Function at 0x140248e60
Capabilities:
Enumerate services

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rcx
mov rax, qword [0x140346038]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rbx, [rsp + 0xf4]
mov dword [rbx], 0x2000
xor r13d, r13d
movabs rdi, 0x3fffffffffffffff
xor r12d, r12d
xor edx, edx
jmp 0x140248fae
mov rdi, rax
mov r12, r15
jmp 0x140248f4e
mov r15, r12
mov r12, rdx
sub r13, rdx
lea r14, [r13*2]
cmp r14, rsi
cmovbe r14, rsi
cmp r13, rdi
movabs rax, 0x7fffffffffffffff
cmovae r14, rax
mov rcx, r14
call fcn.140153bd4
mov rdi, rax
add rax, rbp
mov r13, r14
add r13, rdi
lea r14, [rdi + rsi]
mov rcx, rbp
mov rdx, rdi
add rdx, rcx
je 0x1402499cc
mov byte [rdx], 0
inc rcx
cmp rsi, rcx
jne 0x140248f0b
cmp r15, r12
je 0x140248ebc
lea rax, [rdi + rbp]
dec rax
mov r8, r15
mov dl, byte [r8 - 1]
dec r8
mov byte [rax], dl
dec rax
cmp r8, r12
jne 0x140248f31
dec r15
cmp rbp, r15
ja 0x1402499d8
test r12, r12
je 0x140248f5b
mov rcx, r12
call fcn.140153bcc
mov r12, r14
mov rdx, rdi
movabs rdi, 0x3fffffffffffffff
jmp 0x140248f87
jae 0x140248f87
add rsi, rdx
mov rax, r12
sub rax, rsi
dec r12
cmp rax, r12
ja 0x1402499d5
mov r12, rsi
mov qword [rsp + 0x50], rdx
mov rsi, r12
sub rsi, rdx
mov ecx, 5
mov r8d, esi
mov r9, rbx
call fcn.1401a8af0
mov rdx, qword [rsp + 0x50]
cmp eax, 0xc0000004
jne 0x140248ff1
mov esi, dword [rsp + 0xf4]
mov rbp, r12
sub rbp, rdx
mov rax, rsi
sub rax, rbp
jbe 0x140248f6d
mov rcx, r13
sub rcx, r12
cmp rcx, rax
jb 0x140248ec7
lea rcx, [r12 + rax]
test r12, r12
je 0x1402499d2
mov byte [r12], 0
inc r12
dec rax
jne 0x140248fd6
mov r12, rcx
jmp 0x140248f87
xor r15d, r15d
test eax, eax
js 0x1402491ab
xor ecx, ecx
xor edx, edx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x1402491a6
mov r14, rax
mov ecx, 0x18
call fcn.140153bd4
mov rbx, rax
mov ecx, 0x15e0
call fcn.140153bd4
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea rcx, [rax + 0x15e0]
mov qword [rbx + 0x10], rcx
mov rdx, rax
neg rdx
xor r8d, r8d
cmp rdx, r8
je 0x1402499c9
mov byte [rax + r8], 0
inc r8
cmp r8, 0x15e0
jne 0x14024904a
mov qword [rsp + 0x58], rsi
mov qword [rbx + 8], rcx
xor edx, edx
lea rdi, [rsp + 0xd0]
mov dword [rdi], edx
lea rbp, [rsp + 0xb0]
mov dword [rbp], edx
xorps xmm6, xmm6
mov rsi, qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
sub ecx, eax
movups xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], ecx
mov rcx, r14
xor edx, edx
mov r8d, 0x30
mov r9d, 1
call rsi
test eax, eax
jne 0x1402491f3
call r15
cmp eax, 0xea
jne 0x140249109
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
mov edx, dword [rsp + 0xb0]
add rdx, rax
mov rcx, rbx
call fcn.14011f230
mov dword [rsp + 0xb0], 0
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
cmp rcx, rax
jne 0x140249095
jmp 0x1402499cf
cmp dword [0x1403629c0], 2
jg 0x140249161
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwatsonmemory_csv.cc
lea r15, [rsp + 0xf8]
mov rcx, r15
mov r8d, 0x73
mov r9d, 2
call fcn.14009c6a0
lea rcx, [rsp + 0x108]
lea rdx, str.Cannot_enumerate_running_services.
mov r8d, 0x22
call fcn.140097cc9
mov rcx, r15
call fcn.14009c720
test rbx, rbx
mov rsi, qword [rsp + 0x58]
je 0x14024919a
mov rcx, qword [rbx]
test rcx, rcx
je 0x140249192
mov rax, qword [rbx + 8]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x1402499e4
mov qword [rbx + 8], rcx
call fcn.140153bcc
mov rcx, rbx
call fcn.140153bcc
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r15d, r15d
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1402491c4
dec r12
cmp rsi, r12
ja 0x1402499db
mov rcx, rdx
call fcn.140153bcc
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140156fe0
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xe0], rax
movaps xmm6, xmmword [0x1402fccc0]
movaps xmmword [rsp + 0xd0], xmm6
mov byte [rsp + 0xe7], 9
lea rax, str.ImageName
cmp rdi, rax
ja 0x14024924e
lea rcx, [rsp + 0xe2]
cmp rcx, rax
ja 0x1402499ed
movups xmm0, xmmword [str.ImageName]
lea r14, [rsp + 0xd0]
movaps xmmword [r14], xmm0
mov dword [r14 + 0x10], 0x65
xor esi, esi
lea rdi, str.UniqueProcessId
lea r15, str.___ls
lea r13, [rsp + 0xf8]
jmp 0x1402492bf
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov rcx, r14
call fcn.14021c1da
cmp byte [rsp + 0x10f], 0
jns 0x1402492b2
mov rcx, qword [rsp + 0xf8]
call fcn.140153bcc
add rsi, 0x10
cmp rsi, 0x1f0
je 0x1402492e5
mov r8, qword [rsi + rdi]
mov rcx, r13
mov rdx, r15
call fcn.140240440
movzx r8d, byte [rsp + 0x10f]
test r8b, r8b
js 0x140249283
and r8d, 0x7f
mov rdx, r13
jmp 0x140249293
movzx eax, byte [rsp + 0xe7]
mov edx, 0xa
mov r9, rax
test al, al
jns 0x140249319
mov rdx, qword [rsp + 0xe0]
movabs rcx, 0x7fffffffffffffff
and rdx, rcx
dec rdx
mov r9, qword [rsp + 0xd8]
mov r8, rdx
sub r8, r9
lea rcx, str._Services_r_n
cmp r8, 0xb
jb 0x14024998c
test al, al
jns 0x14024933c
mov r14, qword [rsp + 0xd0]
lea rax, [r14 + r9*2]
cmp rax, rcx
mov rdi, qword [rsp + 0x50]
ja 0x14024935b
lea rdx, [r14 + r9*2]
add rdx, 0x16
cmp rdx, rcx
ja 0x1402499f0
movups xmm0, xmmword [str._Services_r_n]
movups xmmword [rax], xmm0
movabs rcx, 0xa000d00730065
mov qword [rax + 0xe], rcx
lea rax, [r9 + 0xb]
cmp byte [rsp + 0xe7], 0
jns 0x14024997a
mov qword [rsp + 0xd8], rax
mov word [r14 + r9*2 + 0x16], 0
cmp r12, rdi
je 0x1402499e7
mov qword [rsp + 0x60], r12
mov r15, qword [rbx]
cmp qword [rbx + 8], r15
je 0x1402499ea
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
imul r12, qword [rsp + 0x68], 0x38
lea r13, [rsp + 0xf8]
jmp 0x140249568
mov r8, r9
sub r8, rdx
add r8, 2
lea rax, [0x140313e22]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xd0]
call fcn.140133162
jmp 0x14024955a
and r8d, 0x7f
mov rdx, r13
lea rcx, [rsp + 0xd0]
call fcn.14021c1da
cmp byte [rsp + 0x10f], 0
jns 0x140249444
mov rcx, qword [rsp + 0xf8]
call fcn.140153bcc
xor eax, eax
add r14, 0x38
cmp r12, r14
je 0x1402494b2
mov ecx, dword [r15 + r14 + 0x2c]
cmp ecx, dword [rdi + 0x50]
jne 0x140249446
mov r9, qword [r15 + r14 + 8]
test al, 1
lea r8, [0x140304342]
cmove r8, rsi
mov rcx, r13
lea rdx, [0x140313e14]
call fcn.140240440
movzx r8d, byte [rsp + 0x10f]
test r8b, r8b
jns 0x140249419
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
jmp 0x140249420
cmp dword [rsp + 0x68], 0
mov rbp, rsi
lea rsi, [0x140313e10]
je 0x1402494b2
mov al, 1
xor r14d, r14d
jmp 0x14024944f
movzx ecx, byte [rsp + 0xe7]
mov edx, 0xa
mov r9, rcx
test cl, cl
jns 0x1402494e6
mov rdx, qword [rsp + 0xe0]
movabs rax, 0x7fffffffffffffff
and rdx, rax
dec rdx
mov r9, qword [rsp + 0xd8]
mov rax, rdx
sub rax, r9
cmp rax, 2
jb 0x1402493da
lea rax, [rsp + 0xd0]
test cl, cl
jns 0x14024950a
mov rax, qword [rsp + 0xd0]
lea rcx, [rax + r9*2]
lea rdx, [0x140313e22]
cmp rcx, rdx
ja 0x140249532
lea rdx, [rax + r9*2]
add rdx, 4
lea r8, [0x140313e22]
cmp rdx, r8
ja 0x1402499de
mov dword [rcx], 0xa000d
lea rcx, [r9 + 2]
cmp byte [rsp + 0xe7], 0
jns 0x1402495cc
mov qword [rsp + 0xd8], rcx
mov word [rax + r9*2 + 4], 0
mov eax, dword [rdi]
add rdi, rax
test rax, rax
je 0x140249736
cmp qword [rdi + 0x50], 0
je 0x1402495e2
mov r14, qword [rdi + 0x40]
test r14, r14
je 0x140249974
mov rcx, r14
call fcn.14015468c
lea r8, [r14 + rax*2]
mov rcx, r13
mov rdx, r14
call fcn.140109490
cmp byte [rsp + 0xc7], 0
jns 0x1402495aa
mov rcx, qword [rsp + 0xb0]
call fcn.140153bcc
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0xf8]
movaps xmmword [rsp + 0xb0], xmm0
jmp 0x140249627
cmp rcx, 0xb
jae 0x1402499e1
mov byte [rsp + 0xe7], cl
jmp 0x140249552
cmp byte [rsp + 0xc7], 0
jns 0x140249602
mov qword [rsp + 0xb8], 6
mov rax, qword [rsp + 0xb0]
jmp 0x14024960d
mov byte [rsp + 0xc7], 6
mov rax, rbp
movabs rcx, 0x6c00640049005b
mov qword [rax], rcx
mov dword [rax + 8], 0x5d0065
mov word [rax + 0xc], 0
cmp byte [rsp + 0xc7], 0
mov r8, rbp
jns 0x14024963c
mov r8, qword [rsp + 0xb0]
mov rcx, r13
lea rdx, str.__ls__
call fcn.140240440
movzx r8d, byte [rsp + 0x10f]
test r8b, r8b
js 0x140249662
and r8d, 0x7f
mov rdx, r13
jmp 0x140249672
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
mov rsi, rbp
lea rcx, [rsp + 0xd0]
call fcn.14021c1da
cmp byte [rsp + 0x10f], 0
jns 0x140249699
mov rcx, qword [rsp + 0xf8]
call fcn.140153bcc
lea r14, [0x140313798]
xor ebp, ebp
jmp 0x140249713
mov r8, qword [rdi + rax]
mov rcx, r13
lea rdx, str._llu_
call fcn.140240440
movzx r8d, byte [rsp + 0x10f]
test r8b, r8b
js 0x1402496ce
and r8d, 0x7f
mov rdx, r13
jmp 0x1402496de
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0xd0]
call fcn.14021c1da
cmp byte [rsp + 0x10f], 0
jns 0x140249702
mov rcx, qword [rsp + 0xf8]
call fcn.140153bcc
inc rbp
add r14, 0x10
cmp rbp, 0x1f
je 0x14024949a
mov eax, dword [r14]
mov ecx, 0x5000121a
bt rcx, rbp
jae 0x1402496a4
mov r8d, dword [rdi + rax]
mov rcx, r13
lea rdx, str._lu_
call fcn.140240440
jmp 0x1402496b7
lea r15, [rsp + 0x90]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [r15 + 0x10], rax
movaps xmmword [r15], xmm6
lea rax, [0x140313e28]
lea r8, [rsp + 0x80]
mov qword [r8], rax
mov qword [r8 + 8], 0xa
mov rcx, qword [rsp + 0x78]
mov rdx, r15
call fcn.1400cb0d0
mov ecx, 0x60
call fcn.140153bd4
mov r14, rax
mov rcx, rax
mov edx, 1
call fcn.14019a56c
mov rcx, r14
mov rdx, r15
mov r8d, 3
xor r9d, r9d
call fcn.14019a990
test al, al
jne 0x1402498c1
cmp dword [0x1403629c0], 2
mov r12, qword [rsp + 0x60]
jg 0x140249800
lea rdx, str....._third_partycrashpadcrashpadutilwatsonmemory_csv.cc
lea r15, [rsp + 0xf8]
mov rcx, r15
mov r8d, 0x117
mov r9d, 2
call fcn.140117f40
lea rcx, [rsp + 0x108]
lea rdx, str.Failed_to_create_memory.csv
mov r8d, 0x1b
call fcn.140097cc9
mov rcx, r15
call fcn.14009caf0
xor r15d, r15d
mov rsi, qword [rsp + 0x58]
test r14, r14
mov rdx, qword [rsp + 0x50]
jne 0x1402498a7
cmp byte [rsp + 0xa7], 0
jns 0x140249832
mov rcx, qword [rsp + 0x90]
call fcn.140153bcc
mov rdx, qword [rsp + 0x50]
cmp byte [rsp + 0xc7], 0
jns 0x14024984e
mov rcx, qword [rsp + 0xb0]
call fcn.140153bcc
mov rdx, qword [rsp + 0x50]
cmp byte [rsp + 0xe7], 0
jns 0x14024986a
mov rcx, qword [rsp + 0xd0]
call fcn.140153bcc
mov rdx, qword [rsp + 0x50]
test rbx, rbx
je 0x1402491ab
mov rcx, qword [rbx]
test rcx, rcx
je 0x14024989a
mov rax, qword [rbx + 8]
mov rdx, rax
sub rdx, rcx
dec rax
cmp rdx, rax
ja 0x140249977
mov qword [rbx + 8], rcx
call fcn.140153bcc
mov rcx, rbx
call fcn.140153bcc
jmp 0x1402491a6
mov rcx, r14
call fcn.14019ce26
mov rcx, r14
call fcn.140153bcc
mov rdx, qword [rsp + 0x50]
jmp 0x140249816
lea rdx, [rsp + 0xd0]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
add r8, r8
mov rcx, qword [r14 + 0x38]
call fcn.140149820
test al, al
mov r12, qword [rsp + 0x60]
je 0x140249911
mov rcx, r14
call fcn.14024c282
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.1400d8490
mov r15b, 1
jmp 0x140249803
cmp dword [0x1403629c0], 2
mov rsi, qword [rsp + 0x58]
jg 0x140249964
lea rdx, str....._third_partycrashpadcrashpadutilwatsonmemory_csv.cc
lea r15, [rsp + 0xf8]
mov rcx, r15
mov r8d, 0x11d
mov r9d, 2
call fcn.140117f40
lea rcx, [rsp + 0x108]
lea rdx, str.Failed_to_write_to_memory.csv
mov r8d, 0x1d
call fcn.140097cc9
mov rcx, r15
call fcn.14009caf0
mov rcx, r14
call fcn.14024c282
xor r15d, r15d
jmp 0x140249808
int3
int3
cmp r9, 0xfffffffffffffff4
jbe 0x1402499f3
mov byte [rsp + 0xe7], al
jmp 0x14024938d
mov r8, r9
sub r8, rdx
add r8, 0xb
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xd0]
call fcn.140133162
mov rdi, qword [rsp + 0x50]
jmp 0x140249395
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3