Function at 0x6500b010
Capabilities:
Enumerate services

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov qword [rsp + 0x78], 0xfffffffffffffffe
movzx r12d, dl
mov rbp, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
call qword [0x65043098]
lea rcx, [0x650430a0]
mov rax, qword [0x650430a0]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
mov r13d, 1
mov dword [rsp + 0x50], r13d
xor eax, eax
lock cmpxchg dword [0x65047dac], r13d
jne 0x6500b0e2
lea r8, [0x65039a30]
lea edx, [r14 + 0xe]
lea rcx, [0x65039a58]
call fcn.6500bcb0
mov rdi, rax
lea r8, [0x65039a68]
lea edx, [r14 + 8]
lea rcx, [0x65039878]
call fcn.6500c660
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add dword [0x65044948], r13d
test rax, rax
je 0x6500b0d6
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add dword [0x6504494c], r13d
jmp 0x6500b0d9
mov rax, r14
mov qword [0x65047ee0], rax
jmp 0x6500b0e9
mov rax, qword [0x65047ee0]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 4]
call rax
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x6500b4bc
mov dword [rsp + 0x4c], r14d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x30
lea r9, [rsp + 0x80]
mov edx, 0x13f
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or r8, 0xffffffffffffffff
test edi, edi
je 0x6500b16f
cmp eax, 0xea
je 0x6500b16f
mov r15, qword [rsp + 0x110]
jmp 0x6500b1cb
mov edi, dword [rsp + 0x48]
add edi, 0x30
mov ecx, edi
mov eax, 0x30
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.6501d2f0
mov r15, rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, r15
mov edx, 0x13f
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
mov esi, r14d
mov dword [rsp + 0x110], r14d
cmp dword [rsp + 0x118], r14d
jbe 0x6500b4bc
mov rbx, qword [r15]
lea rcx, [0x650430a0]
mov rax, qword [0x650430a0]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rbx, rbx
je 0x6500b247
test rbx, 0xffffffffffff0000
jne 0x6500b232
movzx edi, bx
xor edx, edx
mov ecx, edi
call fcn.650026f0
test rax, rax
je 0x6500b25b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.65003e00
jmp 0x6500b25b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x6500b24a
mov ecx, r14d
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.65003f90
nop
test r12b, r12b
je 0x6500b2e9
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x6500b28d
cmp rax, qword [rdi - 0x18]
jne 0x6500b28d
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x6500b2c9
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x6500b498
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.6501d7b0
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.65008410
test al, al
jne 0x6500b369
jmp 0x6500b45b
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x6500b312
cmp rax, qword [rdi - 0x18]
jne 0x6500b312
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x6500b34e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x6500b4b6
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.6501d7b0
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call fcn.65006530
test al, al
jne 0x6500b45b
lea r8, [0x65038cb0]
mov edx, 4
lea rcx, [0x65038ce0]
call fcn.6500bcb0
mov rdx, rax
mov rcx, rbp
call fcn.65003ab0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.65004ac0
nop
mov rsi, qword [rax]
movsxd r13, dword [rsi - 0x10]
mov rax, qword [rbp]
mov rbx, rsi
sub rbx, rax
sar rbx, 1
mov r12d, dword [rax - 0x10]
lea edi, [r12 + r13]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x6500b3d3
mov edx, edi
mov rcx, rbp
call fcn.65002640
mov rax, qword [rbp]
cmp rbx, r12
ja 0x6500b3e0
lea rsi, [rax + rbx*2]
mov rdx, r13
add rdx, rdx
lea rcx, [rax + r12*2]
mov r9, rdx
mov r8, rsi
call fcn.6501d7b0
test edi, edi
js 0x6500b49e
mov rax, qword [rbp]
cmp edi, dword [rax - 0xc]
jg 0x6500b49e
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp]
mov word [rax + rcx*2], 0
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x6500b44c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov esi, dword [rsp + 0x110]
mov r12b, byte [rsp + 0x108]
jmp 0x6500b45b
mov esi, dword [rsp + 0x110]
mov r12b, byte [rsp + 0x108]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x6500b47c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
add esi, 1
mov dword [rsp + 0x110], esi
add r15, 0x30
cmp esi, dword [rsp + 0x118]
jae 0x6500b4a9
jmp 0x6500b1e4
call fcn.65002320
nop
mov ecx, 0x80070057
call fcn.65001050
nop
mov rbx, qword [rsp + 0x60]
mov r13d, 1
jmp 0x6500b4bc
call fcn.65002320
nop
xor eax, eax
lock cmpxchg dword [0x65047dc0], r13d
jne 0x6500b530
lea r8, [0x65039a98]
mov edx, 0x12
lea rcx, [0x65039ad8]
call fcn.6500bcb0
mov rdi, rax
lea r8, [0x65039af0]
mov edx, 8
lea rcx, [0x65039878]
call fcn.6500c660
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
add dword [0x65044948], 1
test rax, rax
je 0x6500b527
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
add dword [0x6504494c], 1
mov qword [0x65047ee8], r14
jmp 0x6500b537
mov r14, qword [0x65047ee8]
mov rcx, rbx
call r14
mov rax, rbp
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret