Function at 0x28a2871f20
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x28a2890cb8], 0
jne 0x28a2872255
mov qword [rsp + 0x20], rbx
mov byte [0x28a2890cb8], 1
call fcn.28a28769c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.28a2876ee0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x28a2871f95
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890cb0], rax
test rax, rax
je 0x28a2871f9c
lea rdx, [0x28a2872260]
lea rcx, [0x28a2890cb0]
call fcn.28a2875fa0
jmp 0x28a2871f9c
mov qword [0x28a2890cb0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a2871fdf
lea rdx, str.NtResumeThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890c98], rax
test rax, rax
je 0x28a2871fe6
lea rdx, [0x28a28724f0]
lea rcx, [0x28a2890c98]
call fcn.28a2875fa0
jmp 0x28a2871fe6
mov qword [0x28a2890c98], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a2872029
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890ce8], rax
test rax, rax
je 0x28a2872030
lea rdx, [0x28a2872630]
lea rcx, [0x28a2890ce8]
call fcn.28a2875fa0
jmp 0x28a2872030
mov qword [0x28a2890ce8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a2872073
lea rdx, str.NtQueryDirectoryFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890ca8], rax
test rax, rax
je 0x28a287207a
lea rdx, [0x28a2872a10]
lea rcx, [0x28a2890ca8]
call fcn.28a2875fa0
jmp 0x28a287207a
mov qword [0x28a2890ca8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a28720bd
lea rdx, str.NtEnumerateKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890ca0], rax
test rax, rax
je 0x28a28720c4
lea rdx, [0x28a2873030]
lea rcx, [0x28a2890ca0]
call fcn.28a2875fa0
jmp 0x28a28720c4
mov qword [0x28a2890ca0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a2872107
lea rdx, str.NtEnumerateValueKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890cc0], rax
test rax, rax
je 0x28a287210e
lea rdx, [0x28a2873120]
lea rcx, [0x28a2890cc0]
call fcn.28a2875fa0
jmp 0x28a287210e
mov qword [0x28a2890cc0], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a2872151
lea rdx, str.EnumServiceGroupW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890cc8], rax
test rax, rax
je 0x28a2872158
lea rdx, [0x28a2873210]
lea rcx, [0x28a2890cc8]
call fcn.28a2875fa0
jmp 0x28a2872158
mov qword [0x28a2890cc8], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a287219b
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890cd0], rax
test rax, rax
je 0x28a28721a2
lea rdx, [0x28a28732a0]
lea rcx, [0x28a2890cd0]
call fcn.28a2875fa0
jmp 0x28a28721a2
mov qword [0x28a2890cd0], rbx
lea rcx, str.sechost.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a28721e5
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890cd8], rax
test rax, rax
je 0x28a28721ec
lea rdx, [0x28a2873330]
lea rcx, [0x28a2890cd8]
call fcn.28a2875fa0
jmp 0x28a28721ec
mov qword [0x28a2890cd8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x28a287223b
lea rdx, str.NtDeviceIoControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x28a2890ce0], rax
test rax, rax
je 0x28a2872242
lea rdx, [0x28a28733c0]
lea rcx, [0x28a2890ce0]
call fcn.28a2875fa0
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.28a2876a30
mov qword [0x28a2890ce0], rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.28a2876a30
add rsp, 0x28
ret