Function at 0x18000ca80
Capabilities:
Enumerate services
Query or enumerate registry value

Disassembly:
jmp 0x18000ca80
mov rax, rsp
mov qword [rax + 0x18], rsi
push rbp
lea rbp, [rax - 0xc8]
sub rsp, 0x1c0
movsd xmm0, qword [0x1800b3878]
mov esi, 0xbb980
movaps xmmword [rax - 0x48], xmm9
movsd xmm9, qword [0x18009a520]
ucomisd xmm0, xmm9
jp 0x18000cf5a
jne 0x18000cf5a
movaps xmmword [rax - 0x58], xmm10
movsd xmm10, qword [0x18009a298]
movaps xmmword [rax - 0x68], xmm11
movsd xmm11, qword [0x180099170]
movaps xmmword [rax - 0x78], xmm12
movsd xmm12, qword [0x1800996f8]
movaps xmmword [rax - 0x88], xmm13
movsd xmm13, qword [0x1800995a8]
movaps xmmword [rax - 0x98], xmm14
movsd xmm14, qword [0x180099138]
movaps xmmword [rax - 0xa8], xmm15
movsd xmm15, qword [0x18009a1c8]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
cmp esi, 0xbb981
jge 0x18000cefb
lea rdx, str.ifoehiiog
lea rcx, [rsp + 0x20]
call fcn.1800090b0
movsd xmm1, qword [0x1800b3910]
mov r8, rax
mov ecx, 0x185e73da
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
movaps xmm6, xmm10
lea rdx, str.iyuyegoybyv
lea rcx, [rsp + 0x40]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
mov rcx, rax
movsd xmm1, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
movsd xmm6, qword [0x180099178]
subsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x60]
movd xmm8, eax
cvtdq2pd xmm8, xmm8
mulsd xmm8, xmm11
addsd xmm8, xmm6
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x80]
mov rdi, rax
cvttsd2si ebx, qword [0x1800b3870]
call fcn.18002f2f0
mov rcx, rax
mov r8, rdi
mov edx, ebx
movsd xmm3, qword [0x1800b3910]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
movaps xmm6, xmm12
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x60]
cvttsd2si ebx, qword [0x1800b3848]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm8, xmm6
call fcn.18002f2f0
mov rdx, rax
mov r9d, ebx
movaps xmm2, xmm13
mov ecx, 0x21bcae6e
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cvttsd2si edx, qword [0x1800b37e8]
mov ecx, 0x3f549ab2
movaps xmm6, xmm0
mulsd xmm6, xmm14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm1, xmm1
lea rdx, str.carymyyvecyyuy
lea rcx, [rbp - 0x40]
cvtsi2sd xmm1, rax
divsd xmm6, xmm1
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x20]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call fcn.18002f2f0
lea rdx, str.couhysauu
mov rbx, rax
lea rcx, [rbp]
call fcn.18000a440
mov rcx, rax
mov r9, rbx
mov r8d, 0x3c3e2d83
movaps xmm1, xmm15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
divsd xmm6, xmm0
lea rdx, str.ifoehiiog
lea rcx, [rbp]
subsd xmm8, xmm6
movsd qword [0x1800b3878], xmm8
call fcn.1800090b0
movsd xmm1, qword [0x1800b3910]
mov r8, rax
mov ecx, 0x185e73da
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
movaps xmm6, xmm10
lea rdx, str.iyuyegoybyv
lea rcx, [rbp - 0x20]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
call fcn.18000a440
mov rcx, rax
movsd xmm1, qword [0x1800b3870]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, xmm6
movsd xmm6, qword [0x180099078]
subsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x40]
movd xmm8, eax
cvtdq2pd xmm8, xmm8
mulsd xmm8, xmm11
addsd xmm8, xmm6
call fcn.18002f2d0
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rbp - 0x60]
mov rdi, rax
cvttsd2si ebx, qword [0x1800b3870]
call fcn.18002f2f0
mov rcx, rax
mov r8, rdi
mov edx, ebx
movsd xmm3, qword [0x1800b3910]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
movaps xmm6, xmm12
cvtsi2sd xmm0, rax
divsd xmm6, xmm0
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
cvttsd2si rdx, qword [0x1800b3848]
lea rcx, [rbp - 0x80]
cvttsd2si ebx, qword [0x1800b3848]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm6, xmm0
subsd xmm8, xmm6
call fcn.18002f2f0
mov rdx, rax
mov r9d, ebx
movaps xmm2, xmm13
mov ecx, 0x21bcae6e
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cvttsd2si edx, qword [0x1800b37e8]
mov ecx, 0x3f549ab2
movaps xmm6, xmm0
mulsd xmm6, xmm14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm1, xmm1
lea rdx, str.carymyyvecyyuy
lea rcx, [rsp + 0x60]
cvtsi2sd xmm1, rax
divsd xmm6, xmm1
call fcn.1800090b0
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cvttsd2si rdx, qword [0x1800b3870]
lea rcx, [rsp + 0x40]
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
mulsd xmm7, xmm6
call fcn.18002f2f0
lea rdx, str.couhysauu
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.18000a440
mov rcx, rax
mov r9, rbx
mov r8d, 0x3c3e2d83
movaps xmm1, xmm15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, xmm7
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
divsd xmm6, xmm0
inc esi
movsd xmm0, qword [0x1800b3878]
ucomisd xmm0, xmm9
subsd xmm8, xmm6
movsd qword [0x1800b3848], xmm8
jp 0x18000cefb
je 0x18000cb34
mov rdi, qword [rsp + 0x1d8]
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1a0]
movaps xmm8, xmmword [rsp + 0x190]
mov rbx, qword [rsp + 0x1d0]
movaps xmm10, xmmword [rsp + 0x170]
movaps xmm11, xmmword [rsp + 0x160]
movaps xmm12, xmmword [rsp + 0x150]
movaps xmm13, xmmword [rsp + 0x140]
movaps xmm14, xmmword [rsp + 0x130]
movaps xmm15, xmmword [rsp + 0x120]
lea r11, [rsp + 0x1c0]
mov rsi, qword [r11 + 0x20]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret