Function at 0x1000630e0
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13e0
call fcn.1000c9670
sub rsp, rax
mov qword [rsp + 0x118], 0xfffffffffffffffe
mov qword [rsp + 0x1428], rbx
mov rcx, rdx
xor edx, edx
mov r8d, 0x2000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r13, rax
mov qword [rsp + 0x68], rax
xor r14d, r14d
cmp rax, r14
jne 0x10006313f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x1000634cd
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x1438], r14d
mov dword [rsp + 0x1430], r14d
mov rsi, r14
mov qword [rsp + 0x50], r14
mov r12, r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov bl, byte [rsp + 0x1430]
mov dword [rsp + 0x1438], r14d
mov dword [rsp + 0x1430], r14d
lea rax, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1430]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1438]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x12c0
lea r9, [rsp + 0x120]
mov edx, 0x30
lea r8d, [rdx - 0x2d]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cmp eax, r14d
jne 0x1000631d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [rsp + 0x40], eax
jmp 0x1000631e1
mov ebp, r14d
mov dword [rsp + 0x40], r14d
cmp ebp, 0xea
je 0x1000631f2
cmp ebp, r14d
jne 0x10006345e
mov r15d, r14d
cmp dword [rsp + 0x1430], r14d
jbe 0x10006345e
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x110], rax
lea r14, [rsp + 0x120]
mov r13, qword [rsp + 0x60]
xor ebp, ebp
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], rbp
mov word [rsp + 0xc8], bp
mov qword [rsp + 0x108], 7
mov qword [rsp + 0x100], rbp
mov word [rsp + 0xf0], bp
mov rdx, qword [r14]
cmp rdx, rbp
je 0x1000632f9
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rbp
mov word [rsp + 0xa0], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x98]
call fcn.10002cf94
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xc0]
call fcn.10002cd2c
nop
cmp qword [rsp + 0xb8], 8
jb 0x1000632dd
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbp
je 0x1000632dd
call sub.msvcrt.dll_free
mov qword [rsp + 0xb8], 7
mov qword [rsp + 0xb0], rbp
mov word [rsp + 0xa0], bp
mov rdx, qword [r14 + 8]
cmp rdx, rbp
je 0x10006338a
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.10002cf94
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xe8]
call fcn.10002cd2c
nop
cmp qword [rsp + 0x90], 8
jb 0x100063371
mov rcx, qword [rsp + 0x78]
cmp rcx, rbp
je 0x100063371
call sub.msvcrt.dll_free
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbp
mov word [rsp + 0x78], bp
cmp rsi, rbp
je 0x100063406
mov rcx, r12
sub rcx, rsi
movabs r8, 0x6666666666666667
mov rax, r8
imul rcx
mov rdi, rdx
sar rdi, 5
mov rax, rdi
shr rax, 0x3f
add rdi, rax
mov rcx, r13
sub rcx, rsi
mov rax, r8
imul rcx
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jae 0x100063406
lea rdi, [r12 + 0x50]
xor eax, eax
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x48]
lea r8, [rsp + 0xc0]
lea edx, [rax + 1]
mov rcx, r12
call fcn.1000644f0
mov r12, rdi
mov qword [rsp + 0x58], rdi
jmp 0x100063430
lea r9, [rsp + 0xc0]
mov r8d, 1
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.100063de8
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
lea rcx, [rsp + 0xc0]
call fcn.100074058
inc r15d
add r14, 0x30
cmp r15d, dword [rsp + 0x1430]
jb 0x100063222
mov ebp, dword [rsp + 0x40]
mov r13, qword [rsp + 0x68]
xor r14d, r14d
cmp ebp, 0xea
je 0x100063170
cmp ebp, r14d
jne 0x10006348f
lea rcx, [rsp + 0x48]
mov rax, qword [rsp + 0x1420]
cmp rax, rcx
je 0x10006348f
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.1000639f0
nop
cmp rsi, r14
je 0x1000634b5
mov rdi, rsi
cmp rsi, r12
je 0x1000634ad
mov rcx, rdi
call fcn.100074058
add rdi, 0x50
cmp rdi, r12
jne 0x10006349c
mov rcx, rsi
call sub.msvcrt.dll_free
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x68], r14
mov eax, ebp
mov rbx, qword [rsp + 0x1428]
add rsp, 0x13e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret