Function at 0x1800faac0
Capabilities:
Query service configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1801094f8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, rdx
mov dword [rbp - 0x1d], ecx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], 0
xor edi, edi
mov r15d, ecx
mov dword [rbp - 0x25], ecx
imul eax, ecx, 0x3ba
mov dword [rbp - 0x21], eax
cmp ecx, eax
ja 0x1800fae76
mov esi, dword [rbp - 0x21]
mov r12, qword [rbp - 1]
movzx ebx, byte [rbp - 0x29]
movzx r14d, byte [rbp - 0x29]
cmp r15d, 0x2580
ja 0x1800fae07
je 0x1800faec2
mov eax, r15d
sub eax, 0x3c
je 0x1800fac54
sub eax, 0x7d
je 0x1800fabba
cmp eax, 0x45
jne 0x1800fae5e
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x19]
xor edx, edx
xor ecx, ecx
lea r8d, [rax - 0x1a]
call fcn.1800ea5a0
test al, al
je 0x1800faeb6
mov dword [r13], 0
mov rax, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x11]
cmp rax, rcx
je 0x1800fae5e
cmp dword [rax + 8], 0
jne 0x1800fabac
inc dword [r13]
add rax, 0x20
cmp rax, rcx
jne 0x1800faba2
jmp 0x1800fae5e
xor edx, edx
xor ecx, ecx
mov r8d, 0xef
call fcn.1800f84a0
mov rsi, rax
mov edx, eax
mov byte [rbp - 0x29], 0
mov rcx, qword [r13 + 8]
mov r9, qword [r13]
mov r8, rcx
sub r8, r9
sar r8, 4
cmp rdx, r8
jae 0x1800fabfd
shl rdx, 4
add rdx, r9
mov qword [r13 + 8], rdx
mov rdi, qword [r13]
jmp 0x1800fae5e
jbe 0x1800fac4b
mov rax, qword [r13 + 0x10]
sub rax, r9
sar rax, 4
cmp rdx, rax
jbe 0x1800fac24
lea r8, [rbp - 0x29]
mov rcx, r13
call fcn.1800e5810
mov rdi, qword [r13]
jmp 0x1800fae5e
sub rdx, r8
je 0x1800fac47
xor eax, eax
nop dword [rax + rax]
mov qword [rcx], rax
mov dword [rcx + 8], 0xffffffff
mov dword [rcx + 0xc], eax
add rcx, 0x10
sub rdx, 1
jne 0x1800fac30
mov qword [r13 + 8], rcx
mov rdi, qword [r13]
jmp 0x1800fae5e
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x3b]
call fcn.1800e9e10
test al, al
jne 0x1800fae5e
mov r15d, 0xbe
nop
mov eax, r15d
sub eax, 0xba
je 0x1800fad1b
sub eax, 1
je 0x1800facfa
sub eax, 1
je 0x1800facef
sub eax, 1
je 0x1800facbb
cmp eax, 1
jne 0x1800fadf1
mov byte [rbp + 0x17], 0
lea r8d, [rax + 1]
lea rdx, [0x180103ad4]
lea rcx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x19], 0x504d43
jmp 0x1800fadf1
mov dword [rbp + 0x1c], 0x545f58
mov eax, dword [str._I64]
mov dword [rbp + 0x1f], eax
movzx eax, word [0x180103ae0]
mov word [rbp + 0x23], ax
mov eax, dword [str.32_vi]
mov dword [rbp + 0x25], eax
movzx eax, word [0x180103ae8]
mov word [rbp + 0x29], ax
jmp 0x1800fadf1
mov r14b, 1
xor r12d, r12d
jmp 0x1800fadf1
lea rax, [0x1800e8f00]
mov qword [rbp + 7], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r12, rax
jmp 0x1800fadf1
mov qword [rbp + 0xf], r13
xor ecx, ecx
movzx eax, r14b
test r12, r12
cmovne ecx, eax
mov byte [rbp - 0x29], cl
cmp cl, 0
je 0x1800fad8b
mov r8d, 0xf01ff
lea rdx, [rbp + 0x17]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r14, rax
test rax, rax
jne 0x1800fad5d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [rbp - 0x29], r14b
jmp 0x1800fad8b
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r14d, 0x6b
mov eax, r14d
sub eax, 0x6b
je 0x1800fadb4
sub eax, 0x2b
je 0x1800fada5
cmp eax, 0x7b
je 0x1800fade4
jmp 0x1800fadd4
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x7f]
call fcn.1800eb3b0
jmp 0x1800fadd4
cmp byte [0x180109cf8], 0
je 0x1800faebe
lea rcx, [rbp + 7]
call qword [0x180109cc8]
movzx ebx, al
mov byte [0x180109cf9], al
add r14d, 0xa6
cmp r14d, 0x25d
jb 0x1800fad91
test bl, bl
je 0x1800faebe
movzx r14d, byte [rbp - 0x29]
dec r15d
cmp r15d, 0xb9
ja 0x1800fac70
mov r15d, dword [rbp - 0x25]
jmp 0x1800fae5e
cmp r15d, 0x73a0
je 0x1800fae1d
cmp r15d, 0x9ec0
jne 0x1800fae5e
mov bl, 1
jmp 0x1800fae7a
xor eax, eax
test esi, esi
je 0x1800fae3e
nop dword [rax]
nop word [rax + rax]
mov dword [rdi + 8], eax
add rdi, 0x10
add eax, 2
cmp eax, esi
jb 0x1800fae30
mov eax, 1
cmp esi, eax
jbe 0x1800fae5e
nop word [rax + rax]
mov dword [rdi + 8], eax
add rdi, 0x10
add eax, 2
cmp eax, esi
jb 0x1800fae50
imul eax, dword [rbp - 0x1d], 0x9f
add r15d, eax
mov dword [rbp - 0x25], r15d
cmp r15d, dword [rbp - 0x21]
jbe 0x1800fab31
movzx ebx, byte [rbp - 0x29]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1800faeda
mov rdx, qword [rbp - 9]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800faed5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800faed5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [r13], 1
xor bl, bl
jmp 0x1800fae7a
lea rdx, [r13 + 0x48]
mov ecx, 0xd7
call fcn.1800f2c50
movzx ebx, al
jmp 0x1800fae7a
call fcn.1800fe31c
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800fe830
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret