Function at 0x180001000
Capabilities:
Start service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [0x18001ac5c]
mov ecx, dword [0x18001ac58]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x2c]
cmp ecx, 0xa
setl byte [rsp + 0x2d]
mov eax, 0xabdff189
mov r14d, 0x48b2c05d
mov r15, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r12d, 0x314f165b
mov ebx, 0xa601b533
mov ebp, 0xc5795788
mov esi, 0x8aa7493e
cmp eax, 0x10282d8
jle 0x1800010a3
cmp eax, 0x48b2c05c
jg 0x1800010f2
cmp eax, 0x19755c87
jle 0x18000115e
cmp eax, 0x3e54b274
jg 0x180001259
cmp eax, 0x19755c88
je 0x18000130c
cmp eax, 0x314f165b
jne 0x18000105e
mov eax, 0xc619e9a7
mov edi, dword [rsp + 0x4c]
jmp 0x18000105e
cmp eax, 0xc38669a6
jg 0x180001128
cmp eax, 0xa601b532
jle 0x1800011ac
cmp eax, 0xb3a8e387
jg 0x18000128d
cmp eax, 0xa601b533
je 0x180001334
cmp eax, 0xabdff189
jne 0x18000105e
mov cl, byte [rsp + 0x2c]
cmp byte [rsp + 0x2d], 0
mov eax, 0xc4612187
mov edx, 0x10282d9
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x18000105e
cmp eax, 0x5bb88c29
jle 0x1800011eb
cmp eax, 0x6b0d0067
jg 0x1800012af
cmp eax, 0x5bb88c2a
je 0x18000135d
cmp eax, 0x63616ffb
jne 0x18000105e
mov eax, 0x99011fbb
jmp 0x18000105e
cmp eax, 0xc619e9a6
jle 0x180001221
cmp eax, 0xf3cddabc
jle 0x1800012f4
cmp eax, 0xf3cddabd
je 0x180001383
cmp eax, 0xf4f3fdb3
jne 0x18000105e
mov eax, 0x5bb88c2a
jmp 0x18000105e
cmp eax, 0x10282d9
je 0x18000138d
cmp eax, 0x926090d
je 0x1800013bd
cmp eax, 0xe5d8f16
jne 0x18000105e
mov dword [rsp + 0x4c], r13d
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3a8e388
cmove eax, r14d
cmp dword [0x18001ac58], 0xa
cmovl eax, r14d
jmp 0x18000105e
cmp eax, 0x8aa7493e
je 0x1800013e2
cmp eax, 0x98b5ad5c
je 0x1800013f1
cmp eax, 0x99011fbb
jne 0x18000105e
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf4f3fdb3
mov ecx, 0x5bb88c2a
jmp 0x18000140a
cmp eax, 0x48b2c05d
je 0x18000141c
cmp eax, 0x48b9bc53
je 0x180001444
cmp eax, 0x5a42a156
jne 0x18000105e
cmp qword [rsp + 0x38], 0
sete byte [rsp + 0x2f]
mov eax, 0x6b0d0068
jmp 0x18000105e
cmp eax, 0xc38669a7
je 0x18000146a
cmp eax, 0xc4612187
je 0x180001479
cmp eax, 0xc5795788
jne 0x18000105e
cmp byte [rsp + 0x2e], 0
mov eax, 0x926090d
mov ecx, 0xbbb199d6
cmovne eax, ecx
jmp 0x18000105e
cmp eax, 0x3e54b275
je 0x180001493
cmp eax, 0x44beb857
jne 0x18000105e
mov rcx, qword [rsp + 0x38]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [rsp + 0x44], eax
mov eax, 0x19755c88
jmp 0x18000105e
cmp eax, 0xb3a8e388
je 0x1800014a1
cmp eax, 0xbbb199d6
jne 0x18000105e
mov eax, 0xc619e9a7
xor edi, edi
jmp 0x18000105e
cmp eax, 0x6b0d0068
je 0x1800014ab
cmp eax, 0x7df5ad0e
jne 0x18000105e
movzx eax, byte [rsp + 0x2b]
mov dword [rsp + 0x48], eax
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e54b275
cmove eax, esi
cmp dword [0x18001ac58], 0xa
cmovl eax, esi
jmp 0x18000105e
cmp eax, 0xd4ffdbd6
jne 0x1800014c2
mov eax, 0xe5d8f16
xor r13d, r13d
jmp 0x18000105e
mov rcx, qword [rsp + 0x38]
call r15
mov rcx, qword [rsp + 0x30]
call r15
cmp dword [rsp + 0x44], 0
setne byte [rsp + 0x2b]
mov al, byte [rsp + 0x2b]
mov eax, 0x98b5ad5c
jmp 0x18000105e
cmp qword [rsp + 0x30], 0
sete byte [rsp + 0x2e]
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc38669a7
mov ecx, 0x63616ffb
jmp 0x18000140a
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf4f3fdb3
cmove eax, ebp
cmp dword [0x18001ac58], 0xa
cmovl eax, ebp
jmp 0x18000105e
mov eax, 0x48b9bc53
jmp 0x18000105e
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x30], rax
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc4612187
mov ecx, 0xf3cddabd
jmp 0x18000140a
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov r8d, 0x10
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x38], rax
mov eax, 0x5a42a156
jmp 0x18000105e
mov eax, 0xe5d8f16
mov r13d, dword [rsp + 0x48]
jmp 0x18000105e
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e54b275
mov ecx, 0x7df5ad0e
cmove eax, ecx
cmp dword [0x18001ac58], 0xa
cmovl eax, ecx
jmp 0x18000105e
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3a8e388
cmove eax, r12d
cmp dword [0x18001ac58], 0xa
cmovl eax, r12d
jmp 0x18000105e
mov eax, dword [0x18001ac5c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc38669a7
cmove eax, ebx
cmp dword [0x18001ac58], 0xa
cmovl eax, ebx
jmp 0x18000105e
mov rax, qword [rsp + 0x30]
mov eax, 0xa601b533
jmp 0x18000105e
xor ecx, ecx
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov eax, 0x10282d9
jmp 0x18000105e
mov al, byte [rsp + 0x2b]
mov eax, 0x7df5ad0e
jmp 0x18000105e
mov eax, 0x48b2c05d
jmp 0x18000105e
cmp byte [rsp + 0x2f], 0
mov eax, 0x44beb857
mov ecx, 0xd4ffdbd6
cmovne eax, ecx
jmp 0x18000105e
cmp eax, 0xc619e9a7
jne 0x18000105e
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret