Function at 0x140009c80
Capabilities:
Enumerate services

Disassembly:
push rsi
push rdi
sub rsp, 0x48
xor edi, edi
mov rsi, rcx
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x68], edi
cmp word [rcx], di
jne 0x140009cac
lea rcx, str.No_service_name_specified._n_n
call fcn.14000adf8
add rsp, 0x48
pop rdi
pop rsi
ret
movzx eax, byte [0x140058b2b]
mov qword [rsp + 0x40], rbp
neg al
sbb r8d, r8d
xor edx, edx
xor ecx, ecx
and r8d, 0x1000000
or r8d, 0x20004
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbp, rax
test rax, rax
jne 0x140009d02
lea rcx, str.Error_opening_Service_Control_Manager:_n
call fcn.14000adf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140005190
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret
lea rdx, str.SCMANAGER
mov rcx, rsi
call fcn.14000a6dc
test eax, eax
jne 0x140009d30
lea r8, [0x140054f20]
lea rdx, str.ScManager
mov rcx, rbp
call fcn.140009fc0
jmp 0x140009fa7
movzx eax, word [rsi]
mov qword [rsp + 0x78], rbx
cmp ax, word [0x140028838]
jne 0x140009f07
movzx eax, word [rsi + 2]
cmp ax, word [0x14002883a]
jne 0x140009f07
xor r9d, r9d
lea rax, [rsp + 0x60]
mov rcx, rbp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
lea edx, [r9 + 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
lea r8d, [r9 + 3]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov ebx, dword [rsp + 0x68]
mov ecx, ebx
call fcn.14000ac7c
mov edx, 0x30
mov rcx, rbp
mov rsi, rax
lea rax, [rsp + 0x60]
lea r8d, [rdx - 0x2d]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov r9, rsi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x140009df2
lea rcx, str.Error_enumerating_services:_n
call fcn.14000adf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140005190
mov dword [rsp + 0x60], edi
cmp dword [rsp + 0x70], edi
jbe 0x140009efa
movzx eax, byte [0x140058b2b]
lea rdx, [rdi + rdi*2]
mov rcx, rbp
neg al
sbb r8d, r8d
add rdx, rdx
mov rdx, qword [rsi + rdx*8]
and r8d, 0x1000000
bts r8d, 0x11
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140009ebf
mov rcx, qword [0x140058b18]
test rcx, rcx
je 0x140009e8c
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140009e8c
movzx eax, byte [0x140058b2b]
mov rcx, rbp
neg al
mov eax, dword [rsp + 0x60]
sbb r8d, r8d
lea rdx, [rax + rax*2]
add rdx, rdx
and r8d, 0x1000000
mov rdx, qword [rsi + rdx*8]
bts r8d, 0x11
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test rbx, rbx
jne 0x140009ebf
cmp byte [0x140058b13], 0
jne 0x140009ee6
mov eax, dword [rsp + 0x60]
lea rcx, str.Error_opening__s:_n
lea rdx, [rax + rax*2]
add rdx, rdx
mov rdx, qword [rsi + rdx*8]
call fcn.14000adf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140005190
jmp 0x140009ee6
mov eax, dword [rsp + 0x60]
lea r8, [0x140052ea0]
mov rcx, rbx
lea rdx, [rax + rax*2]
add rdx, rdx
mov rdx, qword [rsi + rdx*8]
call fcn.140009fc0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [rsp + 0x60]
inc edi
mov dword [rsp + 0x60], edi
cmp edi, dword [rsp + 0x70]
jb 0x140009e00
mov rcx, rsi
call fcn.14000ac3c
jmp 0x140009fa2
movzx eax, byte [0x140058b2b]
mov rdx, rsi
mov rcx, rbp
neg al
sbb r8d, r8d
and r8d, 0x1000000
bts r8d, 0x11
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x140009f87
mov rcx, qword [0x140058b18]
test rcx, rcx
je 0x140009f69
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x140009f69
mov r8d, 0x20000
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test rbx, rbx
jne 0x140009fa2
lea rcx, str.Error_opening__s:_n
mov rdx, rsi
call fcn.14000adf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140005190
jmp 0x140009fa2
lea r8, [0x140052ea0]
mov rdx, rsi
mov rcx, rax
call fcn.140009fc0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x78]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
ret