Function at 0x14007f6bc
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x80
xor ebx, ebx
mov edi, r8d
mov rbp, rcx
mov rsi, rdx
lea rcx, [rax - 0x34]
lea r8d, [rbx + 0x18]
xor edx, edx
mov qword [rax - 0x40], rbx
mov qword [rax - 0x50], rbx
mov dword [rax - 0x38], ebx
call sub.msvcrt.dll_memset
mov qword [rsp + 0x50], rbx
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14007f731
test byte [rcx + 0x1c], 2
je 0x14007f731
cmp byte [rcx + 0x19], 5
jb 0x14007f731
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x20]
lea r8, [0x140008cb0]
call fcn.14000ffa8
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x28], 0x2c
mov dword [rsp + 0x20], 1
call fcn.14007edfc
mov rbp, qword [rsp + 0x48]
cmp eax, ebx
jne 0x14007f9ed
mov esi, 1
cmp dword [rsp + 0x64], esi
jne 0x14007f7bb
mov rcx, qword [str.P5_n_]
lea rdx, str.P5_n_
cmp rcx, rdx
je 0x14007f9d8
test byte [rcx + 0x1c], 2
je 0x14007f9d8
cmp byte [rcx + 0x19], 5
jb 0x14007f9d8
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x20]
lea r8, [0x140008cb0]
call fcn.14000ffa8
jmp 0x14007f9d8
cmp edi, ebx
je 0x14007f973
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov edx, esi
mov rcx, rbp
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cmp eax, ebx
jne 0x14007f8b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x14007f83a
mov rcx, qword [str.P5_n_]
lea rdx, str.P5_n_
cmp rcx, rdx
je 0x14007f9f5
test byte [rcx + 0x1c], 2
je 0x14007f9f5
cmp byte [rcx + 0x19], 5
jb 0x14007f9f5
mov edx, 0x22
jmp 0x14007f923
cmp dword [rsp + 0x40], ebx
je 0x14007f973
mov ecx, dword [rsp + 0x40]
call fcn.140076a54
mov rsi, rax
mov qword [rsp + 0x50], rax
cmp rax, rbx
jne 0x14007f8b8
mov rax, qword [str.P5_n_]
lea rdx, str.P5_n_
cmp rax, rdx
je 0x14007f9f5
test byte [rax + 0x1c], 2
je 0x14007f9f5
cmp byte [rax + 0x19], 5
jb 0x14007f9f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov r9d, dword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008cb0]
mov edx, 0x23
mov dword [rsp + 0x20], eax
call fcn.14001d4a0
jmp 0x14007f9f5
mov rsi, rbx
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov r8, rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
cmp eax, ebx
jne 0x14007f93b
mov rax, qword [str.P5_n_]
lea rdx, str.P5_n_
cmp rax, rdx
je 0x14007f9f5
test byte [rax + 0x1c], 2
je 0x14007f9f5
cmp byte [rax + 0x19], 5
jb 0x14007f9f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov edx, 0x24
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008cb0]
mov r9d, eax
call fcn.1400100e0
jmp 0x14007f9f5
mov edi, ebx
cmp dword [rsp + 0x48], ebx
jbe 0x14007f96e
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0xa0]
or r9d, 0xffffffff
xor r8d, r8d
call fcn.14007f6bc
cmp eax, ebx
je 0x14007f9f5
inc edi
add rsi, 0x30
cmp edi, dword [rsp + 0x48]
jb 0x14007f943
mov esi, 1
lea r8, [rsp + 0x60]
mov edx, esi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, ebx
jne 0x14007f9cd
mov rax, qword [str.P5_n_]
lea rdx, str.P5_n_
cmp rax, rdx
je 0x14007f9f5
test byte [rax + 0x1c], 2
je 0x14007f9f5
cmp byte [rax + 0x19], 2
jb 0x14007f9f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140008cb0]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x25
call fcn.1400100e0
jmp 0x14007f9f5
mov eax, dword [rsp + 0xb8]
cmp eax, ebx
jne 0x14007f9dc
mov ebx, esi
jmp 0x14007f9f5
mov r8d, eax
mov edx, esi
mov rcx, rbp
call fcn.140080598
cmp eax, ebx
je 0x14007f9d8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x50]
call fcn.140076afc
mov rcx, qword [rsp + 0x58]
mov rdx, rbp
call fcn.14007ef9c
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret