Function at 0x10013470
Capabilities:
Query or enumerate registry key
Start service

Disassembly:
push ebp
mov ebp, esp
movsd xmm0, qword [0x1002aa70]
sub esp, 0x5c
ucomisd xmm0, qword [0x10022b38]
push ebx
push esi
push edi
lahf
test ah, 0x44
jp 0x100145cd
movaps xmm0, xmmword [0x10022bd0]
sub esp, 0x28
mov ecx, esp
movups xmmword [esp + 0x18], xmm0
push 8
push str.niygucey
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa50]
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
push 0xb
push str.Ivesoywiowe
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cvttsd2si ecx, qword [0x1002aa60]
add esp, 0x48
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], edx
push 0x3a5de26a
push ecx
sub esp, 0x18
mov ecx, esp
push 0xc
push str.ozewpiikaxex
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
add esp, 8
mov dword [ebp - 0x28], eax
mov ecx, esp
push 0xd
push str.ugtimuqugutig
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x10022958]
push 0
push 0x11985a66
sub esp, 8
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa48]
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmGetIMEFileNameA
sub esp, 0x18
mov dword [ebp - 0x20], eax
mov ecx, esp
push 7
push str.reecywo
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
cvttsd2si esi, qword [0x1002aa70]
sub esp, 0x18
mov ecx, esp
push 7
push str.Ybtigaj
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov ecx, esi
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm0, qword [0x1002aa70]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call fcn.10014e70
movsd xmm0, qword [0x1002aa28]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa30]
sub esp, 0x14
mov ecx, esp
movsd qword [esp + 0x18], xmm0
push 0xe
push str.qejogobipfuxaw
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov ecx, esp
mov dword [ebp - 4], edx
push 0xa
push str.Fysruryyoe
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x1002aa50]
call fcn.10014e70
push edx
push eax
push 0
push 0x1b350866
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
sub esp, 0x18
mov ebx, eax
mov ecx, esp
mov edi, edx
push 5
push str.xyzez
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm0, qword [0x10022840]
sub esp, 8
mov esi, eax
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov edx, dword [ebp - 4]
add esp, 8
mov ecx, dword [ebp - 0xc]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x44], xmm0
call fcn.10014f20
movsd xmm1, qword [0x10022ae0]
mov edx, edi
divsd xmm1, xmm0
mov ecx, ebx
movsd xmm0, qword [ebp - 0x44]
mulsd xmm0, xmm1
movsd qword [ebp - 0x44], xmm0
call fcn.10014f20
movsd xmm1, qword [ebp - 0x44]
mulsd xmm1, xmm0
movsd qword [ebp - 0x44], xmm1
call sub.IMM32.dll_ImmGetCandidateListW
movsd xmm0, qword [ebp - 0x44]
movsd qword [ebp - 0x44], xmm0
fmul qword [ebp - 0x44]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x44], xmm0
fdiv qword [ebp - 0x44]
fstp qword [ebp - 0x54]
movsd xmm0, qword [0x1002aa78]
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa30]
sub esp, 0xc
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceA]
add esp, 0xc
call ebx
mov ecx, eax
call fcn.10014f20
movsd qword [ebp - 0x4c], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
movsd xmm0, qword [0x1002aa38]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa38]
add esp, 0xc
push 0x2aebe61a
push 0
push 0x31e2323c
sub esp, 8
movsd qword [esp], xmm0
call ebx
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 8], xmm0
movsd xmm0, qword [0x100227a0]
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x10], xmm0
movsd xmm0, qword [0x1002aa28]
movsd qword [esp], xmm0
sub esp, 0x18
movsd xmm0, qword [0x1002aa68]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa50]
sub esp, 0xc
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCandidateListW
mov edx, dword [ebp - 0x14]
add esp, 0x38
mov ecx, dword [ebp - 0x18]
fstp qword [ebp - 0x44]
call fcn.10014f20
movsd xmm1, qword [0x10022ad0]
divsd xmm1, xmm0
divsd xmm1, qword [ebp - 0x44]
divsd xmm1, qword [ebp - 0x10]
mulsd xmm1, qword [ebp - 8]
mov edi, dword [ebp - 0x20]
movsd xmm0, qword [0x1002aa48]
mov ebx, dword [ebp - 0x28]
divsd xmm1, qword [ebp - 0x4c]
movsd qword [ebp - 0x1c], xmm1
call fcn.10014e70
movsd xmm0, qword [0x1002aa70]
push edx
push eax
sub esp, 0x20
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa28]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa70]
add esp, 0xc
call fcn.10014e70
