Function at 0x1800456e0
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x18007cd08]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r13, r9
mov r14d, r8d
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x50], rdx
mov rsi, rcx
mov r15d, r8d
lea edi, [r8 + 0x46]
mov dword [rsp + 0x40], edi
lea r9, [0x180000000]
xor ebx, ebx
cmp r8d, edi
jae 0x180045a39
add r14d, 0xfffffff5
nop dword [rax]
nop dword [rax + rax]
cmp r14d, 0xec
ja case.0x180045771.10
movzx eax, byte [r9 + r14 + 0x4635c]
mov ecx, dword [r9 + rax*4 + 0x46330]
add rcx, r9
jmp rcx
mov word [rbp + 0x8c], bx
mov r8d, 4
lea rdx, [0x1800738f6]
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180045a17
inc qword [rsi + 0x18]
mov rax, qword [rsi + 0x18]
cmp rax, qword [rsi + 0x28]
jb case.0x180045771.10
inc qword [rsi + 8]
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 8], rax
jb 0x18004582d
test rdx, rdx
je 0x1800457d3
mov r9, rdx
mov r8, qword [rdx + 0x20]
xor edx, edx
lea ecx, [rdx + 0xc]
call fcn.18004cf90
mov rax, qword [rsi + 0x10]
lea rdi, [rax + 0x200]
lea rax, [rdi*8]
mov qword [rsp + 0x60], rax
mov r9d, 0xa0
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsi]
call fcn.18005b920
mov r12, rax
test rax, rax
je 0x180045a9f
mov rcx, qword [rsi + 8]
mov r8, rdi
sub r8, rcx
shl r8, 3
lea rcx, [rax + rcx*8]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rsi], r12
mov qword [rsi + 0x10], rdi
mov edi, dword [rsp + 0x40]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
cmp qword [rax + rcx*8], rbx
jne 0x18004587b
mov rax, qword [rsi + 0x28]
lea rcx, [rax + rax*2]
shl rcx, 3
mov qword [rsp + 0x60], rcx
mov r9d, 0x58
lea r8, [rsp + 0x60]
xor edx, edx
xor ecx, ecx
call fcn.18005dee0
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rcx + rdx*8], rax
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
cmp qword [rax + rcx*8], rbx
je 0x180045ab4
mov qword [rsi + 0x18], rbx
jmp 0x180045a17
mov dword [rbp + 0x88], 0x73006d
jmp case.0x180045771.10
mov rax, qword [rdx + 0x38]
mov qword [rsp + 0x70], rax
jmp case.0x180045771.10
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x55]
mov rcx, rsi
call fcn.18005c490
jmp 0x180045a17
inc qword [rsi + 0x20]
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
mov rax, qword [rsi + 0x18]
lea rcx, [rax + rax*2]
mov rax, qword [rdx + r8*8]
lea rcx, [rax + rcx*8]
mov qword [rsp + 0x70], rcx
jmp 0x180045a1e
lea rcx, [rbp + 0x70]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], bx
jne 0x1800458f0
mov eax, dword [0x180073620]
mov dword [rcx], eax
mov eax, dword [0x18007390c]
mov dword [rbp + 0x78], eax
movzx eax, word [0x180073910]
mov word [rbp + 0x7c], ax
mov r8d, 0xa
lea rdx, [rbp + 0x7c]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
jmp 0x180045a17
mov edi, 0x5e
mov eax, edi
sub eax, 0x5e
je 0x18004596e
cmp eax, 1
jne 0x1800459bd
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.18006edc0
mov rbx, qword [rsp + 0x410]
add rsp, 0x3c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9, rdx
lea r8, [0x1800456d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [rsp + 0x50]
mov qword [rdx], rax
test rax, rax
je 0x180045ac9
mov dword [rsp + 0x58], 1
lea r8, [rsp + 0x58]
mov ecx, 0x4b
call fcn.1800503c0
mov byte [rsp + 0x70], 1
mov rdx, qword [rsp + 0x50]
inc edi
cmp edi, 0x60
jb 0x180045933
mov edi, dword [rsp + 0x40]
mov r8d, 1
lea rdx, [0x18007392a]
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 1
lea rdx, [0x1800739ca]
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 4
lea rdx, [0x180073aa8]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea r9, [0x180000000]
mov rdx, qword [rsp + 0x50]
add r15d, 7
add r14d, 7
cmp r15d, edi
jb 0x180045750
mov r14d, dword [rsp + 0x68]
lea edi, [r14 + 0xb]
mov dword [rsp + 0x40], edi
cmp r14d, edi
jae case.0x180045a9d.0
lea edi, [r14 - 0x8d]
mov dword [rsp + 0x58], edi
mov esi, 0x32
lea r8d, [rsi + 0x21]
movabs r13, 0x7ffffffffffffffe
lea r11d, [rsi + 0x1e]
lea r10d, [rsi + 0x13]
lea r15d, [rsi + 0x22]
mov r12d, dword [rsp + 0x7c]
mov eax, dword [rsp + 0x40]
nop dword [rax]
cmp edi, 0x3c
ja case.default.0x180045a9d
movzx eax, byte [r9 + rdi + 0x46478]
mov ecx, dword [r9 + rax*4 + 0x4644c]
add rcx, r9
jmp rcx
test r13, r13
je 0x180045ac1
mov dword [r13], 0x3d
mov rax, rbx
jmp 0x180045944
test r13, r13
je 0x180045ac1
mov dword [r13], 0x3e
mov rax, rbx
jmp 0x180045944
mov byte [rsp + 0x70], bl
jmp case.0x180045a9d.0
mov eax, dword [str.V1265_WeightIdx_WeightIdx]
mov dword [rbp + 0x50], eax
movzx eax, word [0x180073ab4]
mov word [rbp + 0x54], ax
mov word [rbp + 0x56], si
mov dword [rbp + 0x58], 0x5f0031
jmp case.0x180045a9d.10
mov r8d, 0xa
lea rdx, [rbp + 0x7e]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
jmp 0x1800462ce
mov dword [rbp + 0x5c], 0x53
mov r8d, 2
lea rdx, [0x180073b1c]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800462ce
mov dword [rbp + 0x38], 0x730073
mov dword [rbp + 0x3c], 0x65006c
mov dword [rbp + 0x40], 0x790061
jmp case.0x180045a9d.10
mov dword [rbp + 0x44], 0x320033
mov word [rbp + 0x48], bx
movups xmm0, xmmword [rbp + 8]
movups xmmword [rbp + 0x20], xmm0
movsd xmm1, qword [rbp + 0x18]
movsd qword [rbp + 0x30], xmm1
jmp case.0x180045a9d.10
lea rax, [rbp + 0x88]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x28], rax
jmp case.0x180045a9d.10
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
jmp case.0x180045a9d.10
mov dword [rsp + 0x78], ebx
lea rsi, [rbp + 0x20]
mov qword [rsp + 0x60], rsi
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], bx
mov r9d, 0xd1
mov dword [rsp + 0x48], r9d
mov r8d, ebx
mov dword [rsp + 0x4c], ebx
cmp r8d, 0xa
ja case.0x180045be0.9
mov eax, r8d
lea rdi, [0x180000000]
mov ecx, dword [rdi + rax*4 + 0x464b8]
add rcx, rdi
jmp rcx
mov eax, 0x65
mov word [rbp + 0x18], ax
lea rcx, [rbp + 8]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180045bf2
movzx eax, word [0x180072c18]
mov word [rcx], ax
mov byte [rsp + 0x44], 1
jmp case.0x180045be0.9
mov eax, dword [str.icud]
mov dword [rbp + 8], eax
movzx eax, word [0x180073b44]
mov word [rbp + 0xc], ax
movzx eax, byte [0x180073b46]
mov byte [rbp + 0xe], al
jmp case.0x180045be0.9
mov rsi, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
cmp rsi, rcx
jae 0x180045c69
lea rax, [rsi + 1]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x58]
cmp rcx, 8
cmovae rax, qword [rbp - 0x58]
mov dword [rax + rsi*2], 0x2e
mov dword [rbp - 0x80], ebx
mov r12d, 4
jmp 0x1800461e0
mov rax, r13
sub rax, rsi
cmp rax, 1
jb 0x180046327
lea r12, [rsi + 1]
mov r14, qword [rbp - 0x40]
mov rdi, r12
or rdi, 7
cmp rdi, r13
jbe 0x180045c92
mov rdi, r13
jmp 0x180045cb3
