Function at 0x406790
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x42a33b], 0
je 0x4067b9
push str.___Killing_services..._n
call fcn.00401330
add esp, 4
push esi
push 0xf003f
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x406826
cmp byte [0x42a33b], al
je 0x4069ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push pe_nt_image_headers32
lea ecx, [ebp - 0x204]
push ecx
push 0x409
push eax
push esi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x204]
push eax
push str.____Failed_to_open_service_manager:__s
call fcn.004012f0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a70
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
lea eax, [ebp - 0x208]
push 0
push 0
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0
push eax
push 0
push 0
push 1
push 0x10
push 0
push esi
mov dword [ebp - 0x208], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4068cc
call edi
cmp eax, 0xea
je 0x4068cc
cmp byte [0x42a33b], 0
je 0x4068b4
call edi
push 0
push pe_nt_image_headers32
lea ecx, [ebp - 0x204]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x204]
push eax
push str.____Failed_to_enum_services___s
call fcn.004012f0
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a70
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x20c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x214], eax
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0x20c]
push eax
push 1
push 0x10
push 0
push esi
call ebx
test eax, eax
jne 0x406979
cmp byte [0x42a33b], al
je 0x40694c
call edi
push 0
push pe_nt_image_headers32
lea ecx, [ebp - 0x204]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x204]
push eax
push str.____Failed_to_enum_services:__s
call fcn.004012f0
add esp, 8
push dword [ebp - 0x214]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409a70
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x208]
mov eax, 0x424c20
mov dword [ebp - 0x210], eax
nop word [eax + eax]
xor edi, edi
test ebx, ebx
je 0x4069dc
mov esi, dword [ebp - 0x214]
nop dword [eax]
mov edx, dword [eax]
mov ecx, dword [esi + 4]
call fcn.00405de0
test eax, eax
jne 0x4069c1
mov edx, dword [ebp - 0x210]
mov ecx, dword [esi]
mov edx, dword [edx]
call fcn.00405de0
test eax, eax
je 0x4069ce
mov ecx, dword [esi]
call fcn.004063b0
mov ebx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x210]
inc edi
add esi, 0x2c
cmp edi, ebx
jb 0x4069a0
add eax, 4
mov dword [ebp - 0x210], eax
cmp eax, 0x424c30
jl 0x406990
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409a70
mov esp, ebp
pop ebp
ret