Function at 0x404da4
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rsi, rcx
call fcn.00402074
xor r13d, r13d
cmp eax, r13d
jne 0x404dcf
xor eax, eax
jmp 0x4050f1
xor edx, edx
xor ecx, ecx
mov r14d, r13d
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
cmp rax, r13
je 0x405025
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], r13
lea r8d, [rdx + 0x28]
call fcn.0041cbe0
mov ebp, 0x30
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc0]
lea r8d, [rbp - 0x2f]
mov qword [rsp + 0x28], rax
mov edx, ebp
mov rcx, r12
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xb8], r13d
mov dword [rsp + 0xc8], r13d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cmp eax, r13d
jne 0x40501c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40501c
mov ebx, dword [rsp + 0xc0]
lea rcx, [rbp - 0x31]
mov rax, rbp
add ebx, ebp
lea edi, [rbx + rbx]
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.0040a030
mov r8, rdi
xor edx, edx
mov rcx, rax
mov r13, rax
call fcn.0041cbe0
lea rdx, [rsp + 0xc8]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea r8d, [rbp - 0x2f]
mov r9, r13
mov edx, ebp
mov rcx, r12
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call fcn.00405254
mov eax, dword [rsp + 0xb8]
test eax, eax
je 0x405011
lea rbp, [r13 + 0x14]
test byte [rbp - 4], 0x30
je 0x405001
test byte [rbp], 4
je 0x405001
mov ecx, 0x18
call fcn.00409fe4
mov rbx, rax
test rax, rax
je 0x404f87
call fcn.0040b984
test rax, rax
je 0x405114
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbx], rax
call fcn.0040b984
test rax, rax
je 0x405109
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov rcx, rbx
add rax, 0x18
mov qword [rbx + 8], rax
call fcn.004063d8
lea rcx, [rbx + 8]
call fcn.004063d8
mov byte [rbx + 0x10], 0
mov byte [rbx + 0x11], 0
mov byte [rbx + 0x12], 0
jmp 0x404f89
xor ebx, ebx
mov byte [rbx + 0x12], 1
mov byte [rbx + 0x11], 1
mov byte [rbx + 0x10], 1
mov rdx, qword [rbp - 0xc]
test rdx, rdx
jne 0x404fa2
xor ecx, ecx
jmp 0x404fb4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, rbx
call fcn.004065b4
mov rdx, qword [rbp - 0x14]
test rdx, rdx
jne 0x404fcc
xor ecx, ecx
jmp 0x404fde
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbx + 8]
call fcn.004065b4
mov rdx, qword [rsi + 0x20]
lea rcx, [rsi + 0x10]
mov r8, rbx
call fcn.0040cfb8
mov eax, dword [rsp + 0xb8]
inc r14d
add rbp, 0x30
cmp r14d, eax
jb 0x404f05
mov rcx, r13
call fcn.0040a028
xor r13d, r13d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp qword [rsi + 0x48], r13
mov edi, r13d
mov rdx, r13
jle 0x40505e
cmp rdx, r13
jl 0x40511f
cmp rdx, qword [rsi + 0x48]
jge 0x40511f
mov rax, qword [rsi + 0x40]
inc edi
mov rcx, qword [rax + rdx*8]
movsxd rax, edi
inc rdx
mov byte [rcx + 0x12], r13b
cmp rax, qword [rsi + 0x48]
jl 0x405031
cmp qword [rsi + 0x20], r13
mov ebp, r13d
mov rdi, r13
jle 0x4050ee
cmp rdi, r13
jl 0x405136
cmp rdi, qword [rsi + 0x20]
jge 0x405136
cmp qword [rsi + 0x48], r13
mov rax, qword [rsi + 0x18]
mov r12d, r13d
mov r15, qword [rax + rdi*8]
mov rbx, r13
jle 0x4050e0
cmp rbx, r13
jl 0x405130
cmp rbx, qword [rsi + 0x48]
jge 0x405130
mov rax, qword [rsi + 0x40]
mov r13, qword [rax + rbx*8]
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x405125
mov rcx, qword [r15 + 8]
call fcn.0041b170
test eax, eax
jne 0x4050cb
mov byte [r13 + 0x12], 1
inc r12d
inc rbx
mov r13d, 0
movsxd rax, r12d
cmp rax, qword [rsi + 0x48]
jl 0x405095
inc ebp
inc rdi
movsxd rax, ebp
cmp rax, qword [rsi + 0x20]
jl 0x40506e
mov eax, r14d
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.0040659c
int3
mov ecx, 0x80004005
call fcn.0040659c
int3
call fcn.0040b74c
int3
mov ecx, 0x80004005
call fcn.0040659c
int3
call fcn.0040b74c
int3
call fcn.0040b74c
int3