Function at 0x180002f70
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.advapi32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rbx, rbx
je 0x1800030e5
lea rdx, str.CreateProcessA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053cd0]
mov rcx, rbx
mov qword [0x18006bbe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053ce0]
mov rcx, rbx
mov qword [0x18006bbf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053cf0]
mov rcx, rbx
mov qword [0x18006bbf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053d00]
mov rcx, rbx
mov qword [0x18006bc00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053d10]
mov rcx, rbx
mov qword [0x18006bc08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053d20]
mov rcx, rbx
mov qword [0x18006bc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053d30]
mov rcx, rbx
mov qword [0x18006bc20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053d40]
mov rcx, rbx
mov qword [0x18006bc28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053d58]
mov rcx, rbx
mov qword [0x18006bc30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053d68]
mov rcx, rbx
mov qword [0x18006bc38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CopyFileA
mov rcx, rbx
mov qword [0x18006bc40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rbx
mov qword [0x18006bc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Wow64RevertWow64FsRedirection
mov rcx, rbx
mov qword [0x18006bbd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18006bbe0], rax
test rdi, rdi
je 0x18000325e
lea rdx, str.OpenSCManagerA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateServiceA
mov rcx, rdi
mov qword [0x18006bc48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ControlService
mov rcx, rdi
mov qword [0x18006bc50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteService
mov rcx, rdi
mov qword [0x18006bc58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CloseServiceHandle
mov rcx, rdi
mov qword [0x18006bc60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.StartServiceA
mov rcx, rdi
mov qword [0x18006bc68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.OpenServiceA
mov rcx, rdi
mov qword [0x18006bc70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053e40]
mov rcx, rdi
mov qword [0x18006bc78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053e50]
mov rcx, rdi
mov qword [0x18006bc98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053e60]
mov rcx, rdi
mov qword [0x18006bca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053e78]
mov rcx, rdi
mov qword [0x18006bca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053e88]
mov rcx, rdi
mov qword [0x18006bcb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053e98]
mov rcx, rdi
mov qword [0x18006bcb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053eb0]
mov rcx, rdi
mov qword [0x18006bc80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180053ec8]
mov rcx, rdi
mov qword [0x18006bc88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegRestoreKeyA
mov rcx, rdi
mov qword [0x18006bc90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18006bcc0], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret