Function at 0x140008b70
Capabilities:
Enumerate services

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f60]
mov eax, 0x3060
call fcn.1400142f0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x30a0], rbx
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rbp + 0x2f50], rax
mov rax, rdx
mov r14, rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2fd0
lea r8, [rbp - 0x80]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
test eax, eax
je 0x140008d4c
xor r15d, r15d
mov edi, r15d
cmp dword [rsp + 0x30], r15d
jbe 0x140008d48
nop word [rax + rax]
mov eax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
lea rsi, [rbp - 0x80]
add rsi, rcx
mov r8d, 0xf01ff
mov rdx, qword [rsi]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x140008d4c
mov r8d, 0x1e
mov rdx, rax
mov rcx, r14
call fcn.140008b70
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rsi]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140008c66
lea rcx, [rsp + 0x40]
call fcn.14000a5a0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140008ca6
lea rcx, [rsp + 0x60]
call fcn.14000a5a0
nop
lea rdx, [rsp + 0x60]
mov rcx, r14
call 0x140008d80
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140008d03
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008cfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d7a
call fcn.140013ee4
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140008d3c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d74
call fcn.140013ee4
inc edi
cmp edi, dword [rsp + 0x30]
jb 0x140008c00
mov al, 1
jmp 0x140008d4e
xor al, al
mov rcx, qword [rbp + 0x2f50]
xor rcx, rsp
call fcn.140013980
mov rbx, qword [rsp + 0x30a0]
add rsp, 0x3060
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140022b6c
nop
call fcn.140022b6c
nop
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
xor r15d, r15d
mov dword [rbp - 0x60], r15d
mov r14b, 1
cmp qword [rdx + 0x18], 0x10
jb 0x140008dc7
mov rdx, qword [rdx]
mov r8d, 0xf01ff
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x140008fbe
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov dword [rbp - 0x60], 1
lea rdi, [rbx + 0x10]
mov rdx, qword [rdi]
add rdx, 0x14
lea rcx, [rbp - 0x50]
call fcn.14000ce70
mov r8d, 0x14
lea rdx, str.__stopping_service:
lea rcx, [rbp - 0x50]
call fcn.14000a720
cmp qword [rbx + 0x18], 0x10
jb 0x140008e2b
mov rbx, qword [rbx]
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.14000a720
lea rcx, [rbp - 0x50]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008e7f
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008fe7
call fcn.140013ee4
mov ebx, r15d
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140008fae
cmp dword [rbp - 0x2c], 1
je 0x140008f40
test ebx, ebx
jne 0x140008ebd
lea r8, [rbp - 0x30]
lea edx, [rbx + 1]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140008fae
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 3
lea rdx, [0x14006bf94]
lea rcx, [rbp - 0x50]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x50]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008f34
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008fed
call fcn.140013ee4
inc ebx
cmp ebx, 0x1e
jae 0x140008fb1
jmp 0x140008e82
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 9
lea rdx, str.__stopped
lea rcx, [rbp - 0x50]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x50]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008fa9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008fe1
call fcn.140013ee4
mov r14b, 1
jmp 0x140008fb1
xor r14b, r14b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, r14b
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140013980
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
int3