Function at 0x101645d0
Capabilities:
Enumerate services
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x658
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64c], ecx
push edi
mov dword [ebp - 0x634], eax
call fcn.1000ad40
mov edi, eax
mov dword [ebp - 0x638], edi
test edi, edi
je 0x10164657
push 8
call fcn.10213511
add esp, 4
test eax, eax
je 0x1016461e
mov ecx, eax
call fcn.10130980
mov esi, eax
jmp 0x10164620
xor esi, esi
push 0x10
call fcn.10213511
mov ebx, eax
add esp, 4
mov dword [ebp - 0x634], ebx
test ebx, ebx
je 0x1016464f
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], vtable.std::_Ref_count_class_DISABLE_WOW64_FILE_REDIR_.0
mov dword [ebx + 0xc], esi
jmp 0x10164657
xor eax, eax
mov dword [ebp - 0x634], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.102134e7
add esp, 0xc
call fcn.10003980
mov ecx, eax
test ecx, ecx
je 0x10164b70
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x208
mov dword [ebp - 0x628], eax
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.102134e7
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x9000
call fcn.102135a7
mov ebx, eax
add esp, 4
mov dword [ebp - 0x654], ebx
test ebx, ebx
je 0x10164b15
push 0x9000
push 0
push ebx
call fcn.102134e7
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, eax
mov dword [ebp - 0x658], ecx
test ecx, ecx
je 0x10164b0c
lea eax, [ebp - 0x640]
mov dword [ebp - 0x644], 0
push eax
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0
push eax
lea eax, [ebp - 0x644]
mov dword [ebp - 0x640], 0
push eax
movzx eax, byte [ebp + 8]
neg eax
push 0x9000
sbb eax, eax
push ebx
and eax, 0xffffffdb
push 3
add eax, 0x30
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x10164b00
cmp dword [ebp - 0x630], 0
mov dword [ebp - 0x63c], 0
jbe 0x10164b00
mov esi, ebx
mov dword [ebp - 0x624], ebx
jmp 0x10164780
push dword [esi]
lea eax, [ebp - 0x628]
push str.SYSTEMCurrentControlSetServices
push str._s_sParameters
push eax
call fcn.10004de0
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x620], 1
push 0
push eax
mov dword [ebp - 0x62c], 0x208
call fcn.102134e7
add esp, 0x1c
lea eax, [ebp - 0x62c]
push 0x20219
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
push str.ServiceDll
push dword [ebp - 0x628]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10003510
test eax, eax
jne 0x10164812
mov eax, dword [ebp - 0x620]
cmp eax, 1
je 0x10164891
cmp eax, 2
je 0x10164891
cmp eax, 7
je 0x10164891
push dword [esi]
lea eax, [ebp - 0x628]
mov dword [ebp - 0x620], 1
push str.SYSTEMCurrentControlSetServices
push 0x1021b408
push eax
mov dword [ebp - 0x62c], 0x208
call fcn.10004de0
add esp, 0x10
lea eax, [ebp - 0x62c]
push 0x20219
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
push str.ImagePath
push dword [ebp - 0x628]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10003510
test eax, eax
jne 0x10164ad8
mov eax, dword [ebp - 0x620]
cmp eax, 1
je 0x10164891
cmp eax, 2
je 0x10164891
cmp eax, 7
jne 0x10164ad8
cmp word [ebp - 0x20c], 0
je 0x10164ad8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.101644b0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.10164b80
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.10213523
add esp, 0x18
test eax, eax
jne 0x10164946
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
push str._ws_system32_ws
lea eax, [ebp - 0x61c]
push 0x104
push eax
call fcn.1000bd10
lea ecx, [ebp - 0x20c]
add esp, 0x14
lea esi, [ebp - 0x61c]
mov eax, ecx
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1016493b
movzx eax, word [ecx + esi]
test ax, ax
je 0x10164934
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10164914
jmp 0x10164938
test edx, edx
jne 0x1016493b
sub ecx, 2
mov esi, dword [ebp - 0x624]
xor eax, eax
mov word [ecx], ax
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x10164978
call fcn.10003ae0
cmp dword [eax + 0x140], 2
jne 0x10164967
mov eax, dword [eax + 0x3c]
jmp 0x10164969
xor eax, eax
test eax, eax
je 0x10164978
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x10164985
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10164ad8
test al, 0x10
jne 0x10164ad8
push 0x650
call fcn.102135a7
mov ebx, eax
add esp, 4
mov dword [ebp - 0x650], ebx
test ebx, ebx
je 0x10164afa
push 0x650
push 0
push ebx
call fcn.102134e7
add esp, 0xc
test edi, edi
je 0x101649d0
mov word [ebx + 0x64c], 0x101
mov dword [ebx + 4], 4
lea edi, [ebx + 0x630]
mov dword [ebx + 0x624], 0x80000002
add esi, 8
mov dword [ebx + 0x628], 0x1021dd40
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x624]
lea ecx, [ebx + 8]
mov edx, 0x104
mov esi, dword [esi]
jmp 0x10164a10
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10164a39
movzx eax, word [esi]
test ax, ax
je 0x10164a32
mov word [ecx], ax
add esi, 2
add ecx, 2
sub edx, 1
jne 0x10164a10
jmp 0x10164a36
test edx, edx
jne 0x10164a39
sub ecx, 2
xor eax, eax
lea edi, [ebx + 0x210]
lea esi, [ebp - 0x20c]
mov word [ecx], ax
mov edx, 0x104
mov ecx, edi
sub esi, edi
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10164a7a
movzx eax, word [esi + ecx]
test ax, ax
je 0x10164a73
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10164a53
jmp 0x10164a77
test edx, edx
jne 0x10164a7a
sub ecx, 2
xor eax, eax
push edi
mov word [ecx], ax
call fcn.10163c60
mov ecx, dword [ebp - 0x64c]
add esp, 4
mov dword [ebx + 0x620], eax
lea eax, [ebp - 0x648]
mov dword [ebp - 0x648], 4
push eax
lea ecx, [ecx + 4]
call fcn.100d68d0
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x10164abd
mov dword [ecx], ebx
add dword [eax + 4], 4
jmp 0x10164acc
lea edx, [ebp - 0x650]
push edx
push ecx
mov ecx, eax
call fcn.100d5b90
mov edi, dword [ebp - 0x638]
mov esi, dword [ebp - 0x624]
mov eax, dword [ebp - 0x63c]
add esi, 0x24
inc eax
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x63c], eax
cmp eax, dword [ebp - 0x630]
jb 0x10164780
mov ebx, dword [ebp - 0x654]
push dword [ebp - 0x658]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call fcn.10213559
add esp, 4
mov edx, dword [ebp - 0x628]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10164b35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x634]
test ebx, ebx
je 0x10164b5d
mov eax, esi
lock xadd dword [ebx + 4], eax
jne 0x10164b5d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
lock xadd dword [ebx + 8], esi
dec esi
jne 0x10164b5d
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.100030c0
int3