Function at 0x18002f310
Capabilities:
Enumerate services
Start service

Disassembly:
mov rax, rsp
push rbp
push r15
lea rbp, [rax - 0x6f8]
sub rsp, 0x7e8
movsd xmm0, qword [0x1800b3878]
mov r15, rcx
ucomisd xmm0, qword [0x18009a3c0]
mov qword [rax - 0x18], r14
mov r14d, edx
jp 0x18002fd4e
jne 0x18002fd4e
mov qword [rax + 8], rbx
lea rdx, str.ajexake
mov qword [rax + 0x10], rsi
lea rcx, [rsp + 0x30]
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
call fcn.1800090b0
lea rdx, [0x180096728]
mov rsi, rax
lea rcx, [rsp + 0x50]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rsp + 0x70]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b37e8]
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp - 0x70]
cvttsd2si edi, qword [0x1800b37e8]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x180099c78]
call fcn.18002f2d0
lea rdx, str.ojyveawopeid
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.18000a440
movsd xmm3, qword [0x1800b37e8]
mov rcx, rax
mov r8, rbx
mov dword [rsp + 0x20], edi
mov edx, 0x115c3d64
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp - 0x30]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2f0
movsd xmm1, qword [0x1800b3910]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
xorps xmm1, xmm1
lea rdx, str.Cuebyyuwyixi
lea rcx, [rbp - 0x10]
cvtsi2sd xmm1, rax
divsd xmm7, xmm1
call fcn.18000a440
lea rcx, [rbp + 0x10]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
cvttsd2si edx, qword [0x1800b3910]
mov r8, rax
mov r9, rbx
mov ecx, 0xec1bcf4
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x30]
movsd xmm8, qword [0x1800990e0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
subsd xmm8, xmm7
call fcn.18002f2f0
movsd xmm3, qword [0x1800b37e8]
mov rdx, rax
cvttsd2si rcx, xmm3
mov r8d, 0x1dbae43f
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movaps xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x180099058]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x50]
cvttsd2si rbx, qword [0x1800b3878]
mulsd xmm6, xmm1
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mulsd xmm0, xmm6
lea rdx, str.Uqnelnekgi
lea rcx, [rbp + 0x70]
subsd xmm8, xmm0
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x90]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea rdx, str.yyupsesyypwyram
lea rcx, [rbp + 0xb0]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x18009a0b0]
call fcn.18000a440
movsd xmm0, qword [0x1800987e0]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0xd0]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2d0
lea rdx, str.econo
mov rsi, rax
lea rcx, [rbp + 0xf0]
call fcn.18000a440
lea rdx, str.ybooqaccambiuz
mov rdi, rax
lea rcx, [rbp + 0x110]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x130]
mov rbx, rax
call fcn.18002f2f0
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov ecx, 0x20072ebf
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x150]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18002f2d0
lea rcx, [rbp + 0x170]
mov rsi, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x190]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3910]
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
lea rdx, str.ajexake
lea rcx, [rbp + 0x1b0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm7
subsd xmm8, xmm0
movsd qword [0x1800b3870], xmm8
call fcn.1800090b0
lea rdx, [0x180096728]
mov rsi, rax
lea rcx, [rbp + 0x1d0]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp + 0x1f0]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b37e8]
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x210]
cvttsd2si edi, qword [0x1800b37e8]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x180099c78]
call fcn.18002f2d0
lea rdx, str.ojyveawopeid
mov rbx, rax
lea rcx, [rbp + 0x230]
call fcn.18000a440
movsd xmm3, qword [0x1800b37e8]
mov rcx, rax
mov r8, rbx
mov dword [rsp + 0x20], edi
mov edx, 0x115c3d64
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x250]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2f0
movsd xmm1, qword [0x1800b3910]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
xorps xmm1, xmm1
lea rdx, str.Cuebyyuwyixi
lea rcx, [rbp + 0x270]
cvtsi2sd xmm1, rax
divsd xmm7, xmm1
call fcn.18000a440
lea rcx, [rbp + 0x290]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
cvttsd2si edx, qword [0x1800b3910]
mov r8, rax
mov r9, rbx
mov ecx, 0xec1bcf4
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x2b0]
movsd xmm8, qword [0x1800994b8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
subsd xmm8, xmm7
call fcn.18002f2f0
movsd xmm3, qword [0x1800b37e8]
mov rdx, rax
cvttsd2si rcx, xmm3
mov r8d, 0x1dbae43f
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movaps xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x2d0]
cvttsd2si rbx, qword [0x1800b3878]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x180099058]
mulsd xmm6, xmm1
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mulsd xmm0, xmm6
lea rdx, str.Uqnelnekgi
lea rcx, [rbp + 0x2f0]
subsd xmm8, xmm0
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x310]
mov rbx, rax
call fcn.18002f2f0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea rdx, str.yyupsesyypwyram
lea rcx, [rbp + 0x330]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x18009a0b0]
call fcn.18000a440
movsd xmm0, qword [0x1800987e0]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x350]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2d0
lea rdx, str.econo
mov rsi, rax
lea rcx, [rbp + 0x370]
call fcn.18000a440
lea rdx, str.ybooqaccambiuz
mov rdi, rax
lea rcx, [rbp + 0x390]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x3b0]
mov rbx, rax
call fcn.18002f2f0
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov ecx, 0x20072ebf
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x3d0]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18002f2d0
lea rcx, [rbp + 0x3f0]
mov rsi, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x410]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3910]
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
lea rdx, str.ajexake
lea rcx, [rbp + 0x430]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm7
subsd xmm8, xmm0
movsd qword [0x1800b3878], xmm8
call fcn.1800090b0
lea rdx, [0x180096728]
mov rsi, rax
lea rcx, [rbp + 0x450]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3848]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b37e8]
lea rcx, [rbp + 0x470]
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x490]
cvttsd2si edi, qword [0x1800b37e8]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x180099c78]
call fcn.18002f2d0
lea rdx, str.ojyveawopeid
mov rbx, rax
lea rcx, [rbp + 0x4b0]
call fcn.18000a440
movsd xmm3, qword [0x1800b37e8]
mov rcx, rax
mov r8, rbx
mov dword [rsp + 0x20], edi
mov edx, 0x115c3d64
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x4d0]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2f0
movsd xmm1, qword [0x1800b3910]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
xorps xmm1, xmm1
lea rdx, str.Cuebyyuwyixi
lea rcx, [rbp + 0x4f0]
cvtsi2sd xmm1, rax
divsd xmm7, xmm1
call fcn.18000a440
lea rcx, [rbp + 0x510]
mov rbx, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
cvttsd2si edx, qword [0x1800b3910]
mov r8, rax
mov r9, rbx
mov ecx, 0xec1bcf4
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x530]
movsd xmm8, qword [0x180099248]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
subsd xmm8, xmm7
call fcn.18002f2f0
movsd xmm3, qword [0x1800b37e8]
mov rdx, rax
cvttsd2si rcx, xmm3
mov r8d, 0x1dbae43f
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
movaps xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x550]
cvttsd2si rbx, qword [0x1800b3878]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x180099058]
mulsd xmm6, xmm1
call fcn.18002f2d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mulsd xmm0, xmm6
lea rdx, str.Uqnelnekgi
lea rcx, [rbp + 0x570]
subsd xmm8, xmm0
call fcn.1800090b0
mov rbx, rax
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x590]
call fcn.18002f2f0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea rdx, str.yyupsesyypwyram
lea rcx, [rbp + 0x5b0]
movd xmm6, eax
cvtdq2pd xmm6, xmm6
mulsd xmm6, qword [0x18009a0b0]
call fcn.18000a440
movsd xmm0, qword [0x1800987e0]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cvttsd2si rdx, qword [0x1800b3878]
lea rcx, [rbp + 0x5d0]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2d0
lea rdx, str.econo
mov rsi, rax
lea rcx, [rbp + 0x5f0]
call fcn.18000a440
lea rdx, str.ybooqaccambiuz
mov rdi, rax
lea rcx, [rbp + 0x610]
call fcn.18000a440
cvttsd2si rdx, qword [0x1800b3910]
lea rcx, [rbp + 0x630]
mov rbx, rax
call fcn.18002f2f0
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov ecx, 0x20072ebf
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp + 0x650]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18002f2d0
lea rcx, [rbp + 0x670]
mov rsi, rax
cvttsd2si rdx, qword [0x1800b37e8]
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rbp + 0x690]
mov rbx, rax
cvttsd2si rdi, qword [0x1800b3910]
call fcn.18002f2f0
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
movaps xmm6, xmmword [rsp + 0x7d0]
mov rdi, qword [rsp + 0x810]
mov rsi, qword [rsp + 0x808]
mov rbx, qword [rsp + 0x800]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x7c0]
subsd xmm8, xmm0
movsd qword [0x1800b37e8], xmm8
movaps xmm8, xmmword [rsp + 0x7b0]
cmp r14d, 1
mov eax, 1
mov r14, qword [rsp + 0x7e0]
jne 0x18002fd68
mov qword [0x1800b37e0], r15
add rsp, 0x7e8
pop r15
pop rbp
ret