Function at 0x18000c480
Capabilities:
Get file size
Get memory capacity
Modify service
Query service status
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x710]
sub rsp, 0x810
mov rax, qword [0x1800f6ae8]
xor rax, rsp
mov qword [rbp + 0x700], rax
mov qword [rbp - 0x68], r9
mov r11d, r8d
mov dword [rbp - 0x78], r8d
mov qword [rsp + 0x70], rdx
mov r10, rcx
mov qword [rbp - 0x80], rcx
mov r8, qword [rbp + 0x770]
mov qword [rbp - 0x70], r8
mov rbx, qword [rbp + 0x778]
mov qword [rbp - 0x60], rbx
mov r14d, r11d
mov dword [rsp + 0x78], r11d
lea esi, [r11 - 0x12]
mov dword [rsp + 0x60], esi
lea rcx, [0x180000000]
cmp r11d, esi
jbe 0x18000ca25
lea esi, [r11 - 0xfb]
mov dword [rsp + 0x68], esi
mov r15d, 0x62
lea r11d, [r15 - 0x42]
mov rdi, qword [rbp - 0x60]
mov qword [rbp - 0x50], rdi
mov r12d, dword [rsp + 0x70]
mov r13, qword [rbp + 0x6c0]
mov eax, dword [rsp + 0x60]
nop word [rax + rax]
cmp esi, 0x3b
ja case.default.0x18000c552
movzx eax, byte [rcx + rsi + 0xd158]
mov ecx, dword [rcx + rax*4 + 0xd10c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov qword [rbp - 8], rdx
jmp case.0x18000c552.8
mov r8d, 3
lea rdx, [0x1800e099c]
lea rcx, [rbp + 0x6f2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r10, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x68]
mov rdx, qword [rsp + 0x70]
mov r11d, 0x20
jmp case.0x18000c552.8
mov rdi, qword [rbx]
mov r15, qword [rbx + 8]
cmp rdi, r15
je 0x18000c6be
mov r14, qword [r10]
mov rbx, qword [r14 + 8]
mov qword [rbp - 0x30], rbx
mov dword [rbp - 0x28], 0
mov rsi, r14
cmp byte [rbx + 0x19], 0
jne 0x18000c5f7
nop
mov qword [rbp - 0x30], rbx
lea rcx, [rbx + 0x20]
mov rdx, rdi
call fcn.18003d5b0
shr eax, 0x1f
test al, al
je 0x18000c5e4
mov dword [rbp - 0x28], 0
mov rbx, qword [rbx + 0x10]
jmp 0x18000c5f1
mov dword [rbp - 0x28], 1
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x18000c5c0
cmp byte [rsi + 0x19], 0
jne 0x18000c610
lea rdx, [rsi + 0x20]
mov rcx, rdi
call fcn.18003d5b0
shr eax, 0x1f
test al, al
je 0x18000c68d
mov rsi, qword [rbp - 0x80]
movabs rax, 0x3ffffffffffffff
cmp qword [rsi + 8], rax
je 0x18000d103
mov qword [rbp + 0x6c0], rsi
mov qword [rbp + 0x6c8], 0
mov ecx, 0x40
call fcn.1800d08a8
mov rbx, rax
mov qword [rbp + 0x6c8], rax
lea rcx, [rax + 0x20]
mov rdx, rdi
call fcn.180003d80
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov word [rbx + 0x18], 0
mov qword [rbp + 0x6c8], 0
movups xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp - 0x30], xmm0
mov r8, rbx
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.18001ca60
add rdi, 0x28
cmp rdi, r15
mov r10, qword [rbp - 0x80]
jne 0x18000c5a3
mov rdx, qword [rsp + 0x70]
mov esi, dword [rsp + 0x68]
mov r14d, dword [rsp + 0x78]
mov r9, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
mov rbx, qword [rbp - 0x60]
mov r11d, 0x20
mov r15d, 0x62
mov rdi, qword [rbp - 0x50]
mov eax, dword [rsp + 0x60]
lea rcx, [0x180000000]
dec r14d
mov dword [rsp + 0x78], r14d
dec esi
mov dword [rsp + 0x68], esi
cmp r14d, eax
ja 0x18000c530
mov r11d, dword [rbp - 0x78]
mov r8, qword [rbp - 0x50]
lea eax, [r11 + 0x12]
mov dword [rsp + 0x70], eax
cmp r11d, eax
jae case.0x18000c757.263
lea r9, [0x180091060]
mov ebx, dword [rsp + 0x70]
mov rsi, qword [rbp + 0x6c0]
movzx r13d, byte [rbp - 0x58]
mov r12, qword [rbp + 0x6c0]
mov r15d, dword [rsp + 0x70]
mov edi, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x78]
mov eax, dword [rbp - 0x78]
mov edx, 0x6461
add eax, 0xffffff00
cmp eax, 0x1b
ja case.0x18000c757.264
lea r11, [0x180000000]
mov ecx, dword [r11 + rax*4 + 0xd194]
add rcx, r11
jmp rcx
mov dword [rbp + 0x6e6], 0x757165
jmp case.0x18000c552.8
mov dword [rbp + 0x6ee], 0x346365
mov r8d, 1
lea rdx, [0x1800e09a0]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18000c577
mov dword [rbp + 0xc], 0
mov rax, qword [rbx]
mov rcx, qword [rax + 0x20]
mov qword [rbp + 0x18], rcx
jmp case.0x18000c552.8
mov eax, dword [r10]
mov qword [rbp - 0x30], rax
mov rax, qword [rbx]
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x20], 0xf7
lea r9, [rbp - 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
call fcn.180051df0
jmp 0x18000c577
mov word [rbp + 0x6e0], r15w
mov eax, dword [str.vec4]
mov dword [rbp + 0x6e1], eax
movzx eax, byte [0x1800e09a8]
mov byte [rbp + 0x6e5], al
jmp case.0x18000c552.8
mov eax, dword [r9]
mov dword [rbp + 8], eax
jmp case.0x18000c552.8
test rdx, rdx
je 0x18000c829
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x18000c812
mov dword [rbp], eax
mov eax, dword [r8]
mov dword [rbp + 4], eax
jmp case.0x18000c552.8
mov dword [rbp], 0
mov eax, dword [r8]
mov dword [rbp + 4], eax
jmp case.0x18000c552.8
mov eax, dword [str.vec4__]
mov dword [rbp + 0x6f4], eax
movzx eax, word [0x1800e09b0]
mov word [rbp + 0x6f8], ax
movzx eax, byte [0x1800e09b2]
mov byte [rbp + 0x6fa], al
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18000c86f
mov rcx, qword [rbx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rbp - 0x50], rax
jmp 0x18000c577
mov rcx, qword [rbx]
cmp dword [rcx], 0x7f2bb701
je 0x18000c8fe
mov eax, 9
cmp eax, 9
je 0x18000c8ee
cmp eax, 0x12
jne 0x18000c8f6
mov eax, dword [rsp + 0x64]
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.1800d1090
mov rbx, qword [rsp + 0x860]
add rsp, 0x810
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x64], 0x7f2bb701
add eax, 9
cmp eax, 0x1b
jb 0x18000c8b6
test byte [rcx + 0x10], 1
jne case.0x18000c552.8
mov ecx, 0xbd
nop dword [rax]
mov eax, ecx
sub eax, 0xbd
je 0x18000c920
cmp eax, 0x56
je case.0x18000c757.263
jmp 0x18000c928
mov dword [rsp + 0x64], 0x7f2bb715
add ecx, 0x56
cmp ecx, 0x169
jb 0x18000c910
jmp case.0x18000c552.8
cmp rdi, 0xffffffffffffffff
jne case.0x18000c552.8
mov ebx, 6
cmp ebx, 6
ja case.default.0x18000c95f
mov eax, ebx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0xd204]
add rcx, rdx
jmp rcx
mov r12d, 1
jmp case.default.0x18000c95f
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rbp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
jmp case.default.0x18000c95f
mov qword [rbp - 0x40], 0
jmp case.default.0x18000c95f
xor r13d, r13d
jmp case.default.0x18000c95f
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
jmp case.default.0x18000c95f
lea r8, [rbp - 0x40]
mov edx, r12d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
dec ebx
lea eax, [rbx + 0x3b]
cmp eax, 0x3a
ja 0x18000c947
mov rbx, qword [rbp - 0x60]
jmp 0x18000c577
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
jmp case.0x18000c552.8
lea rcx, [rbp + 0x6e0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18000c9d6
movzx eax, word [0x1800e09b4]
mov word [rcx], ax
movzx eax, byte [0x1800e09b6]
mov byte [rcx + 2], al
mov dword [rbp + 0x6eb], 0x766428
jmp case.0x18000c552.8
mov word [rbp + 0x6e5], r11w
jmp case.0x18000c552.8
mov dword [rbp - 0x48], 0
jmp case.0x18000c552.8
mov byte [rsp + 0x64], 0
jmp case.0x18000c757.263
mov r8, qword [rbp - 0x60]
mov qword [rbp - 0x50], r8
jmp 0x18000c6f2
test ebx, ebx
je case.0x18000c757.264
mov eax, ebx
jmp 0x18000c8c4
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
jmp case.0x18000c757.264
mov dword [rbp - 0x38], 1
jmp case.0x18000c757.264
mov dword [rsp + 0x64], 0
jmp case.0x18000c757.264
cmp dword [rbp + 0xc], 0
jne 0x18000cab8
mov eax, 0xa7
nop dword [rax]
cmp eax, 0xa7
je 0x18000caa4
cmp eax, 0x13e
je case.0x18000c757.263
jmp 0x18000caac
mov dword [rsp + 0x64], 0x7f2bb726
add eax, 0x97
cmp eax, 0x1d5
jb 0x18000ca90
mov eax, dword [r10]
mov dword [rsp + 0x68], eax
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x78]
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x68]
mov ecx, 0xdc
call fcn.180055f90
mov ebx, eax
test eax, eax
je 0x18000cb15
mov eax, 0xbd
cmp eax, 0xbd
je 0x18000cb05
cmp eax, 0x2dc6
je case.0x18000c757.263
jmp 0x18000cb09
mov dword [rsp + 0x64], ebx
add eax, 0x2d09
cmp eax, 0x5a12
jbe 0x18000caf1
lea r9, [0x180091060]
jmp case.0x18000c757.264
cmp dword [rbp + 0x14], 0
je case.0x18000c757.264
mov ecx, 0xf2
cmp ecx, 0xf2
je 0x18000cb46
cmp ecx, 0x28a6
je case.0x18000c757.263
jmp 0x18000cb4d
mov eax, dword [rbp + 0x14]
mov dword [rsp + 0x64], eax
add ecx, 0x27b4
cmp ecx, 0x4f68
jbe 0x18000cb30
jmp case.0x18000c757.264
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
mov ecx, dword [rax + 0x28]
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x14], 0
jmp case.0x18000c757.264
mov edx, edi
xor r8d, r8d
mov rcx, r10
call fcn.1800a6ba0
mov dword [rbp - 0x40], 4
lea r9, [0x180091060]
jmp case.0x18000c757.264
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [0x180091060]
jmp case.0x18000c757.264
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], rcx
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, dword [rbp - 0x40]
mov edx, dword [rbp - 0x30]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.ADVAPI32.dll_TreeResetNamedSecurityInfoA]
mov edx, dword [rbp - 0x38]
lea rcx, [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_CredWriteA]
lea r9, [0x180091060]
jmp case.0x18000c757.264
mov dword [rsp + 0x68], 1
mov eax, dword [r10]
mov dword [rsp + 0x78], eax
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
mov qword [rbp + 0x6c0], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x78]
lea r8, [rbp + 0x6c0]
mov edx, 0x2d
xor ecx, ecx
call fcn.18009d100
mov rbx, rax
lea r9, [0x180091060]
jmp case.0x18000c757.264
mov dword [rbp - 0x30], 1
xor edx, edx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x60], eax
lea r9, [0x180091060]
jmp 0x18000d0e2
mov byte [rsp + 0x64], 1
jmp case.0x18000c757.264
mov rdx, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18000cc9a
mov rdx, qword [r10]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov r8d, edi
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp - 0x70], 0
lea r9, [0x180091060]
jmp case.0x18000c757.264
mov dword [rsp + 0x78], 4
mov eax, dword [rsp + 0x60]
cmp eax, dword [rbp - 0x48]
je 0x18000d0dd
xor edi, edi
mov dword [rsp + 0x68], edi
cmp edi, 0x16
ja case.default.0x18000ccf6
mov ecx, dword [r11 + rdi*4 + 0xd220]
add rcx, r11
jmp rcx
mov r8d, 2
lea rdx, [0x1800e09c3]
lea rcx, [rbp + 0x6cc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18000d010
mov byte [rbp + 0x6c9], 0
jmp case.default.0x18000ccf6
mov r8d, dword [rbp - 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
mov dword [rbp + 0x130], 0x38
jmp 0x18000d010
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rax
mov dword [rbp + 0x128], eax
jmp case.default.0x18000ccf6
mov byte [rbp + 0x6c2], 0
mov r8d, 4
lea rdx, [0x1800e09ea]
lea rcx, [rbp + 0x6c2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18000d010
mov byte [rbp + 0x6d5], 0x74
jmp case.default.0x18000ccf6
xor esi, esi
jmp case.default.0x18000ccf6
mov r8d, 2
lea rdx, [0x1800e0a0b]