push edx
push eax
mov ecx, 0x32e77d5e
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
sub esp, 0x18
mov esi, esp
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x24], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
sub esp, 0x18
movsd qword [ebp - 0x2c], xmm0
movsd xmm0, qword [0x1002aa38]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
fstp qword [ebp - 0x4c]
movsd xmm1, qword [ebp - 0x4c]
mulsd xmm1, qword [0x10022908]
mov edx, dword [ebp - 0x30]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mov ecx, dword [ebp - 0x38]
divsd xmm1, qword [ebp - 0x2c]
mulsd xmm1, qword [ebp - 0x24]
divsd xmm1, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movsd qword [ebp - 0x2c], xmm1
call fcn.10014f20
sub esp, 0x20
movsd qword [ebp - 0x3c], xmm0
movsd xmm0, qword [0x10022a38]
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa30]
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0
push 0xbe89ece
sub esp, 0x18
mov esi, esp
movsd xmm0, qword [0x1002aa60]
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCandidateListW
movsd xmm0, qword [0x1002aa28]
sub esp, 0x18
cvttsd2si edi, qword [0x1002aa50]
mov esi, esp
fstp qword [ebp - 0x4c]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov ecx, edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm0, qword [0x10022ab0]
sub esp, 0x28
mov ecx, esp
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x100229d0]
divsd xmm1, qword [ebp - 0x4c]
divsd xmm1, qword [ebp - 0x3c]
subsd xmm0, xmm1
subsd xmm0, qword [ebp - 0x2c]
addsd xmm0, qword [ebp - 0x1c]
subsd xmm0, qword [ebp - 0x54]
movsd qword [0x1002aa28], xmm0
movaps xmm0, xmmword [0x10022bd0]
movups xmmword [esp + 0x18], xmm0
push 8
push str.niygucey
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa50]
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
push 0xb
push str.Ivesoywiowe
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cvttsd2si ecx, qword [0x1002aa60]
add esp, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
push 0x3a5de26a
push ecx
sub esp, 0x18
mov ecx, esp
push 0xc
push str.ozewpiikaxex
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, esp
push 0xd
push str.ugtimuqugutig
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
push 0
push 0x11985a66
movsd xmm0, qword [0x10022958]
sub esp, 8
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa48]
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmGetIMEFileNameA
sub esp, 0x18
mov dword [ebp - 0x18], eax
mov ecx, esp
push 7
push str.reecywo
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
cvttsd2si esi, qword [0x1002aa70]
sub esp, 0x18
mov ecx, esp
push 7
push str.Ybtigaj
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov ecx, esi
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm0, qword [0x1002aa70]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
call fcn.10014e70
movsd xmm0, qword [0x1002aa28]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa30]
sub esp, 0x14
mov ecx, esp
movsd qword [esp + 0x18], xmm0
push 0xe
push str.qejogobipfuxaw
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
sub esp, 0x18
mov dword [ebp - 0x30], eax
mov ecx, esp
mov dword [ebp - 0x38], edx
push 0xa
push str.Fysruryyoe
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x1002aa50]
call fcn.10014e70
push edx
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_StartServiceA]
push 0
push 0x1b350866
call eax
sub esp, 0x18
mov ebx, eax
mov ecx, esp
mov edi, edx
push 5
push str.xyzez
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm0, qword [0x10022840]
sub esp, 8
mov esi, eax
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov edx, dword [ebp - 0x38]
add esp, 8
mov ecx, dword [ebp - 0x30]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x44], xmm0
call fcn.10014f20
movsd xmm1, qword [0x10022ae0]
mov edx, edi
divsd xmm1, xmm0
mov ecx, ebx
movsd xmm0, qword [ebp - 0x44]
mulsd xmm0, xmm1
movsd qword [ebp - 0x44], xmm0
call fcn.10014f20
movsd xmm1, qword [ebp - 0x44]
mulsd xmm1, xmm0
movsd qword [ebp - 0x44], xmm1
call sub.IMM32.dll_ImmGetCandidateListW
movsd xmm0, qword [ebp - 0x44]
sub esp, 0x18
movsd qword [ebp - 0x54], xmm0
fmul qword [ebp - 0x54]
movd xmm0, esi
mov esi, esp
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x54], xmm0
fdiv qword [ebp - 0x54]
movsd xmm0, qword [0x1002aa78]
fstp qword [ebp - 0x5c]
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa30]
sub esp, 0xc
