Function at 0x180001f30
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x180020ca8], 0
jne 0x180002265
mov qword [rsp + 0x20], rbx
mov byte [0x180020ca8], 1
call fcn.180006a30
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.180006f50
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x180001fa5
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020ca0], rax
test rax, rax
je 0x180001fac
lea rdx, [0x180002270]
lea rcx, [0x180020ca0]
call fcn.180006010
jmp 0x180001fac
mov qword [0x180020ca0], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001fef
lea rdx, str.NtResumeThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020c88], rax
test rax, rax
je 0x180001ff6
lea rdx, [0x180002500]
lea rcx, [0x180020c88]
call fcn.180006010
jmp 0x180001ff6
mov qword [0x180020c88], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002039
lea rdx, str.NtQueryDirectoryFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cd8], rax
test rax, rax
je 0x180002040
lea rdx, [0x180002660]
lea rcx, [0x180020cd8]
call fcn.180006010
jmp 0x180002040
mov qword [0x180020cd8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002083
lea rdx, str.NtQueryDirectoryFileEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020c98], rax
test rax, rax
je 0x18000208a
lea rdx, [0x180002a40]
lea rcx, [0x180020c98]
call fcn.180006010
jmp 0x18000208a
mov qword [0x180020c98], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800020cd
lea rdx, str.NtEnumerateKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020c90], rax
test rax, rax
je 0x1800020d4
lea rdx, [0x180003070]
lea rcx, [0x180020c90]
call fcn.180006010
jmp 0x1800020d4
mov qword [0x180020c90], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002117
lea rdx, str.NtEnumerateValueKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cb0], rax
test rax, rax
je 0x18000211e
lea rdx, [0x180003160]
lea rcx, [0x180020cb0]
call fcn.180006010
jmp 0x18000211e
mov qword [0x180020cb0], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180002161
lea rdx, str.EnumServiceGroupW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cb8], rax
test rax, rax
je 0x180002168
lea rdx, [0x180003250]
lea rcx, [0x180020cb8]
call fcn.180006010
jmp 0x180002168
mov qword [0x180020cb8], rbx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800021ab
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cc0], rax
test rax, rax
je 0x1800021b2
lea rdx, [0x1800032e0]
lea rcx, [0x180020cc0]
call fcn.180006010
jmp 0x1800021b2
mov qword [0x180020cc0], rbx
lea rcx, str.sechost.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800021f5
lea rdx, str.EnumServicesStatusExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cc8], rax
test rax, rax
je 0x1800021fc
lea rdx, [0x180003370]
lea rcx, [0x180020cc8]
call fcn.180006010
jmp 0x1800021fc
mov qword [0x180020cc8], rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000224b
lea rdx, str.NtDeviceIoControlFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180020cd0], rax
test rax, rax
je 0x180002252
lea rdx, [0x180003400]
lea rcx, [0x180020cd0]
call fcn.180006010
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180006aa0
mov qword [0x180020cd0], rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp fcn.180006aa0
add rsp, 0x28
ret