Function at 0x180001f00
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x180020cb8], 0
jne 0x180002235
mov qword [rsp + 0x20], rbx
mov byte [0x180020cb8], 1
call fcn.1800069a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180006ec0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x180001f75
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cb0], rax
test rax, rax
je 0x180001f7c
lea rdx, [0x180002240]
lea rcx, [0x180020cb0]
call fcn.180005f80
jmp 0x180001f7c
mov qword [0x180020cb0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001fbf
lea rdx, str.NtResumeThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020c98], rax
test rax, rax
je 0x180001fc6
lea rdx, [0x1800024d0]
lea rcx, [0x180020c98]
call fcn.180005f80
jmp 0x180001fc6
mov qword [0x180020c98], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002009
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ce8], rax
test rax, rax
je 0x180002010
lea rdx, [0x180002610]
lea rcx, [0x180020ce8]
call fcn.180005f80
jmp 0x180002010
mov qword [0x180020ce8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002053
lea rdx, str.NtQueryDirectoryFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ca8], rax
test rax, rax
je 0x18000205a
lea rdx, [0x1800029f0]
lea rcx, [0x180020ca8]
call fcn.180005f80
jmp 0x18000205a
mov qword [0x180020ca8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000209d
lea rdx, str.NtEnumerateKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ca0], rax
test rax, rax
je 0x1800020a4
lea rdx, [0x180003010]
lea rcx, [0x180020ca0]
call fcn.180005f80
jmp 0x1800020a4
mov qword [0x180020ca0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800020e7
lea rdx, str.NtEnumerateValueKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cc0], rax
test rax, rax
je 0x1800020ee
lea rdx, [0x180003100]
lea rcx, [0x180020cc0]
call fcn.180005f80
jmp 0x1800020ee
mov qword [0x180020cc0], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002131
lea rdx, str.EnumServiceGroupW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cc8], rax
test rax, rax
je 0x180002138
lea rdx, [0x1800031f0]
lea rcx, [0x180020cc8]
call fcn.180005f80
jmp 0x180002138
mov qword [0x180020cc8], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000217b
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cd0], rax
test rax, rax
je 0x180002182
lea rdx, [0x180003280]
lea rcx, [0x180020cd0]
call fcn.180005f80
jmp 0x180002182
mov qword [0x180020cd0], rbx
lea rcx, str.sechost.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800021c5
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cd8], rax
test rax, rax
je 0x1800021cc
lea rdx, [0x180003310]
lea rcx, [0x180020cd8]
call fcn.180005f80
jmp 0x1800021cc
mov qword [0x180020cd8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000221b
lea rdx, str.NtDeviceIoControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ce0], rax
test rax, rax
je 0x180002222
lea rdx, [0x1800033a0]
lea rcx, [0x180020ce0]
call fcn.180005f80
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180006a10
mov qword [0x180020ce0], rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180006a10
add rsp, 0x28
ret