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceA]
add esp, 0xc
call ebx
mov ecx, eax
call fcn.10014f20
movsd qword [ebp - 0x34], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
movsd xmm0, qword [0x1002aa38]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa38]
add esp, 0xc
push 0x2aebe61a
push 0
push 0x31e2323c
sub esp, 8
movsd qword [esp], xmm0
call ebx
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x3c], xmm0
movsd xmm0, qword [0x100227a0]
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x4c], xmm0
movsd xmm0, qword [0x1002aa28]
movsd qword [esp], xmm0
sub esp, 0x18
movsd xmm0, qword [0x1002aa68]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa50]
sub esp, 0xc
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCandidateListW
mov edx, dword [ebp - 0x28]
add esp, 0x38
mov ecx, dword [ebp - 0x20]
fstp qword [ebp - 0x54]
call fcn.10014f20
movsd xmm1, qword [0x10022ad0]
divsd xmm1, xmm0
movsd xmm0, qword [0x1002aa48]
divsd xmm1, qword [ebp - 0x54]
divsd xmm1, qword [ebp - 0x4c]
mulsd xmm1, qword [ebp - 0x3c]
divsd xmm1, qword [ebp - 0x34]
movsd qword [ebp - 0x34], xmm1
call fcn.10014e70
movsd xmm0, qword [0x1002aa70]
push edx
push eax
sub esp, 0x20
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa28]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa70]
add esp, 0xc
call fcn.10014e70
push edx
push eax
mov ecx, 0x32e77d5e
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
sub esp, 0x18
mov esi, esp
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x3c], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
sub esp, 0x18
movsd qword [ebp - 0x4c], xmm0
movsd xmm0, qword [0x1002aa38]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
fstp qword [ebp - 0x54]
movsd xmm1, qword [ebp - 0x54]
mulsd xmm1, qword [0x10022908]
mov edx, dword [ebp - 0xc]
movd xmm0, dword [ebp - 0x14]
cvtdq2pd xmm0, xmm0
mov ecx, dword [ebp - 4]
divsd xmm1, qword [ebp - 0x4c]
mulsd xmm1, qword [ebp - 0x3c]
divsd xmm1, xmm0
movd xmm0, dword [ebp - 0x18]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movsd qword [ebp - 0x3c], xmm1
call fcn.10014f20
sub esp, 0x20
movsd qword [ebp - 0x4c], xmm0
movsd xmm0, qword [0x10022a38]
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa30]
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa60]
add esp, 0xc
push 0
push 0xbe89ece
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCandidateListW
movsd xmm0, qword [0x1002aa28]
sub esp, 0x18
cvttsd2si edi, qword [0x1002aa50]
mov esi, esp
fstp qword [ebp - 0x54]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov ecx, edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm1, qword [0x10022a40]
sub esp, 0x28
mov ecx, esp
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100229d0]
divsd xmm0, qword [ebp - 0x54]
divsd xmm0, qword [ebp - 0x4c]
subsd xmm1, xmm0
movaps xmm0, xmmword [0x10022bd0]
movups xmmword [esp + 0x18], xmm0
push 8
push str.niygucey
subsd xmm1, qword [ebp - 0x3c]
addsd xmm1, qword [ebp - 0x34]
subsd xmm1, qword [ebp - 0x5c]
movsd qword [0x1002aa28], xmm1
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa50]
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
push 0xb
push str.Ivesoywiowe
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cvttsd2si ecx, qword [0x1002aa60]
add esp, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
push 0x3a5de26a
push ecx
sub esp, 0x18
mov ecx, esp
push 0xc
push str.ozewpiikaxex
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, esp
push 0xd
push str.ugtimuqugutig
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x10022958]
push 0
push 0x11985a66
sub esp, 8
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa48]
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmGetIMEFileNameA
sub esp, 0x18
mov dword [ebp - 0x18], eax
mov ecx, esp
push 7
push str.reecywo
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
cvttsd2si esi, qword [0x1002aa70]
sub esp, 0x18
mov ecx, esp
push 7
push str.Ybtigaj
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
mov ecx, esi
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm0, qword [0x1002aa70]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], edx
call fcn.10014e70
movsd xmm0, qword [0x1002aa28]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa30]
sub esp, 0x14
mov ecx, esp
movsd qword [esp + 0x18], xmm0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0xe
push str.qejogobipfuxaw
