Function at 0x180002d00
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10900]
mov eax, 0x10a00
call fcn.18000bba0
sub rsp, rax
mov rax, qword [0x1800251e0]
xor rax, rsp
mov qword [rbp + 0x108f0], rax
mov rdi, rcx
mov ecx, 1
mov ebx, edx
call fcn.180002950
xor r12d, r12d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov dword [rdi + 0x12c], ebx
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], 0x2000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, dword [rsp + 0x44]
mov edx, dword [rdi + 0x12c]
mov r15, rax
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
lea r8d, [r12 + 3]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, r15
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov edx, dword [rsp + 0x44]
lea ecx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [rsp + 0x44]
mov qword [rsp + 0x38], r12
mov rsi, rax
lea rax, [rsp + 0x48]
lea r8d, [r12 + 3]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov edx, dword [rdi + 0x12c]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea ecx, [r12 + 0x40]
mov edx, 0x800
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, 1
mov byte [rax], 0x64
mov r14, rax
mov dword [rsp + 0x4c], ebx
cmp dword [rsp + 0x48], r12d
jbe 0x1800031e2
mov qword [rsp + 0x10a38], r13
lea r13, [0x180000000]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x2000
mov dword [rsp + 0x40], 0x2000
call fcn.18000c280
mov rdx, qword [rsi]
mov r8d, 0xf01ff
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x1800031c8
mov r9d, dword [rsp + 0x40]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfig2W]
lea rcx, [rbp + 0x100f0]
xor edx, edx
mov r8d, 0x800
call fcn.18000c280
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x180002eb5
lea rcx, [rbp + 0x100f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0xff50]
xor edx, edx
mov r8d, 0xc8
call fcn.18000c280
mov eax, dword [rsi + 0x14]
dec eax
cmp eax, 6
ja case.default.0x180002ede
mov ecx, dword [r13 + rax*4 + 0x3234]
add rcx, r13
jmp rcx
lea rdx, str.Continue
jmp 0x180002f26
lea rdx, str.Pausing
jmp 0x180002f26
lea rdx, str.Paused
jmp 0x180002f26
lea rdx, str.Running
jmp 0x180002f26
lea rdx, str.Starting
jmp 0x180002f26
lea rdx, str.Stopping
jmp 0x180002f26
lea rdx, str.Stopped
jmp 0x180002f26
lea rdx, str.Erro
lea rcx, [rbp + 0xff50]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r8d, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.18000c280
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x2000
mov rcx, rdi
mov dword [rsp + 0x40], 0x2000
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x1800031c8
lea rcx, [rbp + 0x10020]
xor edx, edx
mov r8d, 0xc8
call fcn.18000c280
mov r11d, dword [rsp + 0x54]
test r11d, r11d
je 0x180002fd3
dec r11d
je 0x180002fca
dec r11d
je 0x180002fc1
dec r11d
je 0x180002fb8
dec r11d
lea rcx, [rbp + 0x10020]
je 0x180002faf
lea rdx, str.Erro
jmp 0x180002fe1
lea rdx, str.Disabled
jmp 0x180002fe1
lea rdx, str.Demand_Start
jmp 0x180002fda
lea rdx, str.Auto_Start
jmp 0x180002fda
lea rdx, str.System_Start
jmp 0x180002fda
lea rdx, str.Boot_Start
lea rcx, [rbp + 0x10020]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rsp + 0x50], 0x100
lea rax, [0x180020c7c]
lea r13, [0x180020c80]
mov rcx, r14
cmovb r13, rax
add ebx, 0x2000
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp rax, rbx
jae 0x180003029
mov r8d, 0x42
mov edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov r14, rax
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [rsp + 0x4c]
mov rdx, qword [rsi + 8]
movsxd r8, eax
lea rcx, [r14 + rbx]
lea r8, [r8 + r8 + 2]
call fcn.18000ad70
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x100f0]
lea ebx, [rbx + rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
movsxd r8, eax
lea rdx, [rbp + 0x100f0]
add rcx, r14
lea r8, [r8 + r8 + 2]
call fcn.18000ad70
lea rcx, [rbp + 0x100f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0xff50]
lea ebx, [rbx + rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
movsxd r8, eax
lea rdx, [rbp + 0xff50]
add rcx, r14
lea r8, [r8 + r8 + 2]
call fcn.18000ad70
lea rcx, [rbp + 0xff50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x10020]
lea ebx, [rbx + rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
movsxd r8, eax
lea rdx, [rbp + 0x10020]
add rcx, r14
lea r8, [r8 + r8 + 2]
call fcn.18000ad70
lea rcx, [rbp + 0x10020]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp - 0x80]
lea ebx, [rbx + rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rbp - 0x80]
movsxd r8, eax
mov ecx, ebx
lea r8, [r8 + r8 + 2]
add rcx, r14
call fcn.18000ad70
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r13
lea ebx, [rbx + rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, ebx
movsxd r8, eax
add rcx, r14
mov rdx, r13
lea r8, [r8 + r8 + 2]
call fcn.18000ad70
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi]
lea ebx, [rbx + rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsi]
movsxd r8, eax
mov ecx, ebx
lea r8, [r8 + r8 + 2]
add rcx, r14
call fcn.18000ad70
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
lea ebx, [rbx + rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
lea r8, [r8 + r8 + 2]
mov rdx, qword [rsp + 0x60]
mov ecx, ebx
add rcx, r14
call fcn.18000ad70
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rdi
lea ebx, [rbx + rax*2 + 2]
mov dword [rsp + 0x4c], ebx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea r13, [0x180000000]
inc r12d
add rsi, 0x30
cmp r12d, dword [rsp + 0x48]
jb 0x180002e30
mov r13, qword [rsp + 0x10a38]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, ebx
mov r8d, 0x42
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
xor ecx, ecx
mov rbx, rax
call fcn.180002950
mov rax, rbx
mov rcx, qword [rbp + 0x108f0]
xor rcx, rsp
call fcn.18000ad40
lea r11, [rsp + 0x10a00]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret