Function at 0x1400a6d20
Capabilities:
Enumerate services

Disassembly:
push rbx
push r15
sub rsp, 0x288
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], ebx
lea r8d, [rbx + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x1400a6f9d
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1402767a0
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rbx
lea r9d, [rbx + 3]
mov qword [rsp + 0x38], rax
lea r8d, [rbx + 0x30]
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400a6f94
mov ecx, dword [rsp + 0x50]
mov qword [rsp + 0x2b8], r12
call fcn.140125a94
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov r12, rax
call fcn.1402767a0
mov ecx, dword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea r9d, [rbx + 3]
lea rax, [rsp + 0x5c]
xor edx, edx
mov qword [rsp + 0x40], rax
lea r8d, [rbx + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov rcx, r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
test eax, eax
je 0x1400a6f8c
mov rcx, qword [0x140456df8]
lea r8, [0x140333ce0]
xor r9d, r9d
mov edx, 0x52d
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1400a6f8c
mov qword [rsp + 0x2a8], rsi
mov rsi, r12
mov qword [rsp + 0x2a0], rbp
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x280], r14
cmp dword [0x140455b64], 0
jne 0x1400a6f6c
mov rdx, qword [rsi]
mov r8d, 1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x1400a6f5c
lea r9, [rsp + 0x54]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov ecx, dword [rsp + 0x54]
call fcn.140125a94
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1402767a0
mov r8d, dword [rsp + 0x54]
lea r9, [rsp + 0x54]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x1400a6f46
cmp dword [rdi + 4], 2
ja 0x1400a6f46
mov r8, qword [rsi]
xor r9d, r9d
mov rcx, qword [0x140456df8]
mov edx, 0x52e
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rdi + 0x10]
call fcn.140054780
mov rcx, rax
mov r14, rax
call fcn.14004d2b0
test eax, eax
jne 0x1400a6f46
movsxd rcx, ebx
imul rdx, rcx, 0x38
mov rcx, r14
add rdx, r12
call fcn.14007de60
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400a6f5c
mov rcx, rdi
call fcn.140125e14
inc ebx
add rsi, 0x38
cmp ebx, dword [rsp + 0x58]
jb 0x1400a6e80
mov rbp, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140125a70
add rsp, 0x288
pop r15
pop rbx
ret