Function at 0x1800014dd
Capabilities:
Query service status
Terminate process

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rdi
push rbx
sub rsp, 0x2a8
mov eax, 0x2ca35a
mov ecx, eax
mov rdx, qword [sym.imp.KERNEL32.dll_AddRefActCtx]
mov eax, 0x2ca35a
mov r8d, eax
mov qword [rbp - 0x98], rcx
mov rcx, r8
call rdx
mov eax, 0x6f2947
mov ecx, eax
mov eax, 0xcee
mov r9d, 0xaa339c
mov edx, eax
mov r8d, eax
mov qword [rsp + 0x20], 0xaa339c
call sub.USER32.dll_ReuseDDElParam
mov edx, 0x2fb498
mov ecx, edx
mov r9, qword [sym.imp.GDI32.dll_DeleteColorSpace]
mov edx, 0x2fb498
mov r10d, edx
mov qword [rbp - 0xa0], rcx
mov rcx, r10
mov qword [rbp - 0xa8], rax
call r9
mov edx, 0x26396e
mov ecx, edx
mov r9, qword [sym.imp.GDI32.dll_CreatePatternBrush]
mov edx, 0x26396e
mov r10d, edx
mov qword [rbp - 0xb0], rcx
mov rcx, r10
mov dword [rbp - 0xb4], eax
call r9
mov edx, 0x86046e
mov ecx, edx
mov edx, 0xf93
lea r9, [rbp - 0x20]
mov r10, qword [sym.imp.GDI32.dll_OffsetViewportOrgEx]
mov r8d, 0x86046e
mov r11d, r8d
mov r8d, 0xf93
lea rsi, [rbp - 0x20]
mov qword [rbp - 0xc0], rcx
mov rcx, r11
mov dword [rbp - 0xc4], edx
mov edx, r8d
mov qword [rbp - 0xd0], r9
mov r9, rsi
mov qword [rbp - 0xd8], rax
call r10
mov edx, 0x458ae2
mov ecx, edx
lea r9, [rbp - 0x40]
lea r10, [rbp - 0x44]
mov edx, 0xd88
mov dword [rbp - 0x44], 0x35e
mov r11, qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov r8d, 0x458ae2
mov esi, r8d
lea rdi, [rbp - 0x40]
lea r8, [rbp - 0x44]
mov ebx, 0xd88
mov qword [rbp - 0xe0], rcx
mov rcx, rsi
mov dword [rbp - 0xe4], edx
mov rdx, rdi
mov qword [rbp - 0xf0], r9
mov r9d, ebx
mov dword [rbp - 0xf4], eax
mov qword [rbp - 0x100], r10
call r11
xor r9d, r9d
mov ecx, r9d
mov dword [rbp - 0x104], eax
mov qword [rbp - 0x110], rcx
mov rax, qword [rbp - 0x110]
mov ecx, 0x5517dc
mov edx, ecx
mov ecx, 0x7b4
mov r8, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r9d, 0x5517dc
mov r10d, r9d
mov r9d, 0x7b4
mov dword [rbp - 0x114], ecx
mov rcx, r10
mov qword [rbp - 0x120], rdx
mov edx, r9d
mov qword [rbp - 0x128], rax
call r8
lea rcx, [rbp - 0x68]
mov r8, qword [sym.imp.USER32.dll_CreateIconIndirect]
lea r10, [rbp - 0x68]
mov qword [rbp - 0x130], rcx
mov rcx, r10
mov dword [rbp - 0x134], eax
call r8
mov edx, 0x1ee986
mov ecx, edx
mov edx, 0x69d
mov r8, qword [sym.imp.GDI32.dll_SetTextCharacterExtra]
mov r9d, 0x1ee986
mov r10d, r9d
mov r9d, 0x69d
mov qword [rbp - 0x140], rcx
mov rcx, r10
mov dword [rbp - 0x144], edx
mov edx, r9d
mov qword [rbp - 0x150], rax
call r8
mov edx, 0xb6bbf1
mov ecx, edx
lea r8, [rbp - 0x88]
mov r10, qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edx, 0xb6bbf1
mov r11d, edx
lea rdx, [rbp - 0x88]
mov qword [rbp - 0x158], rcx
mov rcx, r11
mov dword [rbp - 0x15c], eax
mov qword [rbp - 0x168], r8
call r10
xor r9d, r9d
mov ecx, r9d
mov dword [rbp - 0x16c], eax
mov qword [rbp - 0x178], rcx
mov rax, qword [rbp - 0x178]
mov ecx, SafeArrayDestroy
mov edx, ecx
mov qword [rbp - 0x180], rax
xor ecx, ecx
mov qword [rbp - 0x188], rdx
mov edx, ecx
mov r8, qword [rbp - 0x188]
div r8
cmp rdx, 0
jne 0x1800017a9
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov rcx, qword [sym.imp.USER32.dll_GetSysColor]
mov edx, reloc.WS2_32.dll_WSAGetLastError
mov qword [rbp - 0x190], rcx
mov ecx, edx
mov r8, qword [rbp - 0x190]
mov dword [rbp - 0x194], eax
call r8
mov dword [rbp - 0x198], eax
mov rax, qword [rbp - 0x180]
add rax, 1
mov qword [rbp - 0x1a0], rax
mov rax, qword [rbp - 0x1a0]
cmp rax, 0xe4
mov qword [rbp - 0x178], rax
jne 0x180001746
xor eax, eax
mov ecx, eax
mov rdx, qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov eax, 0x6e68bc
mov r8d, eax
mov eax, 0xa83376
mov r9d, eax
mov qword [rbp - 0x1a8], rcx
mov rcx, r8
mov qword [rbp - 0x1b0], rdx
mov rdx, r9
mov r8, qword [rbp - 0x1b0]
call r8
xor r10d, r10d
mov ecx, r10d
mov rdx, qword [rbp - 0x128]
sub rdx, 0xe
mov dword [rbp - 0x1b4], eax
mov qword [rbp - 0x1c0], rcx
mov qword [rbp - 0x1c8], rdx
je 0x18000191b
jmp 0x18000183d
mov rax, qword [rbp - 0x128]
sub rax, 0x2f
mov rcx, qword [rbp - 0x1c0]
mov qword [rbp - 0x1d0], rax
mov qword [rbp - 0x1d8], rcx
jne 0x1800019d6
jmp 0x180001865
mov eax, 0x4e01b8
mov ecx, eax
mov eax, 0x2feaf8
mov edx, eax
mov eax, 0x5d1
mov r8, qword [sym.imp.USER32.dll_GetUpdateRgn]
mov r9d, 0x4e01b8
mov r10d, r9d
mov r9d, 0x2feaf8
mov r11d, r9d
mov r9d, 0x5d1
mov qword [rbp - 0x1e0], rcx
mov rcx, r10
mov qword [rbp - 0x1e8], rdx
mov rdx, r11
mov qword [rbp - 0x1f0], r8
mov r8d, r9d
mov r10, qword [rbp - 0x1f0]
mov dword [rbp - 0x1f4], eax
call r10
mov r8d, 0xcd99f0
mov ecx, r8d
mov r8d, 0x508
mov rdx, qword [sym.imp.KERNEL32.dll_TerminateThread]
mov r9d, 0xcd99f0
mov r10d, r9d
mov r9d, 0x508
mov qword [rbp - 0x200], rcx
mov rcx, r10
mov qword [rbp - 0x208], rdx
mov edx, r9d
mov r10, qword [rbp - 0x208]
mov dword [rbp - 0x20c], eax
mov dword [rbp - 0x210], r8d
call r10
mov dword [rbp - 0x214], eax
mov eax, 0xd7ada9
mov ecx, eax
mov rdx, qword [sym.imp.USER32.dll_ReplyMessage]
mov eax, 0xd7ada9
mov r8d, eax
mov qword [rbp - 0x220], rcx
mov rcx, r8
call rdx
mov r9d, 0x29d
lea rcx, [rbp - 0x89]
lea rdx, [rbp - 0x8c]
mov r10d, 0xd99
mov byte [rbp - 0x89], 4
mov word [rbp - 0x8c], 0x40
mov r8, rsp
mov dword [r8 + 0x20], 0xd99
mov r8, qword [sym.imp.USER32.dll_ToAscii]
mov r11d, 0x29d
lea rsi, [rbp - 0x89]
lea rdi, [rbp - 0x8c]
mov qword [rbp - 0x228], rcx
mov ecx, r11d
mov qword [rbp - 0x230], rdx
mov edx, r11d
mov qword [rbp - 0x238], r8
mov r8, rsi
mov dword [rbp - 0x23c], r9d
mov r9, rdi
mov rsi, qword [rbp - 0x238]
mov dword [rbp - 0x240], eax
mov dword [rbp - 0x244], r10d
call rsi
mov dword [rbp - 0x248], eax
jmp 0x180001aa4
mov rax, qword [rbp - 0x1d8]
mov ecx, 0x34c11f
mov edx, ecx
mov r8, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x34c11f
mov qword [rbp - 0x250], rax
mov qword [rbp - 0x258], rdx
call r8
mov r9d, 0x1202b8
mov ecx, r9d
mov rdx, qword [sym.imp.GDI32.dll_DeleteDC]
mov r9d, 0x1202b8
mov r8d, r9d
mov qword [rbp - 0x260], rcx
mov rcx, r8
mov dword [rbp - 0x264], eax
call rdx
mov r9d, 0xeae2b2
mov ecx, r9d
mov r9d, 0xe3a
mov rdx, qword [sym.imp.SHLWAPI.dll_GetMenuPosFromID]
mov r10d, 0xeae2b2
mov r8d, r10d
mov r10d, 0xe3a
mov qword [rbp - 0x270], rcx
mov rcx, r8
mov qword [rbp - 0x278], rdx
mov edx, r10d
mov r8, qword [rbp - 0x278]
mov dword [rbp - 0x27c], eax
mov dword [rbp - 0x280], r9d
call r8
mov rcx, qword [rbp - 0x250]
add rcx, 1
cmp rcx, 0xa
mov dword [rbp - 0x284], eax
mov qword [rbp - 0x1d8], rcx
jne 0x1800019d6
mov eax, 0x674c4
mov ecx, eax
mov rdx, qword [sym.imp.USER32.dll_GetParent]
mov eax, 0x674c4
mov r8d, eax
mov qword [rbp - 0x290], rcx
mov rcx, r8
call rdx
mov qword [rbp - 0x298], rax
mov rax, qword [rbp - 0x128]
add rax, 1
cmp rax, 0x43
mov qword [rbp - 0x110], rax
jne 0x18000164e
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop rbp
ret