Function at 0x180021730
Capabilities:
Enumerate services
Query or enumerate registry value

Disassembly:
sub rsp, 0x158
call fcn.180021b70
movsd xmm0, qword [0x1800b3848]
ucomisd xmm0, qword [0x18009a370]
jp 0x180021b5d
jne 0x180021b5d
mov qword [rsp + 0x160], rbx
lea rdx, str.cicaoboxeyygixi
mov qword [rsp + 0x150], rdi
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm7
movaps xmmword [rsp + 0x120], xmm8
movaps xmmword [rsp + 0x110], xmm10
movaps xmmword [rsp + 0x100], xmm13
movaps xmmword [rsp + 0xf0], xmm14
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.18002f2f0
mov rdx, rax
mov r8, rbx
mov ecx, 0x3c523ec1
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movsd xmm14, qword [0x180099210]
movaps xmm6, xmm14
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x90]
mov rbx, rax
call fcn.18002f2f0
movsd xmm2, qword [0x180098fb0]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movaps xmm8, xmm0
mulsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm8, xmm0
addsd xmm8, qword [0x180099db0]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si rdx, qword [0x1800b3848]
mov r8d, 0x30735e9e
movsd xmm0, qword [0x1800b3870]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, qword [0x18009a030]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm0, xmm0
lea rdx, [0x180096bf0]
lea rcx, [rsp + 0xb0]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.1800090b0
lea rdx, str.Ireatodaabujuwu
mov rbx, rax
lea rcx, [rsp + 0xd0]
cvttsd2si edi, qword [0x1800b3910]
call fcn.18000a440
mov rcx, rax
mov r9, rbx
mov edx, edi
movsd xmm4, qword [0x180098e50]
movsd xmm2, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movaps xmm6, xmm0
movsd xmm0, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mulsd xmm0, xmm7
mulsd xmm6, xmm0
subsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm13, qword [0x180099468]
movaps xmm6, xmm13
divsd xmm6, xmm0
addsd xmm6, xmm8
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movsd xmm10, qword [0x180099be8]
lea rdx, str.cicaoboxeyygixi
movaps xmm1, xmm10
lea rcx, [rsp + 0xd0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
subsd xmm6, xmm1
movsd qword [0x1800b3870], xmm6
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0xb0]
mov rbx, rax
call fcn.18002f2f0
mov rdx, rax
mov r8, rbx
mov ecx, 0x3c523ec1
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm14, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x90]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm14
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.18002f2f0
movsd xmm2, qword [0x180098fb0]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movaps xmm8, xmm0
mulsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm8, xmm1
addsd xmm8, qword [0x180099c58]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si rdx, qword [0x1800b3848]
mov r8d, 0x30735e9e
movsd xmm0, qword [0x1800b3870]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, qword [0x18009a030]
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm0, xmm0
lea rdx, [0x180096bf0]
lea rcx, [rsp + 0x50]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.1800090b0
lea rdx, str.Ireatodaabujuwu
mov rbx, rax
lea rcx, [rsp + 0x30]
cvttsd2si edi, qword [0x1800b3910]
call fcn.18000a440
mov rcx, rax
mov r9, rbx
mov edx, edi
movsd xmm4, qword [0x180098e50]
movsd xmm2, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movaps xmm6, xmm0
movsd xmm0, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mulsd xmm0, xmm7
mulsd xmm6, xmm0
subsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
divsd xmm13, xmm0
addsd xmm13, xmm8
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movaps xmm14, xmmword [rsp + 0xf0]
movaps xmm8, xmmword [rsp + 0x120]
movaps xmm7, xmmword [rsp + 0x130]
movaps xmm6, xmmword [rsp + 0x140]
mov rdi, qword [rsp + 0x150]
mov rbx, qword [rsp + 0x160]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm10, xmm0
subsd xmm13, xmm10
movaps xmm10, xmmword [rsp + 0x110]
movsd qword [0x1800b3870], xmm13
movaps xmm13, xmmword [rsp + 0x100]
add rsp, 0x158
ret