Function at 0x18003185c
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov rax, qword [0x1802107c0]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor r12d, r12d
cmp qword [rcx + 0x18], 0xf
jbe 0x1800318a8
mov rcx, qword [rcx]
mov qword [rsp + 0x20], 1
lea r9, [0x1801beac8]
mov rdx, qword [rdi + 0x10]
call fcn.18002eca0
cmp rax, 0xffffffffffffffff
je 0x180031ae7
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
mov esi, 0x1000
cmp rax, 0xffffffffffffffff
je 0x180031a64
mov dword [rbp - 0x60], 0x130
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
lea rax, [rbp - 0x34]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x180031913
lea rdx, [rbp - 0x34]
lea rcx, [rsp + 0x38]
call fcn.18002d86c
nop
lea r15, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
seta al
mov rbx, qword [rsp + 0x38]
cmova r15, rbx
lea rcx, [rsp + 0x38]
mov r14, qword [rsp + 0x48]
test al, al
je 0x180031955
add r14, rbx
jmp 0x18003195d
add r14, rcx
lea rbx, [rsp + 0x38]
cmp rbx, r14
je 0x180031979
sub r15, rbx
movsx ecx, byte [rbx]
call fcn.18011f5ac
mov byte [r15 + rbx], al
inc rbx
cmp rbx, r14
jne 0x180031965
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x70], xmm1
movups xmm2, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x80], xmm2
mov qword [rsp + 0x48], r12
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r8
mov byte [rsp + 0x38], r12b
lea rdx, [rsp + 0x70]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
mov qword [rsp + 0x68], rax
cmp rax, r8
seta byte [rsp + 0x30]
movq r14, xmm1
cmova rdx, r14
mov r12, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], r8
jbe 0x1800319da
mov rcx, qword [rdi]
mov r8, r12
movq r15, xmm2
cmp r15, r12
cmovb r8, r15
call fcn.180157df0
mov ebx, eax
test eax, eax
jne 0x180031a06
cmp r12, r15
jae 0x1800319fe
or ebx, 0xffffffff
jmp 0x180031a06
xor ebx, ebx
cmp r12, r15
seta bl
xor r12d, r12d
cmp byte [rsp + 0x30], r12b
je 0x180031a41
mov rdx, qword [rsp + 0x68]
inc rdx
mov rax, r14
cmp rdx, rsi
jb 0x180031a39
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031beb
mov rcx, r14
call fcn.180118260
mov rcx, r13
test ebx, ebx
je 0x180031aa3
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1800318f9
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x180031b9a
inc rdx
mov rcx, qword [rdi]
cmp rdx, rsi
jb 0x180031a99
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180031bd9
mov rcx, r8
call fcn.180118260
jmp 0x180031b9a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x58]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x180031b98
inc rdx
mov rcx, qword [rdi]
cmp rdx, rsi
jb 0x180031b93
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180031bdf
jmp 0x180031b90
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180031b04
mov rdx, qword [rdi]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], eax
mov dword [rsp + 0x68], r12d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [rbp - 0x74]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x180031b98
inc rdx
mov rcx, qword [rdi]
mov esi, 0x1000
cmp rdx, rsi
jb 0x180031b93
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180031be5
mov rcx, r8
call fcn.180118260
mov eax, ebx
mov byte [rdi], r12b
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], r12
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180118240
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18012c6c4
int3
call fcn.18012c6c4
int3
call fcn.18012c6c4
nop
call fcn.18012c6c4
nop
int3