Function at 0x18002fcd0
Capabilities:
Create service
Delete service
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x88]
mov r13, r8
mov r8, qword [rbp + 0x80]
mov edi, r9d
mov r11, qword [rbp + 0x98]
mov ebx, dword [rbp - 0x70]
imul r10d, r9d, 0xaaa
mov qword [rbp - 0x30], rdx
mov rdx, qword [rbp + 0x90]
mov dword [rsp + 0x70], r9d
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x40], rdx
mov qword [rsp + 0x78], r11
mov dword [rsp + 0x74], r10d
cmp r9d, r10d
ja 0x1800303e0
movzx esi, byte [rbp - 0x58]
mov r12d, dword [rbp - 0x70]
mov r14d, dword [rbp - 0x70]
mov r15d, dword [rbp - 0x70]
mov dword [rbp - 0x80], esi
nop word [rax + rax]
cmp edi, 0x9920
ja 0x180030251
je 0x1800301fe
cmp edi, 0x117
ja 0x18002ff6f
je 0x18002ff61
mov eax, edi
sub eax, 0x37
je 0x18002fee3
sub eax, 0x3d
je 0x18002fe8f
cmp eax, 0x54
jne 0x18002fe6c
xor eax, eax
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rax + 0x21]
call fcn.18002cab0
mov rcx, qword [r13 + 0x88]
lea r9, [r13 + 0xa8]
mov qword [rbp - 0x28], rax
xor r8d, r8d
mov qword [rbp - 0x78], rcx
xor eax, eax
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov edx, 0x111
call fcn.180034fa0
cmp al, 1
jne 0x18002fe15
lea r9, str.TrimCommandPoolKHR
mov r8, r13
xor edx, edx
mov ecx, 0xba
call fcn.180056680
mov rax, qword [r13 + 0x78]
lea r9, [r13 + 0xa8]
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
xor eax, eax
xor r8d, r8d
mov edx, 0x111
mov qword [rsp + 0x20], rax
call fcn.180034fa0
cmp al, 1
jne 0x18002fe56
lea r9, str.LONG_BRANCH_DADDiu
mov r8, r13
xor edx, edx
mov ecx, 0xba
call fcn.180056680
mov esi, dword [rbp - 0x80]
mov r11, qword [rsp + 0x78]
mov r9d, dword [rsp + 0x70]
mov r10d, dword [rsp + 0x74]
mov r8, qword [rbp - 0x60]
mov rax, qword [rbp - 0x68]
imul ecx, r9d, 0xc3
add edi, ecx
cmp edi, r10d
ja 0x1800303e0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x40]
jmp 0x18002fd70
mov rcx, qword [r8]
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [r13 + 0xe0], rax
test rax, rax
jne 0x18002fec6
lea r9, str.GEN_CPACK_DEBIAN_PACKAGE_PREDEPENDS
mov r8, r13
xor edx, edx
mov ecx, 0xba
call fcn.180056680
mov rax, qword [r13 + 0xe0]
mov r8, qword [rbp - 0x60]
mov rcx, rax
mov rdx, qword [rsp + 0x78]
mov r8, qword [r8]
shl r8, 3
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002fe59
cmp dword [r13 + 0x4724], 0x10
jge 0x18002ff0f
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x123
mov qword [rsp + 0x20], r13
xor ecx, ecx
call fcn.180049e30
mov r8, qword [rbp - 0x60]
mov r9, r8
mov edx, 0x8b
xor r8d, r8d
mov rcx, r13
call fcn.180064da0
mov dword [rbp - 0x70], eax
test eax, eax
js 0x1800303c1
mov r11, qword [rsp + 0x78]
xorps xmm0, xmm0
movups xmmword [r11], xmm0
movups xmmword [r11 + 0x10], xmm0
movups xmmword [r11 + 0x20], xmm0
movups xmmword [r11 + 0x30], xmm0
movups xmmword [r11 + 0x40], xmm0
movups xmmword [r11 + 0x50], xmm0
movups xmmword [r11 + 0x60], xmm0
movups xmmword [r11 + 0x70], xmm0
jmp 0x18002fe5e
mov ecx, 0x26
mov word [rbp - 0x18], cx
jmp 0x18002fe70
cmp edi, 0x2a1c
je 0x180030191
cmp edi, 0x5401
je 0x18002ff99
cmp edi, 0x7de6
jne 0x18002fe70
mov ebx, 1
jmp 0x18002fe70
mov esi, 1
nop
mov edi, 0xb4
mov dword [rbp - 0x48], edi
nop dword [rax + rax]
cmp edi, 0xb4
jne 0x180030169
cmp dword [r13 + 0x4724], 0x10
jge 0x18002ffef
xor eax, eax
lea edx, [rdi + 0x6f]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor ecx, ecx
call fcn.180049e30
mov r11, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x40]
mov eax, dword [r13 + 0x4720]
mov r8, qword [rbp - 0x30]
shr rax, 0x17
movsx r10d, word [r8 + rax*2]
test r10d, r10d
je 0x180030093
mov r9d, 0x126
mov eax, r9d
sub eax, 0x126
je 0x180030056
sub eax, 0x14
je 0x180030043
cmp eax, 0x14
jne 0x180030079
mov r8d, r12d
mov eax, r10d
sar eax, 8
movzx edx, byte [r8 + rcx]
movsx ecx, ax
mov eax, edx
imul eax, ecx
mov word [r11 + r8*2], ax
jmp 0x180030079
movsxd rax, esi
lea rcx, [0x18008ca10]
inc esi
movzx r12d, byte [rax + rcx]
jmp 0x180030079
mov eax, r10d
mov r14d, r10d
