Function at 0x4ee790
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
xorps xmm0, xmm0
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
movlps qword [ebp - 0x30], xmm0
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0
push 1
push dword [ebp + 0xc]
call sub.advapi32.dll_EnumDependentServicesW
mov edi, dword [ebp + 8]
test eax, eax
je 0x4ee7e3
mov esi, 1
mov dword [ebp - 0x18], 0
jmp 0x4ee8aa
call sub.kernel32.dll_GetLastError
cmp eax, 0xea
mov dword [ebp - 0x44], eax
jne 0x4ee83a
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4ee887
xor edx, edx
lea ecx, [ebp - 0x34]
push esi
call fcn.004ec6b0
add esp, 4
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x2c]
cmp esi, 2
lea eax, [edi + ebx]
jb 0x4ee82f
lea ecx, [esi - 1]
push ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ebx, [ebx + esi - 1]
lea eax, [edi + ebx]
mov byte [eax], 0
mov esi, edi
inc ebx
mov eax, dword [ebp - 0x14]
jmp 0x4ee890
lea eax, [ebp - 0x44]
mov dword [ebp - 0x7c], 0x56accc
mov dword [ebp - 0x78], 2
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], 0x4eb9f0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 1
lea eax, [ebp - 0x7c]
push eax
call fcn.004c4f80
add esp, 4
xorps xmm0, xmm0
mov dword [edi], 4
movlps qword [edi + 4], xmm0
jmp 0x4eea51
mov esi, 1
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
push 1
push dword [ebp + 0xc]
call sub.advapi32.dll_EnumDependentServicesW
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 4
movlps qword [ebp - 0x24], xmm0
test eax, eax
mov dword [ebp - 0x58], eax
je 0x4eea2a
xor edi, edi
mov ecx, 4
xor ebx, ebx
mov dword [ebp - 0x10], esi
jmp 0x4ee921
mov ecx, dword [ebp - 0x5c]
movsd xmm0, qword [ebp - 0x64]
mov eax, edi
inc ebx
inc edi
shl eax, 5
cmp ebx, dword [ebp - 0x58]
movsd qword [ecx + eax + 0x18], xmm0
movsd xmm0, qword [ebp - 0x6c]
movsd qword [ecx + eax + 0x10], xmm0
movsd xmm0, qword [ebp - 0x7c]
movsd xmm1, qword [ebp - 0x74]
movsd qword [ecx + eax + 8], xmm1
movsd qword [ecx + eax], xmm0
mov dword [ebp - 0x20], edi
je 0x4eea2a
cmp ebx, 0x71c71c7
mov dword [ebp - 0x5c], ecx
je 0x4eea5b
lea eax, [ebx*4]
lea esi, [eax + eax*8]
lea eax, [esi + 0x24]
cmp eax, dword [ebp - 0x18]
ja 0x4eea6e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + esi]
test eax, eax
je 0x4ee980
mov ecx, 0xffffffff
nop word cs:[eax + eax]
nop
cmp word [eax + ecx*2 + 2], 0
lea ecx, [ecx + 1]
jne 0x4ee960
push ecx
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004c5b70
add esp, 0xc
jmp 0x4ee992
xorps xmm0, xmm0
mov dword [ebp - 0x44], 1
movlps qword [ebp - 0x40], xmm0
mov byte [ebp - 0x38], 1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + esi + 4]
mov esi, ecx
test eax, eax
je 0x4ee9d0
mov ecx, 0xffffffff
nop word cs:[eax + eax]
nop
cmp word [eax + ecx*2 + 2], 0
lea ecx, [ecx + 1]
jne 0x4ee9b0
push ecx
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.004c5b70
add esp, 0xc
jmp 0x4ee9e2
xorps xmm0, xmm0
mov dword [ebp - 0x54], 1
movlps qword [ebp - 0x50], xmm0
mov byte [ebp - 0x48], 1
movsd xmm0, qword [ebp - 0x44]
movsd xmm1, qword [ebp - 0x3c]
cmp edi, dword [ebp - 0x24]
movsd xmm2, qword [ebp - 0x4c]
lea eax, [ebp - 0x6c]
movsd qword [ebp - 0x7c], xmm0
movsd xmm0, qword [ebp - 0x54]
movsd qword [ebp - 0x74], xmm1
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm0
jne 0x4ee8e0
lea ecx, [ebp - 0x28]
mov edx, edi
call fcn.004ec420
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x20]
jmp 0x4ee8e3
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x28]
cmp dword [ebp - 0x30], 0
mov dword [edi + 8], eax
movsd qword [edi], xmm0
je 0x4eea51
mov eax, dword [0x56bbf8]
push esi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, edi
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x56ad08
push 0x20
push 0xfffffffffffffffc
call fcn.00417fa0
add esp, 0xc
jmp 0x4eea7f
push 0x56ad08
push dword [ebp - 0x18]
push eax
call fcn.00417f20
add esp, 0xc
ud2