Function at 0x18002c380
Capabilities:
Enumerate services
Query or enumerate registry key
Query or enumerate registry value
Query service status
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rsi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
movsd xmm0, qword [0x1800b3878]
mov esi, 0xe4740
movaps xmmword [rax - 0x28], xmm7
movsd xmm7, qword [str.S4I]
ucomisd xmm0, xmm7
jp 0x18002c13f
jne 0x18002c13f
movaps xmmword [rax - 0x38], xmm8
movsd xmm8, qword [0x18009a1c0]
movaps xmmword [rax - 0x48], xmm9
movsd xmm9, qword [0x18009a158]
movaps xmmword [rax - 0x58], xmm10
movsd xmm10, qword [0x180099dd8]
movaps xmmword [rax - 0x68], xmm11
movsd xmm11, qword [0x18009a000]
movaps xmmword [rax - 0x78], xmm12
movsd xmm12, qword [0x1800998c8]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
movaps xmmword [rax - 0x18], xmm6
nop
cmp esi, 0xe4741
jge 0x18002c0fa
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x79]
cvttsd2si rdi, qword [0x1800b3870]
call fcn.18002f2f0
lea rcx, [rbp - 0x59]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3910]
call fcn.18002f2d0
movsd xmm3, qword [0x1800b37e8]
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rbx, qword [0x1800b37e8]
lea rdx, str.meuraisyadoyg
lea rcx, [rbp - 0x39]
xorps xmm0, xmm0
movaps xmm6, xmm8
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x39]
cvttsd2si rdi, qword [0x1800b3870]
movd xmm1, eax
movaps xmm0, xmm9
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm6
subsd xmm0, xmm1
movsd qword [0x1800b3910], xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp - 0x59]
mov rbx, rax
call fcn.18002f2d0
movsd xmm3, qword [0x1800b37e8]
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rbx, qword [0x1800b37e8]
lea rdx, str.meuraisyadoyg
lea rcx, [rbp - 0x79]
xorps xmm0, xmm0
movaps xmm6, xmm8
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x39]
cvttsd2si rdi, qword [0x1800b3870]
movd xmm1, eax
movaps xmm0, xmm10
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm6
subsd xmm0, xmm1
movsd qword [0x1800b3910], xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp - 0x59]
mov rbx, rax
call fcn.18002f2d0
movsd xmm3, qword [0x1800b37e8]
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rbx, qword [0x1800b37e8]
lea rdx, str.meuraisyadoyg
lea rcx, [rbp - 0x79]
xorps xmm0, xmm0
movaps xmm6, xmm8
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x39]
cvttsd2si rdi, qword [0x1800b3870]
movd xmm1, eax
movaps xmm0, xmm11
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm6
subsd xmm0, xmm1
movsd qword [0x1800b3910], xmm0
call fcn.18002f2f0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp - 0x59]
mov rbx, rax
call fcn.18002f2d0
movsd xmm3, qword [0x1800b37e8]
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rbx, qword [0x1800b37e8]
lea rdx, str.meuraisyadoyg
lea rcx, [rbp - 0x79]
xorps xmm0, xmm0
movaps xmm6, xmm8
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18000a440
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
movaps xmm1, xmm12
inc esi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
subsd xmm1, xmm0
ucomisd xmm1, xmm7
movsd qword [0x1800b3878], xmm1
jp 0x18002c0fa
je 0x18002be80
mov rdi, qword [rsp + 0x108]
movaps xmm6, xmmword [rsp + 0xe0]
mov rbx, qword [rsp + 0x100]
movaps xmm8, xmmword [rsp + 0xc0]
movaps xmm9, xmmword [rsp + 0xb0]
movaps xmm10, xmmword [rsp + 0xa0]
movaps xmm11, xmmword [rsp + 0x90]
movaps xmm12, xmmword [rsp + 0x80]
mov rsi, qword [rsp + 0x110]
movaps xmm7, xmmword [rsp + 0xd0]
add rsp, 0xf0
pop rbp
jmp 0x18002c160
jmp 0x18002c170
mov rax, rsp
sub rsp, 0x88
movsd xmm0, qword [0x1800b3910]
ucomisd xmm0, qword [0x18009a3a0]
jp 0x18002c36b
jne 0x18002c36b
mov qword [rax + 8], rbx
lea rdx, str.wuisu
mov qword [rax + 0x10], rsi
lea rcx, [rax - 0x58]
cvttsd2si rsi, qword [0x1800b3870]
mov qword [rax - 8], rdi
cvttsd2si rdi, qword [0x1800b3878]
movaps xmmword [rax - 0x18], xmm6
call fcn.1800090b0
lea rdx, [0x180097544]
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbx
mov edx, 0x2eff2223
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movsd xmm6, qword [0x1800991b0]
lea rdx, str.wuisu
movsd xmm2, qword [0x180098ff8]
lea rcx, [rsp + 0x50]
cvttsd2si rdi, qword [0x1800b3878]
movaps xmm1, xmm6
divsd xmm1, xmm0
subsd xmm2, xmm1
movsd qword [0x1800b3870], xmm2
cvttsd2si rsi, xmm2
call fcn.1800090b0
lea rdx, [0x180097544]
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbx
mov edx, 0x2eff2223
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movsd xmm1, qword [0x1800995d8]
lea rdx, str.wuisu
cvttsd2si rdi, qword [0x1800b3878]
lea rcx, [rsp + 0x50]
cvttsd2si rsi, qword [0x1800b3870]
movaps xmm2, xmm6
divsd xmm2, xmm0
subsd xmm1, xmm2
movsd qword [0x1800b3848], xmm1
call fcn.1800090b0
lea rdx, [0x180097544]
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbx
mov edx, 0x2eff2223
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movsd xmm2, qword [0x1800987a8]
lea rdx, str.wuisu
cvttsd2si rdi, qword [0x1800b3878]
lea rcx, [rsp + 0x50]
movaps xmm1, xmm6
divsd xmm1, xmm0
subsd xmm2, xmm1
movsd qword [0x1800b3870], xmm2
cvttsd2si rsi, xmm2
call fcn.1800090b0
lea rdx, [0x180097544]
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbx
mov edx, 0x2eff2223
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
divsd xmm6, xmm0
movsd xmm1, qword [0x180098e88]
mov rdi, qword [rsp + 0x80]
subsd xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
movsd qword [0x1800b3910], xmm1
add rsp, 0x88
jmp 0x18002c380
mov rax, rsp
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
movsd xmm0, qword [0x1800b3870]
ucomisd xmm0, qword [0x18009a4a8]
jp 0x18002ccb6
jne 0x18002ccb6
mov qword [rax + 8], rbx
lea rdx, str.xycyi
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x30]
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm11
call fcn.18000a440
lea rdx, str.yqoyard
mov rsi, rax
lea rcx, [rsp + 0x50]
call fcn.18000a440
lea rdx, str.ezuiiponbyxikyq
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, str.wiokuei
lea rcx, [rbp - 0x50]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099ad8]
call fcn.1800090b0
movsd xmm0, qword [0x1800b3848]
mov r8, rax
mov edx, 0x1fcb3361
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cvttsd2si ebx, qword [0x1800b3870]
lea rdx, str.huezbyyyugy
lea rcx, [rbp - 0x30]
cvttsd2si rdi, qword [0x1800b3878]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call fcn.18000a440
mov rdx, rax
mov r9d, ebx
mov r8, rdi
mov ecx, 0x1f0cf4ed
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
mov ecx, 0x5d6fd06
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm8, xmm8
lea rdx, str.veycefufjuusam
lea rcx, [rbp - 0x10]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm7
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x10]
mov rbx, rax
call fcn.18002f2f0
cvttsd2si edx, qword [0x1800b3878]
mov r9, rax
mov r8d, 0x1f6c42d3
mov qword [rsp + 0x20], rbx
cvttsd2si rcx, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
divsd xmm8, xmm0
lea rdx, str.Ijnuxoiwioge
lea rcx, [rbp + 0x30]
addsd xmm8, qword [0x180098e48]
call fcn.1800090b0
lea rdx, str.ekdoaejxi
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], 0x17908767
mov r9d, 0x3d22f019
mov r8d, 0xe33ebe3
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si ecx, qword [0x1800b37e8]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099d18]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdi, qword [0x1800b3848]
lea rdx, str.eherqapuximcole
lea rcx, [rbp + 0x70]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.18002f2d0
movsd xmm2, qword [0x1800b37e8]
mov rcx, rax
mov r9, rbx
mov qword [rsp + 0x20], rdi
mov edx, 0x789d32e
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp + 0xb0]
cvttsd2si ebx, qword [0x1800b3848]
cvttsd2si edi, qword [0x1800b3878]
divsd xmm7, xmm0
call fcn.18002f2d0
mov rdx, rax
mov r9d, ebx
mov r8d, edi
movsd xmm0, qword [0x18009a0d8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cvttsd2si edi, qword [0x1800b3878]
lea rdx, str.ufguzivurajayfi
lea rcx, [rbp + 0xd0]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm7
subsd xmm8, xmm0
call fcn.18000a440
lea rdx, str.udjaokigelzic
mov rbx, rax
lea rcx, [rbp + 0xf0]
call fcn.18000a440
movsd xmm1, qword [0x1800b37e8]
mov r8, rax
cvttsd2si ecx, xmm1
mov r9, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
movsd xmm11, qword [0x180099f08]
xorps xmm0, xmm0
movaps xmm6, xmm11
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xorps xmm0, xmm0
lea rdx, str.xycyi
lea rcx, [rbp + 0xf0]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm8, xmm6
movsd qword [0x1800b3848], xmm8
call fcn.18000a440
lea rdx, str.yqoyard
mov rsi, rax
lea rcx, [rbp + 0xd0]
call fcn.18000a440
lea rdx, str.ezuiiponbyxikyq
mov rdi, rax
lea rcx, [rbp + 0xb0]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3878]
mov rbx, rax
lea rcx, [rbp + 0x90]
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, str.wiokuei
lea rcx, [rbp + 0x70]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099ad8]
call fcn.1800090b0
movsd xmm0, qword [0x1800b3848]
mov r8, rax
mov edx, 0x1fcb3361
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cvttsd2si ebx, qword [0x1800b3870]
lea rdx, str.huezbyyyugy
lea rcx, [rbp + 0x50]
cvttsd2si rdi, qword [0x1800b3878]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
call fcn.18000a440
mov rdx, rax
mov r9d, ebx
mov r8, rdi
mov ecx, 0x1f0cf4ed
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
mov ecx, 0x5d6fd06
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm8, xmm8
lea rdx, str.veycefufjuusam
lea rcx, [rbp + 0x30]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm7
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x10]
mov rbx, rax
call fcn.18002f2f0
cvttsd2si edx, qword [0x1800b3878]
mov r9, rax
mov r8d, 0x1f6c42d3
mov qword [rsp + 0x20], rbx
cvttsd2si rcx, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
divsd xmm8, xmm0
lea rdx, str.Ijnuxoiwioge
lea rcx, [rbp - 0x10]
addsd xmm8, qword [0x180098af0]
call fcn.1800090b0
lea rdx, str.ekdoaejxi
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], 0x17908767
mov r9d, 0x3d22f019
mov r8d, 0xe33ebe3
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si ecx, qword [0x1800b37e8]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099d18]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdi, qword [0x1800b3848]
lea rdx, str.eherqapuximcole
lea rcx, [rbp - 0x50]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.18002f2d0
movsd xmm2, qword [0x1800b37e8]
mov rcx, rax
mov r9, rbx
mov qword [rsp + 0x20], rdi
mov edx, 0x789d32e
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
cvttsd2si ebx, qword [0x1800b3848]
cvttsd2si edi, qword [0x1800b3878]
divsd xmm7, xmm0
call fcn.18002f2d0
mov rdx, rax
mov r9d, ebx
mov r8d, edi
movsd xmm0, qword [0x18009a0d8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cvttsd2si edi, qword [0x1800b3878]
lea rdx, str.ufguzivurajayfi
lea rcx, [rsp + 0x50]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm7
subsd xmm8, xmm0
call fcn.18000a440
lea rdx, str.udjaokigelzic
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.18000a440
movsd xmm1, qword [0x1800b37e8]
mov r8, rax
cvttsd2si ecx, xmm1
mov r9, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm0, xmm0
movaps xmm6, xmm11
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xorps xmm0, xmm0
lea rdx, str.xycyi
lea rcx, [rbp + 0xf0]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
subsd xmm8, xmm6
movsd qword [0x1800b3878], xmm8
call fcn.18000a440
lea rdx, str.yqoyard
mov rsi, rax
lea rcx, [rbp + 0xd0]
call fcn.18000a440
lea rdx, str.ezuiiponbyxikyq
mov rdi, rax
lea rcx, [rbp + 0xb0]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea rdx, str.wiokuei
lea rcx, [rbp + 0x70]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099ad8]
call fcn.1800090b0
movsd xmm0, qword [0x1800b3848]
mov r8, rax
mov edx, 0x1fcb3361
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cvttsd2si ebx, qword [0x1800b3870]
lea rdx, str.huezbyyyugy
cvttsd2si rdi, qword [0x1800b3878]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
lea rcx, [rbp + 0x50]
call fcn.18000a440
mov rdx, rax
mov r9d, ebx
mov r8, rdi
mov ecx, 0x1f0cf4ed
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
mov ecx, 0x5d6fd06
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xorps xmm8, xmm8
lea rdx, str.veycefufjuusam
lea rcx, [rbp + 0x30]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm7
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x10]
mov rbx, rax
call fcn.18002f2f0
cvttsd2si edx, qword [0x1800b3878]
mov r9, rax
mov r8d, 0x1f6c42d3
mov qword [rsp + 0x20], rbx
cvttsd2si rcx, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
divsd xmm8, xmm0
lea rdx, str.Ijnuxoiwioge
lea rcx, [rbp - 0x10]
addsd xmm8, qword [0x180099b90]
call fcn.1800090b0
lea rdx, str.ekdoaejxi
mov rbx, rax
lea rcx, [rbp - 0x30]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], 0x17908767
mov r9d, 0x3d22f019
mov r8d, 0xe33ebe3
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si ecx, qword [0x1800b37e8]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x180099d18]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdi, qword [0x1800b3848]
lea rdx, str.eherqapuximcole
lea rcx, [rbp - 0x50]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.18002f2d0
movsd xmm2, qword [0x1800b37e8]
mov rcx, rax
mov r9, rbx
mov qword [rsp + 0x20], rdi
mov edx, 0x789d32e
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
cvttsd2si ebx, qword [0x1800b3848]
cvttsd2si edi, qword [0x1800b3878]
divsd xmm7, xmm0
call fcn.18002f2d0
mov rdx, rax
mov r9d, ebx
mov r8d, edi
movsd xmm0, qword [0x18009a0d8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cvttsd2si edi, qword [0x1800b3878]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm7
subsd xmm8, xmm0
lea rdx, str.ufguzivurajayfi
lea rcx, [rsp + 0x50]
call fcn.18000a440
lea rdx, str.udjaokigelzic
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.18000a440
movsd xmm1, qword [0x1800b37e8]
mov r8, rax
cvttsd2si ecx, xmm1
mov r9, rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm11, xmm0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movaps xmm7, xmmword [rsp + 0x230]
xorps xmm0, xmm0
movaps xmm6, xmmword [rsp + 0x240]
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x260]
cvtsi2sd xmm0, rax
divsd xmm11, xmm0
subsd xmm8, xmm11
movaps xmm11, xmmword [rsp + 0x210]
movsd qword [0x1800b37e8], xmm8
movaps xmm8, xmmword [rsp + 0x220]
add rsp, 0x250
pop rbp
jmp 0x18002ccd0
mov rax, rsp
sub rsp, 0x1c8
movsd xmm0, qword [0x1800b37e8]
ucomisd xmm0, qword [str.ITi]
jp 0x18002cfa1
jne 0x18002cfa1
mov qword [rax + 8], rbx
lea rdx, str.zookipii
mov qword [rax - 8], rdi
lea rcx, [rsp + 0x30]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
call fcn.18000a440
cvttsd2si rcx, qword [0x1800b37e8]
mov rdx, rax
movsd xmm2, qword [0x180098b50]
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
movsd xmm6, qword [0x180099f88]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
lea rdx, str.jynyluaryxot
lea rcx, [rsp + 0x50]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
mulsd xmm7, xmm6
addsd xmm7, qword [0x180099e40]
call fcn.18000a440
movsd xmm0, qword [0x1800b3848]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm1, qword [0x180099730]
lea rcx, [rsp + 0x70]
cvttsd2si rdx, qword [0x1800b3870]
divsd xmm1, xmm0
subsd xmm7, xmm1
call fcn.18002f2d0
lea rdx, str.Utuikuiqywaojyy
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.1800090b0
mov rcx, rax
mov r9d, 0xe29fe08
mov r8d, 0x255c45d
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsd xmm6, qword [0x180099ea0]
lea rdx, str.xaxule
xorps xmm0, xmm0
lea rcx, [rsp + 0xb0]
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.1800090b0
lea rdx, str.oirkipuhyubyi
mov rbx, rax
lea rcx, [rsp + 0xd0]
call fcn.1800090b0
mov rdx, rax
mov r9, rbx
cvttsd2si ecx, qword [0x1800b37e8]
movsd xmm2, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0xf0]
divsd xmm6, xmm0
call fcn.18002f2f0
lea rdx, str.sylxee
mov rbx, rax
lea rcx, [rsp + 0x110]
call fcn.1800090b0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movsd xmm0, qword [0x1800b3878]
xorps xmm8, xmm8
cvttsd2si r8d, xmm0
mov edx, 0x3355970e
cvtsi2sd xmm8, rax
mulsd xmm8, xmm6
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cvttsd2si rbx, qword [0x1800b3910]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm8, xmm0
addsd xmm8, xmm7
cvttsd2si edi, qword [0x1800b3870]
lea rdx, str.obosoweerr
lea rcx, [rsp + 0x130]
call fcn.1800090b0
mov rdx, rax
mov r9, rbx
mov r8d, edi
movsd xmm4, qword [0x1800b3910]
cvttsd2si rcx, xmm4
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
movaps xmm6, xmm0
lea rdx, str.fadiykiupeb
mulsd xmm6, qword [0x180099c70]
lea rcx, [rsp + 0x150]
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x170]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call fcn.18002f2d0
cvttsd2si edx, qword [0x1800b3878]
mov r8, rax
cvttsd2si rcx, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movaps xmm7, xmmword [rsp + 0x1a0]
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1d0]
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x1b0]
addsd xmm0, xmm8
movaps xmm8, xmmword [rsp + 0x190]
movsd qword [0x1800b3878], xmm0
add rsp, 0x1c8
ret