Function at 0x180156080
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp - 8], rax
movzx r14d, r8b
movzx edi, dl
mov rsi, rcx
xor ebx, ebx
xor r15b, r15b
xor edx, edx
xor ecx, ecx
mov r8d, 0x80000001
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r13, rax
test rax, rax
je 0x180156344
mov rcx, rsi
call fcn.1801571c0
mov rdx, qword [0x18029b2d8]
test al, al
cmovne rdx, qword [0x18029b2e0]
mov r8d, 0x80000000
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x18015632e
mov dword [rbp - 0x38], ebx
lea r9, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x180156325
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180156325
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x180156325
mov ecx, eax
call fcn.1801139d0
mov rbx, rax
test rax, rax
je 0x180156325
lea r9, [rbp - 0x38]
mov r8d, dword [rbp - 0x38]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x180156325
mov ecx, dword [rbx + 4]
cmp ecx, 2
jne 0x180156184
test dil, dil
jne 0x180156196
jmp 0x180156325
cmp ecx, 3
jne 0x180156325
test r14b, r14b
je 0x180156325
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1800f2e20
nop
lea rcx, [rbp - 0x28]
mov r15, qword [rbp - 0x28]
mov r12, qword [rbp - 0x10]
cmp r12, 0x10
cmovae rcx, r15
mov r14, qword [rbp - 0x18]
add rcx, r14
mov qword [rbp - 0x40], rcx
lea rdi, [rbp - 0x28]
cmp r12, 0x10
cmovae rdi, r15
add rdi, r14
lea rcx, [rbp - 0x28]
cmp r12, 0x10
cmovae rcx, r15
mov r8, rdi
sub r8, rcx
mov edx, 0x22
call fcn.18020c090
mov rcx, rdi
test rax, rax
cmovne rcx, rax
mov r8, rcx
cmp rcx, rdi
je 0x180156229
inc rcx
cmp rcx, rdi
je 0x180156229
movzx eax, byte [rcx]
cmp al, 0x22
je 0x180156215
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rdi
jne 0x180156208
mov r12, qword [rbp - 0x10]
mov r14, qword [rbp - 0x18]
mov r15, qword [rbp - 0x28]
lea rax, [rbp - 0x28]
cmp r12, 0x10
cmovae rax, r15
mov rdx, r8
sub rdx, rax
mov r9, qword [rbp - 0x40]
sub r9, r8
mov rax, r14
sub rax, rdx
cmp rax, r9
cmovb r9, rax
lea rcx, [rbp - 0x28]
cmp r12, 0x10
cmovae rcx, r15
add rcx, rdx
sub r14, r9
mov qword [rbp - 0x18], r14
sub r14, rdx
lea r8, [r14 + 1]
lea rdx, [rcx + r9]
call fcn.18020b760
lea rcx, [rbp - 0x30]
call fcn.1800f3960
test al, al
jne 0x1801562ce
lea rax, [0x1800567d8]
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1801562c9
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801562c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180156378
call fcn.1801e60f0
nop
xor r15b, r15b
jmp 0x180156314
mov r15b, 1
lea rax, [0x1800567d8]
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x180156314
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18015630e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180156372
call fcn.1801e60f0
nop
movdqa xmm0, xmmword [0x180056d80]
mov byte [rbp - 0x28], 0
movdqu xmmword [rbp - 0x18], xmm0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x180156344
mov rcx, rbx
call fcn.18010fae0
movzx eax, r15b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1801e67e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18010f960
nop
call fcn.18010f960
int3