Function at 0x140007480
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x14007a040]
xor rax, rsp
mov qword [rbp + 0x48], rax
xor r13d, r13d
xor edx, edx
xor ecx, ecx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x1400079b8
mov dword [rbp - 0x14], r13d
mov dword [rbp - 0x18], r13d
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x14]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov r9d, 3
mov r8d, 0x30
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
xorps xmm0, xmm0
mov eax, dword [rbp - 0x14]
mov edi, eax
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
test eax, eax
je 0x140007587
cmp rax, 0x1000
jb 0x14000755f
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x1400079eb
call fcn.140028138
mov rcx, rax
test rax, rax
je 0x1400079f1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140007567
mov rcx, rdi
call fcn.140028138
mov qword [rbp + 0x10], rax
lea rbx, [rax + rdi]
mov qword [rbp + 0x20], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140040ae0
mov qword [rbp + 0x18], rbx
mov eax, dword [rbp - 0x14]
mov r12, qword [rbp + 0x10]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x14]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
xor edx, edx
mov r9d, 3
mov r8d, 0x30
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x140007978
mov r14d, r13d
cmp dword [rbp - 0x18], r13d
jbe 0x140007978
nop dword [rax]
mov eax, r14d
imul rdx, rax, 0x38
mov r8d, 0x10001
mov rdx, qword [rdx + r12]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x14000796b
mov dword [rbp - 0x10], r13d
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
xorps xmm0, xmm0
mov r8d, dword [rbp - 0x10]
mov edi, r8d
movdqu xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r13
test r8d, r8d
je 0x140007692
cmp r8, 0x1000
jb 0x140007669
lea rcx, [r8 + 0x27]
cmp rcx, r8
jbe 0x1400079f7
call fcn.140028138
mov rcx, rax
test rax, rax
je 0x1400079e5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140007671
mov rcx, rdi
call fcn.140028138
mov qword [rbp - 8], rax
lea rbx, [rax + rdi]
mov qword [rbp + 8], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.140040ae0
mov qword [rbp], rbx
mov r8d, dword [rbp - 0x10]
mov rbx, qword [rbp - 8]
lea r9, [rbp - 0x10]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14000792b
mov rdx, qword [rbx + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400076d0
lea rcx, [rbp + 0x28]
call fcn.14000fb90
nop
lea r9, [rbp + 0x28]
mov r10, qword [rbp + 0x28]
mov r11, qword [rbp + 0x40]
cmp r11, 7
cmova r9, r10
mov rdi, qword [rbp + 0x38]
cmp rdi, 0xf
jb 0x1400078f0
mov ecx, 0xf
lea rdx, str.C:UsersPublic
mov rax, rdx
mov ebx, r13d
sub r9, rdx
nop dword [rax]
movzx edx, word [rax + r9]
cmp dx, word [rax]
jne 0x140007736
add rax, 2
sub rcx, 1
jne 0x140007720
jmp 0x140007745
mov ebx, 1
mov rax, 0xffffffffffffffff
cmovb ebx, eax
test ebx, ebx
jne 0x1400078f0
lea rdx, [rbp + 0x28]
cmp r11, 7
cmova rdx, r10
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8, rdi
lea rcx, [rsp + 0x50]
call fcn.14000fb90
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
lea rdi, [rcx + rax*2]
mov rbx, rdi
mov rdx, rdi
call fcn.140004340
cmp rax, rdi
je 0x1400077db
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400077b2
cmp cx, 0x2f
jne 0x1400077bb
add rax, 2
cmp rax, rdi
jne 0x1400077a3
cmp rax, rdi
je 0x1400077db
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x1400077db
cmp cx, 0x2f
je 0x1400077db
mov rbx, rdx
cmp rax, rdx
jne 0x1400077c0
sub rdi, rbx
sar rdi, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.14000fb90
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x38]
call fcn.14000cf80
nop
lea rax, [rbp - 0x38]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x50]
call fcn.14000c990
lea rcx, [rbp - 0x50]
call fcn.140006ed0
lea rcx, [rbp - 0x50]
call fcn.14000d2a0
nop
lea r9, [fcn.140004860]
mov edx, 0x20
mov r8d, 1
lea rcx, [rbp - 0x38]
call fcn.140028174
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1400078a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400079fd
call fcn.140028130
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400078e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007a03
call fcn.140028130
mov r10, qword [rbp + 0x28]
mov r11, qword [rbp + 0x40]
cmp r11, 7
jbe 0x14000792b
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140007923
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007a09
mov rcx, r10
call fcn.140028130
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14000796b
mov rdx, qword [rbp + 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007966
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400079e5
call fcn.140028130
inc r14d
cmp r14d, dword [rbp - 0x18]
jb 0x1400075e0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400079b8
mov rdx, qword [rbp + 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400079f1
call fcn.140028130
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.140028110
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002e1f4
nop
call fcn.140001360
int3
call fcn.14002e1f4
nop
call fcn.140001360
nop
call fcn.14002e1f4
nop
call fcn.14002e1f4
nop
call fcn.14002e1f4
int3