Function at 0x180058654
Capabilities:
Enumerate services

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
xor edi, edi
mov r15, rcx
test rcx, rcx
jne 0x180058697
xor r8d, r8d
lea ecx, [rdi + 0xa]
mov edx, 0x80
call fcn.18005781c
lea eax, [rdi + 1]
jmp 0x180058ab7
xor edx, edx
mov qword [rbp - 9], rdi
xor ecx, ecx
mov qword [rbp - 1], rdi
mov r8d, 0x2000000
mov dword [rbp + 0x7f], edi
mov r13, rdi
mov dword [rbp + 0x77], edi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov r12, rax
mov esi, 1
test rax, rax
jne 0x1800586de
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x180058888
lea rdx, [rbp - 0x11]
mov qword [rbp + 7], rdi
lea rcx, [rbp + 7]
mov dword [rbp - 0x11], edi
call fcn.18000db84
mov r14, qword [rbp + 7]
test eax, eax
jne 0x180058707
mov r8, r14
lea ecx, [rax + 8]
mov edx, esi
call fcn.18000ca28
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rdi
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, r12
lea rax, [rbp - 0x19]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumServicesStatusExW]
nop dword [rax + rax]
test eax, eax
jne 0x180058767
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xea
je 0x180058767
cmp eax, 0x7a
jne 0x18005882f
mov edx, dword [rbp - 0x19]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x180058788
lea ebx, [rax + 8]
jmp 0x18005882b
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x77]
mov qword [rsp + 0x40], rdi
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, r12
lea rax, [rbp - 0x19]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0x19]
lea r9d, [rdx + 3]
mov dword [rsp + 0x28], eax
lea r8d, [rdx + 0x30]
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumServicesStatusExW]
nop dword [rax + rax]
test eax, eax
jne 0x1800587dd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18005881c
xor ebx, ebx
cmp dword [rbp + 0x77], ebx
jbe 0x18005881c
mov eax, edi
lea r9, [rbp - 1]
imul rdx, rax, 0x38
mov rcx, r12
mov r8, qword [rdx + r15 + 8]
mov rdx, qword [rdx + r15]
call fcn.1800141b8
mov ebx, eax
test eax, eax
jne 0x180058812
add edi, esi
cmp edi, dword [rbp + 0x77]
jb 0x1800587e4
xor edi, edi
mov ebx, edi
jmp 0x180058814
xor edi, edi
mov r13, qword [rbp - 1]
mov qword [rbp - 9], r13
mov rcx, r15
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov r15, qword [rbp + 0x67]
mov rcx, r12
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test ebx, ebx
je 0x180058851
mov rcx, r13
call fcn.1800117f4
mov r13, rdi
mov qword [rbp - 9], rdi
test r14, r14
je 0x180058863
xor edx, edx
mov r8, r14
lea ecx, [rdx + 8]
call fcn.18000ca28
cmp dword [rbp - 0x11], edi
je 0x180058874
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
nop dword [rax + rax]
test r14, r14
je 0x180058888
mov rcx, r14
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov ecx, ebx
call fcn.18000ec90
mov edi, eax
mov r14d, 0xa
test eax, eax
jne 0x180058a97
and qword [rbp + 0x77], 0
lea r9, [0x180080ee0]
mov r12d, dword [rbp + 0x6f]
lea rdx, [rbp + 0x77]
and qword [rbp - 0x11], 0
and r12d, 0x4000000
mov eax, r12d
mov rcx, r15
neg eax
sbb r8d, r8d
neg r8d
add r8d, esi
call fcn.180044a68
mov edi, eax
test eax, eax
jne 0x180058a77
mov eax, r12d
lea r9, [rbp - 0x11]
neg eax
lea r8, [0x180080ee0]
mov rcx, r15
mov rbx, r13
sbb edx, edx
and edx, 4
add edx, 0x12e
call fcn.180043b58
mov edi, eax
test eax, eax
jne 0x180058a41
and qword [rbp - 1], 0
test rbx, rbx
je 0x180058a36
mov r14d, dword [rbp + 0x7f]
mov r13d, dword [0x18008b2a0]
mov r9, qword [rbx]
xor edx, edx
mov r8d, 0x1c34
lea ecx, [rdx + 2]
call fcn.180038d90
cmp r14d, 5
jae 0x180058953
xor r8d, r8d
mov edx, 0x80
mov ecx, esi
call fcn.18005781c
add r14d, esi
mov rdx, qword [rbx]
lea r8, [rbp - 1]
mov rcx, qword [rbp - 0x11]
call fcn.180059bdc
mov r15, qword [rbp - 1]
mov edi, eax
test eax, eax
jne 0x180058999
lea r8, [rbp + 0x67]
mov rdx, rbx
mov rcx, r15
call fcn.180058ad4
mov edi, eax
test eax, eax
jne 0x1800589b9
cmp dword [rbp + 0x67], eax
je 0x1800589b9
test r12d, r12d
sete al
mov byte [rbx + 0x10], al
mov eax, dword [r15 + 0x20]
mov dword [rbx + 0x20], eax
jmp 0x1800589a7
cmp eax, 2
jne 0x1800589b9
test r12d, r12d
jne 0x1800589b7
mov byte [rbx + 0x10], 4
mov rcx, qword [rbp + 0x77]
mov rdx, rbx
call fcn.18005a1a0
mov edi, eax
jmp 0x1800589b9
xor edi, edi
mov rcx, r15
call fcn.1800117f4
and qword [rbp - 1], 0
test edi, edi
je 0x180058a1b
mov ecx, edi
call fcn.180011120
mov r9, qword [rbx]
mov edx, eax
mov r8d, 0x1c38
mov ecx, esi
call fcn.180038d90
cmp edi, 9
jne 0x180058a28
mov ecx, edi
call fcn.180011120
mov rcx, qword gs:[0x58]
mov edx, 0x18
mov rcx, qword [rcx + r13*8]
mov dword [rdx + rcx], eax
test r12d, r12d
jne 0x180058a19
mov rcx, qword [rbp + 0x77]
mov rdx, rbx
mov byte [rbx + 0x10], 5
call fcn.18005a1a0
xor edi, edi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x180058928
mov r13, qword [rbp - 9]
mov dword [rbp + 0x7f], r14d
mov r14d, 0xa
mov edx, esi
lea rcx, [rbp - 0x11]
call fcn.18004cd24
test r12d, r12d
jne 0x180058a68
mov r15, rbx
test rbx, rbx
je 0x180058a68
mov rcx, qword [rbp + 0x77]
mov rdx, rbx
mov byte [r15 + 0x10], 5
call fcn.18005a1a0
mov r15, qword [r15 + 0x28]
test r15, r15
jne 0x180058a4e
mov edx, esi
lea rcx, [rbp + 0x77]
call fcn.18004cd24
test edi, edi
je 0x180058a8d
mov ecx, edi
call fcn.180011120
mov edx, eax
mov r8d, 0x1c3f
mov ecx, esi
call fcn.180038d90
mov eax, dword [rbp + 0x7f]
cmp eax, r14d
jae 0x180058aad
jmp 0x180058a9a
mov eax, dword [rbp + 0x7f]
sub r14d, eax
xor r8d, r8d
mov ecx, r14d
mov edx, 0x80
call fcn.18005781c
mov rcx, r13
call fcn.1800117f4
mov eax, edi
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret