Function at 0x18008c360
Capabilities:
Create service
Delete service
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1800f6ae8]
xor rax, rsp
mov qword [rbp + 0x228], rax
imul eax, edx, 0x747
mov r12, r9
mov rsi, r8
mov qword [rsp + 0x78], rcx
mov r13d, edx
mov ebx, edx
mov dword [rbp - 0x80], eax
cmp edx, eax
ja 0x18008c848
mov rdi, qword [rbp - 0x78]
mov edx, 0x6c
mov r15, qword [rbp - 0x78]
movabs r9, 0x6600640064
mov r14, qword [rbp - 0x78]
lea r10d, [rdx + 4]
lea r11d, [rdx + 7]
lea r8d, [rdx + 8]
movabs rax, 0x65006d0061
cmp ebx, 0x8733
ja 0x18008c65b
je 0x18008c63d
cmp ebx, 0x2c86
ja 0x18008c55c
je 0x18008c543
cmp ebx, 0x117
ja 0x18008c508
je 0x18008c4c8
mov eax, ebx
sub eax, 0x52
je 0x18008c494
sub eax, 0x4f
je 0x18008c467
cmp eax, 0x58
jne 0x18008c839
mov rdx, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r9d, [rax - 2]
mov rcx, qword [rsi + 0x10]
xor r8d, r8d
call fcn.1800910a0
mov rdx, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, 0x56
mov rcx, qword [rsi + 0x18]
xor r8d, r8d
call fcn.1800910a0
jmp 0x18008c4e3
movabs rax, 0x6e00550024
lea rdx, [0x1800e0fec]
mov r8d, 2
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0x1ce]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18008c4e3
mov rdi, qword [rsi]
mov r14, rsi
test rdi, rdi
je 0x18008c4b8
nop
mov rax, qword [rdi + 8]
cmp qword [rax], r12
je 0x18008c8a8
mov r14, rdi
mov rdi, qword [rdi]
test rdi, rdi
jne 0x18008c4a0
mov ecx, 0x30
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
jmp 0x18008c4e3
mov rax, qword [rsi]
lea rcx, [rbp - 0x68]
mov r9d, 0x10f
mov qword [rbp - 0x68], rax
xor r8d, r8d
xor edx, edx
call fcn.180045b60
mov rcx, qword [rsp + 0x78]
mov edx, 0x6c
movabs r9, 0x6600640064
lea r8d, [rdx + 8]
lea r10d, [rdx + 4]
lea r11d, [rdx + 7]
jmp 0x18008c839
cmp ebx, 0x166c
je 0x18008c532
cmp ebx, 0x2c06
jne 0x18008c839
mov qword [rbp + 0x1d0], rax
mov dword [rbp + 0x1d6], 0x64
jmp 0x18008c839
test r15, r15
je 0x18008c8a8
mov rdi, r15
jmp 0x18008c839
lea rcx, [r15 + 0x10]
mov qword [rdi + 8], rcx
mov qword [rcx], r12
mov qword [rbp - 0x78], rcx
mov rcx, qword [rsp + 0x78]
jmp 0x18008c839
cmp ebx, 0x58ba
ja 0x18008c602
je 0x18008c5f6
cmp ebx, 0x42a0
je 0x18008c5d7
cmp ebx, 0x4416
je 0x18008c5a0
cmp ebx, 0x576b
jne 0x18008c839
mov dword [rbp + 0x1d8], 0x43
mov word [rbp + 0x1da], dx
jmp 0x18008c839
mov rdx, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, 0x56
mov rcx, qword [rsi + 0x28]
xor r8d, r8d
call fcn.1800910a0
mov rdx, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, 0x56
mov rcx, qword [rsi + 0x20]
xor r8d, r8d
call fcn.1800910a0
jmp 0x18008c4e3
mov eax, dword [rcx]
mov rcx, qword [rbp - 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbp + 0x280]
mov eax, dword [rax]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x78]
jmp 0x18008c839
mov qword [rdi], 0
jmp 0x18008c839
cmp ebx, 0x6ed4
je 0x18008c635
cmp ebx, 0x82d0
jne 0x18008c839
mov eax, dword [0x1800e0ff4]
mov dword [rbp + 0x1dc], eax
movzx eax, word [0x1800e0ff8]
mov word [rbp + 0x1e0], ax
jmp 0x18008c839
mov qword [r14], rdi
jmp 0x18008c839
mov rdx, qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, 0x56
mov rcx, qword [rsi + 0x30]
xor r8d, r8d
call fcn.1800910a0
jmp 0x18008c4e3
cmp ebx, 0x1508a
ja 0x18008c7ab
je 0x18008c796
cmp ebx, 0x104ff
ja 0x18008c737
je 0x18008c70f
cmp ebx, 0xae35
je 0x18008c6df
cmp ebx, 0xca50
je 0x18008c6ba
cmp ebx, 0xd99a
jne 0x18008c839
mov r8d, 2
lea rdx, [0x1800e0ffc]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18008c4e3
mov r8, qword [rsi + 0x10]
xor edx, edx
mov ecx, 0x90
call fcn.180083250
mov r8, qword [rsi + 0x18]
xor edx, edx
mov ecx, 0x90
call fcn.180083250
jmp 0x18008c4e3
movabs rax, 0x3000240073
lea rdx, [0x1800e0ff0]
mov r8d, 2
mov qword [rbp + 0x1e0], rax
lea rcx, [rbp + 0x1e6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18008c4e3
movsd xmm0, qword [str.e18f_]
mov eax, dword [0x1800e0fe8]
mov qword [rbp + 0x1ea], r9
movsd qword [rbp + 0x1f0], xmm0
mov dword [rbp + 0x1f8], eax
jmp 0x18008c839
cmp ebx, 0x10d6d
je 0x18008c771
cmp ebx, 0x13064
jne 0x18008c839
mov r8d, 0xa
lea rdx, [rbp + 0x1fa]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov dword [rbp + 0x1fe], 0x30
jmp 0x18008c4e3
mov r8, qword [rsi + 0x28]
xor edx, edx
mov ecx, 0x90
call fcn.180083250
mov r8, qword [rsi + 0x20]
xor edx, edx
mov ecx, 0x90
call fcn.180083250
jmp 0x18008c4e3
mov r8, qword [rsi + 0x30]
xor edx, edx
mov ecx, 0x90
call fcn.180083250
jmp 0x18008c4e3
cmp ebx, 0x1b293
ja 0x18008c80b
je 0x18008c7ff
cmp ebx, 0x15bc9
je 0x18008c7f3
cmp ebx, 0x1872e
je 0x18008c7db
cmp ebx, 0x193a7
jne 0x18008c839
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18008c4e3
mov eax, 0x5f
mov dword [rbp + 0x1a0], 0x320053
mov word [rbp + 0x1a4], ax
jmp 0x18008c839
mov dword [rbp + 0x200], 0x24
jmp 0x18008c839
mov dword [rbp + 0x1a6], 0x730070
jmp 0x18008c839
cmp ebx, 0x1ddf8
je 0x18008c831
cmp ebx, 0x2095d
jne 0x18008c839
mov dword [rbp + 0x1ac], 0x72006f
mov dword [rbp + 0x1b0], 0x720065
jmp 0x18008c839
mov word [rbp + 0x1aa], r8w
imul eax, r13d, 0x45
add ebx, eax
cmp ebx, dword [rbp - 0x80]
jbe 0x18008c3e0
mov ebx, dword [rbp - 0x80]
lea r12d, [r13 - 0x1b]
cmp r13d, r12d
jbe case.0x18008c8a6.0
mov rsi, qword [rbp - 0x78]
lea r14d, [r13 - 0x87]
movzx r13d, byte [rsp + 0x70]
mov r15d, dword [rbp - 0x70]
movzx edi, byte [rsp + 0x70]
lea rdx, [0x180000000]
mov r11d, 0x6f
movabs r9, 0x6c006c0064
lea r8d, [r11 - 9]
lea r10d, [r11 - 2]
cmp r14d, 0x1a
ja case.0x18008c8a6.9
mov ecx, dword [rdx + r14*4 + 0x8cba0]
add rcx, rdx
jmp rcx
mov eax, dword [rbp - 0x80]
jmp 0x18008c965
mov qword [rbp + 0x21a], r9
jmp case.0x18008c8a6.9
mov r8d, 3
lea rdx, [0x1800e1000]
lea rcx, [rbp + 0x208]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18008c8a6.9
mov word [rbp + 0x198], r10w
jmp case.0x18008c8a6.9
mov dword [rbp + 0x1c0], 0x6f0069
jmp case.0x18008c8a6.9
cmp byte [rsp + 0x70], 0
je 0x18008c94b
mov edi, 0x2f
nop word [rax + rax]
mov eax, edi
sub eax, 0x2e
je 0x18008c93b
cmp eax, 1
jne 0x18008c944
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x6c]
mov edx, r15d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
jmp 0x18008c944
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
dec edi
cmp edi, 0x2d
ja 0x18008c900
movzx edi, byte [rsp + 0x70]
dec r14d
lea ecx, [r14 + 0x87]
cmp ecx, r12d
ja 0x18008c872
mov eax, ebx
mov rcx, qword [rbp + 0x228]
xor rcx, rsp
call fcn.1800d1090
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 0x49
mov word [rbp + 0x199], ax
mov eax, 0x6e
mov word [rbp + 0x19a], ax
jmp case.0x18008c8a6.9
mov word [rbp + 0x19b], r8w
jmp case.0x18008c8a6.9
mov dword [rbp + 0x1b4], 0x6e0062
mov dword [rbp + 0x1b8], 0x770065
jmp case.0x18008c8a6.9
xor eax, eax
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x6c], eax
call qword [sym.imp.ADVAPI32.dll_OpenTraceW]
mov qword [rsp + 0x78], rax
jmp case.0x18008c8a6.9
mov dil, 1
mov byte [rsp + 0x70], dil
movzx r13d, dil
jmp case.0x18008c8a6.9
xor eax, eax
mov word [rbp + 0x1c4], ax
jmp case.0x18008c8a6.9
mov rax, qword [rsp + 0x78]
movabs rcx, 0xfffffffeffffffff
inc rax
movzx r13d, r13b
test rcx, rax
mov edx, 0
movzx eax, dil
mov ecx, edx
cmove r13d, edx
test rsi, rsi
cmovne ecx, eax
movzx edi, cl
mov byte [rsp + 0x70], cl
jmp case.0x18008c8a6.9
mov r8d, 5
lea rdx, str.rnel
lea rcx, [rbp + 0x20c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 0xa
lea rdx, [rbp + 0x214]
lea ecx, [r8 + 0x16]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
jmp case.0x18008c8a6.9
mov dword [rbp + 0x194], 0x65747379
jmp case.0x18008c8a6.9
lea rcx, [rbp - 0x60]
call qword [rbp - 0x68]
jmp case.0x18008c8a6.9
mov dword [rbp + 0x1bc], 0x5f0066
jmp case.0x18008c8a6.9
mov word [rbp + 0x19c], r11w
jmp case.0x18008c8a6.9
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x1c0
call sub.VCRUNTIME140.dll_memset
mov r15d, 3
jmp case.0x18008c8a6.9
mov dword [rbp + 0x218], 0x2e
jmp case.0x18008c8a6.9
mov eax, 0x53
mov word [rbp + 0x193], ax
jmp case.0x18008c8a6.9
test r13b, r13b
je 0x18008cafa
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseTrace]
mov ebx, dword [rbp - 0x40]
jmp case.0x18008c8a6.9
mov dword [rbp + 0x190], 0x746547
jmp case.0x18008c8a6.9
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x1a0]
xor eax, eax
lea rdx, [rbp + 0x1c8]
mov qword [rsp + 0x60], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov dword [rbp - 0x70], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
jmp case.0x18008c8a6.9
xor eax, eax
mov qword [rbp - 0x78], rax
mov esi, eax
jmp case.0x18008c8a6.9
lea r8, [rbp + 0x208]
mov ecx, 0x7f
lea rdx, [rbp + 0x190]
call fcn.1800c3a10
mov qword [rbp - 0x68], rax
jmp case.0x18008c8a6.9