sar eax, 4
and r14d, 0xf
and eax, 0xf
mov ecx, r14d
shl dword [r13 + 0x4720], cl
add esi, eax
sub dword [r13 + 0x4724], r14d
mov rcx, qword [rbp - 0x50]
add r9d, 0x14
cmp r9d, 0x162
jb 0x180030012
mov rdx, qword [rbp - 0x40]
jmp 0x180030169
mov edi, 0xdc
nop dword [rax + rax]
mov eax, edi
sub eax, 0xdc
je 0x180030135
sub eax, 1
je 0x180030123
cmp eax, 1
jne 0x18003014b
test r14d, r14d
jne 0x1800300d7
mov r11, qword [rsp + 0x78]
cmp r15d, 0xf0
jne 0x180030184
add esi, 0x10
jmp 0x180030150
mov eax, r15d
mov dword [rbp - 0x78], r14d
sar eax, 4
lea rcx, [0x18008ca10]
add esi, eax
lea rdx, [rbp - 0x78]
movsxd rax, esi
mov r8d, 0x7d
inc esi
movzx r12d, byte [rax + rcx]
mov rcx, r13
call fcn.180043980
mov rcx, qword [rbp - 0x50]
mov r11, qword [rsp + 0x78]
movsx edx, ax
movzx ecx, byte [r12 + rcx]
mov eax, ecx
imul eax, edx
mov word [r11 + r12*2], ax
jmp 0x180030150
test r15d, r15d
js 0x1800303d7
mov r14d, r15d
and r14d, 0xf
jmp 0x18003014b
mov r9, rdx
xor r8d, r8d
mov edx, 0x8b
mov rcx, r13
call fcn.180064da0
mov r15d, eax
mov r11, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x40]
inc edi
cmp edi, 0xdf
jb 0x1800300a0
mov rcx, qword [rbp - 0x50]
mov edi, dword [rbp - 0x48]
add edi, 0xf
mov dword [rbp - 0x48], edi
cmp edi, 0xc3
jb 0x18002ffb0
cmp esi, 0x40
jl 0x18002ffa0
mov esi, dword [rbp - 0x80]
mov edi, 0x5401
jmp 0x18002fe5e
mov r8d, dword [rbp - 0x70]
test r8d, r8d
je 0x1800301c7
mov dword [rbp - 0x78], r8d
lea rdx, [rbp - 0x78]
mov r8d, 0x7d
mov rcx, r13
call fcn.180043980
mov r11, qword [rsp + 0x78]
mov edx, eax
mov rax, qword [rbp - 0x68]
mov r9d, dword [rsp + 0x70]
mov r10d, dword [rsp + 0x74]
jmp 0x1800301cb
xor ecx, ecx
mov edx, ecx
movsxd rax, dword [rax]
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x50]
shl rcx, 5
add edx, dword [rcx + r13 + 0x45b8]
mov dword [rcx + r13 + 0x45b8], edx
movzx eax, byte [rax]
movsx ecx, dx
mov edx, eax
imul edx, ecx
mov word [r11], dx
jmp 0x18002fe68
mov rax, qword [r13 + 0x80]
lea r9, [rbp - 0x48]
mov r8, r13
mov qword [rbp - 0x48], rax
mov edx, 0xce
mov dword [rbp - 0x78], 0x11
lea rcx, [rbp - 0x78]
call fcn.180025130
mov rax, qword [rbp - 0x28]
lea r9, [rbp - 0x48]
dec rax
mov dword [rbp - 0x78], 0xf
mov r8, r13
mov qword [rbp - 0x48], rax
mov edx, 0xce
lea rcx, [rbp - 0x78]
call fcn.180025130
jmp 0x18002fe59
cmp edi, 0x27ea6
ja 0x1800302bf
je 0x1800302aa
cmp edi, 0xa7cb
je 0x1800303e0
cmp edi, 0xd59c
je 0x180030297
cmp edi, 0x1aa21
jne 0x18002fe70
mov ecx, 0x6f
mov dword [rbp - 0xc], 0x647574
mov word [rbp - 9], cx
mov dword [rbp - 0x10], 0x2072616e
jmp 0x18002fe70
mov dword [rbp - 0x17], 0x6c6553
mov dword [rbp - 0x14], 0x6f696365
jmp 0x18002fe70
xor eax, eax
mov sil, 1
mov dword [rbp - 0x80], esi
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x38], rax
jmp 0x18002fe6c
cmp edi, 0x3532b
je 0x180030336
cmp edi, 0x427b0
jne 0x18002fe70
test sil, sil
je 0x1800302ff
mov rsi, qword [rbp - 0x38]
xor r8d, r8d
mov rcx, rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [rbp - 0x80]
mov r8d, 0x128
mov rdx, r13
xor ecx, ecx
call fcn.18001f120
cmp eax, 2
jne 0x18002fe59
mov r8d, 0x10f
mov dword [rbp - 0x78], 1
lea rdx, [rbp - 0x78]
mov rcx, r13
call fcn.1800205f0
jmp 0x18002fe59
mov eax, dword [0x18007bd78]
lea r8, [rbp]
movsd xmm0, qword [str.video_encode]
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov r9d, 0xf01ff
mov dword [rbp + 8], eax
movzx eax, byte [0x18007bd7c]
mov byte [rbp + 0xc], al
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
movsd qword [rbp], xmm0
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
mov qword [rbp - 0x38], rax
mov eax, 0
movzx esi, sil
cmove esi, eax
mov dword [rbp - 0x80], esi
jmp 0x18002fe59
lea r9, str.concurrent.as_20
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.180041b10
jmp 0x1800303e2
lea r9, str._test_case.html_
jmp 0x1800303c8
mov eax, ebx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.180076c30
mov rbx, qword [rsp + 0x160]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret