Function at 0x180033790
Capabilities:
Enumerate services

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1800bf580]
xor rax, rsp
mov qword [rbp + 0x288], rax
lea r13d, [r8 + 0x13]
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x50], rcx
mov r12, r9
mov rbx, rdx
mov rdi, rcx
cmp r8d, r13d
jae case.0x180033833.8
mov edx, dword [rsp + 0x58]
lea r14d, [r8 - 0x77]
mov r8d, dword [rsp + 0x58]
lea r9, [0x180000000]
xor esi, esi
mov dword [rsp + 0x54], r8d
movabs r15, 0x6b636f53415357
mov dword [rsp + 0x50], edx
movabs r10, 0x7fffffffffffffff
lea r11d, [rsi + 0x73]
cmp r14d, 0x3a
ja case.0x180033833.18
movzx eax, byte [r9 + r14 + 0x33cf8]
mov ecx, dword [r9 + rax*4 + 0x33cac]
add rcx, r9
jmp rcx
mov eax, r8d
cmp rax, qword [rbp - 0x78]
jae 0x1800339a2
cmp qword [r12 + 0x18], 0x10
mov rax, r12
mov dword [rbp - 0x7c], 0xb
jb 0x180033858
mov rax, qword [r12]
mov edx, dword [rax + 4]
mov dword [rsp + 0x50], edx
mov dword [rbp - 0x80], 1
jmp case.0x180033833.18
mov eax, edx
cmp rax, qword [rbp - 0x78]
jae 0x1800339a2
mov dword [rsp + 0x7c], esi
mov dword [rbx + 0x20], r8d
mov dword [rbx + 0x24], edx
jmp case.0x180033833.18
cmp qword [r12 + 0x18], 0x10
mov rax, r12
mov dword [rsp + 0x58], esi
jb 0x18003389a
mov rax, qword [r12]
mov r8d, dword [rax]
mov dword [rsp + 0x54], r8d
jmp case.0x180033833.18
lea rcx, [rbp + 0x260]
mov qword [rbp + 0x260], r15
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800338c0
movzx eax, word [0x180097118]
mov word [rcx], ax
jmp case.0x180033833.18
mov dword [rbp + 0x270], 0x77
jmp case.0x180033833.18
mov eax, dword [0x18009baf0]
lea rdx, [rbp + 0x278]
mov r8d, 0xa
mov dword [rbp + 0x274], eax
movzx eax, word [0x18009baf4]
mov word [rbp + 0x278], ax
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov r8d, 2
lea rdx, [0x1800970e0]
lea rcx, [rbp + 0x270]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180033c2d
movabs rax, 0x6c006c0064
mov dword [rsp + 0x28], 0x96
mov qword [rbp + 0x27e], rax
lea rdx, [rbp + 0x270]
lea rax, [rbp + 0x260]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.1800295d0
mov ecx, dword [rdi]
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], ecx
lea rdx, [rbp - 0x20]
mov ecx, dword [rbx]
mov r8d, 0x58
mov dword [rsp + 0x70], ecx
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x60], rax
call fcn.180057cb0
test al, al
jne 0x180033c2d
mov byte [rsp + 0x60], 0
jmp case.0x180033833.8
mov rax, qword [r12 + 0x10]
mov rbx, qword [rbp - 0x70]
mov qword [rbp - 0x58], rsi
cmp rax, rbx
jb 0x1800339a2
sub rax, rbx
mov rbx, qword [rbp - 0x68]
mov qword [rbp - 0x78], rax
jmp case.0x180033833.18
mov word [rbp + 0x272], r11w
jmp case.0x180033833.18
mov ecx, 0x38
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xorps xmm0, xmm0
xor ecx, ecx
mov qword [rsp + 0x60], rax
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rcx
jmp 0x180033c2d
mov dword [rsp + 0x28], 1
lea r9, [rbp - 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [rbp - 0x60]
xor r8d, r8d
mov edx, 0x107
mov rcx, r12
mov qword [r12], rax
call fcn.180034440
test al, al
je 0x1800339a2
jmp 0x180033c2d
mov r8d, 2
lea rdx, [0x180097940]
lea rcx, [rbp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x57
mov word [rbp + 0x269], ax
jmp 0x180033c2d
mov byte [rsp + 0x60], 1
jmp case.0x180033833.18
mov qword [rbp - 0x70], 8
jmp case.0x180033833.18
mov rcx, qword [r12]
test rcx, rcx
je case.0x180033833.18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r12], rsi
jmp 0x180033c2d
mov rax, qword [r12 + 0x10]
mov rbx, qword [rbp - 0x70]
mov dword [rsp + 0x78], esi
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
cmp rax, rbx
jb 0x180033c9a
sub rax, rbx
mov rdi, 0xffffffffffffffff
cmp rax, rdi
cmovb rdi, rax
cmp qword [r12 + 0x18], 0x10
mov rax, r12
jb 0x180033adf
mov rax, qword [r12]
lea r15, [rax + rbx]
cmp rdi, 0xf
ja 0x180033b06
mov r8, rdi
mov qword [rbp - 0x38], rdi
mov rdx, r15
lea rcx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rdi - 0x48], 0
jmp 0x180033b97
cmp rdi, r10
ja 0x180033ca6
mov rsi, rdi
or rsi, 0xf
cmp rsi, r10
jbe 0x180033b20
mov rsi, r10
jmp 0x180033b2d
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180033b66
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180033ca0
mov rcx, rax
call fcn.1800930c8
test rax, rax
je 0x180033c5f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180033b77
test rcx, rcx
je 0x180033b75
call fcn.1800930c8
mov rbx, rax
jmp 0x180033b77
xor ebx, ebx
mov r8, rdi
mov qword [rbp - 0x38], rdi
mov rdx, r15
mov qword [rbp - 0x30], rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
mov byte [rbx + rdi], 0
mov qword [rbp - 0x48], rbx
mov rbx, qword [rbp - 0x68]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call fcn.180003be0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x180033be2
mov rcx, qword [rbp - 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180033bdd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180033c5f
call fcn.180093104
mov r9d, dword [rbp - 0x80]
lea rax, [rsp + 0x78]
mov r8d, dword [rbp - 0x7c]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x58]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov rdi, qword [rbp - 0x50]
movabs r15, 0x6b636f53415357
mov edx, dword [rsp + 0x50]
lea r9, [0x180000000]
mov r8d, dword [rsp + 0x54]
movabs r10, 0x7fffffffffffffff
mov r11d, 0x73
inc r14d
lea eax, [r14 + 0x77]
cmp eax, r13d
jb 0x180033815
jmp case.0x180033833.8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov byte [rsp + 0x60], 1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp + 0x288]
xor rcx, rsp
call fcn.1800938b0
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18003a8b0
int3
call fcn.18003a730
int3
call fcn.18003a870
int3