Function at 0x140026b90
Capabilities:
Query service configuration

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r13, rcx
mov qword [rsp + 0x38], r8
xor ebx, ebx
lea rcx, [0x140051890]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
call fcn.140025790
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x28], rbx
lea rcx, [0x1400518d8]
call fcn.140025790
mov qword [rsp + 0x98], rbp
lea r15, [rbx - 1]
mov qword [rsp + 0x50], rsi
mov r12d, ebx
nop dword [rax + rax]
mov rcx, qword [r13 + r12*8]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
call fcn.140025790
mov rdi, qword [rsp + 0x30]
mov rbx, r15
nop dword [rax]
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140026c20
mov edx, 1
lea rcx, [rbx - 4]
call fcn.14002f9e8
lea r9, [rbx - 5]
mov rcx, rax
lea r8, [rdi + 1]
mov r14, rax
lea rdx, [rbx - 4]
call fcn.1400333fc
mov rcx, r14
call fcn.140026fa0
cmp eax, 1
jne 0x140026d0f
lea edx, [rax + 3]
mov rcx, r14
call fcn.140027130
cmp eax, 1
jne 0x140026d23
mov rcx, r14
call fcn.140027060
test eax, eax
jne 0x140026d23
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 1
mov rdx, r14
mov rcx, rax
mov rbp, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ebx, dword [rsp + 0x40]
xor ecx, ecx
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
lea rdx, [0x140051b28]
mov rcx, r14
call fcn.140027220
mov rcx, qword [rdi + 0x10]
call fcn.140033648
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc r12
cmp r12, 1
jge 0x140026ed0
xor ebx, ebx
jmp 0x140026c00
mov rcx, r14
call fcn.140027060
cmp eax, 1
jne 0x140026d5b
lea edx, [rax + 1]
mov rcx, r14
call fcn.140027130
cmp eax, 1
jne 0x140026d5b
mov rcx, qword [rsp + 0x20]
call fcn.14002fc28
mov rcx, qword [rsp + 0x28]
call fcn.14002fc28
xor eax, eax
jmp 0x140026f6d
mov rcx, r14
call fcn.140027060
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
test eax, eax
jne 0x140026def
lea rdx, [0x140051905]
lea ecx, [rax + 2]
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, SafeArrayDestroy
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroy
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
mov rcx, rbx
call fcn.140003eb0
mov rcx, rdi
call fcn.140003f30
mov ecx, 2
call fcn.140003de0
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
mov edx, 2
mov rcx, r14
call fcn.140027130
test eax, eax
jne 0x140026e82
lea rdx, [0x140051905]
lea ecx, [rax + 2]
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, SafeArrayDestroy
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroy
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
mov rcx, rbx
call fcn.140003eb0
mov rcx, rdi
call fcn.140003f30
mov ecx, 3
call fcn.140003de0
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
cmp byte [r14 + r15 + 1], 0
lea r15, [r15 + 1]
jne 0x140026e82
mov edx, 1
lea rcx, [r15 + 1]
call fcn.14002f9e8
mov rcx, qword [rsp + 0x38]
lea rdx, [r15 + 1]
mov r8, r14
mov qword [rcx], rax
mov rcx, rax
call fcn.14002fbc8
mov edx, 1
mov rcx, r14
call fcn.1400278a0
mov rcx, rbx
call fcn.14002fc28
mov rcx, rdi
jmp 0x140026f63
lea rdx, [0x140051905]
mov ecx, 2
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, SafeArrayDestroy
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroy
call fcn.140003920
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
mov rcx, qword [rsp + 0x20]
call fcn.140003eb0
mov rcx, qword [rsp + 0x28]
call fcn.140003f30
mov ecx, 1
call fcn.140003de0
lea rdx, [0x140051905]
mov ecx, recvfrom
call fcn.140003920
mov rcx, qword [rsp + 0x20]
call fcn.14002fc28
mov rcx, qword [rsp + 0x28]
call fcn.14002fc28
mov eax, 1
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002d5c0
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret