Function at 0x140017ed0
Capabilities:
Copy file
Delete file
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x1400a2060]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r12, rcx
xor r15d, r15d
mov esi, r15d
mov dword [rsp + 0x60], r15d
mov edi, r15d
mov dword [rsp + 0x68], r15d
mov r13, qword [rdx]
mov r14, qword [rdx + 8]
mov qword [rbp - 0x60], r14
cmp r13, r14
je 0x140018d4e
movzx ebx, byte [rsp + 0x70]
lea rax, str.h__n_
mov rcx, qword [str.h__n_]
cmp rcx, rax
je 0x140017f71
test byte [rcx + 0x1c], 0x80
je 0x140017f71
cmp byte [rcx + 0x19], 4
jb 0x140017f71
mov r9, r13
cmp qword [r13 + 0x18], 8
jb 0x140017f5c
mov r9, qword [r13]
mov edx, 0x16
lea r8, [0x14008f668]
mov rcx, qword [rcx + 0x10]
call fcn.1400050c0
mov rdx, r13
cmp qword [r13 + 0x18], 8
jb 0x140017f7f
mov rdx, qword [r13]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov r8, qword [r13 + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1400071b0
or esi, 3
mov dword [rsp + 0x60], esi
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x90]
call fcn.140011e90
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140017ff9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017ff4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018da2
call fcn.14004c810
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
cmp dword [rbp + 0x1b0], 0
jne 0x140018cec
cmp dword [rbp + 0x1b4], 0
jne 0x140018cec
lea rdx, [rbp + 0x110]
lea rax, [rbp + 0xf0]
cmp dword [rbp + 0x134], 0
cmovne rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006ab0
nop
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
xor r8d, r8d
lea rdx, [0x14008f638]
lea rcx, [rbp - 0x80]
call fcn.1400071b0
nop
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], 7
xor r8d, r8d
lea rdx, [0x14008f638]
lea rcx, [rbp + 0x48]
call fcn.1400071b0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x138]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x134]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x130]
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x30]
call fcn.140016240
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x140018139
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018134
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018da8
call fcn.14004c810
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r15w
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001818a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018185
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018dae
call fcn.14004c810
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
cmp byte [rbp + 0x40], 0
je 0x140018c2d
mov rsi, qword [rbp + 0x198]
mov rax, qword [rbp + 0x1a0]
mov qword [rsp + 0x78], rax
cmp rsi, rax
je 0x140018436
cmp qword [rsi + 0x10], 0
je 0x140018421
cmp qword [rsi + 0x30], 0
je 0x140018421
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov r8d, 0x22
lea rdx, str.systemcurrentcontrolset_services_
lea rcx, [rbp - 0x30]
call fcn.1400071b0
nop
mov r14, qword [rbp + 0xc0]
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 8
cmovae r9, qword [rbp + 0xb0]
mov r15, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r15
cmp r14, rax
ja 0x140018267
lea rax, [r14 + r15]
mov qword [rbp - 0x20], rax
lea rdi, [rbp - 0x30]
cmp rcx, 8
cmovae rdi, qword [rbp - 0x30]
lea rcx, [rdi + r15*2]
lea r8, [r14 + r14]
mov rdx, r9
call fcn.14004ea60
lea rax, [r15 + r14]
xor r15d, r15d
mov word [rdi + rax*2], r15w
jmp 0x14001827f
mov qword [rsp + 0x20], r14
movzx r8d, bl
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.1400080f0
xor r15d, r15d
mov dword [rbp + 0x68], r15d
mov qword [rbp], r15
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001897b
mov qword [rbp - 8], r15
lea rax, [rbp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdi, str.Instances
mov rdx, rdi
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001883c
mov eax, dword [rbp + 0x188]
add eax, eax
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rcx, qword [rbp + 0x178]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea r14, str.DefaultInstance
mov rdx, r14
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140018769
mov qword [rbp - 0x38], r15
lea rcx, [rbp - 0x38]
call fcn.140018ff0
mov rdi, rax
lea rcx, [rbp + 0x178]
call fcn.140006890
mov r8, rdi
mov rdx, rax
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140018709
mov edi, dword [rsi + 0x30]
add edi, edi
lea rcx, [rsi + 0x20]
call fcn.140006890
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Altitude
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400186ad
mov dword [rbp + 8], r15d
mov dword [rsp + 0x28], 4
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Flags
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400185ea
lea rcx, [rbp - 0x38]
call fcn.140016230
lea rcx, [rbp - 8]
call fcn.140016230
lea rcx, [rbp]
call fcn.140016230
nop
lea rcx, [rbp - 0x30]
call fcn.140006940
mov rax, qword [rsp + 0x78]
add rsi, 0x48
cmp rsi, rax
jne 0x1400181c1
mov edi, dword [rsp + 0x68]
mov r14, qword [rbp - 0x60]
lea rcx, [rbp + 0xf0]
call fcn.1400160a0
test al, al
je 0x140018463
lea rcx, [rbp + 0xf0]
call fcn.140006890
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140018aac
mov rdx, r13
lea rcx, [rbp + 0x70]
call fcn.140019070
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xf0]
call fcn.140015e40
nop
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.140015d50
nop
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140015c70
nop
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x70]
call fcn.140015ca0
nop
lea rcx, [rbp + 0x48]
call fcn.140006940
nop
lea rcx, [rbp - 0x58]
call fcn.140006940
nop
lea rcx, [rbp - 0x80]
call fcn.140006940
lea rcx, [rbp + 0xf0]
call fcn.140006890
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140006890
mov r8d, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140018bc8
lea rdx, str.Early_Launch
lea rcx, [rbp + 0x140]
call fcn.140019330
test al, al
je 0x1400185a4
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.140016430
cmp byte [rbp - 0xc], 0
je 0x140018b5e
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x48]
call fcn.140016b00
nop
cmp qword [rbp + 0x58], 0
je 0x140018b20
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x80]
call fcn.140006ab0
lea rcx, [rbp - 0x80]
call fcn.140016e70
test al, al
je 0x140018b20
lea rax, [rbp - 0x30]
mov qword [rsp + 0x78], rax
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x30]
call fcn.140006ab0
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140006ab0
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call fcn.140016fa0
test al, al
je 0x140018b20
lea rcx, [rbp + 0x48]
call fcn.140006940
inc edi
mov dword [rsp + 0x68], edi
lea rcx, [rbp + 0x70]
call fcn.140006940
nop
lea rcx, [rbp + 0x30]
call fcn.1400164e0
nop
lea rcx, [rbp + 0x10]
call fcn.140006940
nop
lea rcx, [rbp + 0x90]
call fcn.140013e40
add r13, 0x20
cmp r13, r14
je 0x140018d4e
mov esi, dword [rsp + 0x60]
jmp 0x140017f2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [str.h__n_]
lea rax, str.h__n_
cmp rdx, rax
je 0x14001863b
test byte [rdx + 0x1c], 0x80
je 0x14001863b
cmp byte [rdx + 0x19], 2
jb 0x14001863b
lea rcx, [rbp + 0x178]
call fcn.140006890
lea rcx, [rbp + 8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [rdx + 0x10]
call fcn.140016950
mov eax, dword [rsp + 0x68]
mov dword [r12], eax
mov dword [r12 + 4], ebx
mov dword [rsp + 0x64], 3
mov dword [rsp + 0x60], 4
mov rax, qword [rsp + 0x60]
mov qword [r12 + 8], rax
lea rcx, [rbp - 0x38]
call fcn.140016230
lea rcx, [rbp - 8]
