Function at 0x401f80
Capabilities:
Enumerate services
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x408370]
lea eax, [ebp - 0x154]
push esi
push edi
push 0x38
push 0
push eax
mov dword [ebp - 0x11c], ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x158], 5
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, dword [sym.imp.MSVCR120.dll_printf]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x401ff1
call edi
push eax
push str.OpenSCManager_failed___d__n
call esi
add esp, 8
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x118], eax
push ecx
lea ecx, [ebp - 0x15c]
push ecx
push 0x10000
push eax
push 3
push 0x3b
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x4022c9
xor edi, edi
cmp dword [ebp - 0x114], edi
jbe 0x4022d6
mov esi, dword [ebp - 0x118]
add esi, 8
mov dword [ebp - 0x108], esi
nop
mov dword [ebp - 0x154], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x150], 0
mov eax, dword [esi - 8]
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x158]
push eax
push 0
push 0x1007
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x150], 1
mov eax, dword [esi - 4]
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x158]
push eax
push edi
push 0x102e
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x150], 2
mov eax, dword [esi]
cmp eax, 0x20
ja 0x4020f9
je 0x4020ed
dec eax
je 0x4020e1
dec eax
je 0x4020d5
sub eax, 0xe
jne 0x40210a
mov dword [ebp - 0x144], str.OwnProcess
jmp 0x40214b
mov dword [ebp - 0x144], str.FileSysDriver
jmp 0x40214b
mov dword [ebp - 0x144], str.KernelDriver
jmp 0x40214b
mov dword [ebp - 0x144], str.ShareProcess
jmp 0x40214b
sub eax, 0x100
je 0x402141
sub eax, 0x10
je 0x402135
sub eax, 0x10
je 0x402129
lea eax, [ebp - 0x104]
mov dword [ebp - 0x144], eax
push dword [esi]
push str.__08X_
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
jmp 0x40214b
mov dword [ebp - 0x144], str.ShareProcess_Interactive_
jmp 0x40214b
mov dword [ebp - 0x144], str.OwnProcess_Interactive_
jmp 0x40214b
mov dword [ebp - 0x144], str.InteractiveProcess
lea eax, [ebp - 0x158]
push eax
push edi
push 0x102e
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x150], 3
mov eax, dword [esi + 4]
mov eax, dword [eax*4 + 0x4062cc]
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x158]
push eax
push edi
push 0x102e
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xf01ff
push dword [esi - 8]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
test ebx, ebx
je 0x402283
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x402270
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x402270
push dword [ebp - 0x110]
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x402257
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x110]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x402257
mov dword [ebp - 0x150], 5
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x158]
push eax
push edi
push 0x102e
push dword [ebp - 0x11c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 4]
push esi
mov eax, dword [eax*4 + 0x4062b0]
mov dword [ebp - 0x144], eax
call dword [sym.imp.MSVCR120.dll_free]
mov esi, dword [ebp - 0x108]
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40228d
mov esi, dword [ebp - 0x108]
push ebx
mov dword [ebp - 0x144], str._ERROR3_
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40228d
push ebx
mov dword [ebp - 0x144], str._ERROR2_
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40228d
mov dword [ebp - 0x144], str._ERROR1_
mov ebx, dword [ebp - 0x11c]
lea eax, [ebp - 0x158]
push eax
push edi
push 0x102e
push ebx
mov dword [ebp - 0x150], 4
call dword [sym.imp.USER32.dll_SendMessageA]
inc edi
add esi, 0x24
mov dword [ebp - 0x108], esi
cmp edi, dword [ebp - 0x114]
jb 0x402050
jmp 0x4022d6
call edi
push eax
push str.EnumServicesStatus_failed___d__n
call esi
add esp, 8
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404ae7
mov esp, ebp
pop ebp
ret