Function at 0x180018f30
Capabilities:
Enumerate services
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x110]
sub rsp, 0x210
movaps xmmword [rsp + 0x1d0], xmm9
call fcn.1800195c0
movsd xmm0, qword [0x1800b3870]
mov esi, 0xbef4b
movsd xmm9, qword [0x18009a5b8]
ucomisd xmm0, xmm9
jp 0x1800195a6
jne 0x1800195a6
movaps xmmword [rsp + 0x1c0], xmm10
movsd xmm10, qword [0x180099df8]
movaps xmmword [rsp + 0x1b0], xmm11
movsd xmm11, qword [0x180098da0]
movaps xmmword [rsp + 0x1a0], xmm12
movsd xmm12, qword [0x180098c80]
movaps xmmword [rsp + 0x190], xmm13
movsd xmm13, qword [0x1800996b0]
movaps xmmword [rsp + 0x180], xmm14
movsd xmm14, qword [0x180098dc0]
movaps xmmword [rsp + 0x170], xmm15
movsd xmm15, qword [0x180099a80]
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x228], rdi
movaps xmmword [rsp + 0x200], xmm6
movaps xmmword [rsp + 0x1f0], xmm7
movaps xmmword [rsp + 0x1e0], xmm8
nop
cmp esi, 0xbef4c
jge 0x180019547
lea rdx, str.azyt
lea rcx, [rsp + 0x30]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x50]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3878]
call fcn.18002f2d0
mov rcx, rax
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x70]
movaps xmm6, xmm0
mulsd xmm6, xmm10
call fcn.18002f2f0
cvttsd2si r8, qword [0x1800b3878]
mov r9, rax
mov edx, 0x2608f66f
movaps xmm0, xmm11
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x70]
cvttsd2si rdi, qword [0x1800b3878]
mulsd xmm0, xmm6
movsd xmm6, qword [0x1800994d0]
subsd xmm6, xmm0
call fcn.18002f2f0
mov rdx, rdi
lea rcx, [rbp - 0x50]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rbx
mov r8d, 0x3b32cf6a
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xorps xmm8, xmm8
lea rdx, str.sivozes
lea rcx, [rbp - 0x30]
cvtsi2sd xmm8, rax
mulsd xmm8, xmm12
addsd xmm8, xmm6
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp - 0x10]
mov rbx, rax
call fcn.18002f2f0
movsd xmm4, qword [0x1800b37e8]
mov rdx, rax
mov r9d, 0x6c2a649
mov r8, rbx
mov ecx, 0x37d79b2f
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
movsd xmm0, qword [0x1800b37e8]
xorps xmm6, xmm6
cvttsd2si r9d, qword [0x1800b3910]
mov r8d, 0x2bb03e6f
mov dword [rsp + 0x20], 0x127775c
cvttsd2si edx, xmm0
cvtsi2sd xmm6, rax
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si rcx, qword [0x1800b37e8]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm13
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si edx, qword [0x1800b37e8]
mov r8d, 0x9d7ad42
cvttsd2si ecx, qword [0x1800b3878]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
movsd xmm0, qword [0x1800b3878]
subsd xmm8, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp + 0x10]
cvttsd2si rbx, qword [0x1800b37e8]
movaps xmm7, xmm0
mulsd xmm7, xmm14
call fcn.18002f2d0
cvttsd2si rcx, qword [0x1800b3848]
mov rdx, rax
mov r8, rbx
movsd xmm3, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x30]
cvttsd2si edi, qword [0x1800b3848]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
divsd xmm7, xmm1
call fcn.18002f2d0
lea rdx, [0x180097538]
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.1800090b0
mov rdx, rax
mov r9, rbx
mov dword [rsp + 0x20], edi
cvttsd2si rcx, qword [0x1800b3870]
movaps xmm2, xmm15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, 0x3f99c007
mov ecx, 0x1743fc7
movaps xmm6, xmm0
mov r8d, 0x2e713a41
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea rdx, str.azyt
lea rcx, [rbp + 0x50]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm6
subsd xmm8, xmm1
movsd qword [0x1800b3910], xmm8
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x30]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3878]
call fcn.18002f2d0
mov rcx, rax
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x10]
movaps xmm6, xmm0
mulsd xmm6, xmm10
call fcn.18002f2f0
cvttsd2si r8, qword [0x1800b3878]
mov r9, rax
mov edx, 0x2608f66f
movaps xmm0, xmm11
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x10]
cvttsd2si rdi, qword [0x1800b3878]
mulsd xmm0, xmm6
movsd xmm6, qword [0x180098a40]
subsd xmm6, xmm0
call fcn.18002f2f0
mov rdx, rdi
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov r9, rbx
mov r8d, 0x3b32cf6a
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xorps xmm8, xmm8
cvtsi2sd xmm8, rax
lea rdx, str.sivozes
lea rcx, [rbp - 0x50]
mulsd xmm8, xmm12
addsd xmm8, xmm6
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.18002f2f0
movsd xmm4, qword [0x1800b37e8]
mov rdx, rax
mov r9d, 0x6c2a649
mov r8, rbx
mov ecx, 0x37d79b2f
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
movsd xmm0, qword [0x1800b37e8]
xorps xmm6, xmm6
cvttsd2si r9d, qword [0x1800b3910]
mov r8d, 0x2bb03e6f
mov dword [rsp + 0x20], 0x127775c
cvttsd2si edx, xmm0
cvtsi2sd xmm6, rax
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si rcx, qword [0x1800b37e8]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm13
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si edx, qword [0x1800b37e8]
mov r8d, 0x9d7ad42
cvttsd2si ecx, qword [0x1800b3878]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
divsd xmm7, xmm0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
movsd xmm0, qword [0x1800b3878]
subsd xmm8, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
cvttsd2si rbx, qword [0x1800b37e8]
movaps xmm7, xmm0
mulsd xmm7, xmm14
call fcn.18002f2d0
cvttsd2si rcx, qword [0x1800b3848]
mov rdx, rax
mov r8, rbx
movsd xmm3, qword [0x1800b3878]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rsp + 0x50]
cvttsd2si edi, qword [0x1800b3848]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
divsd xmm7, xmm1
call fcn.18002f2d0
lea rdx, [0x180097538]
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.1800090b0
mov rdx, rax
mov r9, rbx
mov dword [rsp + 0x20], edi
cvttsd2si rcx, qword [0x1800b3870]
movaps xmm2, xmm15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, 0x3f99c007
mov ecx, 0x1743fc7
movaps xmm6, xmm0
mov r8d, 0x2e713a41
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsd xmm0, qword [0x1800b3870]
inc esi
ucomisd xmm0, xmm9
mulsd xmm1, xmm6
subsd xmm8, xmm1
movsd qword [0x1800b3910], xmm8
jp 0x180019547
je 0x180019010
mov rdi, qword [rsp + 0x228]
movaps xmm6, xmmword [rsp + 0x200]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm8, xmmword [rsp + 0x1e0]
mov rbx, qword [rsp + 0x220]
movaps xmm10, xmmword [rsp + 0x1c0]
movaps xmm11, xmmword [rsp + 0x1b0]
movaps xmm12, xmmword [rsp + 0x1a0]
movaps xmm13, xmmword [rsp + 0x190]
movaps xmm14, xmmword [rsp + 0x180]
movaps xmm15, xmmword [rsp + 0x170]
lea r11, [rsp + 0x210]
mov rsi, qword [r11 + 0x20]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret