Function at 0x180025520
Capabilities:
Enumerate services
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xf8]
sub rsp, 0x1f0
movsd xmm0, qword [0x1800b3878]
ucomisd xmm0, qword [0x18009a460]
jp 0x180025d7e
jne 0x180025d7e
mov qword [rax + 8], rbx
lea rcx, [rsp + 0x20]
mov qword [rax + 0x10], rdi
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
cvttsd2si rdx, xmm0
movaps xmmword [rax - 0x78], xmm12
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x40]
mov rdi, rax
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.18002f2f0
movsd xmm11, qword [0x180098e40]
mov rcx, rax
movaps xmm2, xmm11
mov r9, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x80]
movsd xmm12, qword [0x18009a1f8]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movaps xmm6, xmm12
divsd xmm6, xmm0
call fcn.18002f2d0
mov rcx, rax
mov r8d, 0x222948a
movsd xmm1, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea rdx, str.Hoseitusaok
lea rcx, [rbp - 0x60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rbp - 0x40]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
cvttsd2si rdi, qword [0x1800b3848]
call fcn.18002f2f0
mov rcx, rax
mov r8, rbx
mov rdx, rdi
movsd xmm3, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movsd xmm10, qword [0x180099300]
movaps xmm8, xmm0
movaps xmm0, xmm10
mulsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm8, xmm0
call fcn.18002f2f0
lea rcx, [rbp]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
movsd xmm2, qword [0x1800b3870]
mov rdx, rax
mov r9, rbx
mov ecx, 0x2ed9bc61
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x20]
divsd xmm8, xmm0
addsd xmm8, qword [0x18009a050]
call fcn.18002f2d0
mov rdx, rax
mov ecx, 0x209060ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm9, qword [0x180099400]
movaps xmm6, xmm0
movsd xmm0, qword [0x1800b3910]
mulsd xmm6, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm0, xmm0
lea rdx, str.Ymryiviv
lea rcx, [rbp + 0x40]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18000a440
lea rcx, [rbp + 0x60]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
lea rcx, [rbp + 0x60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
addsd xmm7, xmm8
cvttsd2si rdx, xmm7
movsd qword [0x1800b3878], xmm7
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x40]
mov rdi, rax
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x20]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rdi
movaps xmm2, xmm11
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp]
xorps xmm0, xmm0
movaps xmm6, xmm12
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2d0
mov rcx, rax
mov r8d, 0x222948a
movsd xmm1, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea rdx, str.Hoseitusaok
lea rcx, [rbp - 0x20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rbp - 0x40]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
cvttsd2si rdi, qword [0x1800b3848]
call fcn.18002f2f0
mov rcx, rax
mov r8, rbx
mov rdx, rdi
movsd xmm3, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movaps xmm8, xmm0
movaps xmm0, xmm10
mulsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm8, xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.18002f2d0
movsd xmm2, qword [0x1800b3870]
mov rdx, rax
mov r9, rbx
mov ecx, 0x2ed9bc61
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x60]
divsd xmm8, xmm0
addsd xmm8, qword [0x18009a0c0]
call fcn.18002f2d0
mov rdx, rax
mov ecx, 0x209060ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movaps xmm6, xmm0
movsd xmm0, qword [0x1800b3910]
mulsd xmm6, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm0, xmm0
lea rdx, str.Ymryiviv
lea rcx, [rsp + 0x40]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18000a440
lea rcx, [rsp + 0x20]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
addsd xmm7, xmm8
movsd qword [0x1800b37e8], xmm7
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x40]
mov rdi, rax
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x20]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rdi
movaps xmm2, xmm11
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp]
xorps xmm0, xmm0
movaps xmm6, xmm12
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2d0
mov rcx, rax
mov r8d, 0x222948a
movsd xmm1, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea rdx, str.Hoseitusaok
lea rcx, [rbp - 0x20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
lea rcx, [rbp - 0x40]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
cvttsd2si rdi, qword [0x1800b3848]
call fcn.18002f2f0
movsd xmm3, qword [0x1800b3878]
mov rcx, rax
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movaps xmm8, xmm0
movaps xmm0, xmm10
mulsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm8, xmm0
call fcn.18002f2f0
lea rcx, [rbp - 0x80]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
movsd xmm2, qword [0x1800b3870]
mov rdx, rax
mov r9, rbx
mov ecx, 0x2ed9bc61
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x60]
divsd xmm8, xmm0
addsd xmm8, qword [0x180098aa0]
call fcn.18002f2d0
mov rdx, rax
mov ecx, 0x209060ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movaps xmm6, xmm0
movsd xmm0, qword [0x1800b3910]
mulsd xmm6, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm0, xmm0
lea rdx, str.Ymryiviv
lea rcx, [rsp + 0x40]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18000a440
lea rcx, [rsp + 0x20]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x60]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
addsd xmm7, xmm8
movsd qword [0x1800b3848], xmm7
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x40]
mov rdi, rax
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x20]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rdi
movaps xmm2, xmm11
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm12, xmm0
call fcn.18002f2d0
mov rcx, rax
movsd xmm1, qword [0x1800b3870]
mov r8d, 0x222948a
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea rdx, str.Hoseitusaok
lea rcx, [rbp - 0x20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm12, xmm0
call fcn.18000a440
lea rcx, [rbp - 0x40]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
cvttsd2si rdi, qword [0x1800b3848]
call fcn.18002f2f0
mov rcx, rax
mov r8, rbx
mov rdx, rdi
movsd xmm3, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movaps xmm8, xmm0
movaps xmm0, xmm10
mulsd xmm8, xmm12
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x60]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
divsd xmm8, xmm1
call fcn.18002f2f0
lea rcx, [rbp - 0x80]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
movsd xmm2, qword [0x1800b3870]
mov rdx, rax
mov r9, rbx
mov ecx, 0x2ed9bc61
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x60]
divsd xmm8, xmm0
addsd xmm8, qword [0x18009a290]
call fcn.18002f2d0
mov rdx, rax
mov ecx, 0x209060ee
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movaps xmm6, xmm0
movsd xmm0, qword [0x1800b3910]
mulsd xmm6, xmm9
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm0, xmm0
lea rdx, str.Ymryiviv
lea rcx, [rsp + 0x40]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18000a440
lea rcx, [rsp + 0x20]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movaps xmm12, xmmword [rsp + 0x180]
movaps xmm11, xmmword [rsp + 0x190]
movaps xmm10, xmmword [rsp + 0x1a0]
movaps xmm9, xmmword [rsp + 0x1b0]
movaps xmm6, xmmword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x200]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
addsd xmm7, xmm8
movaps xmm8, xmmword [rsp + 0x1c0]
movsd qword [0x1800b3910], xmm7
movaps xmm7, xmmword [rsp + 0x1d0]
add rsp, 0x1f0
pop rbp
ret