Function at 0x18002fda0
Capabilities:
Enumerate services
Query or enumerate registry key
Query or enumerate registry value
Query service status
Start service

Disassembly:
mov rax, rsp
sub rsp, 0x228
movsd xmm0, qword [0x1800b3848]
ucomisd xmm0, qword [0x18009a5d0]
jp 0x180030144
jne 0x180030144
cvttsd2si rdx, qword [0x1800b3910]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 8], rdi
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movsd xmm7, qword [0x180098fe0]
lea rdx, [0x180098740]
lea rcx, [rsp + 0x30]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call fcn.18000a440
mov rcx, rax
movsd xmm1, qword [0x180099100]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x50]
divsd xmm7, xmm0
call fcn.18002f2f0
lea rcx, [rsp + 0x70]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3910]
call fcn.18002f2f0
movsd xmm3, qword [0x1800b3910]
mov r8, rax
movsd xmm1, qword [0x1800990f0]
mov ecx, 0x123fbb01
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x90]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18002f2d0
mov r8, rax
cvttsd2si rcx, qword [0x1800b3870]
movsd xmm1, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cvttsd2si rsi, qword [0x1800b3848]
lea rcx, [rsp + 0xb0]
cvttsd2si ebp, qword [0x1800b3910]
mov rdx, rsi
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, xmm7
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0xd0]
mov rdi, rax
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0xf0]
mov rbx, rax
call fcn.18002f2d0
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r9d, ebp
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea rdx, str.bynu
lea rcx, [rsp + 0x110]
movd xmm8, eax
cvtdq2pd xmm8, xmm8
mulsd xmm8, xmm6
addsd xmm8, qword [0x1800988f0]
call fcn.1800090b0
mov rcx, rax
mov edx, 0x294ee391
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movsd xmm6, qword [0x18009a080]
mov edx, 0x36f994b7
mov r9d, 0x9464d9a
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
mov r8d, 0x2717147a
mov ecx, 0x2f2fc1ba
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
xorps xmm0, xmm0
lea rdx, str.edogukyxiuutf
lea rcx, [rsp + 0x130]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.1800090b0
mov rdx, rax
mov ecx, 0x9ee43de
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cvttsd2si rdx, qword [0x1800b37e8]
mov ecx, 0xcfba478
divsd xmm6, xmm0
subsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x150]
movsd xmm7, qword [0x18009a1f0]
cvttsd2si ebx, qword [0x1800b3878]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call fcn.18002f2d0
mov rcx, rax
mov r8d, ebx
movsd xmm0, qword [0x1800b3910]
movsd xmm3, qword [0x1800b37e8]
movsd xmm1, qword [0x1800b3870]
movsd qword [rsp + 0x20], xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rsi, qword [0x1800b3848]
lea rdx, str.oxezeuniryaxh
lea rcx, [rsp + 0x170]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call fcn.18000a440
lea rdx, str.uavqaxaso
mov rdi, rax
lea rcx, [rsp + 0x190]
call fcn.1800090b0
lea rcx, [rsp + 0x1b0]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3848]
call fcn.18002f2d0
cvttsd2si rcx, qword [0x1800b37e8]
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xorps xmm6, xmm6
lea rdx, str.keuyano
lea rcx, [rsp + 0x1d0]
cvtsi2sd xmm6, rax
mulsd xmm6, xmm7
call fcn.1800090b0
mov rcx, rax
mov edx, 0x2bfa0efb
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movaps xmm7, xmmword [rsp + 0x200]
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x220]
mov rsi, qword [rsp + 0x240]
mov rbp, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x230]
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x210]
subsd xmm8, xmm0
movsd qword [0x1800b3848], xmm8
movaps xmm8, xmmword [rsp + 0x1f0]
add rsp, 0x228
ret