Function at 0x18003cb1c
Capabilities:
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov rax, qword [0x1801bf780]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rcx
mov qword [rsp + 0x60], rcx
xor r12d, r12d
mov r8, qword [rcx + 0x10]
mov rbx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x18003cb6f
mov rbx, qword [rcx]
cmp r8, 1
jb 0x18003cbb4
lea rsi, [r8 + rbx]
mov r14d, 0x2e
mov rcx, rbx
jmp 0x18003cba7
cmp byte [rax], r14b
jne 0x18003cb8e
mov ecx, r12d
jmp 0x18003cb93
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x18003ccaa
inc rax
mov r8, rsi
sub r8, rax
mov rcx, rax
mov edx, r14d
call fcn.180131a90
test rax, rax
jne 0x18003cb84
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18003cbd1
mov rdx, qword [rdi]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], eax
mov dword [rsp + 0x68], r12d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [rbp - 0x74]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x18003cc69
inc rdx
mov rcx, qword [rdi]
mov esi, 0x1000
cmp rdx, rsi
jb 0x18003cc64
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003ced7
mov rcx, r8
call fcn.1801027b0
mov eax, ebx
mov byte [rdi], r12b
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], r12
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180102790
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x18003cbb4
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
mov esi, 0x1000
cmp rax, 0xffffffffffffffff
je 0x18003ce50
mov dword [rbp - 0x60], 0x130
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
lea rax, [rbp - 0x34]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x18003ccff
lea rdx, [rbp - 0x34]
lea rcx, [rsp + 0x38]
call fcn.1800299a8
nop
lea r15, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
seta al
mov rbx, qword [rsp + 0x38]
cmova r15, rbx
lea rcx, [rsp + 0x38]
mov r14, qword [rsp + 0x48]
test al, al
je 0x18003cd41
add r14, rbx
jmp 0x18003cd49
add r14, rcx
lea rbx, [rsp + 0x38]
cmp rbx, r14
je 0x18003cd65
sub r15, rbx
movsx ecx, byte [rbx]
call fcn.180109b1c
mov byte [r15 + rbx], al
inc rbx
cmp rbx, r14
jne 0x18003cd51
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x70], xmm1
movups xmm2, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x80], xmm2
mov qword [rsp + 0x48], r12
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r8
mov byte [rsp + 0x38], r12b
lea rdx, [rsp + 0x70]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
mov qword [rsp + 0x68], rax
cmp rax, r8
seta byte [rsp + 0x30]
movq r14, xmm1
cmova rdx, r14
mov r12, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], r8
jbe 0x18003cdc6
mov rcx, qword [rdi]
mov r8, r12
movq r15, xmm2
cmp r15, r12
cmovb r8, r15
call fcn.180131b30
mov ebx, eax
test eax, eax
jne 0x18003cdf2
cmp r12, r15
jae 0x18003cdea
or ebx, 0xffffffff
jmp 0x18003cdf2
xor ebx, ebx
cmp r12, r15
seta bl
xor r12d, r12d
cmp byte [rsp + 0x30], r12b
je 0x18003ce2d
mov rdx, qword [rsp + 0x68]
inc rdx
mov rax, r14
cmp rdx, rsi
jb 0x18003ce25
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003cedd
mov rcx, r14
call fcn.1801027b0
mov rcx, r13
test ebx, ebx
je 0x18003ce8b
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18003cce5
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x18003cc6b
inc rdx
mov rcx, qword [rdi]
cmp rdx, rsi
jb 0x18003ce81
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003cecb
mov rcx, r8
call fcn.1801027b0
jmp 0x18003cc6b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x58]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x18003cc69
inc rdx
mov rcx, qword [rdi]
cmp rdx, rsi
jb 0x18003cc64
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003ced1
jmp 0x18003cc61
call fcn.1801135b4
int3
call fcn.1801135b4
int3
call fcn.1801135b4
nop
call fcn.1801135b4
int3