Function at 0x140008f80
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x14008d040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x50], 1
xor r14d, r14d
mov qword [rcx], r14
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
mov qword [rcx + 0x18], r14
mov qword [rcx + 0x20], r14
lea r8d, [r14 + 0xe]
lea rdx, str.Service_list:
call fcn.140005310
nop
mov dword [rsp + 0x50], 1
xor edx, edx
xor ecx, ecx
lea r8d, [r14 + 5]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbp, rax
test rax, rax
jne 0x140009013
lea r8d, [r14 + 0x1f]
lea rdx, str.Failed_to_open_service_manager_n
mov rcx, rdi
call fcn.1400041a0
jmp 0x14000921d
mov dword [rsp + 0x90], r14d
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor edx, edx
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
mov ebx, dword [rsp + 0x8c]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1400090a2
lea r8d, [rax + 0x27]
lea rdx, str.Failed_to_allocate_memory_for_services_n
mov rcx, rdi
call fcn.1400041a0
jmp 0x14000921d
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
xor edx, edx
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
test eax, eax
jne 0x14000910d
lea r8d, [rax + 0x1d]
lea rdx, str.Failed_to_enumerate_services_n
mov rcx, rdi
call fcn.1400041a0
jmp 0x14000921d
mov ebx, r14d
cmp dword [rsp + 0x88], r14d
jbe 0x140009152
nop word [rax + rax]
mov r8d, 3
lea rdx, [0x140086010]
mov rcx, rdi
call fcn.1400041a0
mov eax, ebx
imul rcx, rax, 0x38
mov rdx, qword [rcx + rsi]
mov rcx, rdi
call fcn.140002ec0
inc ebx
cmp ebx, dword [rsp + 0x88]
jb 0x140009120
mov r8d, 0x10
lea rdx, str._nService_count:
mov rcx, rdi
call fcn.1400041a0
lea r9, [rsp + 0xad]
mov r8d, dword [rsp + 0x88]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140009180
lea r8, [rsp + 0xad]
mov rdx, r9
lea rcx, [rsp + 0x60]
call fcn.14000b740
mov dword [rsp + 0x50], 7
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140002f60
nop
lea rcx, [rsp + 0x60]
call fcn.140004080
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov edx, 0x10
call fcn.140005ea0
mov r8d, 1
lea rdx, [0x14008574c]
mov rcx, rdi
call fcn.1400041a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140010e80
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret