp 0x180002158
mov qword [0x180020cc8], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000219b
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cd0], rax
test rax, rax
je 0x1800021a2
lea rdx, [0x1800032a0]
lea rcx, [0x180020cd0]
call fcn.180005fa0
jmp 0x1800021a2
mov qword [0x180020cd0], rbx
lea rcx, str.sechost.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800021e5
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cd8], rax
test rax, rax
je 0x1800021ec
lea rdx, [0x180003330]
lea rcx, [0x180020cd8]
call fcn.180005fa0
jmp 0x1800021ec
mov qword [0x180020cd8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000223b
lea rdx, str.NtDeviceIoControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ce0], rax
test rax, rax
je 0x180002242
lea rdx, [0x1800033c0]
lea rcx, [0x180020ce0]
call fcn.180005fa0
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180006a30
mov qword [0x180020ce0], rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180006a30
add rsp, 0x28
ret