Function at 0x140010fa0
Capabilities:
Enumerate services

Disassembly:
push rbx
push rbp
push r12
push r15
sub rsp, 0x2a8
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r15, r9
mov dword [rsp + 0x50], r8d
mov rbp, rdx
mov r12, rcx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x14001102d
test r15, r15
je 0x140011025
cmp r15, rbp
je 0x140011025
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0x100
lea r8, [rsp + 0x70]
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetServiceDisplayNameW]
mov eax, dword [rsp + 0x2f0]
lea r9, [rsp + 0x60]
mov r8, r15
mov dword [rsp + 0x60], eax
lea rdx, [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
mov rax, rbx
jmp 0x140011247
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x14001106b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov r8, rbx
mov edx, 0x4000021f
call fcn.140002950
xor eax, eax
jmp 0x140011247
test r15, r15
je 0x14001103a
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x40], rax
xor edx, edx
lea rax, [rsp + 0x58]
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x38], rax
mov rcx, r12
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea r9d, [rdx + 3]
mov dword [rsp + 0x28], 0
lea r8d, [rdx + 0x3b]
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x140011101
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov r8, rbx
mov edx, 0x40000220
call fcn.140002950
xor eax, eax
jmp 0x140011247
mov ebx, dword [rsp + 0x54]
mov qword [rsp + 0x2a0], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140011153
lea ecx, [rax + 2]
call fcn.14001c1d0
mov rcx, rax
lea r9, str.open_service__
lea r8, str.ENUM_SERVICE_STATUS_PROCESS
mov edx, 0xc00001fa
call fcn.140002950
xor eax, eax
jmp 0x14001123f
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], r13
mov r13d, dword [rsp + 0x54]
mov qword [rsp + 0x288], r14
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x40], rax
xor edx, edx
lea rax, [rsp + 0x58]
mov rcx, r12
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x3b]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov r14d, eax
test eax, eax
jne 0x1400111cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140011265
xor ebx, ebx
cmp dword [rsp + 0x58], ebx
jbe 0x140011203
nop dword [rax]
nop dword [rax + rax]
mov edi, ebx
mov rdx, rbp
imul rcx, rdi, 0x38
mov rcx, qword [rcx + rsi + 8]
call fcn.14000a0a0
test eax, eax
jne 0x1400112a7
inc ebx
cmp ebx, dword [rsp + 0x58]
jb 0x1400111e0
test r14d, r14d
je 0x140011170
mov rdx, rbp
mov r8d, dword [rsp + 0x50]
xor r9d, r9d
mov rcx, r12
mov dword [rsp + 0x20], 0
call fcn.140010fa0
mov r13, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
mov r14, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x2a8
pop r15
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov r8, rbx
mov edx, 0x40000220
call fcn.140002950
xor eax, eax
jmp 0x140011227
mov edx, dword [rsp + 0x2f0]
lea r9, [0x14002ecd8]
imul rax, rdi, 0x38
mov r8, 0xffffffffffffffff
mov rcx, r15
mov rax, qword [rax + rsi]
mov qword [rsp + 0x20], rax
call fcn.140001d80
test eax, eax
jns 0x140011315
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 2
call fcn.14001c1d0
mov rcx, rax
lea r9, str.open_service__
lea r8, str.canonical_name
mov edx, 0xc00001fa
call fcn.140002950
xor eax, eax
jmp 0x140011227
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, r15
jmp 0x14001120f