Function at 0x180030120
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x180079798]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov rsi, qword [rbp - 0x78]
lea r12, [0x180000000]
mov r14, r8
mov qword [rsp + 0x68], r8
mov ebx, edx
mov dword [rsp + 0x48], edx
mov rdi, rcx
mov r15d, edx
xor r13d, r13d
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x12c]
cmp r15d, eax
jae 0x180030413
lea eax, [r15 - 0x15]
cmp eax, 0xf7
ja case.0x1800301b2.33
movzx eax, byte [r12 + rax + 0x30b10]
mov ecx, dword [r12 + rax*4 + 0x30adc]
add rcx, r12
jmp rcx
xor r8d, r8d
xor edx, edx
mov ecx, 0x109
call fcn.18000ba90
mov r14, rax
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x44], r13d
nop
mov ebx, 0xb4
cmp ebx, 0xb4
jne 0x1800301f8
lea rax, [rsp + 0x44]
mov rcx, r14
lea r8d, [rbx - 0x43]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
call fcn.180024b90
add ebx, 0x72
cmp ebx, 0x126
jb 0x1800301d5
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp eax, 0x3e8
jl 0x1800301d0
mov r14, qword [rsp + 0x68]
add r15d, 0x19
mov ebx, dword [rsp + 0x48]
jmp 0x180030180
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
mov byte [rbp + 0x2a1], r13b
jmp 0x180030180
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
mov byte [rbp + 0x2a9], r13b
jmp 0x180030180
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
mov dword [rsp + 0x44], 0x3e9
jmp 0x180030180
mov eax, SHSetFolderPathW
jmp 0x1800302be
mov rax, qword [r14 + 0x10]
mov rsi, r13
cmp qword [rdi], rax
jae case.0x1800301b2.33
nop word [rax + rax]
mov ebx, 0x1f
mov eax, ebx
sub eax, 0x1d
je 0x1800302e4
sub eax, 1
je 0x1800302df
cmp eax, 1
jne 0x1800302e7
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
jb 0x1800302a3
mov rcx, qword [r14]
mov rax, qword [rdi]
movsx ecx, byte [rcx + rax]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
jne 0x1800302e7
mov eax, SHSetFolderPathW
add eax, 0x8976
cmp eax, 0x19c62
ja case.0x1800301b2.31
cmp eax, 0xe6
je 0x1800302b4
cmp eax, 0x8a5c
je 0x180030304
cmp eax, 0x113d2
jne 0x1800302b9
jmp 0x18003084c
inc rsi
jmp 0x1800302e7
inc qword [rdi]
dec ebx
cmp ebx, 0x1c
ja 0x180030285
mov rax, qword [r14 + 0x10]
cmp qword [rdi], rax
jb 0x180030280
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
jmp 0x180030180
mov r15d, 0x7b
mov qword [rsp + 0x50], rsi
jmp 0x1800302b9
mov rcx, qword [r14 + 8]
test rcx, rcx
je case.0x1800301b2.33
mov rax, qword [r14]
cmp rcx, qword [rax]
jne case.0x1800301b2.33
mov ebx, 0x13
nop
mov eax, ebx
sub eax, 0x12
je 0x180030356
cmp eax, 1
jne 0x18003035a
mov rax, qword [r14 + 8]
mov rcx, qword [r14]
mov rax, qword [rax + 8]
mov qword [rcx], rax
mov rcx, qword [r14 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18003035a
mov qword [r14 + 8], r13
dec ebx
cmp ebx, 0x11
ja 0x180030330
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
jmp 0x180030180
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
mov dword [rsp + 0x44], 0xffffffff
jmp 0x180030180
mov r8d, 2
mov byte [rbp + 0x2a2], r13b
lea rdx, [0x18006f30c]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 5
lea rdx, [0x18006f329]
lea rcx, [rbp + 0x2a4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
jmp 0x180030180
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
mov byte [rbp + 0x2a0], 0x57
jmp 0x180030180
mov r8d, 1
lea rdx, str.SPDY_CONTROL_FRAME_BEFORE_HEADER_BLOCK
lea rcx, [rbp + 0x2a1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov ebx, dword [rsp + 0x48]
add r15d, 0x19
jmp 0x180030180
movzx eax, byte [r14]
mov byte [rsp + 0x50], al
jmp 0x18003084c
lea edi, [rbx + 0x6cc]
mov dword [rsp + 0x7c], edi
cmp ebx, edi
jae 0x18003084c
mov rsi, qword [rbp - 0x78]
mov edx, 0x6c
movzx r15d, byte [rsp + 0x40]
movzx r13d, byte [rsp + 0x40]
movzx r12d, byte [rsp + 0x40]
lea r8d, [rdx + 0xb]
lea r9d, [rdx + 7]
lea r10d, [rdx - 0x3e]
lea r11d, [rdx - 8]
cmp ebx, 0x259
ja 0x180030548
je 0x180030510
cmp ebx, 0x137
ja 0x1800304d0
je 0x1800304b7
mov eax, ebx
sub eax, 0x15
je 0x1800304a9
sub eax, 0x91
je 0x180030490
cmp eax, 0x34
jne 0x180030ac5
mov dword [rsp + 0x44], 0x8521a1
jmp 0x180030ac5
mov dword [rbp + 0x2b0], 0x730077
mov dword [rbp + 0x2b4], 0x5f0032
jmp 0x180030ac5
mov word [rbp + 0x2a9], 0x70
jmp 0x180030ac5
mov dword [rbp + 0x2b8], 0x320033
mov dword [rbp + 0x2bc], 0x64002e
jmp 0x180030ac5
mov eax, ebx
sub eax, 0x16b
je 0x1800304fa
cmp eax, 0x5d
jne 0x180030ac5
xor eax, eax
mov dword [rbp + 0x2c0], 0x6c006c
mov word [rbp + 0x2c4], ax
jmp 0x180030ac5
mov r9, qword [rbp - 0x70]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 9]
call fcn.18002b040
jmp 0x180030ab0
xor eax, eax
lea rdx, [rbp + 0x2a0]
mov qword [rsp + 0x30], rax
mov r9d, 0x128
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp + 0x2b0]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.180033950
mov qword [rbp - 0x68], rax
jmp 0x180030ab0
cmp ebx, 0x2ea
je 0x180030a85
cmp ebx, 0x37b
je 0x18003090f
cmp ebx, 0x40c
je 0x1800305be
cmp ebx, 0x49d
je 0x180030597
cmp ebx, 0x52e
jne 0x180030ac5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xe0
call fcn.18002aac0
mov byte [rsp + 0x50], al
jmp 0x18003084c
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov rax, qword [rbp - 0x78]
cmp rax, 0xffffffffffffffff
je 0x180030ab0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180030ab0
xor eax, eax
mov r8, r14
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r9d, [rax + 0x6f]
call fcn.180040dd0
test al, al
jne 0x180030ab0
mov ebx, 0xec
cmp ebx, 0x7b88
ja 0x18003074f
je 0x180030722
cmp ebx, 0x3578
ja 0x1800306a4
je 0x180030695
cmp ebx, 0xec
je 0x18003066f
cmp ebx, 0x1270
je 0x180030648
cmp ebx, 0x23f4
jne 0x1800308f0
xor eax, eax
lea rdx, [0x18006f572]
lea rcx, [rbp + 0x316]
mov word [rbp + 0x316], ax
lea r8d, [rax + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x1800308f0
movabs rax, 0x61003c0061003c
mov qword [rbp + 0x306], rax
movabs rax, 0x61005300610053
mov qword [rbp + 0x30e], rax
jmp 0x1800308f0
xor eax, eax
lea rdx, [0x18006f5c2]
lea rcx, [rbp + 0x300]
mov word [rbp + 0x300], ax
lea r8d, [rax + 3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800308f0
mov dword [rbp + 0x31e], 0x610079
jmp 0x1800308f0
cmp ebx, 0x46fc
je 0x180030714
cmp ebx, 0x5880
je 0x1800306e8
cmp ebx, 0x6a04
jne 0x1800308f0
mov r8d, 3
lea rdx, [0x18006f3a8]
lea rcx, [rbp + 0x2d2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x2d8], ax
jmp 0x1800308f0
movzx eax, word [0x18006f490]
movsd xmm0, qword [str.INC_DB:_load__s]
mov word [rbp + 0x2d0], ax
xor eax, eax
mov word [rbp + 0x2d2], ax
movsd qword [rbp + 0x2c8], xmm0
jmp 0x1800308f0
xor eax, eax
mov word [rbp + 0x322], ax
jmp 0x1800308f0
movsd xmm0, qword [0x18006f462]
movzx eax, word [0x18006f46a]
movsd qword [rbp + 0x2d8], xmm0
mov word [rbp + 0x2e0], ax
mov dword [rbp + 0x2e2], 0x250020
jmp 0x1800308f0
cmp ebx, 0xc198
ja 0x18003081c
je 0x1800307ed
cmp ebx, 0x8d0c
je 0x1800307ad
cmp ebx, 0x9e90
je 0x180030787
cmp ebx, 0xb014
jne 0x1800308f0
mov r15b, 1
xor eax, eax
jmp 0x1800308ed
xor eax, eax
lea rdx, [0x18006f420]
lea rcx, [rbp + 0x2c8]
mov word [rbp + 0x2f2], ax
lea r8d, [rax + 4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800308f0
xor eax, eax
lea rdx, [0x18006f4d2]
lea rcx, [rbp + 0x2c8]
mov word [rbp + 0x2e6], ax
lea r8d, [rax + 3]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x18006f4f2]
mov dword [rbp + 0x2ec], eax
movzx eax, word [0x18006f4f6]
mov word [rbp + 0x2f0], ax
jmp 0x1800308f0
lea rcx, [rbp + 0x2c8]
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov word [rsp + 0x40], ax
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], eax
movups xmmword [rbp - 0x60], xmm0
jmp 0x1800308f0
cmp ebx, 0xd31c
je 0x1800308de
cmp ebx, 0xe4a0
je 0x18003087b
cmp ebx, 0xf624
jne 0x1800308f0
movzx ecx, word [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov byte [rsp + 0x50], 0
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1800596f0
mov rbx, qword [rsp + 0x598]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
mov ecx, eax
test rsi, rsi
movzx eax, r15b
cmovne ecx, eax
movzx r15d, cl
test cl, cl
je 0x1800308f0
mov r8d, 0xf01ff
lea rdx, [rbp + 0x300]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1800308bd
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r15b, r15b
jmp 0x1800308f0
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800308f0
mov r8d, dword [rsp + 0x78]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
add ebx, 0x1184
cmp ebx, 0x106bc
jbe 0x1800305e2
mov edi, dword [rsp + 0x7c]
mov ebx, dword [rsp + 0x48]
jmp 0x180030ab0
mov ecx, 0x202
lea rdx, [rbp + 0x100]
call qword [rbp - 0x68]
test eax, eax
je 0x180030ab0
mov ebx, 0xad
nop dword [rax + rax]
cmp ebx, 0x1e1d5
ja 0x180030a08
je 0x1800309c9
cmp ebx, 0xad
je 0x1800309c1
cmp ebx, 0x78f7
je 0x1800309b2
cmp ebx, 0xf141
je 0x18003099e
cmp ebx, 0x1698b
jne 0x180030a6d
mov eax, dword [0x18006f5e0]
xor ecx, ecx
movsd xmm0, qword [str.src_http:__]
mov dword [rbp + 0x338], eax
movzx eax, byte [0x18006f5e4]
mov byte [rbp + 0x33c], al
mov dword [rsp + 0x60], ecx
movsd qword [rbp + 0x330], xmm0
mov dword [rsp + 0x5c], ecx
jmp 0x180030a6d
xor eax, eax
mov qword [rsp + 0x68], 0xffffffffffffffff
mov dword [rsp + 0x64], eax
jmp 0x180030a6d
xor eax, eax
mov r13b, 1
mov qword [rsp + 0x70], rax
jmp 0x180030a6d
mov r12b, 1
jmp 0x180030a6d
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x5c]
mov edx, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_GetPaletteEntries]
cmp qword [rsp + 0x68], 0xffffffffffffffff
mov dword [rbp - 0x80], eax
jne 0x180030a6d
xor r13b, r13b
jmp 0x180030a6d
cmp ebx, 0x25a1f
je 0x180030a2d
cmp ebx, 0x2d269
je 0x180030a26
cmp ebx, 0x34ab3
je 0x18003084c
jmp 0x180030a6d
mov byte [rsp + 0x50], 0
jmp 0x180030a6d
xor eax, eax
mov ecx, eax
movzx eax, r12b
cmp dword [rbp - 0x80], ecx
cmovne ecx, eax
movzx r12d, cl
test r13b, r13b
je 0x180030a4f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FindClose]
test r12b, r12b
je 0x180030a6d
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x5c]
mov edx, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_SetPaletteEntries]
add ebx, 0x784a
cmp ebx, 0x3c250
jbe 0x180030930
mov ebx, dword [rsp + 0x48]
jmp 0x180030ab0
xor eax, eax
xor r8d, r8d
mov ecx, 0xc0000000
mov qword [rsp + 0x20], rax
lea r9d, [rax + 1]
lea edx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
mov qword [rbp - 0x78], rax
xor eax, eax
mov word [rsp + 0x58], ax
mov byte [rsp + 0x5a], al
mov edx, 0x6c
lea r8d, [rdx + 0xb]
lea r9d, [rdx + 7]
lea r10d, [rdx - 0x3e]
lea r11d, [rdx - 8]
add ebx, 0x91
mov dword [rsp + 0x48], ebx
cmp ebx, edi
jb 0x180030450
jmp 0x18003084c