Function at 0x18001d4f0
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x1800a0238]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
lea eax, [r9 + 0xedf]
mov rbx, r8
mov qword [rsp + 0x88], rbx
mov edi, r9d
mov dword [rsp + 0x64], eax
mov r14, rdx
mov rsi, rcx
cmp r9d, eax
ja 0x18001d5c0
mov r12d, dword [rsp + 0x64]
lea r8, [0x180000000]
movzx ebp, byte [rsp + 0x68]
xor edx, edx
mov r15d, dword [rsp + 0x64]
mov r13d, dword [rsp + 0x64]
nop
cmp edi, 0x66cf
ja 0x18001d9a9
je 0x18001d657
mov eax, edi
sub eax, 0x1c82
je 0x18001d7da
sub eax, 0x2f
je 0x18001d6be
sub eax, 0x2f
je 0x18001d6a2
sub eax, 0xcd0
je 0x18001d67d
cmp eax, 0x2f
jne 0x18001da58
mov rdi, qword [rsp + 0x88]
mov ebx, 0x3a48
mov eax, ebx
sub eax, 0x3a48
je 0x18001d5ef
cmp eax, 0x44
jne 0x18001d63f
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.18005fbe0
mov rbx, qword [rsp + 0x328]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov r8d, 0x485a
mov rdx, rsi
xor ecx, ecx
call fcn.180012290
mov dword [rdi], eax
xor r9d, r9d
xor eax, eax
mov r8, r14
mov qword [rsp + 0x50], rax
xor edx, edx
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7e69
mov qword [rsp + 0x20], rsi
call fcn.180048690
mov dword [rsp + 0x60], eax
add ebx, 0x44
cmp ebx, 0x3a8c
jbe 0x18001d5b2
xor edx, edx
lea r8, [0x180000000]
mov ecx, dword [rsi]
test ecx, ecx
je 0x18001d7ff
sub ecx, 2
je 0x18001d816
cmp ecx, 1
je 0x18001d8ee
mov eax, 8
jmp 0x18001d5c4
xor r9d, r9d
mov r8d, 0x485a
mov rdx, rsi
xor ecx, ecx
call fcn.180012290
cmp dword [rbx], eax
jae 0x18001da4f
mov eax, 0xfffffffd
jmp 0x18001d5c4
mov eax, 0x73f7
cmp eax, eax
je 0x18001da72
add eax, 0x31
cmp eax, 0x73f7
jbe 0x18001d6a9
jmp 0x18001da58
cmp qword [rsi + 0x38], 0
jne 0x18001d7a8
mov ebx, 0x15d5
nop
mov eax, ebx
sub eax, 0x15d5
je 0x18001d783
sub eax, 0x36
je 0x18001d766
sub eax, 0x36
je 0x18001d73d
cmp eax, 0x36
jne 0x18001d799
mov r8d, dword [rsp + 0x74]
lea rax, [rsp + 0x6c]
mov rcx, qword [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x6c], edx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
jmp 0x18001d799
mov eax, dword [rsi + 0x30]
xor r9d, r9d
mov dword [rsp + 0x70], edx
mov rdx, qword [rsi + 0x38]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [rsi + 0x28]
test eax, eax
jne 0x18001d7f5
xor edx, edx
jmp 0x18001d799
mov eax, dword [rsi + 0x30]
mov dword [rsp + 0x74], 1
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, qword [rsi + 0x10]
mov qword [rsi + 0x40], rcx
jmp 0x18001d799
mov rax, qword [rsi + 0x10]
mov r13d, 0xb
mov qword [rsi + 0x38], rax
mov qword [rsp + 0x90], rdx
add ebx, 0x36
cmp ebx, 0x1677
jbe 0x18001d6d0
mov eax, dword [rsi + 0x30]
xor r9d, r9d
mov rdx, qword [rsi + 0x40]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [rsi + 0x28]
test eax, eax
jne 0x18001d7f5
xor r8d, r8d
mov edx, 0x5355
mov rcx, rsi
call fcn.18001c1e0
jmp 0x18001da4f
mov r9d, 0x55f
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call fcn.180034ae0
test al, al
jne 0x18001da4f
mov byte [rsp + 0x60], 0
jmp 0x18001d5c0
mov eax, 0x11b5
cmp eax, eax
je 0x18001d94a
add eax, 0x30
cmp eax, 0x11b5
jbe 0x18001d806
mov ebx, 0x35a6
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x35a6
je 0x18001d8c7
sub eax, 0x24
je 0x18001d8ab
sub eax, 0x24
je 0x18001d888
cmp eax, 0x24
jne 0x18001d8da
mov qword [r14 + 0x20], rsi
mov edi, 0x66fe
cmp qword [rsi + 0x28], 0
je 0x18001da47
mov ecx, 0x14b2
nop dword [rax]
mov eax, ecx
sub eax, 0x14b2
je 0x18001da2e
sub eax, 0x31
je 0x18001da24
cmp eax, 0x31
jne 0x18001da36
mov qword [rsi + 0x30], r14
jmp 0x18001da36
test r12d, r12d
movzx eax, bpl
mov ecx, edx
cmovne ecx, eax
movzx ebp, cl
test cl, cl
je 0x18001d8da
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
jmp 0x18001d8da
mov r8d, 0x104
lea rdx, [rsp + 0xb0]
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov r12d, eax
jmp 0x18001d8da
cmp dword [r14], 0
mov bpl, 1
mov r15d, 1
jne case.default.0x18001d933
add ebx, 0x24
mov edx, 0
cmp ebx, 0x3612
jbe 0x18001d820
mov ecx, 0x184
cmp ecx, 0x1a9
ja case.default.0x18001d933
mov eax, ecx
sub eax, 0x184
je 0x18001d916
cmp eax, 0x25
je case.0x18001d95d.2
add ecx, 0x25
jmp 0x18001d8f3
movsxd rax, dword [r14]
cmp eax, 6
ja case.default.0x18001d933
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x1da8c]
add rcx, rdx
jmp rcx
cmp qword [r14 + 0x28], 0
jne case.default.0x18001d933
mov ecx, 0x184
add ecx, 0x25
jmp 0x18001d8f3
movsxd rax, dword [r14]
cmp eax, 6
ja case.default.0x18001d95d
mov ecx, dword [r8 + rax*4 + 0x1daa8]
add rcx, r8
jmp rcx
cmp qword [r14 + 0x28], 0
jne case.default.0x18001d933
jmp case.0x18001d95d.2
mov ecx, 0x5864
mov eax, ecx
sub eax, 0x5864
je 0x18001d991
sub eax, 0x63
je 0x18001d5c0
cmp eax, 0x63
je case.0x18001d95d.2
jmp 0x18001d999
mov dword [rsp + 0x60], 8
add ecx, 0x63
cmp ecx, 0x592a
jbe 0x18001d974
jmp case.0x18001d95d.2
mov eax, edi
sub eax, 0x66fe
je case.0x18001d95d.2
sub eax, 0x2f
je 0x18001da1a
sub eax, 0x2f
je 0x18001d5c0
sub eax, 0xeb7
je 0x18001d9d9
cmp eax, 0x2f
je 0x18001d5c0
jmp 0x18001da58
mov dword [rsp + 0x78], edx
lea r9, [rsp + 0x98]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x80], 1
mov r8d, 0x4609
lea rcx, [rsp + 0x80]
call fcn.18000d250
mov eax, dword [rsp + 0xa4]
shr eax, 0x1a
and al, 1
mov byte [rsp + 0x60], al
jmp 0x18001da4f
mov dword [rsp + 0x60], 1
jmp 0x18001da58
mov rax, qword [rsi + 0x30]
mov qword [rax + 0x10], r14
jmp 0x18001da36
mov rax, qword [rsi + 0x30]
mov qword [r14 + 0x18], rax
add ecx, 0x31
cmp ecx, 0x1514
jbe 0x18001d860
jmp 0x18001da4f
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r14
lea r8, [0x180000000]
xor edx, edx
add edi, 0x2f
cmp edi, dword [rsp + 0x64]
ja 0x18001d5c0
mov rbx, qword [rsp + 0x88]
jmp 0x18001d560
mov rax, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x38]
mov qword [rsi + 0x38], rax
mov qword [rsi + 0x40], rcx
mov byte [rsp + 0x60], 1
jmp 0x18001d5c0