Function at 0x100116e0
Capabilities:
Enumerate services
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
movsd xmm0, qword [0x1002aa48]
sub esp, 0x3c
ucomisd xmm0, qword [0x10022b30]
push ebx
push esi
push edi
lahf
test ah, 0x44
jp 0x1001228b
sub esp, 0x18
mov ecx, esp
push 5
push str.Afmyr
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa58]
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmIsUIMessageA
sub esp, 0x18
mov dword [ebp - 4], eax
mov ecx, esp
push 0xf
push str.edoohutavugesei
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa30]
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
push 4
push str.Oxme
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x10022a00]
sub esp, 8
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
add esp, 0x28
mov dword [ebp - 0xc], eax
mov ecx, esp
mov ebx, edx
push 0xa
push str.nukyyrujih
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
sub esp, 0x18
mov ecx, esp
push 4
push str.uoku
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa48]
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
mov ecx, 0xd038257
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm0, qword [0x1002aa30]
mov edi, eax
call fcn.10014e70
movsd xmm0, qword [0x1002aa28]
push edx
push eax
call fcn.10014e70
movsd xmm0, qword [0x1002aa48]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
sub esp, 0xc
mov ecx, esp
push 0xf
push str.naypzosafosetai
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
push 0
push 0x148f8161
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm0, qword [0x1002aa78]
sub esp, 0x18
fstp qword [ebp - 0x1c]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movaps xmm0, xmmword [0x10022bb0]
sub esp, 0x1c
mov ecx, esp
movups xmmword [esp + 0x18], xmm0
push 4
push str.juyv
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
push 0
push 0x25250aef
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si ecx, qword [0x1002aa30]
add esp, 0x48
mov esi, eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, eax
call fcn.10014f20
movsd xmm2, qword [0x10022b18]
mov edx, ebx
movd xmm1, edi
cvtdq2pd xmm1, xmm1
mov ecx, dword [ebp - 0xc]
divsd xmm2, xmm1
movd xmm1, esi
divsd xmm2, qword [ebp - 0x1c]
cvtdq2pd xmm1, xmm1
mulsd xmm0, xmm2
mulsd xmm0, xmm1
movsd qword [ebp - 0x2c], xmm0
movd xmm0, dword [ebp - 4]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10022960]
movsd qword [ebp - 8], xmm0
call fcn.10014f20
movsd xmm1, qword [ebp - 8]
sub esp, 8
divsd xmm1, xmm0
movsd xmm0, qword [0x1002aa78]
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa48]
movsd qword [ebp - 8], xmm1
call fcn.10014e70
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movsd xmm0, qword [0x1002aa50]
push 0
push 0xeb36984
push 0
push 0x2a847547
push 0
push 0x350bdda0
sub esp, 0x18
fstp qword [ebp - 0x10]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 8]
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fdiv qword [ebp - 0x10]
movsd xmm0, qword [0x10022b10]
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa70]
fstp qword [ebp - 0x24]
call fcn.10014e70
push edx
push eax
push 0x17557298
call sub.IMM32.dll_ImmRegisterWordA
movsd xmm0, qword [0x1002aa28]
sub esp, 0xc
fstp qword [ebp - 0x10]
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10022828]
movsd qword [ebp - 0x1c], xmm0
movsd xmm0, qword [0x1002aa78]
call ebx
sub esp, 0x18
movsd qword [ebp - 8], xmm0
movsd xmm0, qword [0x1002aa68]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa30]
add esp, 0xc
push 0
push 0x3a4e489d
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0x15e7137d
call ebx
add esp, 0x24
mov ecx, esp
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push 5
push str.Afmyr
mulsd xmm0, qword [ebp - 0x1c]
divsd xmm0, qword [ebp - 0x10]
divsd xmm0, qword [ebp - 8]
addsd xmm0, qword [0x10022a70]
addsd xmm0, qword [ebp - 0x24]
subsd xmm0, qword [ebp - 0x2c]
movsd qword [0x1002aa30], xmm0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa58]
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmIsUIMessageA
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov ecx, esp
push 0xf
push str.edoohutavugesei
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa30]
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
push 4
push str.Oxme
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x10022a00]
sub esp, 8
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
add esp, 0x28
mov dword [ebp - 4], eax
mov ecx, esp
mov ebx, edx
push 0xa
push str.nukyyrujih
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
sub esp, 0x18
mov ecx, esp
push 4
push str.uoku
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa48]
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
mov ecx, 0xd038257
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm0, qword [0x1002aa30]
mov edi, eax
call fcn.10014e70
movsd xmm0, qword [0x1002aa28]
push edx
push eax
call fcn.10014e70
movsd xmm0, qword [0x1002aa48]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
push 0xf
push str.naypzosafosetai
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
push 0
push 0x148f8161
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm0, qword [0x1002aa78]
sub esp, 0x18
fstp qword [ebp - 0x2c]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movaps xmm0, xmmword [0x10022bb0]
sub esp, 0x1c
mov ecx, esp
movups xmmword [esp + 0x18], xmm0
push 4
push str.juyv
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
push 0
push 0x25250aef
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si ecx, qword [0x1002aa30]
add esp, 0x48
mov esi, eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, eax
call fcn.10014f20
movsd xmm2, qword [0x10022b18]
mov edx, ebx
movd xmm1, edi
cvtdq2pd xmm1, xmm1
mov ecx, dword [ebp - 4]
divsd xmm2, xmm1
movd xmm1, esi
divsd xmm2, qword [ebp - 0x2c]
cvtdq2pd xmm1, xmm1
mulsd xmm0, xmm2
mulsd xmm0, xmm1
movsd qword [ebp - 0x34], xmm0
movd xmm0, dword [ebp - 0xc]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10022960]
movsd qword [ebp - 0x10], xmm0
call fcn.10014f20
movsd xmm1, qword [ebp - 0x10]
sub esp, 8
divsd xmm1, xmm0
movsd xmm0, qword [0x1002aa78]
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa48]
movsd qword [ebp - 0x10], xmm1
call fcn.10014e70
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movsd xmm0, qword [0x1002aa50]
push 0
push 0xeb36984
push 0
push 0x2a847547
push 0
push 0x350bdda0
sub esp, 0x18
fstp qword [ebp - 0x24]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
sub esp, 8
mulsd xmm0, qword [ebp - 0x10]
movsd qword [ebp - 0x2c], xmm0
fld qword [ebp - 0x2c]
fdiv qword [ebp - 0x24]
movsd xmm0, qword [0x10022b10]
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa70]
fstp qword [ebp - 0x10]
call fcn.10014e70
push edx
push eax
push 0x17557298
call sub.IMM32.dll_ImmRegisterWordA
movsd xmm0, qword [0x1002aa28]
sub esp, 0xc
fstp qword [ebp - 0x24]
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10022828]
movsd qword [ebp - 0x2c], xmm0
movsd xmm0, qword [0x1002aa78]
call edi
sub esp, 0x18
movsd qword [ebp - 0x1c], xmm0
movsd xmm0, qword [0x1002aa68]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa30]
add esp, 0xc
push 0
push 0x3a4e489d
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0x15e7137d
call edi
add esp, 0x24
mov ecx, esp
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push 5
push str.Afmyr
mulsd xmm0, qword [ebp - 0x2c]
divsd xmm0, qword [ebp - 0x24]
divsd xmm0, qword [ebp - 0x1c]
addsd xmm0, qword [0x100227b0]
addsd xmm0, qword [ebp - 0x10]
subsd xmm0, qword [ebp - 0x34]
movsd qword [0x1002aa70], xmm0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa58]
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmIsUIMessageA
mov dword [ebp - 0xc], eax
sub esp, 0x18
mov ecx, esp
push 0xf
push str.edoohutavugesei
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa30]
call fcn.10014e70
push edx
push eax
sub esp, 0x18
mov ecx, esp
push 4
push str.Oxme
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
movsd xmm0, qword [0x10022a00]
sub esp, 8
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameA]
add esp, 0x28
mov dword [ebp - 4], eax
mov ecx, esp
mov ebx, edx
push 0xa
push str.nukyyrujih
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
sub esp, 0x18
mov ecx, esp
push 4
push str.uoku
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa48]
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
mov ecx, 0xd038257
call sub.IMM32.dll_ImmGetIMEFileNameA
movsd xmm0, qword [0x1002aa30]
mov edi, eax
call fcn.10014e70
movsd xmm0, qword [0x1002aa28]
push edx
push eax
call fcn.10014e70
movsd xmm0, qword [0x1002aa48]
push edx
push eax
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
sub esp, 0xc
mov ecx, esp
push 0xf
push str.naypzosafosetai
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000ce20
push 0
push 0x148f8161
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm0, qword [0x1002aa78]
sub esp, 0x18
fstp qword [ebp - 0x34]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
movaps xmm0, xmmword [0x10022bb0]
sub esp, 0x1c
mov ecx, esp
movups xmmword [esp + 0x18], xmm0
push 4
push str.juyv
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
push 0
push 0x25250aef
call dword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si ecx, qword [0x1002aa30]
add esp, 0x48
mov esi, eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, eax
call fcn.10014f20
movsd xmm2, qword [0x10022b18]
mov edx, ebx
movd xmm1, edi
cvtdq2pd xmm1, xmm1
mov ecx, dword [ebp - 4]
divsd xmm2, xmm1
movd xmm1, esi
divsd xmm2, qword [ebp - 0x34]
cvtdq2pd xmm1, xmm1
mulsd xmm0, xmm2
mulsd xmm0, xmm1
movsd qword [ebp - 0x3c], xmm0
movd xmm0, dword [ebp - 0xc]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10022960]
movsd qword [ebp - 0x10], xmm0
call fcn.10014f20
movsd xmm1, qword [ebp - 0x10]
sub esp, 8
divsd xmm1, xmm0
movsd xmm0, qword [0x1002aa78]
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa48]
movsd qword [ebp - 0x10], xmm1
call fcn.10014e70
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movsd xmm0, qword [0x1002aa50]
push 0
push 0xeb36984
push 0
push 0x2a847547
push 0
push 0x350bdda0
sub esp, 0x18
fstp qword [ebp - 0x2c]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
sub esp, 8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x10]
movsd qword [ebp - 0x34], xmm0
fld qword [ebp - 0x34]
fdiv qword [ebp - 0x2c]
fstp qword [ebp - 0x1c]
movsd xmm0, qword [0x10022b10]
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002aa70]
call fcn.10014e70
push edx
push eax
push 0x17557298
call sub.IMM32.dll_ImmRegisterWordA
movsd xmm0, qword [0x1002aa28]
sub esp, 0xc
fstp qword [ebp - 0x2c]
mov esi, esp
movsd qword [esp + 0x18], xmm0
movsd xmm0, qword [0x1002aa68]
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
add esp, 0xc
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10022828]
movsd qword [ebp - 0x34], xmm0
movsd xmm0, qword [0x1002aa78]
call ebx
sub esp, 0x18
movsd qword [ebp - 0x24], xmm0
movsd xmm0, qword [0x1002aa68]
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x1002aa30]
add esp, 0xc
push 0
push 0x3a4e489d
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0x15e7137d
call ebx
add esp, 0x3c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x34]
divsd xmm0, qword [ebp - 0x2c]
divsd xmm0, qword [ebp - 0x24]
addsd xmm0, qword [0x10022ac8]
addsd xmm0, qword [ebp - 0x1c]
subsd xmm0, qword [ebp - 0x3c]
movsd qword [0x1002aa58], xmm0
push 0
push 0x10022410
push 0x100225b4
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret