Function at 0x1600c4824
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rbp, rcx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x98]
mov r8, rbp
lea rdx, str.MSS:_Stopping_service__ls_and_its_dependents.
mov ecx, 0x4000000
call fcn.1600f0a4c
mov rcx, rax
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, str._StopWithDependentServices
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x25c
xor r9d, r9d
mov esi, 0xf0000
mov edx, esi
call fcn.1600ecb60
mov r8d, 0x2c
mov rdx, rbp
lea rcx, [rsp + 0xb8]
call fcn.1600ccac0
nop
mov rbx, qword [rsp + 0xb8]
test rbx, rbx
je 0x1600c4adb
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edi, [r9 + 1]
mov edx, edi
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
test eax, eax
jne 0x1600c4a76
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
cmp eax, 0xea
jne 0x1600c4a1f
xor esi, esi
mov ecx, dword [rsp + 0xa8]
mov rax, qword [0x1601c0fd0]
call qword [case.0x16003fc5a.0]
mov rbp, rax
test rax, rax
je 0x1600c4a15
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
mov r8, rbp
mov edx, edi
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_core_l1_1_1.dll_EnumDependentServicesW]
test eax, eax
je 0x1600c499c
xor ebx, ebx
cmp ebx, dword [rsp + 0xb0]
jae 0x1600c4987
lea rcx, [rbx + rbx*2]
add rcx, rcx
mov rcx, qword [rbp + rcx*8]
call fcn.1600c4824
mov esi, eax
add ebx, edi
test eax, eax
je 0x1600c4965
test esi, esi
jne 0x1600c4a08
mov rcx, qword [rsp + 0xa0]
call fcn.1600c43c4
mov esi, eax
jmp 0x1600c4a08
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x98]
mov r9d, esi
mov r8, qword [rsp + 0xa0]
lea rdx, str.MSS:_Could_not_enumerate_dependent_services_for__ls_service__error_0x_x
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, str._StopWithDependentServices
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x27b
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
mov rcx, rbp
call fcn.160031c48
jmp 0x1600c4b43
mov esi, 8
jmp 0x1600c4b43
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x98]
mov r9d, esi
mov r8, rbp
lea rdx, str.MSS:_Could_not_get_the_count_of_dependent_services_for__ls_service__error_0x_x
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, str._StopWithDependentServices
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x286
jmp 0x1600c4b35
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x98]
mov r8, rbp
lea rdx, str.MSS:_Service__ls_has_no_active_dependents.
mov ecx, 0x4000000
call fcn.1600f0a4c
mov rcx, rax
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, str._StopWithDependentServices
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x28b
xor r9d, r9d
mov edx, esi
call fcn.1600ecb60
mov rcx, rbp
call fcn.1600c43c4
mov esi, eax
jmp 0x1600c4b43
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rdi, qword [rsp + 0x98]
mov r9d, esi
mov r8, rbp
lea rdx, str.MSS:_Could_not_open_handle_for__ls_service__error_0x_x
mov ecx, 0x2000000
call fcn.1600f0a4c
mov rcx, rax
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
lea rax, str._StopWithDependentServices
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x292
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
nop
lea rcx, [rsp + 0xb8]
call fcn.1600c0874
mov eax, esi
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret