Function at 0x180011630
Capabilities:
Enumerate services

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
xor r12d, r12d
test rax, rax
jne 0x18001168a
lea rax, str.Failed_to_open_SC_manager
mov qword [rsp + 0x78], 0x19
lea ecx, [r15 + 0x65]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
call fcn.18001115c
jmp 0x180011dbd
mov dword [rbp + 0x98], r12d
mov dword [rbp + 0x90], r12d
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov edx, 0x3ff
lea r8d, [r9 + 1]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x18001170b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x18001170b
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, str.Failed_to_enumerate_services__1_
mov r13d, 0x20
mov qword [rsp + 0x78], r13
lea ecx, [r13 + 0x1d]
jmp 0x180011676
mov ebx, dword [rbp + 0x98]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov rsi, r12
mov qword [rbp - 0x40], r12
test rbx, rbx
je 0x180011761
mov ecx, ebx
cmp rbx, 0x1000
jb 0x180011737
call fcn.180001ad8
jmp 0x18001173c
call fcn.180027eec
mov rdi, rax
mov qword [rbp - 0x50], rax
lea rsi, [rax + rbx]
mov qword [rbp - 0x40], rsi
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, rsi
mov qword [rbp - 0x48], rax
jmp 0x180011769
mov rax, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x50]
mov dword [rsp + 0x60], r12d
sub eax, edi
mov qword [rsp + 0x70], rax
mov r13d, 0x20
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x98]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov r9, rdi
mov edx, 0x3ff
mov r8d, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x1800117cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x180011cc7
mov r14d, r12d
mov dword [rbp + 0xa0], r12d
mov ebx, dword [rbp + 0x90]
test ebx, ebx
je 0x180011cb2
mov eax, r14d
lea r12, [rax + rax*2]
shl r12, 4
add r12, rdi
mov r8, r12
lea rdx, [0x1801e4f60]
lea rcx, [0x1801e4ee0]
call fcn.180010bfc
lea rcx, [0x1801e4f60]
cmp rax, rcx
je 0x180011c9c
lea rax, str.Fund_potentially_problematic_Anti_Cheat_service:_n____nDisable_automatically_
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x4f
lea r8, [r12 + 8]
mov r9, r12
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x20]
call fcn.180010ff8
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r9d, 0x1033
lea r8, str.Invasive_Anti_Cheat_is_running
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x180011c8d
mov rcx, r15
cmp eax, 6
jne 0x180011d5e
mov rdx, qword [r12]
call fcn.180011580
mov ebx, eax
mov dword [rbp + 0xa8], eax
xor eax, eax
test ebx, ebx
je 0x180011c8d
lea r14d, [rax + 7]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r14
mov word [rsp + 0x40], ax
mov ecx, ebx
sub ecx, 0x3e
je 0x180011ae3
sub ecx, 1
je 0x180011a62
sub ecx, 1
je 0x1800119dd
cmp ecx, 1
lea rcx, [rbp - 0x70]
je 0x18001195c
lea rax, str.Unknown_error:_
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x11
lea r9, [rbp + 0xa8]
lea r8, [rbp - 0x20]
mov edx, ebx
call fcn.180010e3c
mov r14, rax
lea rax, [rsp + 0x40]
cmp rax, r14
je 0x180011b91
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180011b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, str.Failed_to_query_service_status:_
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x22
mov r9, r12
lea r8, [rbp - 0x10]
mov edx, 0x41
call fcn.180010ef8
mov r14, rax
lea rax, [rsp + 0x40]
cmp rax, r14
je 0x180011b91
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180011b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, str.Timeout_while_stopping_service:_
mov qword [rbp], rax
mov qword [rbp + 8], 0x22
mov r9, r12
lea r8, [rbp]
mov edx, 0x40
lea rcx, [rbp - 0x70]
call fcn.180010ef8
mov r14, rax
lea rax, [rsp + 0x40]
cmp rax, r14
je 0x180011b91
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180011b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, str.Failed_to_stop_service:_
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0x1a
mov r9, r12
lea r8, [rbp + 0x10]
mov edx, 0x3f
lea rcx, [rbp - 0x70]
call fcn.180010ef8
mov r14, rax
lea rax, [rsp + 0x40]
cmp rax, r14
je 0x180011b91
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180011b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, str.Failed_to_open_service:_
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0x1a
mov r9, r12
lea r8, [rbp - 0x80]
mov edx, 0x3e
lea rcx, [rbp - 0x70]
call fcn.180010ef8
mov r14, rax
lea rax, [rsp + 0x40]
cmp rax, r14
je 0x180011b91
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180011b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011cf4
call fcn.180027f28
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], ax
mov r8, r13
mov rdx, r14
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov qword [r14 + 0x10], rax
mov word [r14], ax
mov qword [r14 + 0x18], 7
lea rcx, [rbp - 0x70]
call fcn.18000df34
lea rdx, [rsp + 0x40]
mov r14d, 7
cmp qword [rsp + 0x58], r14
cmova rdx, qword [rsp + 0x40]
mov r9d, 0x1012
lea r8, str.Failed_to_disable_service
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 4
jne 0x180011c2b
mov rdx, qword [rsp + 0x58]
cmp rdx, r14
jbe 0x180011c0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011c06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011d3d
call fcn.180027f28
mov rdx, qword [r12]
mov rcx, r15
call fcn.180011580
mov ebx, eax
mov dword [rbp + 0xa8], eax
xor eax, eax
test ebx, ebx
jne 0x180011899
jmp 0x180011c86
cmp eax, 5
jne 0x180011cfb
mov rdx, qword [rsp + 0x58]
cmp rdx, r14
jbe 0x180011c75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011c70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180011d3d
call fcn.180027f28
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r14
mov word [rsp + 0x40], ax
mov r14d, dword [rbp + 0xa0]
lea rcx, [rbp + 0x20]
call fcn.18000df34
mov ebx, dword [rbp + 0x90]
inc r14d
mov dword [rbp + 0xa0], r14d
cmp r14d, ebx
jb 0x1800117e5
xor r12d, r12d
cmp dword [rsp + 0x60], r12d
je 0x180011d74
mov rax, qword [rsp + 0x70]
jmp 0x18001177b
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, str.Failed_to_enumerate_services__2_
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], r13
lea rdx, [rbp - 0x80]
mov ecx, 0x3d
call fcn.18001115c
mov ebx, eax
jmp 0x180011d80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, r14
jbe 0x180011d49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011d44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011d44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180027f28
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov word [rsp + 0x40], r12w
jmp 0x180011d69
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 0x63
lea rcx, [rbp + 0x20]
call fcn.18000df34
jmp 0x180011d80
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, r12d
test rdi, rdi
je 0x180011dbb
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x180011db0
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011db0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rsi
mov rcx, rdi
call fcn.180027f28
mov eax, ebx
add rsp, 0x148
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret