Function at 0x406ba0
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x42a33c], 0
je 0x406bc9
push str.___Killing_services..._n
call fcn.00401330
add esp, 4
push esi
push 0xf003f
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x406c36
cmp byte [0x42a33c], al
je 0x406dfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push pe_nt_image_headers32
lea ecx, [ebp - 0x204]
push ecx
push 0x409
push eax
push esi
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x204]
push eax
push str.____Failed_to_open_service_manager:__s
call fcn.004012f0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a11a
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov ebx, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
lea eax, [ebp - 0x208]
push 0
push 0
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x20c], 0
push eax
push 0
push 0
push 1
push 0x10
push 0
push esi
mov dword [ebp - 0x208], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x406cdc
call edi
cmp eax, 0xea
je 0x406cdc
cmp byte [0x42a33c], 0
je 0x406cc4
call edi
push 0
push pe_nt_image_headers32
lea ecx, [ebp - 0x204]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x204]
push eax
push str.____Failed_to_enum_services___s
call fcn.004012f0
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a11a
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x20c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x214], eax
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0x20c]
push eax
push 1
push 0x10
push 0
push esi
call ebx
test eax, eax
jne 0x406d89
cmp byte [0x42a33c], al
je 0x406d5c
call edi
push 0
push pe_nt_image_headers32
lea ecx, [ebp - 0x204]
push ecx
push 0x409
push eax
push 0
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea eax, [ebp - 0x204]
push eax
push str.____Failed_to_enum_services:__s
call fcn.004012f0
add esp, 8
push dword [ebp - 0x214]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a11a
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x208]
mov eax, 0x424c30
mov dword [ebp - 0x210], eax
nop word [eax + eax]
xor edi, edi
test ebx, ebx
je 0x406dec
mov esi, dword [ebp - 0x214]
nop dword [eax]
mov edx, dword [eax]
mov ecx, dword [esi + 4]
call fcn.004061f0
test eax, eax
jne 0x406dd1
mov edx, dword [ebp - 0x210]
mov ecx, dword [esi]
mov edx, dword [edx]
call fcn.004061f0
test eax, eax
je 0x406dde
mov ecx, dword [esi]
call fcn.004067c0
mov ebx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x210]
inc edi
add esi, 0x2c
cmp edi, ebx
jb 0x406db0
add eax, 4
mov dword [ebp - 0x210], eax
cmp eax, 0x424c40
jl 0x406da0
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040a11a
mov esp, ebp
pop ebp
ret