Function at 0x14008fa48
Capabilities:
Enumerate services
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140178010]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x41], r9d
mov rdi, rcx
mov dword [rbp - 0x51], edx
mov qword [rbp - 0x39], rcx
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14008fab3
test byte [rcx + 0x1c], 1
je 0x14008fab3
cmp byte [rcx + 0x19], 4
jb 0x14008fab3
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x65
call fcn.140004c6c
mov rcx, qword [0x1401782b0]
xor eax, eax
mov qword [rbp - 0x21], rax
mov ebx, eax
mov qword [rbp - 0x31], rax
mov esi, eax
mov dword [rbp - 0x55], eax
mov dword [rbp - 0x59], eax
test rdi, rdi
jne 0x14008faeb
lea r8, str.wszServiceName
mov edx, 0x80f
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008624c
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14008fb29
test byte [rcx + 0x1c], 1
je 0x14008fb29
cmp byte [rcx + 0x19], 4
jb 0x14008fb29
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x66
mov r9, rdi
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp dword [rbp - 0x41], 0xa
jb 0x14008fb69
cmp rcx, rax
je 0x14008fb5f
test byte [rcx + 0x1c], 1
je 0x14008fb5f
cmp byte [rcx + 0x19], 2
jb 0x14008fb5f
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x67
mov r9, rdi
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
mov ebx, 0x8000ffff
jmp 0x140090118
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp - 0x21], rax
test rax, rax
jne 0x14008fbc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1401782b0]
lea rdi, [0x1401782b0]
cmp rcx, rdi
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x14009011f
cmp byte [rcx + 0x19], 2
jb 0x14009011f
mov edx, 0x68
jmp 0x14008fe52
mov r8d, 0x2c
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rbp - 0x49], rax
mov rsi, rax
test rax, rax
jne 0x14008fc45
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x140090118
cmp byte [rcx + 0x19], 2
jb 0x140090118
lea edx, [rsi + 0x69]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.140005ce8
jmp 0x140090111
lea rdx, [rbp + 0x17]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14008fc6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140090111
cmp dword [rbp + 0x1b], 1
jne 0x14008fcba
mov rcx, qword [0x1401782b0]
lea rbx, [0x1401782b0]
cmp rcx, rbx
je 0x14008fcb3
test byte [rcx + 0x1c], 1
je 0x14008fcb3
cmp byte [rcx + 0x19], 4
jb 0x14008fcb3
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x6a
mov r9, rdi
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
xor ebx, ebx
jmp 0x140090118
cmp dword [rbp + 0x1b], 3
jne 0x14008fd72
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14008fd02
test byte [rcx + 0x1c], 1
je 0x14008fd02
cmp byte [rcx + 0x19], 4
jb 0x14008fd02
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x6b
mov r9, rdi
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
cmp dword [rbp - 0x51], ebx
je 0x140090118
mov r8d, 0xea60
lea rcx, [rbp - 0x49]
call fcn.14008f7e8
mov ebx, eax
test eax, eax
jns 0x14009010d
mov rcx, qword [0x1401782b0]
lea rsi, [0x1401782b0]
cmp rcx, rsi
je 0x14008fd69
test byte [rcx + 0x1c], 1
je 0x14008fd60
cmp byte [rcx + 0x19], 2
jb 0x14008fd60
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x6c
mov r9d, eax
call fcn.140004c90
jmp 0x14009010d
mov rsi, qword [rbp - 0x49]
jmp 0x140090118
mov rsi, qword [rbp - 0x49]
jmp 0x14009014d
lea r8, [rbp + 0x17]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400900ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x41b
jne 0x1400901d7
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14008fdd4
test byte [rcx + 0x1c], 1
je 0x14008fdd4
cmp byte [rcx + 0x19], 4
jb 0x14008fdd4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x6d
mov r9, rdi
call fcn.140005c6c
xor r9d, r9d
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x55]
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
je 0x14008fe07
mov ebx, 0x8000ffff
jmp 0x140090111
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x14008fe6a
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1401782b0]
lea rdi, [0x1401782b0]
cmp rcx, rdi
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x14009011f