call fcn.140016230
lea rcx, [rbp]
call fcn.140016230
nop
lea rcx, [rbp - 0x30]
call fcn.140006940
nop
lea rcx, [rbp + 0x30]
call fcn.1400164e0
nop
lea rcx, [rbp + 0x10]
call fcn.140006940
nop
lea rcx, [rbp + 0x90]
call fcn.140013e40
jmp 0x140018d63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [str.h__n_]
lea rax, str.h__n_
cmp rbx, rax
je 0x1400186f7
test byte [rbx + 0x1c], 0x80
je 0x1400186f7
cmp byte [rbx + 0x19], 2
jb 0x1400186f7
lea rcx, [rsi + 0x20]
call fcn.140006890
mov edx, 0x1d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9d, edi
mov rcx, qword [rbx + 0x10]
call fcn.1400165f0
mov eax, dword [rsp + 0x68]
mov dword [r12], eax
mov dword [r12 + 4], edi
jmp 0x140018648
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8, qword [str.h__n_]
lea rax, str.h__n_
cmp r8, rax
je 0x14001863b
test byte [r8 + 0x1c], 0x80
je 0x14001863b
cmp byte [r8 + 0x19], 2
jb 0x14001863b
lea rcx, [rbp + 0x178]
call fcn.140006890
mov edx, 0x1c
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [r8 + 0x10]
call fcn.1400165f0
jmp 0x14001863b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.h__n_]
lea rax, str.h__n_
cmp rcx, rax
je 0x1400187c6
test byte [rcx + 0x1c], 0x80
je 0x1400187c6
cmp byte [rcx + 0x19], 2
jb 0x1400187c6
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rdx, qword [rbp + 0x178]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.1400167e0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x64], 3
mov eax, dword [rsp + 0x68]
mov dword [r12], eax
mov dword [r12 + 4], ebx
mov rax, qword [rsp + 0x60]
mov qword [r12 + 8], rax
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400187fc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp]
test rcx, rcx
je 0x14001880c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x140018826
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.140007670
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
jmp 0x140018688
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.h__n_]
lea rax, str.h__n_
cmp rcx, rax
je 0x14001887d
test byte [rcx + 0x1c], 0x80
je 0x14001887d
cmp byte [rcx + 0x19], 2
jb 0x14001887d
mov edx, 0x1a
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.1400165f0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x64], 3
mov eax, dword [rsp + 0x68]
mov dword [r12], eax
mov dword [r12 + 4], ebx
mov rax, qword [rsp + 0x60]
mov qword [r12 + 8], rax
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400188b3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400188c3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140018903
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400188fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018d90
call fcn.14004c810
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140018924
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140018964
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001895f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018d96
call fcn.14004c810
movdqa xmm0, xmmword [0x1400914b0]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r15w
jmp 0x14001869c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8, qword [str.h__n_]
lea rax, str.h__n_
cmp r8, rax
je 0x1400189cc
test byte [r8 + 0x1c], 0x80
je 0x1400189cc
cmp byte [r8 + 0x19], 2
jb 0x1400189cc
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov edx, 0x19
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [r8 + 0x10]
call fcn.1400165f0
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x64], 3
mov eax, dword [rsp + 0x68]
mov dword [r12], eax
mov dword [r12 + 4], ebx
mov rax, qword [rsp + 0x60]
mov qword [r12 + 8], rax
mov rcx, qword [rbp]
test rcx, rcx
je 0x140018a03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140018a43
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018a3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018d90
call fcn.14004c810
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140018a64
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140018964
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001895f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018d96
jmp 0x14001895f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8, qword [str.h__n_]
lea rax, str.h__n_
cmp r8, rax
je 0x140018afb
test byte [r8 + 0x1c], 0x80
je 0x140018afb
cmp byte [r8 + 0x19], 2
jb 0x140018afb
lea rcx, [rbp + 0xf0]
call fcn.140006890
mov edx, 0x1f
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [r8 + 0x10]
call fcn.1400165f0
mov dword [rbp - 0x38], 4
mov dword [rbp - 0x34], 3
mov dword [r12], edi
mov dword [r12 + 4], ebx
mov rax, qword [rbp - 0x38]
mov qword [r12 + 8], rax
jmp 0x140018688
mov dword [rbp - 0x38], 4
mov dword [rbp - 0x34], 3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12], edi
mov dword [r12 + 4], eax
mov rax, qword [rbp - 0x38]
mov qword [r12 + 8], rax
lea rcx, [rbp + 0x48]
call fcn.140006940
nop
lea rcx, [rbp + 0x70]
call fcn.140006940
jmp 0x140018688
mov rbx, qword [rbp - 0x10]
mov rdx, qword [str.h__n_]
lea rax, str.h__n_
cmp rdx, rax
je 0x140018b9a
test byte [rdx + 0x1c], 0x80
je 0x140018b9a
cmp byte [rdx + 0x19], 2
jb 0x140018b9a
lea rcx, [rbp + 0x70]
call fcn.140006890
mov dword [rsp + 0x20], ebx
mov r9, rax
mov rcx, qword [rdx + 0x10]
call fcn.140016a70
mov dword [rbp - 0x10], 4
mov dword [rbp - 0xc], 3
mov dword [r12], edi
mov dword [r12 + 4], ebx
mov rax, qword [rbp - 0x10]
mov qword [r12 + 8], rax
lea rcx, [rbp + 0x70]
call fcn.140006940
jmp 0x140018688
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r10, qword [str.h__n_]
lea rax, str.h__n_
cmp r10, rax
je 0x140018b9a
test byte [r10 + 0x1c], 0x80
je 0x140018b9a
cmp byte [r10 + 0x19], 2
jb 0x140018b9a
lea rcx, [rbp + 0xf0]
call fcn.140006890
mov r8, rax
lea rcx, [rbp + 0x70]
call fcn.140006890
mov edx, 0x20
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [r10 + 0x10]
call fcn.1400166c0
jmp 0x140018b9a
mov ebx, dword [rbp + 0x38]
mov rcx, qword [str.h__n_]
lea rax, str.h__n_
cmp rcx, rax
je 0x140018c74
test byte [rcx + 0x1c], 0x80
je 0x140018c74
cmp byte [rcx + 0x19], 2
jb 0x140018c74
cmp qword [r13 + 0x18], 8
jb 0x140018c5a
mov r13, qword [r13]
mov edx, 0x18
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], ebx
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
call fcn.1400165f0
mov dword [rbp - 0x10], 4
mov dword [rbp - 0xc], 3
mov dword [r12], edi
mov dword [r12 + 4], ebx
mov rax, qword [rbp - 0x10]
mov qword [r12 + 8], rax
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140018ca4
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140018964
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001895f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018d9c
jmp 0x14001895f
mov rcx, qword [str.h__n_]
lea rax, str.h__n_
cmp rcx, rax
je 0x140018d2e
test byte [rcx + 0x1c], 0x80
je 0x140018d2e
cmp byte [rcx + 0x19], 2
jb 0x140018d2e
cmp qword [r13 + 0x18], 8
jb 0x140018d16
mov r13, qword [r13]
mov edx, 0x17
mov r9, r13
lea r8, [0x14008f668]
mov rcx, qword [rcx + 0x10]
call fcn.1400050c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r12], edi
mov dword [r12 + 4], eax
mov rax, qword [rbp + 0x1b0]
mov qword [r12 + 8], rax
jmp 0x14001869c
mov dword [r12], edi
mov dword [r12 + 4], r15d
mov rax, qword [0x14008f3e0]
mov qword [r12 + 8], rax
mov rax, r12
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14004c7f0
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140059a5c
nop
call fcn.140059a5c
int3
call fcn.140059a5c
int3
call fcn.140059a5c
nop
call fcn.140059a5c
nop
call fcn.140059a5c
int3