Function at 0x1800195c0
Capabilities:
Enumerate services
Query or enumerate registry key
Query or enumerate registry value
Query service status
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x138]
sub rsp, 0x230
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
call fcn.18001a160
movsd xmm0, qword [0x1800b37e8]
ucomisd xmm0, qword [0x18009a610]
jp 0x180019c86
jne 0x180019c86
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x1f0], xmm9
movaps xmmword [rsp + 0x1e0], xmm10
movaps xmmword [rsp + 0x1d0], xmm11
movaps xmmword [rsp + 0x1c0], xmm12
movaps xmmword [rsp + 0x1b0], xmm13
call fcn.18002f2f0
movsd xmm12, qword [0x180098bd0]
mov edx, 0x3513b82b
movsd xmm2, qword [0x1800b3870]
movaps xmm3, xmm12
movsd xmm0, qword [0x1800b3848]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x50]
movsd xmm11, qword [0x180099590]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm11
call fcn.18002f2f0
cvttsd2si edx, qword [0x1800b3878]
mov r9, rax
mov r8d, 0x174415f7
cvttsd2si rcx, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
lea rdx, str.Ifudi
lea rcx, [rsp + 0x70]
divsd xmm6, xmm0
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsd xmm13, qword [0x180099ea8]
lea rdx, str.ejxikyadigueufe
cvttsd2si ebx, qword [0x1800b3848]
lea rcx, [rbp - 0x50]
cvttsd2si edi, qword [0x1800b3878]
movaps xmm7, xmm13
divsd xmm7, xmm0
addsd xmm7, qword [0x180099da0]
addsd xmm7, xmm6
call fcn.18000a440
movsd xmm9, qword [0x1800989b0]
mov rcx, rax
movaps xmm3, xmm9
mov r8d, ebx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
movsd xmm10, qword [0x180099ab0]
xorps xmm0, xmm0
cvttsd2si r9d, qword [0x1800b3870]
mov r8d, 0x33206c28
cvttsd2si edx, qword [0x1800b3910]
cvttsd2si rcx, qword [0x1800b3910]
cvtsi2sd xmm0, rax
movaps xmm1, xmm10
divsd xmm1, xmm0
subsd xmm7, xmm1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x30]
movsd xmm8, qword [0x180099aa0]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm8
call fcn.18002f2d0
movsd xmm0, qword [0x1800b37e8]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
divsd xmm6, xmm0
addsd xmm6, xmm7
movsd qword [0x1800b3848], xmm6
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x30]
call fcn.18002f2f0
movsd xmm2, qword [0x1800b3870]
movaps xmm3, xmm12
movsd xmm0, qword [0x1800b3848]
mov edx, 0x3513b82b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x50]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm11
call fcn.18002f2f0
cvttsd2si edx, qword [0x1800b3878]
mov r9, rax
mov r8d, 0x174415f7
cvttsd2si rcx, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
lea rdx, str.Ifudi
lea rcx, [rbp - 0x70]
divsd xmm6, xmm0
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cvttsd2si ebx, qword [0x1800b3848]
lea rdx, str.ejxikyadigueufe
lea rcx, [rsp + 0x50]
cvttsd2si edi, qword [0x1800b3878]
movaps xmm7, xmm13
divsd xmm7, xmm0
addsd xmm7, qword [0x180099ae8]
addsd xmm7, xmm6
call fcn.18000a440
mov rcx, rax
movaps xmm3, xmm9
mov r8d, ebx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cvttsd2si r9d, qword [0x1800b3870]
mov r8d, 0x33206c28
cvttsd2si edx, qword [0x1800b3910]
cvttsd2si rcx, qword [0x1800b3910]
xorps xmm0, xmm0
movaps xmm1, xmm10
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
subsd xmm7, xmm1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x30]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm8
call fcn.18002f2d0
movsd xmm0, qword [0x1800b37e8]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x30]
divsd xmm6, xmm0
addsd xmm6, xmm7
movsd qword [0x1800b37e8], xmm6
call fcn.18002f2f0
movsd xmm2, qword [0x1800b3870]
movaps xmm3, xmm12
movsd xmm0, qword [0x1800b3848]
mov edx, 0x3513b82b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x50]
mulsd xmm6, xmm11
call fcn.18002f2f0
cvttsd2si edx, qword [0x1800b3878]
mov r9, rax
mov r8d, 0x174415f7
cvttsd2si rcx, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
lea rdx, str.Ifudi
lea rcx, [rbp - 0x70]
divsd xmm6, xmm0
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cvttsd2si ebx, qword [0x1800b3848]
lea rdx, str.ejxikyadigueufe
lea rcx, [rsp + 0x50]
cvttsd2si edi, qword [0x1800b3878]
movaps xmm7, xmm13
divsd xmm7, xmm0
addsd xmm7, qword [0x180098b00]
addsd xmm7, xmm6
call fcn.18000a440
mov rcx, rax
movaps xmm3, xmm9
mov r8d, ebx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cvttsd2si r9d, qword [0x1800b3870]
mov r8d, 0x33206c28
cvttsd2si edx, qword [0x1800b3910]
cvttsd2si rcx, qword [0x1800b3910]
xorps xmm0, xmm0
movaps xmm1, xmm10
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
subsd xmm7, xmm1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x30]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm8
call fcn.18002f2d0
movsd xmm0, qword [0x1800b37e8]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x30]
divsd xmm6, xmm0
addsd xmm6, xmm7
movsd qword [0x1800b3910], xmm6
call fcn.18002f2f0
movsd xmm2, qword [0x1800b3870]
movaps xmm3, xmm12
movsd xmm0, qword [0x1800b3848]
mov edx, 0x3513b82b
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x50]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm11
call fcn.18002f2f0
cvttsd2si edx, qword [0x1800b3878]
mov r9, rax
mov r8d, 0x174415f7
cvttsd2si rcx, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
divsd xmm6, xmm0
lea rdx, str.Ifudi
lea rcx, [rbp - 0x70]
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call fcn.18002f2f0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cvttsd2si ebx, qword [0x1800b3848]
lea rdx, str.ejxikyadigueufe
lea rcx, [rsp + 0x50]
cvttsd2si edi, qword [0x1800b3878]
divsd xmm13, xmm0
addsd xmm13, qword [0x180099580]
addsd xmm13, xmm6
call fcn.18000a440
mov rcx, rax
movaps xmm3, xmm9
mov r8d, ebx
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cvttsd2si r9d, qword [0x1800b3870]
mov r8d, 0x33206c28
cvttsd2si edx, qword [0x1800b3910]
cvttsd2si rcx, qword [0x1800b3910]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm10, xmm0
subsd xmm13, xmm10
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x30]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, xmm8
call fcn.18002f2d0
movsd xmm0, qword [0x1800b37e8]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
movaps xmm12, xmmword [rsp + 0x1c0]
movaps xmm11, xmmword [rsp + 0x1d0]
movaps xmm10, xmmword [rsp + 0x1e0]
movaps xmm9, xmmword [rsp + 0x1f0]
divsd xmm6, xmm0
addsd xmm6, xmm13
movaps xmm13, xmmword [rsp + 0x1b0]
movsd qword [0x1800b3910], xmm6
movsd xmm0, qword [0x1800b3878]
ucomisd xmm0, qword [0x18009a580]
jp 0x180019f4e
jne 0x180019f4e
movsd xmm0, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp - 0x30]
movsd xmm8, qword [0x18009a280]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x180099f40]
subsd xmm8, xmm0
call fcn.18002f2d0
cvttsd2si rcx, qword [0x1800b3878]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, 0x9a9dc67
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
movsd xmm1, qword [0x180098f98]
lea rdx, str.eqyq
lea rcx, [rbp - 0x50]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
mulsd xmm1, xmm6
subsd xmm8, xmm1
call fcn.18000a440
movsd xmm3, qword [0x1800b3870]
mov rdx, rax
movsd xmm0, qword [0x1800b3910]
mov r8d, 0xc81dbf3
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movsd xmm7, qword [0x1800991e8]
lea rdx, str.goseaqmei
cvttsd2si rbx, qword [0x1800b3878]
lea rcx, [rbp - 0x70]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18000a440
movsd xmm1, qword [0x1800b3848]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
subsd xmm8, xmm7
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rsp + 0x50]
mov rdi, rax
call fcn.18002f2f0
lea rdx, str.soswuijyvriaki
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.1800090b0
mov rcx, rax
mov r9, rdi
mov r8d, 0x19f1d8fb
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xorps xmm7, xmm7
mov ecx, 0x339f6ceb
cvtsi2sd xmm7, rax
mulsd xmm7, qword [0x180099c10]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x10]
divsd xmm7, xmm0
addsd xmm7, xmm8
call fcn.18002f2f0
lea rdx, str.eroay
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.1800090b0
mov rcx, rax
mov dword [rsp + 0x20], 0x8e4cf6e
mov r9d, 0x3111fd5c
mov r8d, 0x2403eb27
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cvttsd2si rbx, qword [0x1800b3910]
lea rdx, str.etbug
lea rcx, [rbp + 0x30]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x180099a00]
call fcn.18000a440
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp + 0x50]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18002f2d0
lea rcx, [rbp + 0x70]
mov rdi, rax
cvttsd2si rdx, qword [0x1800b3878]
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.18002f2d0
movsd xmm2, qword [0x180099220]
mov rcx, rax
movsd xmm1, qword [0x180099140]
mov r9, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cvttsd2si rcx, qword [0x1800b3878]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
addsd xmm6, xmm7
movsd qword [0x1800b3910], xmm6
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rbp
ret