Function at 0x40fc60
Capabilities:
Enumerate services
Query service configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x84f0
call fcn.00550390
mov eax, dword [0x5d1124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
mov ebx, ecx
mov dword [ebp - 0x84d8], 0
push 0
push 0
mov dword [ebp - 0x84e0], 0
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x84d4], 0x2000
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
lea ecx, [ebp - 0x84e0]
push 0
push ecx
lea ecx, [ebp - 0x84d8]
mov dword [ebp - 0x84ec], eax
push ecx
push dword [ebp - 0x84d8]
push 0
push 3
push dword [ebx + 0xc]
push eax
call edi
push dword [ebp - 0x84d8]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call esi
push 0
lea ecx, [ebp - 0x84e0]
mov dword [ebp - 0x84e4], eax
push ecx
lea ecx, [ebp - 0x84d8]
push ecx
push dword [ebp - 0x84d8]
push eax
push 3
push dword [ebx + 0xc]
push dword [ebp - 0x84ec]
call edi
push 0x400
push 0x40
call esi
mov edi, eax
mov dword [ebp - 0x84dc], 1
mov dword [ebp - 0x84d0], edi
mov dword [ebp - 0x84f0], 0
mov byte [edi], 0xd0
cmp dword [ebp - 0x84e0], 0
jbe 0x4100e5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [ebp - 0x84e4]
nop word [eax + eax]
push 0x2000
lea eax, [ebp - 0x84cc]
mov dword [ebp - 0x84d4], 0x2000
push 0
push eax
call fcn.00552b90
add esp, 0xc
push 0xf01ff
push dword [ebx]
push dword [ebp - 0x84ec]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x84e4], eax
test eax, eax
je 0x4100c9
lea ecx, [ebp - 0x84d4]
push ecx
push dword [ebp - 0x84d4]
lea ecx, [ebp - 0x84cc]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
push 0x400
lea eax, [ebp - 0x4cc]
push 0
push eax
call fcn.00552b90
mov eax, dword [ebp - 0x84cc]
add esp, 0xc
test eax, eax
je 0x40fde8
push eax
lea eax, [ebp - 0x4cc]
push eax
call esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00552b90
mov eax, dword [ebx + 0xc]
add esp, 0xc
dec eax
cmp eax, 6
ja case.default.0x40fe01
jmp dword [eax*4 + 0x410114]
push str.Continue
jmp 0x40fe3e
push str.Pausing
jmp 0x40fe3e
push str.Paused
jmp 0x40fe3e
push str.Running
jmp 0x40fe3e
push str.Starting
jmp 0x40fe3e
push str.Stopping
jmp 0x40fe3e
push str.Stopped
jmp 0x40fe3e
push str.Erro
lea eax, [ebp - 0x68]
push eax
call esi
push dword [ebp - 0x84d4]
lea eax, [ebp - 0x84cc]
push 0
push eax
call fcn.00552b90
add esp, 0xc
mov dword [ebp - 0x84d4], 0x2000
lea eax, [ebp - 0x84d4]
push eax
push 0x2000
lea eax, [ebp - 0x84cc]
push eax
push dword [ebp - 0x84e4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
push 0x64
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00552b90
mov eax, dword [ebp - 0x84c8]
add esp, 0xc
cmp eax, 4
ja case.default.0x40fea2
jmp dword [eax*4 + 0x410130]
push str.Auto_Start
jmp 0x40fed1
push str.Boot_Start
jmp 0x40fed1
push str.Demand_Start
jmp 0x40fed1
push str.Disabled
jmp 0x40fed1
push str.System_Start
jmp 0x40fed1
push str.Erro
lea eax, [ebp - 0xcc]
push eax
call esi
cmp dword [ebp - 0x84cc], 0x100
mov ecx, 0x5b3c90
mov eax, 0x5b4070
cmovb eax, ecx
push edi
mov dword [ebp - 0x84e8], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0x84dc]
add ecx, 0x2000
cmp eax, ecx
jae 0x40ff20
push 0x42
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edi, eax
mov dword [ebp - 0x84d0], edi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebx + 4]
mov eax, dword [ebp - 0x84dc]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 0x84dc]
inc edi
add edi, eax
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x4cc]
push eax
mov eax, dword [ebp - 0x84d0]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add edi, eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x84d0]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add edi, eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x84d0]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x84b0]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x84b0]
mov eax, dword [ebp - 0x84d0]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
push dword [ebp - 0x84b0]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x84e8]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [ebp - 0x84d0]
push dword [ebp - 0x84e8]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
push dword [ebp - 0x84e8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebx]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebx]
mov eax, dword [ebp - 0x84d0]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x84c0]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x84c0]
mov eax, dword [ebp - 0x84d0]
add eax, edi
push eax
call fcn.00552610
add esp, 0xc
push dword [ebp - 0x84c0]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x84e4]
inc edi
add eax, edi
mov dword [ebp - 0x84dc], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x84d0]
mov eax, dword [ebp - 0x84f0]
add ebx, 0x24
inc eax
mov dword [ebp - 0x84f0], eax
cmp eax, dword [ebp - 0x84e0]
jb 0x40fd60
push dword [ebp - 0x84ec]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x42
push dword [ebp - 0x84dc]
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f768
mov esp, ebp
pop ebp
ret 4