Function at 0x18000e200
Capabilities:
Enumerate services
Query or enumerate registry value
Start service

Disassembly:
jmp 0x18000e200
mov rax, rsp
sub rsp, 0x148
movsd xmm0, qword [0x1800b3870]
ucomisd xmm0, qword [0x18009a628]
jp 0x18000e707
jne 0x18000e707
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax - 8], rdi
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm11
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x30]
movsd xmm11, qword [0x180099b50]
movd xmm0, eax
movaps xmm6, xmm11
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2d0
mov r8, rax
movsd xmm1, qword [0x180098b28]
movsd xmm0, qword [0x180098e08]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xorps xmm0, xmm0
lea rdx, str.etiewaulizmyyua
lea rcx, [rsp + 0x50]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rsp + 0x70]
mov rdi, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
lea rdx, str.yfuoja
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.18000a440
movsd xmm0, qword [0x1800b3910]
mov rdx, rax
cvttsd2si ecx, qword [0x1800b37e8]
mov r9, rdi
mov r8, rbx
movsd qword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
xorps xmm7, xmm7
lea rdx, str.livoho
lea rcx, [rsp + 0xb0]
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0xd0]
mov rsi, rax
call fcn.18002f2f0
cvttsd2si edi, qword [0x1800b3878]
lea rdx, str.uybcoheuiwinuue
mov rbx, rax
lea rcx, [rsp + 0xf0]
call fcn.18000a440
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cvttsd2si rcx, qword [0x1800b3878]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si ecx, qword [0x1800b3910]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x180098d70]
mulsd xmm0, xmm6
addsd xmm0, qword [0x180099bb0]
addsd xmm0, xmm7
movsd qword [0x1800b3848], xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0xf0]
movd xmm0, eax
movaps xmm6, xmm11
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2d0
mov r8, rax
movsd xmm1, qword [0x180098b28]
movsd xmm0, qword [0x180098e08]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xorps xmm0, xmm0
lea rdx, str.etiewaulizmyyua
lea rcx, [rsp + 0xd0]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rsp + 0xb0]
mov rdi, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
lea rdx, str.yfuoja
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.18000a440
movsd xmm0, qword [0x1800b3910]
mov rdx, rax
cvttsd2si ecx, qword [0x1800b37e8]
mov r9, rdi
mov r8, rbx
movsd qword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
xorps xmm7, xmm7
lea rdx, str.livoho
lea rcx, [rsp + 0x70]
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x50]
mov rsi, rax
call fcn.18002f2f0
cvttsd2si edi, qword [0x1800b3878]
lea rdx, str.uybcoheuiwinuue
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.18000a440
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cvttsd2si rcx, qword [0x1800b3878]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si ecx, qword [0x1800b3910]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
mulsd xmm2, qword [0x180098d70]
mulsd xmm2, xmm6
addsd xmm2, qword [0x180098810]
addsd xmm2, xmm7
movsd qword [0x1800b37e8], xmm2
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0xf0]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
divsd xmm11, xmm2
call fcn.18002f2d0
mov r8, rax
movsd xmm1, qword [0x180098b28]
movsd xmm0, qword [0x180098e08]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xorps xmm0, xmm0
lea rdx, str.etiewaulizmyyua
lea rcx, [rsp + 0xd0]
cvtsi2sd xmm0, rax
divsd xmm11, xmm0
call fcn.18000a440
lea rcx, [rsp + 0xb0]
mov rdi, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
lea rdx, str.yfuoja
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.18000a440
movsd xmm0, qword [0x1800b3910]
mov rdx, rax
cvttsd2si ecx, qword [0x1800b37e8]
mov r9, rdi
mov r8, rbx
movsd qword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
xorps xmm7, xmm7
lea rdx, str.livoho
lea rcx, [rsp + 0x70]
cvtsi2sd xmm7, rax
mulsd xmm7, xmm11
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x50]
mov rsi, rax
call fcn.18002f2f0
cvttsd2si edi, qword [0x1800b3878]
lea rdx, str.uybcoheuiwinuue
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.18000a440
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cvttsd2si rcx, qword [0x1800b3878]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si ecx, qword [0x1800b3910]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movaps xmm11, xmmword [rsp + 0x110]
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x140]
mov rsi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x150]
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x180098d70]
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x130]
addsd xmm0, qword [0x180099338]
addsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x120]
movsd qword [0x1800b3848], xmm0
add rsp, 0x148
ret