Function at 0x140007a20
Capabilities:
Create service
Encode data using xor
Persist via windows service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x140053080]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov r8d, 0x104
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
jne 0x140007c01
movdqa xmm0, xmmword [0x14004c8e0]
movdqu xmmword [rsp + 0x70], xmm0
mov cl, 0x43
mov dl, 0x54
mov r8b, 0x40
mov r9b, 0x45
mov r10b, 0x5d
mov bl, 0x56
mov dil, 0x53
movd r11d, xmm0
psrldq xmm0, 1
movd eax, xmm0
xor al, r11b
mov byte [rsp + 0x71], al
lea eax, [r11 + 1]
xor byte [rsp + 0x72], al
lea eax, [r11 + 2]
xor byte [rsp + 0x73], al
lea eax, [r11 + 3]
xor byte [rsp + 0x74], al
lea eax, [r11 + 4]
xor byte [rsp + 0x75], al
lea eax, [r11 + 5]
xor byte [rsp + 0x76], al
lea eax, [r11 + 6]
xor byte [rsp + 0x77], al
lea eax, [r11 + 7]
xor byte [rsp + 0x78], al
lea eax, [r11 + 8]
xor byte [rsp + 0x79], al
lea eax, [r11 + 9]
xor byte [rsp + 0x7a], al
lea eax, [r11 + 0xa]
xor byte [rsp + 0x7b], al
lea eax, [r11 + 0xb]
xor byte [rsp + 0x7c], al
lea eax, [r11 + 0xc]
xor byte [rsp + 0x7d], al
lea eax, [r11 + 0xd]
xor byte [rsp + 0x7e], al
lea eax, [r11 + 0xe]
xor byte [rsp + 0x7f], al
lea eax, [r11 + 0xf]
xor cl, al
mov byte [rbp - 0x80], cl
lea eax, [r11 + 0x10]
xor dl, al
mov byte [rbp - 0x7f], dl
lea eax, [r11 + 0x11]
xor r8b, al
mov byte [rbp - 0x7e], r8b
lea eax, [r11 + 0x12]
xor r9b, al
mov byte [rbp - 0x7d], r9b
lea eax, [r11 + 0x13]
xor r10b, al
mov byte [rbp - 0x7c], r10b
lea eax, [r11 + 0x14]
xor bl, al
mov byte [rbp - 0x7b], bl
add r11b, 0x15
xor dil, r11b
mov byte [rbp - 0x7a], dil
mov byte [rbp - 0x79], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140007b80
lea rdx, [rsp + 0x71]
lea rcx, [rbp - 0x70]
call fcn.1400129a0
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rbx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
mov rdx, rbx
lea rcx, [0x14004beb0]
call fcn.140001150
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14000809d
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008098
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400080cf
jmp 0x140008098
mov esi, 0x1e5a
mov word [rsp + 0x70], si
mov eax, 0x1e78
mov ecx, 0x1e7e
mov edx, 0x1e2f
mov r8d, 0x1e7f
mov r9d, 0x1e5e
mov r11d, 0x1e5f
movzx r10d, word [0x14004beca]
xor r10w, r11w
mov ebx, 0x1e60
movzx r11d, word [0x14004becc]
xor r11w, bx
mov edi, 0x1e61
movzx ebx, word [0x14004bece]
xor bx, di
mov r14d, 0x1e62
movzx edi, word [str.OpenSCManager_failed]
xor di, r14w
xor ax, si
mov word [rsp + 0x72], ax
lea eax, [rsi + 1]
xor cx, ax
mov word [rsp + 0x74], cx
lea eax, [rsi + 2]
xor dx, ax
mov word [rsp + 0x76], dx
lea eax, [rsi + 3]
xor r8w, ax
mov word [rsp + 0x78], r8w
lea eax, [rsi + 4]
xor r9w, ax
mov word [rsp + 0x7a], r9w
lea eax, [rsi + 5]
xor r10w, ax
mov word [rsp + 0x7c], r10w
lea eax, [rsi + 6]
xor r11w, ax
mov word [rsp + 0x7e], r11w
lea eax, [rsi + 7]
xor bx, ax
mov word [rbp - 0x80], bx
add si, 8
xor di, si
mov word [rbp - 0x7e], di
xor ebx, ebx
mov word [rbp - 0x7c], bx
lea rdx, [rsp + 0x72]
lea rcx, [rbp - 0x50]
call fcn.14000fcd0
nop
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r8, qword [rbp - 0x50]
lea r9, [rbp - 0x30]
mov edx, 0x104
lea rcx, [rbp + 0x1e0]
call fcn.140001260
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x140007e22
movdqa xmm0, xmmword [str.E_n5_]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x20292c24
mov word [rbp - 0x7c], 0x21
movd eax, xmm0
movsx eax, al
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
movdqu xmm0, xmmword [rsp + 0x71]
xorps xmm0, xmm1
movdqu xmmword [rsp + 0x71], xmm0
mov ebx, 0x10
nop dword [rax + rax]
movzx eax, byte [rsp + 0x70]
xor byte [rsp + rbx + 0x71], al
inc rbx
cmp rbx, 0x14
jb 0x140007d70
mov byte [rbp - 0x7b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140007da1
lea rdx, [rsp + 0x71]
lea rcx, [rbp - 0x70]
call fcn.1400129a0
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rbx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
mov rdx, rbx
lea rcx, [0x14004bee8]
call fcn.140001150
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140008061
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400080d5
jmp 0x140007f61
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov ebx, 0x10
mov dword [rsp + 0x20], ebx
mov r9d, 0xf01ff
lea r8, [0x14004bef8]
lea rdx, [0x14004bf28]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
jne 0x140007f6b
movdqa xmm0, xmmword [0x14004c940]
mov dword [rbp - 0x80], 0x6b6c7370
mov byte [rbp - 0x7c], al
psubb xmm0, xmmword [str._a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_a_bCMJJR_aAGY_MAB]
movdqu xmmword [rsp + 0x70], xmm0
nop dword [rax]
add byte [rsp + rbx + 0x70], 0xf9
inc rbx
cmp rbx, 0x14
jb 0x140007eb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140007ee0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.1400129a0
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rbx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r8d, eax
mov rdx, rbx
lea rcx, str._s___d__n
call fcn.140001150
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140008061
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400080db
call fcn.140017710
jmp 0x140008061
movdqa xmm1, xmmword [0x14004c8f0]
movdqu xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x14004c850]
movdqu xmmword [rbp - 0x80], xmm0
movd eax, xmm1
movsx eax, al
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
movdqu xmm0, xmmword [rsp + 0x71]
xorps xmm0, xmm1
movdqu xmmword [rsp + 0x71], xmm0
nop dword [rax]
movzx eax, byte [rsp + 0x70]
xor byte [rsp + rbx + 0x71], al
inc rbx
cmp rbx, 0x1e
jb 0x140007fb0
mov byte [rbp - 0x71], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140007fe1
lea rdx, [rsp + 0x71]
lea rcx, [rbp - 0x70]
call fcn.1400129a0
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
lea rcx, [0x14004bfa0]
call fcn.140001150
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14000804e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008049
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400080e1
call fcn.140017710
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14000809d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008098
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400080c9
call fcn.140017710
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400176f0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140024a78
int3
call fcn.140024a78
nop
call fcn.140024a78
nop
call fcn.140024a78
int3
call fcn.140024a78
int3