Function at 0x140082af0
Capabilities:
Encode data using xor
Query service status
Terminate process

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov dword [rax + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], eax
mov word [rbp - 0x65], ax
lea rdx, [rbp - 0x79]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor edi, edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x190
mov r9d, 0x320
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_MoveWindow]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp - 0x41]
call qword [sym.imp.USER32.dll_GetWindowRect]
movd xmm0, dword [rbp - 0x39]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x1401b8dfc]
subss xmm0, dword [0x1401b90f4]
cvttss2si r15d, xmm0
movd xmm0, dword [rbp - 0x35]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x1401b8dfc]
subss xmm0, dword [0x1401b9088]
cvttss2si r12d, xmm0
lea edx, [rdi - 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfff8ffff
mov r8d, eax
lea edx, [rdi - 0x10]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
lea rdx, [rbp - 0x79]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ecx, word [rbp - 0x6b]
sub cx, word [rbp - 0x6f]
inc cx
mov word [rbp + 0x67], cx
movzx ecx, word [rbp - 0x69]
sub cx, word [rbp - 0x6d]
inc cx
mov word [rbp + 0x69], cx
test rsi, rsi
je 0x14008303f
mov edx, dword [rbp + 0x67]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
lea edx, [rdi - 0x14]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
bts eax, 0x13
mov r8d, eax
lea edx, [rdi - 0x14]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea r9d, [rdi + 2]
mov r8b, 0xf5
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov qword [rbp + 0x77], 0x64
lea rdx, [rbp + 0x77]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov r14d, 5
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0x190
mov dword [rsp + 0x20], 0x320
mov r9d, r12d
mov r8d, r15d
lea rdx, [rdi - 2]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rbp + 0x6f], edi
lea rdx, [rbp + 0x6f]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rbp + 0x6f]
and edx, 0xfffffd3f
mov dword [rbp + 0x6f], edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
movsd xmm0, qword [str.GUTZXASE8]
movsd qword [rsp + 0x40], xmm0
movzx eax, byte [0x1401b4460]
mov byte [rsp + 0x40], 0x77
xor byte [rsp + 0x41], 0x31
xor byte [rsp + 0x42], 0x32
xor byte [rsp + 0x43], 0x33
xor byte [rsp + 0x44], 0x34
xor byte [rsp + 0x45], 0x35
xor byte [rsp + 0x46], 0x36
xor byte [rsp + 0x47], 0x37
xor al, 0x38
mov byte [rsp + 0x48], al
mov qword [rbp - 0x61], rdi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], reloc.WS2_32.dll_ntohs
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140082d46
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x61]
call fcn.14004ef70
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
lea rdx, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rdx, qword [rbp - 0x61]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
lea rdx, [rbp - 0x31]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
cmp dword [rbp - 0x2d], 4
jne 0x140082fcd
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rbp - 0x49]
cmp rdx, 0x10
jb 0x140082df3
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082dee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008300e
call fcn.14016c298
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x31]
call fcn.140083060
mov rcx, rax
cmp byte [rax + 0x17], 0
je 0x140082f9e
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140082f69
movdqa xmm5, xmmword [0x1401b9240]
movdqa xmm4, xmmword [0x1401b9770]
movd xmm6, r14d
movdqa xmm7, xmmword [0x1401b9280]
mov eax, Ordinal_33
movd xmm8, eax
movdqa xmm0, xmmword [str.0000000000000000]
movdqa xmmword [rsp + 0x40], xmm0
mov rdx, rcx
mov r8d, dword [rsp + 0x40]
nop word [rax + rax]
movd xmm2, edi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401b9320]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
lea eax, [rdi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1401b9320]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx + 4]
pxor xmm2, xmm0
movd dword [rdx + 4], xmm2
add edi, 8
lea rdx, [rdx + 8]
cmp edi, 0x18
jl 0x140082e60
jmp 0x140082f9e
mov r8, rcx
nop dword [rax]
mov eax, 0x1f7047dd
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x39
movzx eax, dil
sub al, dl
add al, 0x30
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 0x18
jl 0x140082f70
mov rdx, rcx
mov rcx, r9
call fcn.14005c1e0
lea rdx, [0x14005c3d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rbp - 0x49]
cmp rdx, 0x10
jb 0x14008301a
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083015
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140083015
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14016c298
lea r11, [rsp + 0xf0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rbp + 0x67], edi
lea rdx, [0x1401d2df8]
lea rcx, [rbp + 0x67]
call sub.VCRUNTIME140.dll__CxxThrowException
int3