Function at 0x404dcc
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rsi, rcx
call fcn.0040209c
xor r13d, r13d
cmp eax, r13d
jne 0x404df7
xor eax, eax
jmp 0x405119
xor edx, edx
xor ecx, ecx
mov r14d, r13d
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
cmp rax, r13
je 0x40504d
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], r13
lea r8d, [rdx + 0x28]
call fcn.0041cbe0
mov ebp, 0x30
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc0]
lea r8d, [rbp - 0x2f]
mov qword [rsp + 0x28], rax
mov edx, ebp
mov rcx, r12
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xb8], r13d
mov dword [rsp + 0xc8], r13d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cmp eax, r13d
jne 0x405044
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x405044
mov ebx, dword [rsp + 0xc0]
lea rcx, [rbp - 0x31]
mov rax, rbp
add ebx, ebp
lea edi, [rbx + rbx]
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.0040a030
mov r8, rdi
xor edx, edx
mov rcx, rax
mov r13, rax
call fcn.0041cbe0
lea rdx, [rsp + 0xc8]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea r8d, [rbp - 0x2f]
mov r9, r13
mov edx, ebp
mov rcx, r12
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call fcn.0040527c
mov eax, dword [rsp + 0xb8]
test eax, eax
je 0x405039
lea rbp, [r13 + 0x14]
test byte [rbp - 4], 0x30
je 0x405029
test byte [rbp], 4
je 0x405029
mov ecx, 0x18
call fcn.00409fe4
mov rbx, rax
test rax, rax
je 0x404faf
call fcn.0040b98c
test rax, rax
je 0x40513c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
call fcn.0040b98c
test rax, rax
je 0x405131
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov rcx, rbx
add rax, 0x18
mov qword [rbx + 8], rax
call fcn.004063d8
lea rcx, [rbx + 8]
call fcn.004063d8
mov byte [rbx + 0x10], 0
mov byte [rbx + 0x11], 0
mov byte [rbx + 0x12], 0
jmp 0x404fb1
xor ebx, ebx
mov byte [rbx + 0x12], 1
mov byte [rbx + 0x11], 1
mov byte [rbx + 0x10], 1
mov rdx, qword [rbp - 0xc]
test rdx, rdx
jne 0x404fca
xor ecx, ecx
jmp 0x404fdc
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, rbx
call fcn.004065b4
mov rdx, qword [rbp - 0x14]
test rdx, rdx
jne 0x404ff4
xor ecx, ecx
jmp 0x405006
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbx + 8]
call fcn.004065b4
mov rdx, qword [rsi + 0x20]
lea rcx, [rsi + 0x10]
mov r8, rbx
call fcn.0040d164
mov eax, dword [rsp + 0xb8]
inc r14d
add rbp, 0x30
cmp r14d, eax
jb 0x404f2d
mov rcx, r13
call fcn.0040a028
xor r13d, r13d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsi + 0x48], r13
mov edi, r13d
mov rdx, r13
jle 0x405086
cmp rdx, r13
jl 0x405147
cmp rdx, qword [rsi + 0x48]
jge 0x405147
mov rax, qword [rsi + 0x40]
inc edi
mov rcx, qword [rax + rdx*8]
movsxd rax, edi
inc rdx
mov byte [rcx + 0x12], r13b
cmp rax, qword [rsi + 0x48]
jl 0x405059
cmp qword [rsi + 0x20], r13
mov ebp, r13d
mov rdi, r13
jle 0x405116
cmp rdi, r13
jl 0x40515e
cmp rdi, qword [rsi + 0x20]
jge 0x40515e
cmp qword [rsi + 0x48], r13
mov rax, qword [rsi + 0x18]
mov r12d, r13d
mov r15, qword [rax + rdi*8]
mov rbx, r13
jle 0x405108
cmp rbx, r13
jl 0x405158
cmp rbx, qword [rsi + 0x48]
jge 0x405158
mov rax, qword [rsi + 0x40]
mov r13, qword [rax + rbx*8]
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x40514d
mov rcx, qword [r15 + 8]
call fcn.0041b170
test eax, eax
jne 0x4050f3
mov byte [r13 + 0x12], 1
inc r12d
inc rbx
mov r13d, 0
movsxd rax, r12d
cmp rax, qword [rsi + 0x48]
jl 0x4050bd
inc ebp
inc rdi
movsxd rax, ebp
cmp rax, qword [rsi + 0x20]
jl 0x405096
mov eax, r14d
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.0040659c
int3
mov ecx, 0x80004005
call fcn.0040659c
int3
call fcn.0040b754
int3
mov ecx, 0x80004005
call fcn.0040659c
int3
call fcn.0040b754
int3
call fcn.0040b754
int3