Function at 0x180027640
Capabilities:
Enumerate services
Query or enumerate registry value
Query service status
Start service

Disassembly:
mov rax, rsp
sub rsp, 0x108
movsd xmm0, qword [0x1800b3848]
ucomisd xmm0, qword [0x18009a378]
jp 0x180027a65
jne 0x180027a65
mov qword [rax - 8], rbx
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm13
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
movsd xmm13, qword [0x180099980]
lea rdx, str.yfiwuniuxveeyy
movaps xmm7, xmm13
lea rcx, [rsp + 0x20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call fcn.1800090b0
mov r9, rax
mov edx, 0x11f3a5bf
mov ecx, 0x3cf34b77
movsd xmm2, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xorps xmm0, xmm0
lea rdx, str.Haceypfi
lea rcx, [rsp + 0x40]
cvtsi2sd xmm0, rax
divsd xmm7, xmm0
call fcn.18000a440
lea rdx, str.apunibyqryvama
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.1800090b0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movaps xmm6, xmm0
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movaps xmm8, xmm0
lea rdx, str.hium
mulsd xmm8, xmm6
lea rcx, [rsp + 0x80]
addsd xmm8, qword [0x180098e38]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0xa0]
mov rbx, rax
call fcn.18002f2f0
movsd xmm0, qword [0x1800b3870]
mov rdx, rax
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movaps xmm6, xmm0
movsd xmm0, qword [0x18009a218]
mulsd xmm6, qword [0x180098880]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
divsd xmm7, xmm0
movsd xmm0, qword [0x180099430]
addsd xmm7, xmm8
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x18009a198]
addsd xmm0, xmm7
movsd qword [0x1800b37e8], xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
movaps xmm7, xmm13
lea rdx, str.yfiwuniuxveeyy
lea rcx, [rsp + 0xa0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm7, xmm0
call fcn.1800090b0
mov r9, rax
mov edx, 0x11f3a5bf
mov ecx, 0x3cf34b77
movsd xmm2, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
lea rdx, str.Haceypfi
lea rcx, [rsp + 0x80]
divsd xmm7, xmm0
call fcn.18000a440
lea rdx, str.apunibyqryvama
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.1800090b0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movaps xmm6, xmm0
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movaps xmm8, xmm0
lea rdx, str.hium
mulsd xmm8, xmm6
lea rcx, [rsp + 0x40]
addsd xmm8, qword [0x180098fa8]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.18002f2f0
movsd xmm0, qword [0x1800b3870]
mov rdx, rax
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movaps xmm6, xmm0
movsd xmm0, qword [0x18009a218]
mulsd xmm6, qword [0x180098880]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
divsd xmm7, xmm0
movsd xmm0, qword [0x180099430]
addsd xmm7, xmm8
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x18009a198]
addsd xmm0, xmm7
movsd qword [0x1800b37e8], xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea rdx, str.yfiwuniuxveeyy
lea rcx, [rsp + 0xa0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm13, xmm0
call fcn.1800090b0
mov r9, rax
mov edx, 0x11f3a5bf
mov ecx, 0x3cf34b77
movsd xmm2, qword [0x1800b3848]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xorps xmm0, xmm0
lea rdx, str.Haceypfi
lea rcx, [rsp + 0x80]
cvtsi2sd xmm0, rax
divsd xmm13, xmm0
call fcn.18000a440
lea rdx, str.apunibyqryvama
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.1800090b0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
movaps xmm6, xmm0
mulsd xmm6, xmm13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movaps xmm8, xmm0
lea rdx, str.hium
mulsd xmm8, xmm6
lea rcx, [rsp + 0x40]
addsd xmm8, qword [0x180098bf8]
call fcn.1800090b0
cvttsd2si rdx, qword [0x1800b3870]
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.18002f2f0
movsd xmm0, qword [0x1800b3870]
mov rdx, rax
mov r8, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
movaps xmm6, xmm0
movsd xmm0, qword [0x18009a218]
mulsd xmm6, qword [0x180098880]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
divsd xmm7, xmm0
movsd xmm0, qword [0x180099430]
addsd xmm7, xmm8
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
movaps xmm13, xmmword [rsp + 0xc0]
xorps xmm0, xmm0
movaps xmm8, xmmword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0xf0]
mov rbx, qword [rsp + 0x100]
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x18009a198]
addsd xmm0, xmm7
movaps xmm7, xmmword [rsp + 0xe0]
movsd qword [0x1800b3870], xmm0
add rsp, 0x108
ret