Function at 0x7ff65ee1efd0
Capabilities:
Create service
Encode data using xor
Get common file path
Get program files directory
Get startup folder
Query service configuration
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov r14, rcx
mov ecx, 0x20
call fcn.7ff65efe06d0
xor r15d, r15d
mov dword [rax + 1], r15d
mov word [rax + 5], r15w
mov byte [rax + 7], r15b
mov byte [rax], r15b
mov rsi, 0xffffffffffffffff
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [r14], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rcx, rax
mov rax, qword [r14]
mov qword [rax + 0x10], rcx
mov rax, qword [r14]
cmp qword [rax + 0x10], r15
jne 0x7ff65ee1f068
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x7ff65ee1f554
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov r9, r15
mov qword [rbp - 0x80], r15
nop dword [rax + rax]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
cmp rdx, rcx
jne 0x7ff65ee1f096
mov eax, 0x104
jmp 0x7ff65ee1f0a2
mov rax, rcx
sub rax, rdx
sar rax, 1
add rax, rax
mov r8, rcx
sub r8, rdx
sar r8, 1
cmp rax, r8
jae 0x7ff65ee1f0bb
lea rcx, [rdx + rax*2]
mov qword [rsp + 0x78], rcx
jmp 0x7ff65ee1f0fd
jbe 0x7ff65ee1f0fd
sub r9, rdx
sar r9, 1
cmp rax, r9
jbe 0x7ff65ee1f0dc
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.7ff65ee1f7d0
mov rcx, qword [rsp + 0x78]
jmp 0x7ff65ee1f0f8
sub rax, r8
lea rbx, [rcx + rax*2]
mov r8, rbx
sub r8, rcx
xor edx, edx
call fcn.7ff65efe35e0
mov rcx, rbx
mov qword [rsp + 0x78], rbx
mov rdx, qword [rsp + 0x70]
sub rcx, rdx
sar rcx, 1
mov r8d, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x7ff65ee1f122
mov r9, qword [rbp - 0x80]
jmp 0x7ff65ee1f080
test eax, eax
jne 0x7ff65ee1f513
mov rax, qword [rsp + 0x78]
add rax, 0xfffffffffffffffe
mov rdx, qword [rsp + 0x70]
cmp rax, rdx
je 0x7ff65ee1f15f
nop dword [rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x7ff65ee1f15a
cmp cx, 0x2f
je 0x7ff65ee1f15a
sub rax, 2
cmp rax, rdx
jne 0x7ff65ee1f140
jmp 0x7ff65ee1f15f
mov word [rax + 2], r15w
call fcn.7ff65ecbd370
mov edx, 0x1a
mov ecx, 0x26
test eax, eax
cmovne edx, ecx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
lea rax, [rbp - 0x20]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff65ee1f1b0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.7ff65ec85900
nop
mov dword [rbp - 0x50], 0xcb246369
mov dword [rbp - 0x4c], 0x2faac5a4
mov dword [rbp - 0x48], 0xdb690548
mov dword [rbp - 0x44], 0xc995be
mov dword [rbp - 0x40], 0xcb0a6379
mov dword [rbp - 0x3c], 0x2fb6c5a9
mov dword [rbp - 0x38], 0xdb520573
mov dword [rbp - 0x34], 0xa39589
mov dword [rbp - 0x30], 0xcb4d6301
mov dword [rbp - 0x2c], 0x2fbcc5b8
mov dword [rbp - 0x28], 0xdb05055c
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x140
mov eax, dword [rcx + rdi]
test al, 1
jne 0x7ff65ee1f2a8
or eax, 1
mov dword [rcx + rdi], eax
mov eax, 0x148
mov ebx, eax
lea rcx, [rax + rdi]
mov byte [rcx + 0x2c], 1
lea rax, [rcx + 0x2a]
lea rdx, [rbp - 0x26]
cmp rcx, rdx
ja 0x7ff65ee1f27a
lea rdx, [rbp - 0x50]
cmp rax, rdx
jb 0x7ff65ee1f27a
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x30]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x28]
mov dword [rcx + 0x28], eax
jmp 0x7ff65ee1f299
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [rbp - 0x30]
movsd qword [rcx + 0x20], xmm0
mov eax, dword [rbp - 0x28]
mov dword [rcx + 0x28], eax
lea rcx, [0x7ff65f01a7b0]
call fcn.7ff65efe1128
nop
jmp 0x7ff65ee1f2ad
mov ebx, 0x148
lea r9, [rbx + rdi]
cmp byte [r9 + 0x2c], 0
je 0x7ff65ee1f2f2
mov rdx, r15
movabs r8, 0x95db052fc5cb6335
nop word [rax + rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor word [r9 + rdx*2], ax
inc rdx
cmp rdx, 0x16
jb 0x7ff65ee1f2d0
mov byte [r9 + 0x2c], 0
inc rsi
cmp word [r9 + rsi*2], 0
jne 0x7ff65ee1f2f2
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x7ff65ee1f33c
lea rdi, [rcx + rsi]
mov qword [rbp - 0x60], rdi
lea rbx, [rbp - 0x70]
cmp rdx, 8
cmovae rbx, qword [rbp - 0x70]
lea rcx, [rbx + rcx*2]
lea r8, [rsi + rsi]
mov rdx, r9
call fcn.7ff65efe2f30
mov word [rbx + rdi*2], r15w
jmp 0x7ff65ee1f34d
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.7ff65ed4bd20
mov rcx, qword [r14]
mov r8d, 0xf01ff
lea rdx, str.WinRing0_1_2_0
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rax
mov rax, qword [r14]
mov qword [rax + 0x18], rcx
mov rax, qword [r14]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x7ff65ee1f47a
lea rdx, [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x7ff65ee1f583
mov dword [rbp - 0x78], r15d
mov rcx, qword [r14]
lea r9, [rbp - 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x7ff65ee1f46a
mov esi, dword [rbp - 0x78]
mov rbx, r15
mov rdi, r15
test rsi, rsi
je 0x7ff65ee1f41b
cmp rsi, 0x1000
jb 0x7ff65ee1f3fc
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x7ff65ee1f7b6
call fcn.7ff65efe06d0
test rax, rax
je 0x7ff65ee1f7bc
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x7ff65ee1f407
mov rcx, rsi
call fcn.7ff65efe06d0
mov rbx, rax
lea rdi, [rbx + rsi]
mov r8, rdi
sub r8, rbx
xor edx, edx
mov rcx, rbx
call fcn.7ff65efe35e0
sub rdi, rbx
mov rcx, qword [r14]
lea r9, [rbp - 0x78]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test rbx, rbx
je 0x7ff65ee1f46a
mov rax, rbx
cmp rdi, 0x1000
jb 0x7ff65ee1f45f
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ee1f7bc
mov rdx, rdi
mov rcx, rbx
call fcn.7ff65efe070c
cmp dword [rbp - 0x4c], 4
jne 0x7ff65ee1f583
mov rax, qword [r14]
mov byte [rax], 1
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..WinRing0_1_2_0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov rax, qword [r14]
mov qword [rax + 8], rcx
mov rcx, qword [r14]
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x7ff65ee1f62d
mov byte [rcx], 1
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x7ff65ee1f502
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x7ff65ee1f4fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ee1f7a4
call fcn.7ff65efe070c
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff65ee1f554
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ee1f54f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ee1f7b0
call fcn.7ff65efe070c
mov rax, r14
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.7ff65efe06b0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [r14]
call fcn.7ff65ee1ef20
test al, al
jne 0x7ff65ee1f47a
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x7ff65ee1f5d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ee1f5ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ee1f7c2
call fcn.7ff65efe070c
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff65ee1f554
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ee1f54f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ee1f7aa
jmp 0x7ff65ee1f54f
cmp byte [rcx], 0
jne 0x7ff65ee1f6db
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rax, qword [rbp - 0x70]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0xf01ff
lea r8, str.WinRing0_1_2_0
lea rdx, str.WinRing0_1_2_0
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rcx, rax
mov rax, qword [r14]
mov qword [rax + 0x18], rcx
mov rax, qword [r14]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x7ff65ee1f4c2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x7ff65ee1f6db
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x7ff65ee1f6db
mov rcx, qword [r14]
call fcn.7ff65ee1ef20
jmp 0x7ff65ee1f4c2
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..WinRing0_1_2_0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov rax, qword [r14]
mov qword [rax + 8], rcx
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x7ff65ee1f74e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ee1f749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ee1f7a4
call fcn.7ff65efe070c
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r15w
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff65ee1f554
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65ee1f54f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65ee1f7b0
jmp 0x7ff65ee1f54f
call fcn.7ff65efe777c
nop
call fcn.7ff65efe777c
int3
call fcn.7ff65efe777c
nop
call fcn.7ff65ec842d0
int3
call fcn.7ff65efe777c
nop
call fcn.7ff65efe777c
int3