Function at 0x1400aa880
Capabilities:
Enumerate services

Disassembly:
push rbx
push r15
sub rsp, 0x288
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], ebx
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x1400aaafd
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.14027b2c0
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rbx
lea r9d, [rbx + 3]
mov qword [rsp + 0x38], rax
lea r8d, [rbx + 0x30]
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400aaaf4
mov ecx, dword [rsp + 0x50]
mov qword [rsp + 0x2b8], r12
call fcn.14012a2dc
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.14027b2c0
mov ecx, dword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea r9d, [rbx + 3]
lea rax, [rsp + 0x5c]
xor edx, edx
mov qword [rsp + 0x40], rax
lea r8d, [rbx + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov rcx, r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x1400aaaec
mov rcx, qword [0x14045df08]
lea r8, [0x140339920]
xor r9d, r9d
mov edx, 0x52d
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1400aaaec
mov qword [rsp + 0x2a8], rsi
mov rsi, r12
mov qword [rsp + 0x2a0], rbp
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x280], r14
cmp dword [0x14045e968], 0
jne 0x1400aaacc
mov rdx, qword [rsi]
mov r8d, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x1400aaabc
lea r9, [rsp + 0x54]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ecx, dword [rsp + 0x54]
call fcn.14012a2dc
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14027b2c0
mov r8d, dword [rsp + 0x54]
lea r9, [rsp + 0x54]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x1400aaaa6
cmp dword [rdi + 4], 2
ja 0x1400aaaa6
mov r8, qword [rsi]
xor r9d, r9d
mov rcx, qword [0x14045df08]
mov edx, 0x52e
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rdi + 0x10]
call fcn.140054e40
mov rcx, rax
mov r14, rax
call fcn.140084e80
test eax, eax
jne 0x1400aaaa6
movsxd rcx, ebx
imul rdx, rcx, 0x38
mov rcx, r14
add rdx, r12
call fcn.140082ee0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400aaabc
mov rcx, rdi
call fcn.14012a2d4
inc ebx
add rsi, 0x38
cmp ebx, dword [rsp + 0x58]
jb 0x1400aa9e0
mov rbp, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x288
pop r15
pop rbx
ret