lea rcx, [rbp + 0x6ce]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x6d0], 0
jmp 0x18000d010
mov byte [rbp + 0x6ce], 0
jmp case.default.0x18000ccf6
xor ecx, ecx
movzx eax, r13b
test rsi, rsi
cmovne ecx, eax
movzx r13d, cl
jmp case.default.0x18000ccf6
movzx eax, word [0x1800e0a42]
mov word [rbp + 0x6c6], ax
movzx eax, byte [0x1800e0a44]
mov byte [rbp + 0x6c8], al
jmp case.default.0x18000ccf6
mov word [rbp + 0x6c0], dx
jmp case.default.0x18000ccf6
mov byte [rbp + 0x6d8], 0
mov r13b, 1
jmp case.default.0x18000ccf6
mov eax, dword [0x1800e0a98]
mov dword [rbp + 0x6d0], eax
movzx eax, byte [0x1800e0a9c]
mov byte [rbp + 0x6d4], al
mov byte [rbp + 0x6d5], 0
jmp case.default.0x18000ccf6
mov byte [rbp + 0x6d7], 0x67
jmp case.default.0x18000ccf6
mov dword [rbp - 0x68], 1
jmp case.default.0x18000ccf6
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov byte [rsp + 0x64], 0
jmp 0x18000d010
mov qword [r10 + 0x10], 0
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18000ce85
mov rax, qword [r10]
mov byte [rax], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rax
jmp case.default.0x18000ccf6
test r13b, r13b
je case.default.0x18000ccf6
mov r14d, 7
nop dword [rax]
mov eax, r14d
sub eax, 7
je 0x18000cfb8
cmp eax, 1
jne 0x18000cfd1
test r12, r12
jne 0x18000cf74
mov edi, 0x12c
mov eax, edi
sub eax, 0x129
je 0x18000cf63
sub eax, 1
je 0x18000cf4d
sub eax, 1
je 0x18000cf1f
cmp eax, 1
jne 0x18000cf66
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000cf66
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
mov r15d, 1
jmp 0x18000cf66
mov r8d, r15d
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CredWriteDomainCredentialsW]
jmp 0x18000cf66
xor r13b, r13b
dec edi
cmp edi, 0x128
ja 0x18000cee3
test r13b, r13b
je 0x18000cfd1
mov edi, 0x116
nop
mov eax, edi
sub eax, 0x115
je 0x18000cfa3
cmp eax, 1
jne 0x18000cfac
lea rdx, [rbp + 0x110]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, r12
jmp 0x18000cfa6
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
dec edi
cmp edi, 0x114
ja 0x18000cf80
jmp 0x18000cfd1
mov r8d, 0xf01ff
lea rdx, [rbp + 0x6c0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r12, rax
inc r14d
cmp r14d, 9
jb 0x18000cec0
mov edi, dword [rsp + 0x68]
jmp 0x18000d010
mov byte [rbp + 0x6d7], 0
jmp case.default.0x18000ccf6
mov byte [rbp + 0x6d6], 0x61
jmp case.default.0x18000ccf6
mov r8d, 3
lea rdx, [0x1800e0aab]
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov edx, 0x6461
lea r11, [0x180000000]
inc edi
mov dword [rsp + 0x68], edi
lea eax, [rdi + 0xfc]
cmp eax, 0x113
mov r10, qword [rbp - 0x80]
jb 0x18000cce2
mov edi, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x78]
lea r9, [0x180091060]
jmp case.0x18000c757.264
test dword [rbp + 0x190], 0x1000
je case.0x18000c757.264
and dword [rbp + 0x190], 0xffffefff
mov eax, dword [r10]
mov dword [rsp + 0x68], eax
mov rax, qword [rbp - 0x60]
mov rax, qword [rax]
mov qword [rbp + 0x6c0], rax
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x6c0]
mov edx, 0x111
lea rcx, [rsp + 0x68]
call fcn.180084c90
mov ebx, eax
test eax, eax
je 0x18000cb15
mov eax, 0x88
nop
cmp eax, 0x88
je 0x18000d0c4
cmp eax, 0x10e
je case.0x18000c757.263
jmp 0x18000d0c8
mov dword [rsp + 0x64], ebx
add eax, 0x86
cmp eax, 0x194
jb 0x18000d0b0
lea r9, [0x180091060]
jmp case.0x18000c757.264
mov r14d, dword [rsp + 0x78]
mov edi, eax
mov eax, dword [rbp - 0x78]
inc eax
mov dword [rbp - 0x78], eax
cmp eax, dword [rsp + 0x70]
jae case.0x18000c757.263
mov r10, qword [rbp - 0x80]
mov r8, qword [rbp - 0x50]
jmp 0x18000c732
call fcn.18001cd90
int3