Function at 0x1000d8e0
Capabilities:
Enumerate services
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100215b4
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x1002a0f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsd xmm0, qword [0x1002aa68]
ucomisd xmm0, qword [0x10022b60]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x244], eax
lahf
test ah, 0x44
jp 0x1000dcad
movsd xmm0, qword [0x1002aa48]
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x238], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa78]
sub esp, 0x14
mov dword [ebp - 4], 0
mov esi, esp
mov dword [ebp - 0x23c], esp
movsd qword [esp + 0x18], xmm0
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
sub esp, 0xc
mov byte [ebp - 4], 1
mov ecx, esp
mov dword [ebp - 0x228], esp
push 0xd
push str.atosecalozowe
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
push 0xd
push str.buiycujuqouhi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
mov dword [ebp - 4], 0xffffffff
call sub.IMM32.dll_ImmRegisterWordA
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x230], esp
fstp qword [ebp - 0x254]
push 7
push str.yfetixi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x1002aa30]
push 0
push 0x3b9522a7
push 0
push 0x2008ae11
sub esp, 0x18
mov dword [ebp - 4], 3
mov esi, esp
mov dword [ebp - 0x228], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
sub esp, 0xc
mov byte [ebp - 4], 4
mov ecx, esp
push 0xe
push str.jafydababaluuy
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movsd xmm0, qword [0x1002aa58]
add esp, 0x58
fstp qword [ebp - 0x24c]
push 0
push 0x1fa2ec3d
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x230], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
sub esp, 0xc
mov dword [ebp - 4], 5
mov ecx, esp
push 7
push str.wuesymj
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x10022900]
mov dword [ebp - 4], 0xffffffff
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm0, qword [0x1002aa60]
cvttsd2si ecx, xmm0
mov dword [ebp - 0x238], eax
push ecx
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x230], esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
sub esp, 0xc
mov dword [ebp - 4], 6
mov ecx, esp
push 8
push str.saymevue
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
cvttsd2si ecx, qword [0x1002aa78]
mov edx, 0x1abc9c13
mov dword [ebp - 4], 0xffffffff
call sub.IMM32.dll_ImmRegisterWordA
movsd xmm0, qword [0x1002aa38]
sub esp, 0x18
mov edi, eax
mov dword [ebp - 0x230], esp
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
sub esp, 0xc
mov dword [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x228], esp
push 6
push str.Eawose
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x1002aa70]
sub esp, 0x18
mov byte [ebp - 4], 8
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm0, qword [0x10022998]
add esp, 0x40
fstp qword [ebp - 0x22c]
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsd xmm2, qword [0x10022a98]
movsd xmm1, qword [0x10022af8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10022a48]
movsd qword [ebp - 0x234], xmm0
movsd xmm0, qword [0x100229d8]
divsd xmm0, qword [ebp - 0x254]
subsd xmm2, xmm0
movsd xmm0, qword [ebp - 0x24c]
mulsd xmm0, qword [0x10022a58]
subsd xmm2, xmm0
movd xmm0, dword [ebp - 0x238]
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
addsd xmm2, xmm1
movsd qword [ebp - 0x24c], xmm2
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, eax
call fcn.10014f20
mulsd xmm0, qword [ebp - 0x234]
movd xmm1, edi
cvtdq2pd xmm1, xmm1
mulsd xmm0, xmm1
movsd xmm1, qword [ebp - 0x24c]
mulsd xmm0, qword [ebp - 0x22c]
subsd xmm1, xmm0
movsd qword [0x1002aa50], xmm1
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.100161c0
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call fcn.100066a0
add esp, 0x18
test eax, eax
je 0x1000dd8b
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000dce7
sub ecx, edx
sar ecx, 1
lea eax, [ecx - 1]
test eax, eax
js 0x1000dd25
nop dword [eax]
cmp word [ebp + eax*2 - 0x21c], 0x5c
je 0x1000dd25
cmp eax, 0x105
jae 0x1000de2b
xor ecx, ecx
mov word [ebp + eax*2 - 0x21c], cx
sub eax, 1
jns 0x1000dd00
movups xmm0, xmmword [str.license.dat]
push 0
push 0x80
push 3
movups xmmword [ebp + eax*2 - 0x21a], xmm0
push 0
movq xmm0, qword [0x100226fc]
push 1
movq qword [ebp + eax*2 - 0x20a], xmm0
lea eax, [ebp - 0x21c]
push 0x80000000
push eax
call fcn.10002860
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x1000dd8b
cmp esi, 0xffffffff
je 0x1000dd8b
push 0
push esi
call fcn.10005b10
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000dda8
push esi
call fcn.10001c90
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10014e53
mov esp, ebp
pop ebp
ret
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1002adfc]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1002aa8c]
cmp eax, dword [ecx + 4]
jg 0x1000de30
push 0
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push edi
push dword [0x1002aa80]
push esi
call fcn.100091d0
push esi
call fcn.10001c90
push 0x1002aa80
call fcn.1000c050
mov ecx, dword [ebp - 0x240]
add esp, 0x1c
mov eax, dword [0x1002aa80]
mov dword [ecx], eax
mov eax, dword [0x1002aa84]
mov ecx, dword [ebp - 0x244]
sub eax, dword [0x1002aa80]
cmp dword [ebp - 0x220], 0
mov dword [ecx], eax
je 0x1000dd8b
mov al, 1
jmp 0x1000dd8d
call fcn.10014b6f
push 0x1002aa8c
call fcn.10014d7d
add esp, 4
cmp dword [0x1002aa8c], 0xffffffff
jne 0x1000ddc4
lea eax, [ebp - 0x222]
mov dword [ebp - 4], 9
push eax
lea eax, [ebp - 0x221]
mov byte [ebp - 0x221], 0
push eax
push edi
mov ecx, 0x1002aa80
call fcn.1000bba0
push 0x10021950
call fcn.10014a38
push 0x1002aa8c
mov dword [ebp - 4], 0xffffffff
call fcn.10014d33
add esp, 8
jmp 0x1000ddc4