Function at 0x14005fa50
Capabilities:
Encode data using xor
Enumerate services

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0xf0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword [0x140072040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x38], rbp
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0xb
lea rax, [rsp + 0x78]
mov dword [rsp + 0x78], ebp
mov qword [rsp + 0x28], rax
mov r8d, 3
mov dword [rsp + 0x20], ebp
mov rbx, rcx
mov dword [rsp + 0x7c], ebp
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x14005fae8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x14005fc8e
mov eax, dword [rsp + 0x78]
add eax, 0x30
mov ecx, eax
mov dword [rsp + 0x78], eax
call fcn.140062470
mov r9d, dword [rsp + 0x78]
mov rdi, rax
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x30], rax
mov edx, 0xb
lea rax, [rsp + 0x78]
mov r8d, 3
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x20], r9d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x14005fc86
mov ebx, ebp
cmp dword [rsp + 0x7c], ebp
jbe 0x14005fc7a
mov esi, dword [0x140072090]
movdqa xmm9, xmmword [0x14006da10]
movdqa xmm10, xmmword [0x14006da50]
movdqa xmm11, xmmword [0x14006da00]
movdqa xmm7, xmmword [0x14006d990]
movdqa xmm8, xmmword [0x14006da70]
nop dword [rax]
mov eax, ebx
lea rcx, [rax + rax*2]
mov eax, dword [str.BR_7]
add rcx, rcx
mov dword [rsp + 0x40], eax
cmp byte [0x14006d8bb], bpl
movups xmm2, xmmword [rdi + rcx*8]
movups xmm6, xmmword [rdi + rcx*8 + 0x10]
je 0x14005fc46
mov ecx, ebp
cmp esi, 2
jl 0x14005fc14
movdqa xmm1, xmm7
movdqa xmm0, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm8
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm8
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm7
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm7
pmulld xmm0, xmm11
psubd xmm1, xmm0
movd xmm0, eax
andps xmm1, xmm9
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
jmp 0x14005fc46
lea r8, [rsp + 0x40]
nop dword [rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
mul ecx
shr edx, 5
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x14005fc20
lea rdx, [rsp + 0x40]
movq rcx, xmm2
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14005fc6e
psrldq xmm6, 4
movd eax, xmm6
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x14005fc8e
inc ebx
cmp ebx, dword [rsp + 0x7c]
jb 0x14005fb80
mov rcx, rdi
call fcn.14006243c
xor al, al
jmp 0x14005fc90
mov rcx, rdi
call fcn.14006243c
mov al, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400621a0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop rdi
ret