Function at 0x40c9f0
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x424284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
push eax
push esi
push ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x22c], edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x208], eax
test eax, eax
je 0x40caa3
test edi, edi
je 0x40ccf5
cmp edi, esi
je 0x40ccf5
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x204]
push ecx
push esi
push ebx
mov dword [ebp - 0x20c], 0x100
call dword [sym.imp.ADVAPI32.dll_GetServiceDisplayNameW]
mov edx, dword [ebp + 0x18]
lea eax, [ebp - 0x210]
push eax
push edi
lea ecx, [ebp - 0x204]
push ecx
push ebx
mov dword [ebp - 0x210], edx
call dword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
mov eax, dword [ebp - 0x208]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x424
je 0x40cae5
call esi
mov edi, eax
call fcn.00402080
push eax
push 0x4000021f
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x40cab2
push 0
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0
push 0
push 3
push 0x3b
push 0
push ebx
mov dword [ebp - 0x224], 0
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
call esi
cmp eax, 0xea
je 0x40cb35
call esi
mov edi, eax
call fcn.00402080
push eax
push 0x40000220
jmp 0x40cac1
mov edx, dword [ebp - 0x214]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x208], esi
test esi, esi
jne 0x40cb8a
push str.open_service__
push str.ENUM_SERVICE_STATUS_PROCESS
push 0xc00001fa
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041427b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x230], eax
push 0
lea ecx, [ebp - 0x224]
push ecx
mov ecx, dword [ebp - 0x230]
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x214]
push eax
push ecx
push esi
push 3
push 0x3b
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov edi, eax
mov dword [ebp - 0x228], edi
test edi, edi
jne 0x40cbdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x40cc46
xor esi, esi
cmp dword [ebp - 0x21c], esi
jbe 0x40cc33
mov edx, dword [ebp - 0x208]
add edx, 4
mov dword [ebp - 0x218], edx
jmp 0x40cc00
mov eax, dword [ebp - 0x218]
mov edi, dword [ebp - 0x20c]
mov ebx, dword [eax]
call fcn.004080a0
test eax, eax
jne 0x40cc6e
add dword [ebp - 0x218], 0x2c
inc esi
cmp esi, dword [ebp - 0x21c]
jb 0x40cc00
mov ebx, dword [ebp - 0x220]
mov edi, dword [ebp - 0x228]
test edi, edi
jne 0x40ccda
mov esi, dword [ebp - 0x208]
jmp 0x40cb96
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push 0x40000220
jmp 0x40cac1
mov edi, dword [ebp - 0x208]
imul esi, esi, 0x2c
mov ecx, dword [esi + edi]
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp - 0x22c]
push ecx
push 0x4200a8
push 0xffffffffffffffff
push edx
push esi
call fcn.004149b0
add esp, 0x14
push edi
push 0
test eax, eax
jns 0x40ccb8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push str.open_service__
push str.canonical_name
jmp 0x40cb61
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x220]
push 0
push 0
push eax
push esi
push ecx
jmp 0x40cced
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x20c]
push 0
push 0
push edx
push eax
push ebx
call fcn.0040c9f0
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041427b
mov esp, ebp
pop ebp
ret