Function at 0x180027320
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Start service

Disassembly:
push rsi
sub rsp, 0x1b0
movaps xmmword [rsp + 0x160], xmm10
call fcn.180027640
movsd xmm0, qword [0x1800b3878]
mov esi, 0xe44e0
movsd xmm10, qword [0x18009a368]
ucomisd xmm0, xmm10
jp 0x18002761f
jne 0x18002761f
movaps xmmword [rsp + 0x150], xmm11
movsd xmm11, qword [0x180098c70]
movaps xmmword [rsp + 0x140], xmm12
movsd xmm12, qword [0x180099158]
movaps xmmword [rsp + 0x130], xmm13
movsd xmm13, qword [0x180098998]
movaps xmmword [rsp + 0x120], xmm14
movsd xmm14, qword [0x180098e90]
movaps xmmword [rsp + 0x110], xmm15
movsd xmm15, qword [0x180099330]
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rdi
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm7
movaps xmmword [rsp + 0x180], xmm8
movaps xmmword [rsp + 0x170], xmm9
nop word [rax + rax]
cmp esi, 0xe44e1
jge 0x1800275c0
cvttsd2si rdx, qword [0x1800b37e8]
lea rcx, [rsp + 0x30]
call fcn.18002f2f0
cvttsd2si rdi, qword [0x1800b3878]
lea rdx, str.kaonniqeleyzat
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], 0x8907645
mov r9, rbx
mov rdx, rdi
movaps xmm2, xmm11
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
movaps xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mulsd xmm0, xmm12
lea rdx, str.yuyjapuution
lea rcx, [rsp + 0x70]
mulsd xmm6, xmm0
call fcn.1800090b0
cvttsd2si edx, qword [0x1800b3848]
mov r8, rax
mov ecx, 0x28ef1237
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x90]
cvttsd2si edi, qword [0x1800b3870]
movaps xmm7, xmm0
mulsd xmm7, xmm6
call fcn.18002f2f0
lea rdx, str.ulbyafro
mov rbx, rax
lea rcx, [rsp + 0xb0]
call fcn.1800090b0
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8d, edi
movaps xmm1, xmm13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Jaro
lea rcx, [rsp + 0xd0]
movd xmm9, eax
cvtdq2pd xmm9, xmm9
mulsd xmm9, xmm14
addsd xmm9, xmm15
addsd xmm9, xmm7
call fcn.1800090b0
mov rcx, rax
mov edx, 0x3918a6b8
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
movd xmm7, eax
cvtdq2pd xmm7, xmm7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cvttsd2si rdx, qword [0x1800b3910]
movsd xmm6, qword [0x180099b68]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
movsd xmm0, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_InitializeSid]
cvttsd2si rbx, qword [0x1800b37e8]
lea rdx, str.eqazubuuvaysu
lea rcx, [rsp + 0xf0]
movd xmm8, eax
cvtdq2pd xmm8, xmm8
mulsd xmm8, xmm6
mulsd xmm8, xmm7
call fcn.1800090b0
cvttsd2si rcx, qword [0x1800b3910]
mov r8, rax
mov r9, rbx
movsd xmm4, qword [0x180098d18]
movsd xmm1, qword [0x1800992c0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mulsd xmm0, xmm8
inc esi
addsd xmm0, xmm9
movsd qword [0x1800b3878], xmm0
ucomisd xmm0, xmm10
jp 0x1800275c0
je 0x1800273f0
mov rdi, qword [rsp + 0x1c8]
movaps xmm6, xmmword [rsp + 0x1a0]
movaps xmm7, xmmword [rsp + 0x190]
movaps xmm8, xmmword [rsp + 0x180]
movaps xmm9, xmmword [rsp + 0x170]
mov rbx, qword [rsp + 0x1c0]
movaps xmm11, xmmword [rsp + 0x150]
movaps xmm12, xmmword [rsp + 0x140]
movaps xmm13, xmmword [rsp + 0x130]
movaps xmm14, xmmword [rsp + 0x120]
movaps xmm15, xmmword [rsp + 0x110]
movaps xmm10, xmmword [rsp + 0x160]
add rsp, 0x1b0
pop rsi
jmp 0x180027a70
sub rsp, 0x28
lea rcx, [0x1800b3880]
call fcn.180008ffc
movsxd rcx, dword [0x1800b3960]
mov eax, dword [rax + rcx + 4]
mov dword [0x1800b3964], eax
add rsp, 0x28
ret