Function at 0x140202ed5
Capabilities:
Enumerate services

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
movaps xmmword [rsp + 0x250], xmm6
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rcx
mov rax, qword [0x140327038]
xor rax, rsp
mov qword [rsp + 0x248], rax
movabs rax, 0x3fffffffffffffe7
lea rdi, [rsp + 0x104]
mov dword [rdi], 0x2000
xor r14d, r14d
add rax, 0x18
mov qword [rsp + 0x58], rax
xor r12d, r12d
xor ebx, ebx
jmp 0x140202f6c
lea rax, [rbx + rbp]
cmp r13, rbp
cmova r12, rax
mov r15, rbx
mov r8d, r12d
sub r8d, r15d
mov ecx, 5
mov rdx, rbx
mov r9, rdi
call fcn.14022369c
cmp eax, 0xc0000004
jne 0x140203050
mov ebp, dword [rsp + 0x104]
mov r13, r12
sub r13, rbx
cmp r13, rbp
jae 0x140202f3d
mov rax, rbp
sub rax, r13
mov rcx, r14
sub rcx, r12
cmp rcx, rax
jb 0x140202fb4
lea rsi, [r12 + rax]
test r12, r12
je 0x140203cf7
mov byte [r12], 0
inc r12
dec rax
jne 0x140202f93
mov r15, rbx
mov r12, rsi
mov rbx, r15
jmp 0x140202f4b
mov rdi, rbx
sub r14, rbx
lea rbx, [r14 + r14]
cmp rbx, rbp
cmovbe rbx, rbp
cmp r14, qword [rsp + 0x58]
movabs rax, 0x7fffffffffffffff
cmovae rbx, rax
mov rcx, rbx
call fcn.14013a6b4
lea r15, [rax + r13]
mov r14, rbx
add r14, rax
lea rsi, [rax + rbp]
mov rcx, r13
mov rdx, rax
add rdx, rcx
je 0x140203cee
mov byte [rdx], 0
inc rcx
cmp rbp, rcx
jne 0x140202ff1
mov rcx, rdi
cmp r12, rdi
lea rdi, [rsp + 0x104]
je 0x140203035
lea r8, [rax + r13]
dec r8
mov dl, byte [r12 - 1]
dec r12
mov byte [r8], dl
dec r8
cmp r12, rcx
jne 0x14020301f
mov r15, rax
test rcx, rcx
je 0x140202fac
call fcn.14013a6ac
jmp 0x140202fac
xor r14d, r14d
jmp 0x140203177
test eax, eax
js 0x140203048
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0xf8], 0
xor r14d, r14d
xor ecx, ecx
xor edx, edx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x140203163
mov rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xe0], rax
mov ecx, 0x18
call fcn.14013a6b4
mov rbx, rax
mov ecx, 0x15e0
call fcn.14013a6b4
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea rcx, [rax + 0x15e0]
mov qword [rbx + 0x10], rcx
mov rdx, rax
neg rdx
xor r8d, r8d
cmp rdx, r8
je 0x140203ceb
mov byte [rax + r8], 0
inc r8
cmp r8, 0x15e0
jne 0x1402030c8
mov qword [rbx + 8], rcx
mov qword [rsp + 0xe0], rbx
xor edx, edx
lea r8, [rsp + 0xc0]
mov dword [r8], edx
lea rbx, [rsp + 0xa0]
mov dword [rbx], edx
xorps xmm6, xmm6
mov r13, qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
jmp 0x14020329c
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0xe0], 0
lea rcx, [rsp + 0xf8]
call fcn.1401321f8
mov r13d, dword [rsp + 0xc0]
xor r14d, r14d
lea rbx, [rsp + 0xe0]
mov rcx, rbx
xor edx, edx
call fcn.1401321f8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebp, ebp
jne 0x14020338c
lea rcx, [rsp + 0xf8]
xor edx, edx
call fcn.1401321f8
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x140203184
mov rcx, rbx
call fcn.14013a6ac
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14013d520
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r14, r14
js 0x140203cfa
sub rdx, rax
lea rax, [rdx + rdx]
cmp rax, r14
cmova r14, rax
cmp rdx, qword [rsp + 0x58]
movabs rax, 0x7fffffffffffffff
cmovae r14, rax
mov rcx, r14
call fcn.14013a6b4
add rsi, rax
add r14, rax
lea rax, [rsi + r15]
mov rcx, rsi
test rcx, rcx
je 0x140203ce8
mov byte [rcx], 0
inc rcx
dec r15
jne 0x1402031f2
mov rcx, qword [rbp]
mov rdx, qword [rbp + 8]
cmp rdx, rcx
je 0x14020322a
mov r8b, byte [rdx - 1]
dec rdx
mov byte [rsi - 1], r8b
dec rsi
cmp rdx, rcx
jne 0x140203213
mov rcx, qword [rbp]
mov qword [rbp], rsi
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], r14
test rcx, rcx
je 0x140203279
call fcn.14013a6ac
jmp 0x140203279
mov rdx, qword [rbp + 0x10]
mov r8, rdx
sub r8, rcx
cmp r8, r15
jb 0x1402031b3
test r15, r15
je 0x140203275
lea rax, [rcx + r15]
test rcx, rcx
je 0x140203cf1
mov byte [rcx], 0
inc rcx
dec r15
jne 0x14020325e
mov rcx, rax
mov qword [rbp + 8], rcx
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0xa0], 0
cmp rcx, rax
je 0x140203cf4
sub ecx, eax
movups xmmword [rsp + 0x40], xmm6
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], ecx
mov rcx, rdi
xor edx, edx
mov r8d, 0x30
mov r9d, 1
call r13
mov ebp, eax
test eax, eax
jne 0x140203114
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140203329
mov rbp, qword [rsp + 0xe0]
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
mov rsi, rcx
sub rsi, rax
mov r15d, dword [rsp + 0xa0]
lea r14, [rsi + r15]
cmp rsi, r14
jb 0x140203242
jbe 0x140203288
add r14, rax
mov qword [rbp + 8], r14
mov rcx, r14
jmp 0x140203288
cmp dword [0x14033b1a8], 2
jg 0x140203381
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwatsonmemory_csv.cc
lea rbx, [rsp + 0x108]
mov rcx, rbx
mov r8d, 0x73
mov r9d, 2
call fcn.1401fea80
lea rcx, [rsp + 0x118]
lea rdx, str.Cannot_enumerate_running_services.
mov r8d, 0x22
call fcn.1401970a4
mov rcx, rbx
call fcn.1401feb00
mov r13d, 0xaaaaaaaa
jmp 0x14020313d
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xf0], rax
movaps xmm6, xmmword [0x1402e6d80]
movaps xmmword [rsp + 0xe0], xmm6
mov byte [rsp + 0xf7], 9
lea rax, str.ImageName
cmp rbx, rax
ja 0x1402033d2
lea rcx, [rsp + 0xf2]
cmp rcx, rax
ja 0x140203d33
movups xmm0, xmmword [str.ImageName]
lea rdi, [rsp + 0xe0]
movaps xmmword [rdi], xmm0
mov dword [rdi + 0x10], 0x65
xor esi, esi
lea rbx, str.UniqueProcessId
lea r14, str.___ls
lea r15, [rsp + 0x108]
jmp 0x140203441
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
mov rcx, rdi
call fcn.1401d05d6
cmp byte [rsp + 0x11f], 0
jns 0x140203434
mov rcx, qword [rsp + 0x108]
call fcn.14013a6ac
add rsi, 0x10
cmp rsi, 0x1f0
je 0x140203467
mov r8, qword [rsi + rbx]
mov rcx, r15
mov rdx, r14
call fcn.1401fa590
movzx r8d, byte [rsp + 0x11f]
test r8b, r8b
js 0x140203405
and r8d, 0x7f
mov rdx, r15
jmp 0x140203415
movzx eax, byte [rsp + 0xf7]
mov ebx, 0xa
mov rsi, rax
test al, al
jns 0x14020349b
mov rbx, qword [rsp + 0xf0]
movabs rcx, 0x7fffffffffffffff
and rbx, rcx
dec rbx
mov rsi, qword [rsp + 0xe8]
mov rcx, rbx
sub rcx, rsi
cmp rcx, 0xb
jb 0x140203ba3
test al, al
jns 0x1402034b7
mov rdi, qword [rsp + 0xe0]
lea rax, [rdi + rsi*2]
lea rcx, str._Services_r_n
cmp rax, rcx
mov r8, qword [rsp + 0x60]
ja 0x1402034dd
lea rdx, [rdi + rsi*2]
add rdx, 0x16
cmp rdx, rcx
ja 0x140203d36
movups xmm0, xmmword [str._Services_r_n]
movups xmmword [rax], xmm0
movabs rcx, 0xa000d00730065
mov qword [rax + 0xe], rcx
lea rax, [rsi + 0xb]
cmp byte [rsp + 0xf7], 0
jns 0x14020356d
mov qword [rsp + 0xe8], rax
lea rax, [rdi + rax*2]
mov word [rax], 0
cmp r12, r8
je 0x140203d2a
mov rax, qword [rsp + 0xf8]
mov r14, qword [rax]
cmp qword [rax + 8], r14
je 0x140203d2d
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
mov eax, r13d
imul rbp, rax, 0x38
lea r15, [rsp + 0x108]
lea r12, [rsp + 0xe0]
mov rsi, r8
mov dword [rsp + 0x6c], r13d
jmp 0x1402037ba
cmp rsi, 0xfffffffffffffff4
jbe 0x140203d39
mov byte [rsp + 0xf7], al
jmp 0x14020350b
lea r8, [rbx + 2]
mov rcx, r8
sub rcx, rdi
movabs rdx, 0x7fffffffffffffff
sub rdx, rdi
add rdx, 0xffffffffffffffef
cmp rdx, rcx
jb 0x140203d0e
mov rcx, r12
test al, al
jns 0x1402035b3
mov rcx, qword [rsp + 0xe0]
movabs rax, 0x3fffffffffffffe7
cmp rdi, rax
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x70], rcx
jae 0x140203d14
lea r13, [rdi + rdi]
cmp r8, r13
cmova r13, r8
cmp r13, 0xb
jb 0x140203d03
or r13, 7
inc r13
js 0x140203d11
lea rcx, [r13*2]
call fcn.14013a6b4
mov r9, rax
test rbx, rbx
jne 0x140203b59
lea rax, [r9 + rbx*2]
lea rcx, [0x1402f5302]
cmp rax, rcx
mov r8, qword [rsp + 0x58]
ja 0x140203638
lea rcx, [r9 + rbx*2]
add rcx, 4
lea rdx, [0x1402f5302]
cmp rcx, rdx
ja 0x140203d27
mov dword [rax], 0xa000d
cmp rdi, 0xa
jne 0x140203cce
mov qword [rsp + 0xe0], r9
movabs rax, 0x7fffffffffffffff
inc rax
or r13, rax
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xe8], r8
lea rax, [r9 + r8*2]
mov r13d, dword [rsp + 0x6c]
jmp 0x1402037a7
and r8d, 0x7f
mov rdx, r15
mov rcx, r12
call fcn.1401d05d6
cmp byte [rsp + 0x11f], 0
jns 0x1402036a4
mov rcx, qword [rsp + 0x108]
call fcn.14013a6ac
xor eax, eax
add rdi, 0x38
cmp rbp, rdi
je 0x14020370c
mov ecx, dword [r14 + rdi + 0x2c]
cmp ecx, dword [rsi + 0x50]
jne 0x1402036a6
mov r9, qword [r14 + rdi + 8]
test al, 1
lea r8, [0x1402e7b22]
cmove r8, rbx
mov rcx, r15
lea rdx, [0x1402f52f4]
call fcn.1401fa590
movzx r8d, byte [rsp + 0x11f]
test r8b, r8b
jns 0x14020367e
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
jmp 0x140203685
test r13d, r13d
lea rbx, [0x1402f52f0]
je 0x14020370c
mov al, 1
xor edi, edi
jmp 0x1402036af
movzx eax, byte [rsp + 0xf7]
mov edi, 0xa
mov rbx, rax
test al, al
jns 0x140203740
mov rdi, qword [rsp + 0xf0]
movabs rcx, 0x7fffffffffffffff
and rdi, rcx
dec rdi
mov rbx, qword [rsp + 0xe8]
mov rcx, rdi
sub rcx, rbx
cmp rcx, 2
jb 0x140203580
mov rcx, r12
test al, al
jns 0x14020375f
mov rcx, qword [rsp + 0xe0]
lea rax, [rcx + rbx*2]
lea rdx, [0x1402f5302]
cmp rax, rdx
ja 0x140203787
lea rdx, [rcx + rbx*2]
add rdx, 4
lea r8, [0x1402f5302]
cmp rdx, r8
ja 0x140203cfd
mov dword [rax], 0xa000d
add rbx, 2
cmp byte [rsp + 0xf7], 0
jns 0x1402037d4
mov qword [rsp + 0xe8], rbx
lea rax, [rcx + rbx*2]
mov word [rax], 0
mov eax, dword [rsi]
add rsi, rax
test rax, rax
je 0x140203981
cmp qword [rsi + 0x50], 0
je 0x140203831
mov rbx, qword [rsi + 0x40]
test rbx, rbx
je 0x1402037e7
mov rcx, rbx
call fcn.14013ad74
jmp 0x1402037e9
cmp rbx, 0xb
jae 0x140203d00
mov byte [rsp + 0xf7], bl
jmp 0x1402037a3
xor eax, eax
lea r8, [rbx + rax*2]
mov rcx, r15
mov rdx, rbx
call fcn.140109b70
cmp byte [rsp + 0xd7], 0
jns 0x14020380f
mov rcx, qword [rsp + 0xc0]
call fcn.14013a6ac
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0xd0], rax
movups xmm0, xmmword [rsp + 0x108]
movaps xmmword [rsp + 0xc0], xmm0
jmp 0x14020387b
cmp byte [rsp + 0xd7], 0
js 0x14020384d
mov byte [rsp + 0xd7], 6
lea rax, [rsp + 0xc0]
jmp 0x140203861
mov qword [rsp + 0xc8], 6
mov rax, qword [rsp + 0xc0]
movabs rcx, 0x6c00640049005b
mov qword [rax], rcx
mov dword [rax + 8], 0x5d0065
mov word [rax + 0xc], 0
cmp byte [rsp + 0xd7], 0
lea r8, [rsp + 0xc0]
jns 0x140203895
mov r8, qword [rsp + 0xc0]
mov rcx, r15
lea rdx, str.__ls__
call fcn.1401fa590
movzx r8d, byte [rsp + 0x11f]
test r8b, r8b
js 0x1402038bb
and r8d, 0x7f
mov rdx, r15
jmp 0x1402038cb
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
mov rcx, r12
call fcn.1401d05d6
cmp byte [rsp + 0x11f], 0
jns 0x1402038ea
mov rcx, qword [rsp + 0x108]
call fcn.14013a6ac
lea rbx, [0x1402f4c78]
xor edi, edi
jmp 0x14020395f
mov r8, qword [rsi + rax]
mov rcx, r15
lea rdx, str._llu_
call fcn.1401fa590
movzx r8d, byte [rsp + 0x11f]
test r8b, r8b
js 0x14020391f
and r8d, 0x7f
mov rdx, r15
jmp 0x14020392f
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x108]
mov rcx, r12
call fcn.1401d05d6
cmp byte [rsp + 0x11f], 0
jns 0x14020394e
mov rcx, qword [rsp + 0x108]
call fcn.14013a6ac
inc rdi
add rbx, 0x10
cmp rdi, 0x1f
je 0x1402036fa
mov eax, dword [rbx]
mov ecx, 0x5000121a
bt rcx, rdi
jae 0x1402038f5
mov r8d, dword [rsi + rax]
mov rcx, r15
lea rdx, str._lu_
call fcn.1401fa590
jmp 0x140203908
lea rbx, [rsp + 0xa0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbx + 0x10], rax
movaps xmmword [rbx], xmm6
lea rax, [0x1402f5308]
lea r8, [rsp + 0x90]
mov qword [r8], rax
mov qword [r8 + 8], 0xa
mov rcx, qword [rsp + 0x88]
mov rdx, rbx
call fcn.1400bb050
mov ecx, 0x60
call fcn.14013a6b4
mov rdi, rax
mov rcx, rax
mov edx, 1
call fcn.140223ad4
mov rcx, rdi
mov rdx, rbx
mov r8d, 3
xor r9d, r9d
call fcn.140223bf4
test al, al
jne 0x140203ab0
cmp dword [0x14033b1a8], 2
jg 0x140203a48
lea rdx, str....._third_partycrashpadcrashpadutilwatsonmemory_csv.cc
lea rbx, [rsp + 0x108]
mov rcx, rbx
mov r8d, 0x117
mov r9d, 2
call fcn.14012fd40
lea rcx, [rsp + 0x118]
lea rdx, str.Failed_to_create_memory.csv
mov r8d, 0x1b
call fcn.1401970a4
mov rcx, rbx
call fcn.1400a0470
xor r14d, r14d
test rdi, rdi
jne 0x140203a9e
cmp byte [rsp + 0xb7], 0
jns 0x140203a67
mov rcx, qword [rsp + 0xa0]
call fcn.14013a6ac
cmp byte [rsp + 0xd7], 0
jns 0x140203a7e
mov rcx, qword [rsp + 0xc0]
call fcn.14013a6ac
cmp byte [rsp + 0xf7], 0
jns 0x140203163
mov rcx, qword [rsp + 0xe0]
call fcn.14013a6ac
jmp 0x140203163
mov rcx, rdi
call fcn.140223b8c
mov rcx, rdi
call fcn.14013a6ac
jmp 0x140203a50
lea rdx, [rsp + 0xe0]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
add r8, r8
mov rcx, qword [rdi + 0x38]
call fcn.14012fe6e
test al, al
je 0x140203afe
mov rcx, rdi
call fcn.1402077de
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call fcn.1400c7040
mov r14b, 1
jmp 0x140203a4b
cmp dword [0x14033b1a8], 2
jg 0x140203b4c
lea rdx, str....._third_partycrashpadcrashpadutilwatsonmemory_csv.cc
lea rbx, [rsp + 0x108]
mov rcx, rbx
mov r8d, 0x11d
mov r9d, 2
call fcn.14012fd40
lea rcx, [rsp + 0x118]
lea rdx, str.Failed_to_write_to_memory.csv
mov r8d, 0x1d
call fcn.1401970a4
mov rcx, rbx
call fcn.1400a0470
mov rcx, rdi
call fcn.1402077de
jmp 0x140203a48
mov rdx, qword [rsp + 0x70]
cmp rdx, r9
jb 0x140203b70
lea rax, [r9 + rbx*2]
cmp rax, rdx
ja 0x140203d30
lea r8, [rbx + rbx]
mov rcx, r9
mov qword [rsp + 0x78], r9
call fcn.14013efb0
mov r9, qword [rsp + 0x78]
jmp 0x14020360b
movabs rax, 0x7fffffffffffffff
lea r13, [rax - 0x10]
jmp 0x140203c0d
mov r13d, 0xb
jmp 0x140203c0d
lea r15, [rsi + 0xb]
mov rcx, r15
sub rcx, rbx
movabs rdx, 0x7fffffffffffffff
sub rdx, rbx
add rdx, 0xffffffffffffffef
cmp rdx, rcx
jb 0x140203d3c
test al, al
js 0x140203bd5
lea rdi, [rsp + 0xe0]
jmp 0x140203bdd
mov rdi, qword [rsp + 0xe0]
mov ebp, r13d
movabs rax, 0x3fffffffffffffe7
cmp rbx, rax
jae 0x140203b8b
lea r13, [rbx + rbx]
cmp r15, r13
cmova r13, r15
cmp r13, 0xb
jb 0x140203b9b
or r13, 7
inc r13
js 0x140203d3f
lea rcx, [r13*2]
call fcn.14013a6b4
mov r14, rax
test rsi, rsi
jne 0x140203ca8
lea rax, [r14 + rsi*2]
lea rcx, str._Services_r_n
cmp rax, rcx
ja 0x140203c47
lea rdx, [r14 + rsi*2]
add rdx, 0x16
cmp rdx, rcx
ja 0x140203d42
movups xmm0, xmmword [str._Services_r_n]
movups xmmword [rax], xmm0
movabs rcx, 0xa000d00730065
mov qword [rax + 0xe], rcx
cmp rbx, 0xa
jne 0x140203c9e
mov qword [rsp + 0xe0], r14
movabs rax, 0x7fffffffffffffff
inc rax
or r13, rax
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xe8], r15
lea rax, [r14 + r15*2]
mov r8, qword [rsp + 0x60]
mov r13d, ebp
jmp 0x14020350f
mov rcx, rdi
call fcn.14013a6ac
jmp 0x140203c65
cmp rdi, r14
jb 0x140203cba
lea rax, [r14 + rsi*2]
cmp rax, rdi
ja 0x140203d45
lea r8, [rsi + rsi]
mov rcx, r14
mov rdx, rdi
call fcn.14013efb0
jmp 0x140203c26
mov rcx, qword [rsp + 0x70]
mov rdi, r9
call fcn.14013a6ac
mov r9, rdi
mov r8, qword [rsp + 0x58]
jmp 0x140203648
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov r13d, 0xb
jmp 0x1402035f2
int3
int3
movabs rax, 0x7fffffffffffffff
lea r13, [rax - 0x10]
jmp 0x1402035f2
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3