Function at 0x140076fd0
Capabilities:
Enumerate services

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
xor r15d, r15d
mov r12d, r15d
mov eax, dword [0x14017adac]
test al, 4
jne 0x140077528
test al, 2
jne 0x140077528
test al, 1
jne 0x140077528
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CEnvironment::kIsWin9x___return_FALSE__2__LastError_u_n
call fcn.1400631f0
cmp dword [0x14017ad7c], r15d
jne 0x14007703e
lea rcx, str.CEnvironment::kCheckClusterServer_Cluster_Service_none__n
call fcn.140062f80
xor eax, eax
jmp 0x14007754a
mov ecx, 0xc000
call fcn.140096bcc
mov rbx, rax
mov r14, rax
test rax, rax
jne 0x140077074
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov edx, 0xc000
lea rcx, str.CEnvironment::kCheckClusterServer_Memory_Allocation_error._n_size_d_n_LastError_u_n
call fcn.140062f80
xor eax, eax
jmp 0x14007754a
mov dword [rsp + 0xc0], r15d
mov dword [rsp + 0xb0], r15d
mov dword [rsp + 0xb8], r15d
lea rdx, str.ClusSvc
lea rcx, [rsp + 0x40]
call fcn.140002bb0
nop
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r13, rax
test rax, rax
jne 0x1400770fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CEnvironment::kCheckClusterServer_OpenSCManager_Error_GetLastError__d__n
call fcn.140062f80
mov rcx, rbx
call fcn.140096bc4
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400770f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x63
jmp 0x14007754a
mov dword [rsp + 0xb8], r15d
or rsi, 0xffffffffffffffff
nop dword [rax + rax]
mov ebp, r15d
xor edx, edx
mov r8d, 0xc000
mov rcx, rbx
call fcn.1400c6930
lea rdx, [rsp + 0xb8]
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc000
mov r9, rbx
mov edx, 0x30
lea r8d, [rdx - 0x2d]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x140077181
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140077472
mov ebp, 1
mov edi, r15d
cmp dword [rsp + 0xb0], r15d
jbe 0x140077468
mov rdx, qword [rbx]
mov eax, r15d
test rdx, rdx
setne al
test eax, eax
je 0x1400774da
mov rcx, qword [rsp + 0x40]
call fcn.1400c772c
test eax, eax
je 0x1400771c8
add rbx, 0x30
inc edi
cmp edi, dword [rsp + 0xb0]
jb 0x140077192
jmp 0x140077468
mov r12d, 1
call fcn.140097090
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x1400774cf
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0xc8], rax
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14007724a
cmp dword [rdx + 0x10], 0
jge 0x14007721f
cmp dword [rax - 0xc], 0
jl 0x1400774b9
mov dword [rax - 0x10], r15d
mov byte [rax], 0
jmp 0x14007724a
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140077235
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc8], rax
mov eax, dword [rbx + 0x14]
dec eax
cmp eax, 6
ja case.default.0x140077269
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x7755c]
add rcx, rdx
jmp rcx
xor eax, eax
mov rcx, rsi
lea rdi, str.SERVICE_STOPPED
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SERVICE_STOPPED
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
jmp 0x1400773d0
xor eax, eax
mov rcx, rsi
lea rdi, str.SERVICE_START_PENDING
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SERVICE_START_PENDING
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
jmp 0x1400773d0
xor eax, eax
mov rcx, rsi
lea rdi, str.SERVICE_STOP_PENDING
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SERVICE_STOP_PENDING
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
jmp 0x1400773d0
xor eax, eax
mov rcx, rsi
lea rdi, str.SERVICE_RUNNING
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SERVICE_RUNNING
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
jmp 0x1400773d0
xor eax, eax
mov rcx, rsi
lea rdi, str.SERVICE_CONTINUE_PENDING
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SERVICE_CONTINUE_PENDING
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
jmp 0x1400773d0
xor eax, eax
mov rcx, rsi
lea rdi, str.SERVICE_PAUSE_PENDING
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SERVICE_PAUSE_PENDING
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
jmp 0x1400773d0
xor eax, eax
mov rcx, rsi
lea rdi, str.SERVICE_PAUSED
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SERVICE_PAUSED
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
jmp 0x1400773d0
xor eax, eax
mov rcx, rsi
lea rdi, str.None
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.None
lea rcx, [rsp + 0xc8]
call fcn.1400017b0
call fcn.140097090
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x1400774c4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rdx, str.DisplayName:__s__ServiceName:__s___Status:__s__n
lea rcx, [rsp + 0x48]
call fcn.140003170
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140062f80
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140077446
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140077468
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp ebp, 1
jne 0x1400774e5
jmp 0x140077110
mov edx, eax
lea rcx, str.CEnvironment::kCheckClusterServer_EnumServicesStatus_Error_GetLastError__d__n
call fcn.140062f80
mov rcx, r14
call fcn.140096bc4
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400774af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x63
jmp 0x14007754a
mov ecx, 0x80070057
call fcn.140001a00
int3
mov ecx, 0x80004005
call fcn.140001a00
nop
mov ecx, 0x80004005
call fcn.140001a00
int3
mov ecx, 0x80004005
call fcn.140001a00
int3
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
call fcn.140096bc4
mov edx, r12d
lea rcx, str.CEnvironment::kCheckClusterService___return___d___1__n
call fcn.1400631f0
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140077523
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r12d
jmp 0x14007754a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CEnvironment::kIsWin9x___return_TRUE__1__LastError_u_n
call fcn.1400631f0
lea rcx, str.CEnvironment::kCheckClusterServer_Cluster_Service_none__n
call fcn.140062f80
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret