Function at 0x14003fee0
Capabilities:
Encode data using xor
Stop service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xe0
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
vmovaps xmmword [rax - 0x38], xmm8
vmovaps xmmword [rax - 0x48], xmm9
vmovaps xmmword [rax - 0x58], xmm10
mov rax, qword [0x14006b060]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, qword [0x140fb4ac8]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14004010b
lea r8, [rsp + 0x68]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400400fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
vmovups ymm0, ymmword [0x140061500]
movzx ecx, byte [0x140061528]
mov edx, 4
vmovsd xmm1, qword [0x140061520]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140061ff0]
vmovdqu xmm9, xmmword [0x140061f60]
vmovups ymmword [rsp + 0x30], ymm0
vmovdqu xmm0, xmmword [0x140061fe0]
mov r9d, eax
mov byte [rsp + 0x58], cl
vmovdqu xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
mov eax, 0x1f
vmovd xmm8, edx
vmovsd qword [rsp + 0x50], xmm1
xor ecx, ecx
lea rdx, [rsp + 0x34]
vmovd xmm10, eax
nop
vmovd xmm0, ecx
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rdx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, r8d
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rdx - 4], xmm1
lea eax, [rcx + 4]
add ecx, 8
lea rdx, [rdx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, r8d
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rdx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rdx - 8], xmm1
cmp ecx, 0x28
jl 0x14003ffd0
cmp ecx, 0x29
jge 0x1400400dd
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 0x29
jl 0x1400400b0
mov edx, r9d
lea rcx, [rsp + 0x30]
vzeroupper
call fcn.1400036e0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400402ad
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400402af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x140061458]
mov edx, 4
vmovups ymm0, ymmword [0x140061428]
vmovups xmm1, xmmword [0x140061448]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140061ff0]
vmovdqu xmm9, xmmword [0x140061f60]
mov dword [rsp + 0x60], ecx
mov r9d, eax
movzx ecx, word [0x14006145c]
mov eax, 0x1f
vmovups ymmword [rsp + 0x30], ymm0
vmovdqu xmm0, xmmword [0x140061fe0]
vmovdqu xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
mov word [rsp + 0x64], cx
xor ecx, ecx
vmovd xmm8, edx
vmovups xmmword [rsp + 0x50], xmm1
vmovd xmm10, eax
lea rdx, [rsp + 0x34]
nop word [rax + rax]
vmovd xmm0, ecx
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rdx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, r8d
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rdx - 4], xmm1
lea eax, [rcx + 4]
add ecx, 8
lea rdx, [rdx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, r8d
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rdx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rdx - 8], xmm1
cmp ecx, 0x30
jl 0x140040190
cmp ecx, 0x36
jge 0x14004029d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x30
xor byte [r8 - 1], al
cmp ecx, 0x36
jl 0x140040270
mov edx, r9d
lea rcx, [rsp + 0x30]
vzeroupper
call fcn.1400036e0
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14000ee10
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
vmovaps xmm9, xmmword [r11 - 0x40]
vmovaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
ret