Function at 0x18001a530
Capabilities:
Enumerate services
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
movsd xmm0, qword [0x1800b3848]
mov edi, 0x44cad
movaps xmmword [rax - 0x38], xmm8
movsd xmm8, qword [0x18009a2f8]
ucomisd xmm0, xmm8
jp 0x18001a966
jne 0x18001a966
movaps xmmword [rax - 0x48], xmm9
movsd xmm9, qword [0x180098f38]
movaps xmmword [rax - 0x58], xmm10
movsd xmm10, qword [0x180099c20]
movaps xmmword [rax - 0x68], xmm11
movsd xmm11, qword [0x1800992c8]
movaps xmmword [rax - 0x78], xmm12
movsd xmm12, qword [0x180099340]
movaps xmmword [rax - 0x88], xmm13
movsd xmm13, qword [0x1800988e0]
movaps xmmword [rax - 0x98], xmm14
movsd xmm14, qword [0x1800998e0]
movaps xmmword [rax - 0xa8], xmm15
movsd xmm15, qword [0x180099450]
mov qword [rax + 8], rbx
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
nop word [rax + rax]
cmp edi, 0x44cae
jge 0x18001a90f
lea rdx, str.igyegulbyavyuc
lea rcx, [rsp + 0x20]
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmm9
movaps xmm1, xmm10
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movaps xmm0, xmm11
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cvttsd2si ecx, qword [0x1800b3848]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x40]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movaps xmm6, xmm13
mulsd xmm0, xmm7
subsd xmm6, xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.18002f2f0
movsd xmm2, qword [0x1800b3878]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mulsd xmm0, xmm12
lea rdx, str.igyegulbyavyuc
lea rcx, [rsp + 0x60]
addsd xmm0, xmm6
movsd qword [0x1800b3910], xmm0
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmm9
movaps xmm1, xmm10
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movaps xmm0, xmm11
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cvttsd2si ecx, qword [0x1800b3848]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x40]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movaps xmm6, xmm14
mulsd xmm0, xmm7
subsd xmm6, xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.18002f2f0
movsd xmm2, qword [0x1800b3878]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mulsd xmm0, xmm12
lea rdx, str.igyegulbyavyuc
lea rcx, [rsp + 0x60]
addsd xmm0, xmm6
movsd qword [0x1800b3878], xmm0
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmm9
movaps xmm1, xmm10
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movaps xmm0, xmm11
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cvttsd2si ecx, qword [0x1800b3848]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x40]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movaps xmm6, xmm15
mulsd xmm0, xmm7
subsd xmm6, xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.18002f2f0
movsd xmm2, qword [0x1800b3878]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mulsd xmm0, xmm12
lea rdx, str.igyegulbyavyuc
lea rcx, [rsp + 0x60]
addsd xmm0, xmm6
movsd qword [0x1800b3878], xmm0
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmm9
movaps xmm1, xmm10
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
movaps xmm0, xmm11
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cvttsd2si ecx, qword [0x1800b3848]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x40]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
movsd xmm6, qword [0x1800992f0]
mulsd xmm0, xmm7
subsd xmm6, xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.18002f2f0
movsd xmm2, qword [0x1800b3878]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mulsd xmm0, xmm12
inc edi
addsd xmm0, xmm6
movsd qword [0x1800b3910], xmm0
movsd xmm0, qword [0x1800b3848]
ucomisd xmm0, xmm8
jp 0x18001a90f
je 0x18001a5f0
movaps xmm6, xmmword [rsp + 0x110]
movaps xmm7, xmmword [rsp + 0x100]
mov rbx, qword [rsp + 0x130]
movaps xmm11, xmmword [rsp + 0xc0]
movaps xmm10, xmmword [rsp + 0xd0]
movaps xmm9, xmmword [rsp + 0xe0]
movaps xmm12, xmmword [rsp + 0xb0]
movaps xmm13, xmmword [rsp + 0xa0]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0x80]
lea r11, [rsp + 0x120]
mov rdi, qword [r11 + 0x18]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rbp
ret