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
sub esp, 0x18
mov dword [ebp - 0x30], eax
mov ecx, esp
mov dword [ebp - 0x38], edx
push 0xa
push str.Fysruryyoe
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x1002aa50]
call fcn.10014e70
push edx
push eax
push 0
push 0x1b350866
mov eax, ebx
call eax
sub esp, 0x18
mov ebx, eax
mov ecx, esp
mov edi, edx
push 5
push str.xyzez
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm0, qword [0x10022840]
sub esp, 8
mov esi, eax
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov edx, dword [ebp - 0x38]
add esp, 8
mov ecx, dword [ebp - 0x30]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x44], xmm0
call fcn.10014f20
movsd xmm1, qword [0x10022ae0]
mov edx, edi
divsd xmm1, xmm0
mov ecx, ebx
movsd xmm0, qword [ebp - 0x44]
mulsd xmm0, xmm1
movsd qword [ebp - 0x44], xmm0
call fcn.10014f20
movsd xmm1, qword [ebp - 0x44]
mulsd xmm1, xmm0
movsd qword [ebp - 0x44], xmm1
call sub.IMM32.dll_ImmGetCandidateListW
movsd xmm0, qword [ebp - 0x44]
sub esp, 0x18
movsd qword [ebp - 0x5c], xmm0
fmul qword [ebp - 0x5c]
movd xmm0, esi
mov esi, esp
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x5c], xmm0
fdiv qword [ebp - 0x5c]
movsd xmm0, qword [0x1002aa78]
fstp qword [ebp - 0x34]
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa30]
sub esp, 0xc
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov ebx, dword [sym.imp.ADVAPI32.dll_StartServiceA]
call ebx
mov ecx, eax
call fcn.10014f20
movsd qword [ebp - 0x3c], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
movsd xmm0, qword [0x1002aa38]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa38]
add esp, 0xc
push 0x2aebe61a
push 0
push 0x31e2323c
sub esp, 8
movsd qword [esp], xmm0
call ebx
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x4c], xmm0
movsd xmm0, qword [0x100227a0]
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x54], xmm0
movsd xmm0, qword [0x1002aa28]
movsd qword [esp], xmm0
sub esp, 0x18
movsd xmm0, qword [0x1002aa68]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa50]
sub esp, 0xc
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCandidateListW
mov edx, dword [ebp - 0x28]
add esp, 0x38
mov ecx, dword [ebp - 0x20]
fstp qword [ebp - 0x5c]
call fcn.10014f20
movsd xmm1, qword [0x10022ad0]
divsd xmm1, xmm0
movsd xmm0, qword [0x1002aa48]
divsd xmm1, qword [ebp - 0x5c]
divsd xmm1, qword [ebp - 0x54]
mulsd xmm1, qword [ebp - 0x4c]
divsd xmm1, qword [ebp - 0x3c]
movsd qword [ebp - 0x3c], xmm1
call fcn.10014e70
movsd xmm0, qword [0x1002aa70]
push edx
push eax
sub esp, 0x20
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa28]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa70]
add esp, 0xc
call fcn.10014e70
push edx
push eax
mov ecx, 0x32e77d5e
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
sub esp, 0x18
mov esi, esp
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x4c], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
sub esp, 0x18
movsd qword [ebp - 0x54], xmm0
movsd xmm0, qword [0x1002aa38]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
fstp qword [ebp - 0x5c]
movsd xmm1, qword [ebp - 0x5c]
mulsd xmm1, qword [0x10022908]
mov edx, dword [ebp - 0xc]
movd xmm0, dword [ebp - 0x14]
cvtdq2pd xmm0, xmm0
mov ecx, dword [ebp - 4]
divsd xmm1, qword [ebp - 0x54]
mulsd xmm1, qword [ebp - 0x4c]
divsd xmm1, xmm0
movd xmm0, dword [ebp - 0x18]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movsd qword [ebp - 0x4c], xmm1
call fcn.10014f20
sub esp, 0x20
movsd qword [ebp - 0x54], xmm0
movsd xmm0, qword [0x10022a38]
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa30]
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movsd xmm0, qword [0x1002aa60]
add esp, 0xc
push 0
push 0xbe89ece
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCandidateListW
movsd xmm0, qword [0x1002aa28]
sub esp, 0x18
cvttsd2si edi, qword [0x1002aa50]
mov esi, esp
fstp qword [ebp - 0x5c]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
mov ecx, edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm1, qword [0x10022910]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100229d0]
divsd xmm0, qword [ebp - 0x5c]
divsd xmm0, qword [ebp - 0x54]
subsd xmm1, xmm0
subsd xmm1, qword [ebp - 0x4c]
addsd xmm1, qword [ebp - 0x3c]
subsd xmm1, qword [ebp - 0x34]
movsd qword [0x1002aa58], xmm1
push 0
push 0x10022410
push 0x1002251c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret