Function at 0x1009ea20
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019045a
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x101ed40c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1f4], eax
mov ecx, dword [ebp + 8]
push 4
push 0
push 0
mov dword [ebp - 0x224], ecx
mov dword [eax + 8], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 4], 0
test edi, edi
jne 0x1009ebc2
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x101a27cc
push 0x101f3e58
call fcn.100450a0
add esp, 8
mov ecx, eax
call fcn.100804b0
mov esi, eax
push 0xa
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
call fcn.100a1090
movzx ecx, ax
push ecx
mov ecx, esi
call fcn.1008a920
mov ecx, esi
call fcn.1008a640
call fcn.100ca860
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1009ebbb
call edi
push 0x58
push str.d:jenkins.jenkinsworkspacepcmanage_ownpop_native_rightsplugin_startup_autorunmgr.cpp
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0xf
mov byte [ebp - 0x90], 0
call fcn.10044b60
push 3
push 0x1019eb18
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
call fcn.10044b60
mov byte [ebp - 4], 2
call fcn.100ca860
mov edi, eax
lea ecx, [ebp - 0x2c4]
push 0x1b8
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.100461a0
mov esi, eax
push str.OpenSCManager_failed:
push esi
mov byte [ebp - 4], 3
call fcn.10047780
add esp, 8
mov ecx, esi
push dword [ebp - 0x1f0]
call fcn.100804b0
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x2c4]
call fcn.100478a0
lea ecx, [ebp - 0xa8]
call fcn.10042450
lea ecx, [ebp - 0x90]
call fcn.10042450
xor eax, eax
jmp 0x1009f30c
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
lea eax, [ebp - 0x48]
push 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1e4], 0
push eax
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 3
push 0x30
push 0
push edi
mov dword [ebp - 0x48], 0
call esi
lea eax, [ebp - 0x1e9]
mov dword [ebp - 0x210], 0
push eax
push dword [ebp - 0x1e4]
xorps xmm0, xmm0
lea ecx, [ebp - 0x218]
movq qword [ebp - 0x218], xmm0
call fcn.100889f0
push 0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1e4]
push eax
push dword [ebp - 0x1e4]
push dword [ebp - 0x218]
push 3
push 0x30
push 0
push edi
call esi
test eax, eax
jne 0x1009ecb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.EnumServicesStatusEx_failed:
push 0x101f3e58
call fcn.100450a0
add esp, 8
mov ecx, eax
call fcn.100804b0
mov esi, eax
push 0xa
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
call fcn.100a1090
movzx ecx, ax
push ecx
mov ecx, esi
call fcn.1008a920
mov ecx, esi
call fcn.1008a640
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
mov dword [ebp - 0x1f0], 0
jmp 0x1009f2cd
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x200], 0
jbe 0x1009f2b8
mov esi, dword [ebp - 0x218]
mov dword [ebp - 0x1f0], esi
mov edx, dword [esi]
xor eax, eax
mov ecx, edx
mov word [ebp - 0x78], ax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x1e8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009ecf4
sub ecx, dword [ebp - 0x1e8]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x78]
call fcn.10044c60
mov edx, dword [esi + 4]
xor eax, eax
mov ecx, edx
mov byte [ebp - 4], 5
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009ed34
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x90]
call fcn.10044c60
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
push 1
cmovae eax, dword [ebp - 0x78]
push eax
push edi
mov dword [ebp - 0x1e0], 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x1f8], esi
lea eax, [ebp - 0x1e0]
mov byte [ebp - 4], 7
push eax
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
lea eax, [ebp - 0x1f9]
mov dword [ebp - 0x204], 0
push eax
push dword [ebp - 0x1e0]
xorps xmm0, xmm0
lea ecx, [ebp - 0x20c]
movq qword [ebp - 0x20c], xmm0
call fcn.100889f0
lea eax, [ebp - 0x1e0]
mov byte [ebp - 4], 8
push eax
push dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x20c]
push eax
push 1
push esi
mov dword [ebp - 0x1e8], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
test eax, eax
je 0x1009ee3c
mov eax, dword [ebp - 0x1e8]
mov edx, dword [eax]
test edx, edx
je 0x1009ee3c
mov ecx, edx
mov dword [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x1e8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009ee12
sub ecx, dword [ebp - 0x1e8]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x60]
call fcn.10044c60
lea ecx, [ebp - 0x20c]
call fcn.10088b30
jmp 0x1009eeba
xor eax, eax
mov dword [ebp - 0x50], 0
push eax
push 0x1019e5ec
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
call fcn.10044c60
mov ecx, dword [ebp - 0x1e8]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x1009eeba
mov edx, dword [ebp - 0x204]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x1009ee92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009f329
push edx
push ecx
call fcn.1012659a
add esp, 8
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x204], 0
test esi, esi
je 0x1009eec5
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x1f4]
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 9
push eax
mov ecx, esi
call fcn.10089570
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0xa8]
mov ecx, esi
push eax
call fcn.10089220
cmp dword [ebp - 0x98], 0
