Function at 0x140117620
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
mov r12d, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
lea rax, vtable.TAutoHandle_struct_SC_HANDLE______ptr64__struct_ServiceHandleTraits_.0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], r14
xor dil, dil
test r14, r14
je 0x14011784f
xor r13d, r13d
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x74], r13d
mov dword [rsp + 0x78], r13d
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
lea r9d, [r13 + 1]
lea r8d, [r13 + 0x30]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
jne 0x14011784f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14011784f
mov esi, dword [rsp + 0x70]
mov ecx, esi
call fcn.140368330
mov r15, rax
test rax, rax
je 0x14011784f
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
xor edx, edx
lea r9d, [r13 + 1]
lea r8d, [r13 + 0x30]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x140117846
mov rdi, r15
mov ebp, r13d
mov eax, dword [rsp + 0x74]
test eax, eax
je 0x140117843
cmp dword [rdi + 0x2c], r12d
jne 0x140117835
mov rdx, qword [rdi]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1401177a0
lea rcx, [rsp + 0x50]
call fcn.1400739a0
nop
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x10]
lea rax, [rdx + 1]
cmp rcx, rax
ja 0x1401177d7
mov rcx, rbx
call fcn.14011f190
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
lea rax, [rcx - 1]
and rax, qword [rbx + 0x18]
mov qword [rbx + 0x18], rax
add rax, rdx
dec rcx
and rcx, rax
lea rsi, [rcx*8]
mov rax, qword [rbx + 8]
cmp qword [rax + rsi], 0
jne 0x140117818
lfence
mov ecx, 0x20
call fcn.1403590cc
mov rcx, qword [rbx + 8]
mov qword [rsi + rcx], rax
mov rax, qword [rbx + 8]
mov rax, qword [rsi + rax]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
inc qword [rbx + 0x20]
mov eax, dword [rsp + 0x74]
add rdi, 0x38
inc ebp
cmp ebp, eax
jb 0x140117771
mov dil, 1
mov rcx, r15
call fcn.1403683a0
nop
test r14, r14
je 0x14011785d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret