Function at 0x180001140
Capabilities:
Extract resource via kernel32 functions
Query service status

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rbx, rcx
call fcn.1800010a0
xor r13d, r13d
xor edx, edx
xor ecx, ecx
lea r8d, [r13 + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
or rsi, 0xffffffffffffffff
test rax, rax
je 0x1800013d8
lea r8d, [r13 + 4]
lea rdx, str.Dnscache
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x1800011e3
mov dword [rsp + 0x138], r13d
lea rax, [rsp + 0x138]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 0x24]
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
cmovne r13d, dword [rsp + 0x5c]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r13d, r13d
je 0x1800013d8
xor r15d, r15d
xor r14d, r14d
mov eax, dword [0x18001c208]
test al, 1
jne 0x180001238
or eax, 1
mov dword [0x18001c208], eax
lea r8d, [r15 + 0x30]
lea rdx, [rsp + 0x90]
lea rcx, [0x180001050]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdi, qword [rsp + 0x98]
mov qword [0x18001c200], rdi
jmp 0x18000123f
mov rdi, qword [0x18001c200]
lea r8, [0x18000f230]
mov edx, 0x65
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1800012ba
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd r12, eax
test eax, eax
je 0x1800012ba
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800012ba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1800012ba
mov r14d, r12d
mov rcx, r12
call fcn.180003400
mov r15, rax
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.180003df0
mov r8, r12
mov rdx, rbp
mov rcx, r15
call fcn.180004e00
lea rcx, section..data
mov rdx, qword [section..data]
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x148], rdi
test rbx, rbx
je 0x180001326
test rbx, 0xffffffffffff0000
jne 0x180001313
movzx ebp, bx
xor edx, edx
mov ecx, ebp
call fcn.180001ad0
test rax, rax
je 0x180001343
mov r8d, ebp
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.1800018c0
mov rdi, qword [rsp + 0x148]
jmp 0x180001343
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x180001328
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x148]
call fcn.1800017c0
mov rdi, qword [rsp + 0x148]
cmp dword [rdi - 8], 1
jle 0x180001361
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x148]
call fcn.180001710
mov rdi, qword [rsp + 0x148]
movsxd r12, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, r13d
jne 0x18000137a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbp, rax
jmp 0x18000138d
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rbp, rbp
je 0x1800013be
mov qword [rsp + 0x28], rdi
lea rax, [0x18000f238]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r12
mov rdx, r15
mov rcx, rbp
call fcn.180001d70
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800013d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor r12d, r12d
xor edx, edx
xor ecx, ecx
lea r8d, [r12 + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x18000162f
lea r8d, [r12 + 4]
lea rdx, str.DcomLaunch
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x180001451
mov dword [rsp + 0x140], r12d
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 0x24]
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
cmovne r12d, dword [rsp + 0x84]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r12d, r12d
je 0x18000162f
xor r14d, r14d
xor r15d, r15d
mov eax, dword [0x18001c208]
test al, 1
jne 0x1800014a6
or eax, 1
mov dword [0x18001c208], eax
lea r8d, [r14 + 0x30]
lea rdx, [rsp + 0xc0]
lea rcx, [0x180001050]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdi, qword [rsp + 0xc8]
mov qword [0x18001c200], rdi
jmp 0x1800014ad
mov rdi, qword [0x18001c200]
lea r8, [0x18000f230]
mov edx, 0x65
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x180001528
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movsxd r13, eax
test eax, eax
je 0x180001528
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180001528
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x180001528
mov r15d, r13d
mov rcx, r13
call fcn.180003400
mov r14, rax
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.180003df0
mov r8, r13
mov rdx, rbp
mov rcx, r14
call fcn.180004e00
lea rcx, section..data
mov rdx, qword [section..data]
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
test rbx, rbx
je 0x18000158b
test rbx, 0xffffffffffff0000
jne 0x180001578
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.180001ad0
test rax, rax
je 0x1800015a2
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800018c0
mov rdi, qword [rsp + 0x30]
jmp 0x1800015a2
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x18000158d
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800017c0
mov rdi, qword [rsp + 0x30]
cmp dword [rdi - 8], 1
jle 0x1800015ba
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x30]
call fcn.180001710
mov rdi, qword [rsp + 0x30]
movsxd rbp, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, r12d
jne 0x1800015d3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
jmp 0x1800015e6
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rbx, rbx
je 0x180001617
mov qword [rsp + 0x28], rdi
lea rax, [0x18000f258]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call fcn.180001d70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x18000162f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret