Function at 0x1800183b0
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rcx
xor r15d, r15d
mov dword [rbp - 0x60], r15d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov edi, r15d
mov qword [rbp - 0x48], r15
xor edx, edx
xor ecx, ecx
lea r8d, [r15 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x180018417
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
jmp 0x180018803
mov ecx, r15d
mov dword [rbp + 0x68], ecx
mov dword [rbp + 0x70], r15d
mov dword [rbp + 0x78], r15d
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], r8
mov rax, r15
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x40], al
nop dword [rax]
mov edx, ecx
cmp rdx, rax
ja 0x180018461
mov qword [rsp + 0x50], rdx
lea rax, [rsp + 0x40]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [rax + rdx], 0
jmp 0x180018471
sub rdx, rax
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.180009840
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
lea rax, [rbp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
mov edx, 0x3b
lea r8d, [rdx - 0x3a]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x180018551
cmp eax, 0xea
je 0x1800184d3
cmp eax, 0x7a
jne 0x1800184e5
mov ecx, dword [rbp + 0x68]
mov r8, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
jmp 0x180018440
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x180018803
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x180018547
test cl, 0x1f
je 0x18001851a
call fcn.180072ffc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180018529
call fcn.180072ffc
int3
sub rcx, rax
cmp rcx, 8
jae 0x180018538
call fcn.180072ffc
int3
cmp rcx, 0x27
jbe 0x180018544
call fcn.180072ffc
int3
mov rcx, rax
call fcn.18006baac
jmp 0x180018803
lea rbx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rbx, qword [rsp + 0x40]
mov r14d, r15d
cmp dword [rbp + 0x70], r15d
jle 0x1800187e5
add rbx, 0x10
nop dword [rax]
nop word [rax + rax]
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x40], 0
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], r15
mov byte [rbp - 0x20], 0
mov rdx, qword [rbx - 0x10]
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r15
mov word [rsp + 0x60], r15w
cmp word [rdx], 0
jne 0x1800185c3
mov r8, r15
jmp 0x1800185db
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800185d0
lea rcx, [rsp + 0x60]
call fcn.1800076e0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.1800174d0
mov rdi, rax
lea rax, [rbp - 0x40]
cmp rax, rdi
je 0x18001866f
mov rcx, qword [rbp - 0x28]
cmp rcx, 0x10
jb 0x180018652
inc rcx
mov rdx, qword [rbp - 0x40]
cmp rcx, 0x1000
jb 0x18001864a
test dl, 0x1f
jne 0x1800187c3
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x1800187bd
sub rdx, rax
cmp rdx, 8
jb 0x1800187b7
cmp rdx, 0x27
ja 0x1800187b1
mov rdx, rax
mov rcx, rdx
call fcn.18006baac
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x30], r15
mov byte [rbp - 0x40], 0
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.180008020
nop
mov rax, qword [rbp - 0x68]
cmp rax, 0x10
jb 0x1800186bd
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, 0x1000
jb 0x1800186b8
test cl, 0x1f
jne 0x1800187db
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800187d5
sub rcx, rax
cmp rcx, 8
jb 0x1800187cf
cmp rcx, 0x27
ja 0x1800187c9
mov rcx, rax
call fcn.18006baac
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
mov byte [rbp - 0x80], 0
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x1800186ea
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1800094a0
mov rdx, qword [rbx - 8]
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r15
mov word [rsp + 0x60], r15w
cmp word [rdx], 0
jne 0x18001870d
mov r8, r15
jmp 0x18001871c
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x180018711
lea rcx, [rsp + 0x60]
call fcn.1800076e0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.1800174d0
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.180005380
lea rcx, [rbp - 0x80]
call fcn.1800052f0
nop
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x180018768
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.1800094a0
movups xmm0, xmmword [rbx]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rbp + 0x10], xmm1
mov eax, dword [rbx + 0x18]
mov dword [rbp + 0x18], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x58]
call fcn.180018820
nop
lea rcx, [rbp - 0x20]
call fcn.1800052f0
lea rcx, [rbp - 0x40]
call fcn.1800052f0
inc r14d
add rbx, 0x30
cmp r14d, dword [rbp + 0x70]
jge 0x1800187e1
jmp 0x180018580
call fcn.180072ffc
int3
call fcn.180072ffc
int3
call fcn.180072ffc
int3
call fcn.180072ffc
nop
call fcn.180072ffc
int3
call fcn.180072ffc
int3
call fcn.180072ffc
int3
call fcn.180072ffc
nop
mov rdi, qword [rbp - 0x48]
mov rax, qword [rbp - 0x58]
mov qword [rsi], rax
mov rax, qword [rbp - 0x50]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdi
lea rcx, [rsp + 0x40]
call fcn.1800052f0
nop
mov rax, rsi
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret