Function at 0x1800397e0
Capabilities:
Create service
Delete service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x18009a1f0]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x78], rdx
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], al
mov r9d, ecx
imul esi, ecx, 0x451
cmp ecx, esi
ja 0x180039a87
mov dword [rsp + 0x74], 0xffef
lea r15d, [rax + 0x66]
lea r13d, [rax + 0x32]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x78]
mov r11, qword [rsp + 0x78]
mov r10, qword [rsp + 0x78]
mov edi, dword [rsp + 0x74]
mov eax, 0x44
cmp r9d, 0x2894
ja 0x18003995a
je 0x180039950
cmp r9d, 0x5ac
ja 0x180039907
je 0x1800398ff
cmp r9d, 0x16
je 0x1800398e7
cmp r9d, 0x35
je 0x1800398db
cmp r9d, 0x69
je 0x1800398c1
cmp r9d, 0x11b
jne 0x180039a78
mov rdx, qword [r14 + 0x10]
sub rdx, qword [rbx + 0x10]
mov r8, qword [r14 + 8]
sub r8, qword [rbx + 8]
jmp 0x180039a78
mov ax, word [0x40002804]
and ax, word [rsp + 0x74]
mov word [0x40002804], ax
jmp 0x180039a78
mov dword [rbp - 0x10], 0x690066
jmp 0x180039a78
mov eax, dword [0x40010414]
test dword [r14], eax
mov edi, 0
setne dil
jmp 0x180039a78
mov dword [rbp - 0x80], edi
jmp 0x180039a78
cmp r9d, 0xb42
je case.0x180039ad8.0
cmp r9d, 0xdaa
je 0x180039936
cmp r9d, 0x1b1f
jne 0x180039a78
mov dword [rbp], 0x5f0067
jmp 0x180039a78
mov dword [rbp - 0xc], 0x74006c
mov dword [rbp - 8], 0x720065
mov dword [rbp - 4], 0x6e0069
jmp 0x180039a78
mov word [rbp + 4], r15w
jmp 0x180039a78
cmp r9d, 0x5e68
ja 0x1800399cc
je 0x1800399c3
cmp r9d, 0x3609
je 0x1800399b7
cmp r9d, 0x437e
je 0x1800399a2
cmp r9d, 0x48f6
je 0x180039997
cmp r9d, 0x50f3
jne 0x180039a78
mov word [rbp + 0x10], r13w
jmp 0x180039a78
mov r11, qword [r14]
sub r11, qword [rbx]
jmp 0x180039a78
mov dword [rbp + 0xa], 0x650074
mov eax, 0x72
mov word [rbp + 0xe], ax
jmp 0x180039a78
mov dword [rbp + 6], 0x6c0069
jmp 0x180039a78
mov word [rbp + 0x12], ax
jmp 0x180039a78
cmp r9d, 0x6bdd
je 0x180039a72
cmp r9d, 0x90d1
je 0x180039a5f
cmp r9d, 0xd8ac
jne 0x180039a78
mov rax, r10
sub rax, r11
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x180092420]
xorps xmm0, xmm0
cvtsi2sd xmm0, r10
divsd xmm1, xmm0
movsd qword [rbp - 0x80], xmm1
mov rbx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x180039fea
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039fe5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180039fe5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r10, [r8 + rdx]
test r10, r10
jne 0x180039a78
xorps xmm0, xmm0
movsd qword [rbp - 0x80], xmm0
jmp case.0x180039ad8.0
xor eax, eax
mov word [rbp + 0x14], ax
imul eax, ecx, 0x41
add r9d, eax
cmp r9d, esi
jbe 0x18003986a
lea ebx, [rcx - 0x11]
mov dword [rsp + 0x74], ebx
cmp ecx, ebx
jbe case.0x180039ad8.0
lea r13d, [rcx - 0x25]
lea rdx, [0x180000000]
mov edi, 0x63
mov esi, 0x3a22
lea r10d, [rdi - 0x41]
mov r11d, 0x7063
lea r8d, [rdi - 0x37]
lea r9d, [rdi - 0x18]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x78]
cmp r13d, 0x10
ja case.0x180039ad8.6
mov ecx, dword [rdx + r13*4 + 0x3a028]
add rcx, rdx
jmp rcx
mov word [rbp - 0x17], r10w
mov word [rbp - 0x16], r11w
jmp case.0x180039ad8.6
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x4f]
call fcn.180020b10
lea rdx, [0x180000000]
mov r8d, 0x2c
lea r9d, [r8 + 0x1f]
lea r10d, [r8 - 0xa]
mov r11d, 0x7063
jmp case.0x180039ad8.6
cmp byte [rsp + 0x70], 0
je 0x180039b3b
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x126
mov rdx, qword [0x18009a2b0]
lea rcx, [rbp - 0x78]
call fcn.18004a470
mov byte [rbp - 0x80], al
jmp 0x180039b02
mov edx, 0xf6
xor ecx, ecx
call fcn.180024fe0
mov rcx, rax
lea r9, [rbp - 0x23]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x180039b70
xor eax, eax
mov esi, eax
mov qword [rbp - 0x48], rax
mov edi, 0xf
mov qword [rbp - 0x40], rdi
mov byte [rbp - 0x58], al
lea rax, [rbp - 0x23]
cmp r9, rax
je 0x180039bd1
lea r8, [rbp - 0x23]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x58]
call fcn.180052d30
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x48]
lea r9, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x10
cmovae r9, r14
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x180039c24
lea rax, [rcx + rsi]
mov qword [rbp - 0x68], rax
lea rbx, [rbp - 0x78]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x78]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
mov ebx, dword [rsp + 0x74]
jmp 0x180039c40
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x78]
call fcn.18001e310
mov rdi, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x10
jb 0x180039c77
lea rdx, [rdi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x180039c6f
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039fde
mov rcx, r14
call fcn.1800826c0
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x70]
test r12, r12
cmovne ecx, eax
mov byte [rsp + 0x70], cl
mov r14, qword [rsp + 0x78]
mov edi, 0x63
mov esi, 0x3a22
jmp 0x180039b02
lea rcx, [r14 + 0x48]
mov dword [rsp + 0x28], 0x42
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x78]
call fcn.1800743f0
lea rdx, [r14 + 0xa8]
lea r8, [rbp - 0x78]
lea ecx, [r12 + 0x70]
call fcn.1800220f0
jmp 0x180039b02
mov dword [rbp + 0x2a], 0x53003a
xor eax, eax
mov word [rbp + 0x2e], ax
jmp case.0x180039ad8.6
mov dword [rbp + 0x1e], 0x490064
mov dword [rbp + 0x22], 0x2a002a
jmp case.0x180039ad8.6
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
cmp rcx, rdx
jae 0x180039d34
lea rax, [rcx + 1]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x78]
mov word [rax + rcx], 0x7d
lea rdx, [0x180000000]
jmp case.0x180039ad8.6
mov r9b, 0x7d
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x78]
call fcn.18001e1b0
jmp 0x180039b02
mov dword [rbp + 0x26], 0x640049
jmp case.0x180039ad8.6
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], al
lea r8d, [rax + 0x11]
lea rdx, str._method_:_login_
lea rcx, [rbp - 0x58]
call fcn.180052d30
nop
lea rsi, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r15, qword [rbp - 0x40]
cmp r15, 0x10
cmovae rsi, r14
mov rdi, qword [rbp - 0x48]
cmp rdi, 0x10
jae 0x180039dac
movups xmm6, xmmword [rsi]
mov qword [rbp - 0x20], 0xf
jmp 0x180039e2d
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180039e00
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003a01f
mov rcx, rax
call fcn.180082684
mov rcx, rax
test rax, rax
je 0x180039fd7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180039e0e
test rcx, rcx
je 0x180039e0c
call fcn.180082684
jmp 0x180039e0e
xor eax, eax
mov qword [rbp - 0x38], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x20], rbx
movups xmm6, xmmword [rbp - 0x38]
mov ebx, dword [rsp + 0x74]
mov qword [rbp - 0x28], rdi
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x180039e6c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039e67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039fd7
call fcn.1800826c0
movups xmmword [rbp - 0x78], xmm6
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x68], xmm0
cmp r15, 0x10
jb 0x180039eaf
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x180039ea7
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039fde
mov rcx, r14
call fcn.1800826c0
xor eax, eax
mov r15d, eax
mov r14, qword [rsp + 0x78]
lea edi, [rax + 0x63]
mov esi, 0x3a22
jmp 0x180039b02
mov byte [rsp + 0x70], 1
jmp case.0x180039ad8.6
mov word [rbp - 0x18], r8w
jmp case.0x180039ad8.6
mov word [rbp + 0x18], r9w
mov dword [rbp + 0x1a], 0x3a0053
jmp case.0x180039ad8.6
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x180039ef6
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180039f43
lea rax, [rcx + rdi]
mov qword [rbp - 0x68], rax
lea rbx, [rbp - 0x78]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x78]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp - 0x18]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov ebx, dword [rsp + 0x74]
jmp 0x180039f5b
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x18]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.18001e310
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, [rbp + 0x18]
lea rdx, [rbp - 0x10]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r12, rax
mov edi, 0x63
jmp 0x180039b02
mov word [rbp - 0x14], di
mov word [rbp - 0x13], si
mov byte [rbp - 0x11], 0
dec r13d
lea eax, [r13 + 0x25]
cmp eax, ebx
jbe case.0x180039ad8.0
jmp 0x180039ac3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1800826c0
mov rax, rbx
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.180082e70
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18004db20
nop
nop dword [rax]
invalid