Function at 0x10002610
Capabilities:
Enumerate services
Query service configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x84f0
call fcn.100040d0
mov eax, dword [0x100140f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xf003f
mov ebx, ecx
push 0
push 0
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x4dc], 0
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x4d4], 0x2000
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
push 0
lea ecx, [ebp - 0x4e0]
push ecx
lea ecx, [ebp - 0x4dc]
push ecx
push dword [ebp - 0x4dc]
mov dword [ebp - 0x4e8], eax
push 0
push 3
push dword [ebx + 0xc]
push eax
call edi
push dword [ebp - 0x4dc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call esi
push 0
lea ecx, [ebp - 0x4e0]
push ecx
lea ecx, [ebp - 0x4dc]
push ecx
push dword [ebp - 0x4dc]
mov dword [ebp - 0x4e4], eax
push eax
push 3
push dword [ebx + 0xc]
push dword [ebp - 0x4e8]
call edi
push 0x400
push 0x40
call esi
mov edi, eax
mov dword [ebp - 0x4d0], edi
mov byte [edi], 0xd0
cmp dword [ebp - 0x4e0], 0
mov dword [ebp - 0x4d8], 1
mov dword [ebp - 0x4f0], 0
jbe 0x10002a95
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [ebp - 0x4e4]
jmp 0x10002710
push 0x2000
lea eax, [ebp - 0x84f0]
push 0
push eax
mov dword [ebp - 0x4d4], 0x2000
call fcn.10004100
add esp, 0xc
push 0xf01ff
push dword [ebx]
push dword [ebp - 0x4e8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x4e4], eax
test eax, eax
je 0x10002a79
lea ecx, [ebp - 0x4d4]
push ecx
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x84f0]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
push 0x400
lea eax, [ebp - 0x4cc]
push 0
push eax
call fcn.10004100
mov eax, dword [ebp - 0x84f0]
add esp, 0xc
test eax, eax
je 0x10002798
push eax
lea eax, [ebp - 0x4cc]
push eax
call esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.10004100
mov eax, dword [ebx + 0xc]
dec eax
add esp, 0xc
cmp eax, 6
ja case.default.0x100027b1
jmp dword [eax*4 + 0x10002ac4]
push str.Continue
jmp 0x100027ee
push str.Pausing
jmp 0x100027ee
push str.Paused
jmp 0x100027ee
push str.Running
jmp 0x100027ee
push str.Starting
jmp 0x100027ee
push str.Stopping
jmp 0x100027ee
push str.Stopped
jmp 0x100027ee
push str.Erro
lea eax, [ebp - 0x68]
push eax
call esi
push dword [ebp - 0x4d4]
lea eax, [ebp - 0x84f0]
push 0
push eax
call fcn.10004100
add esp, 0xc
lea eax, [ebp - 0x4d4]
push eax
push 0x2000
lea eax, [ebp - 0x84f0]
push eax
push dword [ebp - 0x4e4]
mov dword [ebp - 0x4d4], 0x2000
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
push 0x64
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.10004100
mov eax, dword [ebp - 0x84ec]
add esp, 0xc
cmp eax, 4
ja case.default.0x10002852
jmp dword [eax*4 + 0x10002ae0]
push str.Auto_Start
jmp 0x10002881
push str.Boot_Start
jmp 0x10002881
push str.Demand_Start
jmp 0x10002881
push str.Disabled
jmp 0x10002881
push str.System_Start
jmp 0x10002881
push str.Erro
lea eax, [ebp - 0xcc]
push eax
call esi
cmp dword [ebp - 0x84f0], 0x100
mov ecx, 0x10010374
mov eax, 0x10010370
cmovb eax, ecx
push edi
mov dword [ebp - 0x4ec], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0x4d8]
add ecx, 0x2000
cmp eax, ecx
jae 0x100028d0
push 0x42
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edi, eax
mov dword [ebp - 0x4d0], edi
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebx + 4]
mov eax, dword [ebp - 0x4d8]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 0x4d8]
inc edi
add edi, eax
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x4cc]
push eax
mov eax, dword [ebp - 0x4d0]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
lea eax, [ebp - 0x4cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add edi, eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x4d0]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add edi, eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x4d0]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x84d4]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x84d4]
mov eax, dword [ebp - 0x4d0]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
push dword [ebp - 0x84d4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x4ec]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [ebp - 0x4d0]
push dword [ebp - 0x4ec]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
push dword [ebp - 0x4ec]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebx]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebx]
mov eax, dword [ebp - 0x4d0]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x84e4]
inc eax
add edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x84e4]
mov eax, dword [ebp - 0x4d0]
add eax, edi
push eax
call fcn.100034e0
add esp, 0xc
push dword [ebp - 0x84e4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x4e4]
inc edi
add eax, edi
mov dword [ebp - 0x4d8], eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x4d0]
mov eax, dword [ebp - 0x4f0]
inc eax
add ebx, 0x24
mov dword [ebp - 0x4f0], eax
cmp eax, dword [ebp - 0x4e0]
jb 0x10002710
push dword [ebp - 0x4e8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x42
push dword [ebp - 0x4d8]
push edi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10003c80
mov esp, ebp
pop ebp
ret 4