Function at 0x459576
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4b5898]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
push 4
xor edi, edi
mov dword [ebp - 0x40], ebx
push edi
push edi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, eax
mov dword [ebp - 0x38], ecx
test ecx, ecx
jne 0x4595b0
mov eax, 0x4a5fe4
jmp 0x4597ae
push esi
mov esi, ebx
xor eax, eax
mov word [0x4b9f00], ax
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x4595be
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push edi
push edi
push 1
push 0x20
sub esi, edx
push ecx
sar esi, 1
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x45979e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x45979e
mov edi, dword [ebp - 0x10]
cmp edi, 0x40000
jae 0x45979e
inc edi
push edi
call fcn.00461754
mov ebx, eax
pop ecx
test ebx, ebx
je 0x45979e
push edi
xor eax, eax
push eax
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
mov edi, dword [ebp - 0x38]
push ebx
push 1
push 0x20
push edi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x459795
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], eax
jbe 0x459795
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov edx, dword [eax]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x34], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x3c]
jne 0x459677
sub ecx, dword [ebp - 0x34]
sar ecx, 1
cmp ecx, esi
jb 0x459728
xor eax, eax
mov dword [ebp - 0x1c], 7
push esi
push edx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], eax
call fcn.004021a0
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
cmovae eax, ecx
mov ecx, dword [ebp - 0x40]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4596e2
test dx, dx
je 0x4596de
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4596e2
add eax, 4
add ecx, 4
test dx, dx
jne 0x4596bc
xor eax, eax
jmp 0x4596e7
sbb eax, eax
or eax, 1
test eax, eax
je 0x459743
mov eax, dword [ebp - 0x1c]
cmp eax, 8
jb 0x459728
mov ecx, dword [ebp - 0x34]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], ecx
cmp eax, 0x1000
jb 0x45971f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00402710
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.00461bf2
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x38]
inc ecx
add eax, 0x24
mov dword [ebp - 8], ecx
mov dword [ebp - 0x38], eax
cmp ecx, dword [ebp - 0xc]
jb 0x45966d
jmp 0x459795
mov eax, dword [ebp - 0x38]
push dword [eax]
push 0x20
push 0x4b9f00
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, 8
jb 0x459795
mov ecx, dword [ebp - 0x30]
lea eax, [eax*2 + 2]
mov dword [ebp - 8], eax
mov dword [ebp - 0x34], ecx
cmp eax, 0x1000
jb 0x45978c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00402710
mov eax, dword [ebp - 8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.00461bf2
pop ecx
pop ecx
push ebx
call fcn.0046175d
pop ecx
jmp 0x4597a1
mov edi, dword [ebp - 0x38]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 0x4b9f00
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004619c0
leave
ret