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x180045ca8
mov rdi, r13
jmp 0x180045cb3
lea rax, [r14 + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x58]
call fcn.18004f990
mov r15, rax
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], rdi
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x180045d25
mov rdi, qword [rbp - 0x58]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x180045d1b
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x180046319
mov rdi, rcx
mov rcx, rdi
call fcn.18006e8b0
jmp 0x180045d36
lea rdx, [rbp - 0x58]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
mov qword [rbp - 0x58], r15
mov dword [rbp - 0x80], ebx
mov r12d, 4
jmp 0x1800461e0
lea rdx, [rbp + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rdi, rax
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x68], rax
test rdi, rdi
jne 0x180045d97
mov byte [rsp + 0x44], dil
mov r8d, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x48]
jmp case.0x180045be0.9
cmp byte [rsp + 0x44], 0
je 0x180045dc4
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rbp - 0x80]
mov edx, dword [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_GetEventLogInformation]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov r8d, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x48]
jmp case.0x180045be0.9
mov dword [rbp + 0x15], 0x722e46
jmp case.0x180045be0.9
lea rcx, [rbp + 8]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180045de6
mov eax, dword [str.3l_fr]
mov dword [rcx], eax
movzx eax, word [0x180073b4c]
mov word [rcx + 4], ax
mov eax, 0x5f
mov word [rbp + 0x13], ax
mov eax, 0x57
mov word [rbp + 0x14], ax
jmp case.0x180045be0.9
cmp qword [rbp - 0x68], 0
jne case.0x180045be0.9
mov edi, 0xf1
nop dword [rax]
cmp edi, 0x1d3e1
ja 0x180045f21
je 0x180045ef4
cmp edi, 0xf1
je 0x180045ec7
cmp edi, 0x75ad
je 0x180045ea4
cmp edi, 0xea69
je 0x180045e93
cmp edi, 0x15f25
jne 0x180045ff7
mov dword [rbp + 0xbe], 0x410048
mov dword [rbp + 0xc2], 0x450050
mov dword [rbp + 0xc6], 0x3a005f
mov dword [rbp + 0xca], 0x54005c
jmp 0x180045ff7
mov eax, 0x53
mov word [rbp + 0xbc], ax
jmp 0x180045ff7
mov dword [rbp + 0xb0], 0x450054
mov dword [rbp + 0xb4], 0x4d005f
mov dword [rbp + 0xb8], 0x5f0059
jmp 0x180045ff7
mov dword [rbp + 0xa0], 0x440049
mov dword [rbp + 0xa4], 0x5f0053
mov dword [rbp + 0xa8], 0x500055
mov dword [rbp + 0xac], 0x410044
jmp 0x180045ff7
mov eax, 0x4f
mov word [rbp + 0xce], ax
mov dword [rbp + 0xd0], 0x4c004f
mov dword [rbp + 0xd4], 0x490054
mov word [rbp + 0xd8], r11w
jmp 0x180045ff7
cmp edi, 0x2489d
je 0x180045fde
cmp edi, 0x2bd59
je 0x180045f8b
cmp edi, 0x33215
jne 0x180045ff7
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb case.0x180045a9d.0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046308
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180046308
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp - 0x78], ebx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
mov dword [rbp - 0x7c], ebx
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, dword [rbp - 0x70]
mov edx, dword [rbp - 0x74]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov byte [rsp + 0x70], 0
mov r10d, 0x45
lea r11d, [r10 + 0xb]
jmp 0x180045ff7
mov word [rbp + 0xda], bx
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x74], ILFindLastID
mov dword [rbp - 0x70], 1
add edi, 0x74bc
cmp edi, 0x3a5e0
jbe 0x180045e30
mov r8d, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x48]
jmp case.0x180045be0.9
mov rdx, qword [rsi]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x180046022
lea rcx, [rbp - 0x58]
call fcn.18004fa90
mov dword [rsp + 0x7c], ebx
mov r8d, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x48]
jmp case.0x180045be0.9
mov r8d, 3
lea rdx, [0x180073b50]
lea rcx, [rbp - 0x58]
call fcn.18004fa90
mov r8d, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x48]
jmp case.0x180045be0.9
mov rsi, qword [rdx + 0x10]
mov rdi, rdx
cmp qword [rdx + 0x18], 8
jb 0x18004607f
mov rdi, qword [rdx]
cmp rsi, 8
jae 0x180046098
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x38], xmm0
mov r15d, 7
mov r13, qword [rbp - 0x38]
jmp 0x1800460cd
mov r15, rsi
or r15, 7
cmp r15, r13
cmova r15, r13
lea rdx, [r15 + 1]
lea rcx, [rbp - 0x38]
call fcn.18004f990
mov r13, rax
mov qword [rbp - 0x38], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x28], rsi
lea r14, [rbp - 0x38]
cmp r15, 8
cmovae r14, r13
cmp rsi, 8
jae 0x1800460f5
movups xmm0, xmmword [r14]
mov qword [rbp], 7
jmp 0x180046139
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x18]
call fcn.18004f990
mov qword [rbp - 0x18], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp], rdi
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 8], rsi
mov rcx, qword [rbp - 0x40]
cmp rcx, 8
jb 0x180046181
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004617c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046312
call fcn.18006e8b0
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [rbp - 8]
movups xmmword [rbp - 0x48], xmm0
cmp r15, 8
jb 0x1800461cc
lea rdx, [r15*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x1800461c4
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046319
mov rcx, r13
call fcn.18006e8b0
movabs r13, 0x7ffffffffffffffe
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
mov rsi, qword [rsp + 0x60]
inc r9d
mov dword [rsp + 0x48], r9d
inc r8d
mov dword [rsp + 0x4c], r8d
cmp r9d, 0xdc
mov rdx, qword [rsp + 0x50]
mov r10d, 0x45
lea r11d, [r10 + 0xb]
jb 0x180045bc2
mov rcx, qword [rbp - 0x40]
cmp rcx, 8
jb 0x180046251
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004624c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046320
call fcn.18006e8b0
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
add rsi, 8
mov qword [rsp + 0x60], rsi
cmp eax, 3
mov rdx, qword [rsp + 0x50]
mov r10d, 0x45
lea r11d, [r10 + 0xb]
jb 0x180045ba0
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
mov byte [rsp + 0x70], 1
mov edi, dword [rsp + 0x58]
mov r14d, dword [rsp + 0x68]
mov esi, 0x32
lea r15d, [rsi + 0x22]
jmp 0x1800462ce
mov r8d, 2
lea rdx, [0x180073b7a]
lea rcx, [rbp + 0x62]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x180073c04]
mov dword [rbp + 0x66], eax
movzx eax, word [0x180073c08]
mov word [rbp + 0x6a], ax
mov word [rbp + 0x6c], bx
mov r10d, 0x45
lea r11d, [r10 + 0xb]
lea r8d, [r10 + 0xe]
mov eax, dword [rsp + 0x40]
inc r14d
mov dword [rsp + 0x68], r14d
inc edi
mov dword [rsp + 0x58], edi
cmp r14d, eax
jae case.0x180045a9d.0
mov rdx, qword [rsp + 0x50]
lea r9, [0x180000000]
jmp 0x180045a80
call fcn.18006e8b0
jmp case.0x180045a9d.0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.18004f8b0
int3