lea ecx, [ebp - 0xa8]
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0xb
cmovne eax, ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x30], 0
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x1e0], ecx
jb 0x1009ef3d
mov eax, dword [eax]
mov dword [ebp - 0x1e8], eax
cmp ecx, 8
jae 0x1009ef55
movups xmm0, xmmword [eax]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 7
movups xmmword [ebp - 0x44], xmm0
jmp 0x1009efa6
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x44]
cmp esi, 0x7ffffffe
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10044af0
mov ecx, dword [ebp - 0x1e0]
mov dword [ebp - 0x44], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x1e8]
push eax
call fcn.1014d330
mov eax, dword [ebp - 0x1e0]
add esp, 0xc
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x1f4]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xc
push eax
mov ecx, esi
call fcn.100a0730
mov byte [ebp - 0x1ea], al
mov ecx, esi
lea eax, [ebp - 0x78]
push eax
call fcn.1009c940
cmp byte [ebp - 0x1ea], 0
mov byte [ebp - 0x1e9], al
jne 0x1009f256
test al, al
je 0x1009f256
lea ecx, [ebp - 0x1dc]
call fcn.1007fa90
cmp dword [ebp - 0x80], 0
lea ecx, [ebp - 0x90]
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xd
cmovne eax, ecx
lea ecx, [ebp - 0x1c4]
cmp ecx, eax
je 0x1009f023
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x1009f014
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.10044c60
sub esp, 0x18
mov dword [ebp - 0x160], 2
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.10042000
lea eax, [ebp - 0x2c]
push eax
call fcn.10097070
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
lea esi, [ebp - 0x2c]
cmovae eax, ecx
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1e8], eax
cmovae esi, ecx
push fcn.10158c69
push dword [ebp - 0x1e8]
lea eax, [ebp - 0x2c]
cmovae eax, ecx
push esi
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.10088980
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
push 0x10
push str.windows_defender
push 0
push dword [ebp - 0x1c]
cmp esi, 8
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.1009bec0
add esp, 0x44
cmp eax, 0xffffffff
jne 0x1009f243
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
push 6
cmovae eax, dword [ebp - 0x60]
push 0x101a2448
push 0
push dword [ebp - 0x50]
push eax
call fcn.1009bec0
add esp, 0x14
cmp eax, 0xffffffff
jne 0x1009f243
push 0
push str.WinDefend
lea ecx, [ebp - 0x78]
call fcn.10087b60
cmp eax, 0xffffffff
jne 0x1009f243
push dword [ebp - 0x1c]
cmp esi, 8
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x15c]
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.10044c60
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push dword [ebp - 0x34]
cmovae eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x144]
push eax
call fcn.10044c60
mov al, byte [ebp - 0x1e9]
cmp dword [ebp - 0x18], 8
mov byte [ebp - 0x12c], al
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
mov ecx, esp
push eax
call fcn.10041f60
lea eax, [ebp - 0x21c]
push eax
call fcn.10091620
add esp, 8
push dword [eax]
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 0xf
call fcn.1009c890
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xe
call fcn.10042270
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.10041f60
lea eax, [ebp - 0x220]
push eax
call fcn.10095650
add esp, 8
push dword [eax]
lea ecx, [ebp - 0x1ac]
mov byte [ebp - 4], 0x10
call fcn.1009c890
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 0xe
call fcn.10042270
mov esi, dword [ebp - 0x1f4]
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.1009fa70
sub esp, 0x18
mov dword [ebp - 0x164], eax
mov ecx, esp
mov dword [ebp - 0x1f8], esp
push str.FileDescription
call fcn.10042090
lea eax, [ebp - 0x194]
mov byte [ebp - 4], 0x11
push eax
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.10042000
mov byte [ebp - 4], 0xe
call fcn.10092780
add esp, 0x34
lea eax, [ebp - 0x1dc]
lea ecx, [esi + 0x14]
push eax
call fcn.1007f090
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.1009fa70
push eax
mov ecx, esi
call fcn.100a0c10
mov eax, dword [ebp - 0x224]
fstp dword [ebp - 0x1e8]
movss xmm0, dword [ebp - 0x1e8]
addss xmm0, dword [eax]
movss dword [eax], xmm0
inc dword [esi + 8]
lea ecx, [ebp - 0x2c]
call fcn.100424a0
lea ecx, [ebp - 0x1dc]
call fcn.10064550
lea ecx, [ebp - 0x44]
call fcn.100424a0
lea ecx, [ebp - 0xa8]
call fcn.100424a0
lea ecx, [ebp - 0xc0]
call fcn.100424a0
lea ecx, [ebp - 0x60]
call fcn.100424a0
lea ecx, [ebp - 0x90]
call fcn.100424a0
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 4
call fcn.100424a0
mov eax, dword [ebp - 0x200]
mov esi, dword [ebp - 0x1f0]
inc eax
add esi, 0x2c
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x1f0], esi
cmp eax, dword [ebp - 0x14]
jb 0x1009ecd3
mov eax, dword [ebp - 0x1f4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1f0], eax
mov edx, dword [ebp - 0x218]
test edx, edx
je 0x1009f303
mov ecx, dword [ebp - 0x210]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x1009f2f9
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009f329
push ecx
push edx
call fcn.1012659a
add esp, 8
push edi
call esi
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10126919
mov esp, ebp
pop ebp
ret 4
call fcn.101513dc
int3