Function at 0x401960
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
sub rsp, 0xf8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov qword [rax - 0x28], r15
mov rax, qword [0x004131d8]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov r13, rcx
test rcx, rcx
jne 0x4019b6
mov ax, 1
jmp 0x401bff
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x44], ebp
mov r15w, 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea edx, [rbp + 0x30]
lea r8d, [rbp + 3]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x401bfb
mov edi, dword [rsp + 0x44]
add edi, 0x30
mov ecx, edi
mov eax, 0x30
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rdx, rax
mov rcx, qword [0x00413238]
call fcn.004079a0
mov r12, rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, r12
lea edx, [rbp + 0x30]
lea r8d, [rbp + 3]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
cmp dword [rsp + 0x40], ebp
jne 0x401a90
test r12, r12
je 0x401bfb
mov rdx, r12
mov rcx, qword [r12 - 8]
call fcn.004083a0
jmp 0x401bfb
call fcn.00404e40
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x98]
mov qword [rsp + 0xb8], rcx
mov word [rsp + 0xc0], bp
mov word [rsp + 0xc2], 0x20
mov byte [rsp + 0x98], bpl
xor r14b, r14b
cmp dword [rsp + 0x40], 0
jbe 0x401ba3
mov rsi, r12
nop
nop
mov rbx, qword [rsi]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x90]
call fcn.004098b0
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call sub.MSVCR80.dll_memcpy
mov r9d, 8
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x90]
call fcn.00401890
cmp word [rax + 0x30], 8
je 0x401b3e
xor dil, dil
jmp 0x401b50
mov rax, qword [rax + 0x28]
mov rax, qword [rax]
cmp rax, qword [str.Firebird]
sete dil
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
cmp rcx, rax
je 0x401b73
test rcx, rcx
je 0x401b73
mov rdx, rcx
mov rcx, qword [rcx - 8]
call fcn.004083a0
test dil, dil
je 0x401b8a
mov r8, r13
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi]
call fcn.004015c0
mov r14b, 1
add ebp, 1
add rsi, 0x30
cmp ebp, dword [rsp + 0x40]
jb 0x401ae0
mov rcx, qword [rsp + 0xb8]
test r12, r12
je 0x401bbd
mov rdx, r12
mov rcx, qword [r12 - 8]
call fcn.004083a0
mov rcx, qword [rsp + 0xb8]
test r14b, r14b
je 0x401bc8
xor r15w, r15w
jmp 0x401bdd
lea rcx, str._nNo_named_Firebird_service_instances_are_installed._n
call qword [sym.imp.MSVCR80.dll_printf]
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x98]
cmp rcx, rax
je 0x401bfb
test rcx, rcx
je 0x401bfb
mov rdx, rcx
mov rcx, qword [rcx - 8]
call fcn.004083a0
mov ax, r15w
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.0040cd40
mov rbx, qword [rsp + 0x108]
mov rbp, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x118]
mov rdi, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xd8]
mov r15, qword [rsp + 0xd0]
add rsp, 0xf8
ret