Function at 0x410bf0
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
jle 0x410c13
mov ebx, dword [eax]
mov edi, 0x421d10
call fcn.004080a0
mov byte [ebp + 0xb], 1
test eax, eax
jne 0x410c17
mov byte [ebp + 0xb], 0
mov eax, 5
call fcn.0040c9c0
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
jne 0x410c4a
push 0x400001fb
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 8
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0
push 3
push 0x30
push 0
push edi
mov dword [ebp - 0xc], 0
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xea
je 0x410cab
call esi
mov edi, eax
call fcn.00402080
push eax
push 0x40000220
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0xc
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x410cf1
push str.list_invgate_services__
push str.ENUM_SERVICE_STATUS_PROCESS
push 0xc00001fa
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0x10
lea eax, [ebx + 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push eax
push ebx
push 3
push 0x30
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x410d31
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x410dd0
cmp dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jbe 0x410daf
call fcn.0040db30
mov esi, eax
test esi, esi
je 0x410e10
mov ecx, dword [ebx]
push ecx
push 0x4200a8
push 0xffffffffffffffff
lea edi, [esi + 2]
push 0x100
push edi
call fcn.004149b0
add esp, 0x14
push 0
mov ecx, esi
call fcn.0040b5b0
add esp, 4
cmp byte [ebp + 0xb], 0
jne 0x410d84
cmp word [esi + 0x18416], 0
je 0x410d92
push edi
push 0x420224
call fcn.00414fc1
add esp, 8
call fcn.0040db70
mov eax, dword [ebp - 0x10]
inc eax
add ebx, 0x2c
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jb 0x410d3e
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
test esi, esi
je 0x410cf7
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.00402080
push eax
push 0x40000220
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0xc
mov eax, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push str.list_invgate_services__
push str.invgate_service_t
push 0xc00001fa
call fcn.004147fb
add eax, 0x40
push eax
call fcn.00402220
add esp, 0x10
pop edi
pop esi
mov eax, 5
pop ebx
mov esp, ebp
pop ebp
ret