cmp byte [rcx + 0x19], 2
jb 0x14009011f
mov edx, 0x6e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov r9d, ebx
call fcn.140004c90
jmp 0x14009005d
mov ebx, dword [rbp - 0x55]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x31], rax
test rax, rax
jne 0x14008fe97
mov ebx, 0x8007000e
jmp 0x140090111
mov r9d, dword [rbp - 0x55]
lea rcx, [rbp - 0x59]
mov qword [rsp + 0x28], rcx
mov r8, rax
lea rcx, [rbp - 0x55]
mov edx, 1
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x14008ff0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x140090118
cmp byte [rcx + 0x19], 2
jb 0x140090118
mov edx, 0x6f
jmp 0x14008fc29
mov r10, qword [0x1401782b0]
xor edi, edi
cmp dword [rbp - 0x59], edi
jbe 0x14008ffd9
mov ebx, dword [rbp - 0x41]
inc ebx
mov dword [rbp - 0x29], ebx
mov rax, qword [rbp - 0x31]
lea rcx, [rdi + rdi*2]
add rcx, rcx
movups xmm0, xmmword [rax + rcx*8]
movups xmmword [rbp - 0x19], xmm0
lea rax, [0x1401782b0]
cmp r10, rax
je 0x14008ff6b
test byte [r10 + 0x1c], 1
je 0x14008ff6b
cmp byte [r10 + 0x19], 4
jb 0x14008ff6b
mov r9, qword [rbp - 0x19]
lea r8, [0x140155ec8]
mov rcx, qword [r10 + 0x10]
mov edx, 0x70
call fcn.140005c6c
mov edx, dword [rbp - 0x51]
mov r9d, ebx
mov rcx, qword [rbp - 0x19]
mov r8d, 0xea60
call fcn.14008fa48
mov ebx, eax
test eax, eax
js 0x140090015
mov r10, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp r10, rax
je 0x14008ffcb
test byte [r10 + 0x1c], 1
je 0x14008ffcb
cmp byte [r10 + 0x19], 4
jb 0x14008ffcb
mov r9, qword [rbp - 0x19]
lea r8, [0x140155ec8]
mov rcx, qword [r10 + 0x10]
mov edx, 0x72
call fcn.140005c6c
mov r10, qword [0x1401782b0]
mov ebx, dword [rbp - 0x29]
inc edi
cmp edi, dword [rbp - 0x59]
jb 0x14008ff25
lea rax, [0x1401782b0]
cmp r10, rax
je 0x140090069
test byte [r10 + 0x1c], 1
je 0x140090069
cmp byte [r10 + 0x19], 4
mov rdi, qword [rbp - 0x39]
jb 0x14009006d
mov rcx, qword [r10 + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x73
mov r9, rdi
call fcn.140005c6c
jmp 0x14009006d
mov rcx, qword [0x1401782b0]
lea rdi, [0x1401782b0]
cmp rcx, rdi
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x14009011f
cmp byte [rcx + 0x19], 2
jb 0x14009011f
mov r9, qword [rbp - 0x19]
lea r8, [0x140155ec8]
mov rcx, qword [rcx + 0x10]
mov edx, 0x71
mov dword [rsp + 0x20], eax
call fcn.140005ce8
mov rcx, qword [0x1401782b0]
jmp 0x14009011f
mov rdi, qword [rbp - 0x39]
mov r9d, dword [rbp - 0x41]
mov r8d, 0xea60
mov edx, dword [rbp - 0x51]
inc r9d
mov rcx, rdi
call fcn.14008fa48
mov ebx, eax
test eax, eax
jns 0x1400900b8
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x140090118
cmp byte [rcx + 0x19], 2
jb 0x140090118
mov edx, 0x74
jmp 0x14008fc29
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x1400900f6
test byte [rcx + 0x1c], 1
je 0x1400900f6
cmp byte [rcx + 0x19], 4
jb 0x1400900f6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x75
mov r9, rdi
call fcn.140005c6c
mov rcx, qword [0x1401782b0]
cmp dword [rbp - 0x51], 0
je 0x140090118
mov r8d, 0xea60
lea rcx, [rbp - 0x49]
call fcn.14008f7e8
mov ebx, eax
mov rsi, qword [rbp - 0x49]
mov rcx, qword [0x1401782b0]
lea rdi, [0x1401782b0]
cmp rcx, rdi
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x14009014d
cmp byte [rcx + 0x19], 4
jb 0x14009014d
mov r9, qword [rbp - 0x39]
lea r8, [0x140155ec8]
mov rcx, qword [rcx + 0x10]
mov edx, 0x77
mov dword [rsp + 0x20], ebx
call fcn.140005ce8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x31]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x140090170
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, qword [rbp - 0x21]
test rax, rax
je 0x140090182
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x1400901b6
test byte [rcx + 0x1c], 1
je 0x1400901b6
cmp byte [rcx + 0x19], 4
jb 0x1400901b6
mov rcx, qword [rcx + 0x10]
lea r8, [0x140155ec8]
mov edx, 0x78
call fcn.140004c6c
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401474d0
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x1401782b0]
lea rax, [0x1401782b0]
cmp rcx, rax
je 0x14009014d
test byte [rcx + 0x1c], 1
je 0x140090118
cmp byte [rcx + 0x19], 2
jb 0x140090118
mov edx, 0x76
jmp 0x14008fc29