Function at 0x4ee2d0
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x74
xorps xmm0, xmm0
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2c], 0
movlps qword [ebp - 0x34], xmm0
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push edx
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_EnumServicesStatusW
mov edi, dword [ebp + 8]
test eax, eax
je 0x4ee332
mov esi, 1
mov dword [ebp - 0x18], 0
jmp 0x4ee401
call sub.kernel32.dll_GetLastError
cmp eax, 0xea
mov dword [ebp - 0x48], eax
jne 0x4ee389
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4ee3d6
xor edx, edx
lea ecx, [ebp - 0x38]
push esi
call fcn.004ec6b0
add esp, 4
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x30]
cmp esi, 2
lea eax, [edi + ebx]
jb 0x4ee37e
lea ecx, [esi - 1]
push ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ebx, [ebx + esi - 1]
lea eax, [edi + ebx]
mov byte [eax], 0
mov esi, edi
inc ebx
mov eax, dword [ebp - 0x14]
jmp 0x4ee3df
lea eax, [ebp - 0x48]
mov dword [ebp - 0x80], 0x56accc
mov dword [ebp - 0x7c], 2
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x4eb9f0
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 1
lea eax, [ebp - 0x80]
push eax
call fcn.004c4f80
add esp, 4
xorps xmm0, xmm0
mov dword [edi], 4
movlps qword [edi + 4], xmm0
jmp 0x4ee5a1
mov esi, 1
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_EnumServicesStatusW
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x28], 4
movlps qword [ebp - 0x24], xmm0
test eax, eax
mov dword [ebp - 0x5c], eax
je 0x4ee57a
xor edi, edi
mov ecx, 4
xor ebx, ebx
mov dword [ebp - 0x10], esi
jmp 0x4ee471
mov ecx, dword [ebp - 0x60]
movsd xmm0, qword [ebp - 0x68]
mov eax, edi
inc ebx
inc edi
shl eax, 5
cmp ebx, dword [ebp - 0x5c]
movsd qword [ecx + eax + 0x18], xmm0
movsd xmm0, qword [ebp - 0x70]
movsd qword [ecx + eax + 0x10], xmm0
movsd xmm0, qword [ebp - 0x80]
movsd xmm1, qword [ebp - 0x78]
movsd qword [ecx + eax + 8], xmm1
movsd qword [ecx + eax], xmm0
mov dword [ebp - 0x20], edi
je 0x4ee57a
cmp ebx, 0x71c71c7
mov dword [ebp - 0x60], ecx
je 0x4ee5ab
lea eax, [ebx*4]
lea esi, [eax + eax*8]
lea eax, [esi + 0x24]
cmp eax, dword [ebp - 0x18]
ja 0x4ee5be
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + esi]
test eax, eax
je 0x4ee4d0
mov ecx, 0xffffffff
nop word cs:[eax + eax]
nop
cmp word [eax + ecx*2 + 2], 0
lea ecx, [ecx + 1]
jne 0x4ee4b0
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004c5b70
add esp, 0xc
jmp 0x4ee4e2
xorps xmm0, xmm0
mov dword [ebp - 0x48], 1
movlps qword [ebp - 0x44], xmm0
mov byte [ebp - 0x3c], 1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + esi + 4]
mov esi, ecx
test eax, eax
je 0x4ee520
mov ecx, 0xffffffff
nop word cs:[eax + eax]
nop
cmp word [eax + ecx*2 + 2], 0
lea ecx, [ecx + 1]
jne 0x4ee500
push ecx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004c5b70
add esp, 0xc
jmp 0x4ee532
xorps xmm0, xmm0
mov dword [ebp - 0x58], 1
movlps qword [ebp - 0x54], xmm0
mov byte [ebp - 0x4c], 1
movsd xmm0, qword [ebp - 0x48]
movsd xmm1, qword [ebp - 0x40]
cmp edi, dword [ebp - 0x24]
movsd xmm2, qword [ebp - 0x50]
lea eax, [ebp - 0x70]
movsd qword [ebp - 0x80], xmm0
movsd xmm0, qword [ebp - 0x58]
movsd qword [ebp - 0x78], xmm1
movsd qword [eax + 8], xmm2
movsd qword [eax], xmm0
jne 0x4ee430
lea ecx, [ebp - 0x28]
mov edx, edi
call fcn.004ec420
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x20]
jmp 0x4ee433
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x28]
cmp dword [ebp - 0x34], 0
mov dword [edi + 8], eax
movsd qword [edi], xmm0
je 0x4ee5a1
mov eax, dword [0x56bbf8]
push esi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, edi
add esp, 0x74
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x56acf8
push 0x20
push 0xfffffffffffffffc
call fcn.00417fa0
add esp, 0xc
jmp 0x4ee5cf
push 0x56acf8
push dword [ebp - 0x18]
push eax
call fcn.00417f20
add esp, 0xc
ud2