Function at 0x14010cb44
Capabilities:
Create service

Disassembly:
push rax
pushf
mov eax, 0x73269f02
pushf
not eax
add eax, 0xbb2a5b7d
xor eax, 0xfa544b58
rol eax, 0xa
popf
pushf
not eax
add eax, 0xa20a05f6
xor eax, 0x9ba58f7d
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xf6c66602
xor eax, 0xd92dd6bc
rol eax, 0x3d
popf
cmp eax, 4
jne 0x14010cb94
popf
pop rax
jmp 0x14010d519
cmp eax, 0
jne 0x14010cba3
popf
pop rax
jmp 0x14010cbd0
cmp eax, 3
jne 0x14010cbb2
popf
pop rax
jmp 0x14010d1b0
cmp eax, 1
jne 0x14010cbc1
popf
pop rax
jmp 0x14010cc93
cmp eax, 2
jne 0x14010cbd0
popf
pop rax
jmp 0x14010d120
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rsi, rdx
mov r14, r8
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
jmp 0x14010cbf5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14010cc3a
push rax
pushf
mov eax, 0xfb66cba4
pushf
not eax
add eax, 0xcb7e5dd7
xor eax, 0xdef3a0ef
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xdbae93eb
xor eax, 0xa01dc87e
rol eax, 0x5d
popf
jmp 0x14010cb85
push rax
pushf
mov eax, 0xc0869ffb
pushf
not eax
add eax, 0xf04e39e9
xor eax, 0xa099b89c
rol eax, 0x72
popf
pushf
not eax
add eax, 0xd0c1b10d
xor eax, 0xf1f1c41f
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xf200a1bd
xor eax, 0xd201c1f1
rol eax, 0x26
popf
pushf
not eax
add eax, 0xe1f3f13b
xor eax, 0xce6613c1
rol eax, 0x15
popf
jmp 0x14010cb85
movabs rcx, 0xcb1dcad798c59864
pushf
not rcx
add rcx, 0x479ef7a2
xor rcx, 0x55353bc2
rol rcx, 0x29
popf
pushf
not rcx
add rcx, 0x6803145f
xor rcx, 0x55889584
rol rcx, 0x25
popf
pushf
not rcx
add rcx, 0x711c4c5c
xor rcx, 0x633f7bb0
rol rcx, 0x74
popf
pushf
not rcx
add rcx, 0x625c0f0a
xor rcx, 0x7a56d389
rol rcx, 0xa5
popf
lea rdx, [rbp + 7]
mov qword [rbp + 0x2f], rcx
movabs rax, 0x33720d7000b2da1
pushf
not rax
add rax, 0x7a3ccaac
xor rax, 0x5d2bef32
rol rax, 0xa8
popf
pushf
not rax
add rax, 0x76ec4012
xor rax, 0x6d38173b
rol rax, 0xa7
popf
pushf
not rax
add rax, 0x5f2ed3ae
xor rax, 0x7da0aa88
rol rax, 0xb6
popf
pushf
not rax
add rax, 0x45f88cbe
xor rax, 0x42e05791
rol rax, 0x8a
popf
mov qword [rbp + 7], rax
movabs rax, 0x63665934ba76e7b3
pushf
not rax
add rax, 0x71d74591
xor rax, 0x715c6565
rol rax, 7
popf
pushf
not rax
add rax, 0x4bef4b11
xor rax, 0x77e86d80
rol rax, 0x4d
popf
pushf
not rax
add rax, 0x5d402484
xor rax, 0x72d47d3f
rol rax, 0xb4
popf
pushf
not rax
add rax, 0x47fd25b5
xor rax, 0x705eec7d
rol rax, 0x50
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x76b37f9dec190180
pushf
not rax
add rax, 0x7f5e4ecd
xor rax, 0x4fa79a8a
rol rax, 0x43
popf
pushf
not rax
add rax, 0x44e30764
xor rax, 0x5977dd83
rol rax, 0xb7
popf
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x4caa883715be13dc
pushf
not rax
add rax, 0x6523d2a4
xor rax, 0x43e29578
rol rax, 0x85
popf
pushf
not rax
add rax, 0x7b8f5fbb
xor rax, 0x408975aa
rol rax, 0x1e
popf
mov qword [rbp + 0x1f], rax
movabs rax, 0x719e8adf71660d92
pushf
not rax
add rax, 0x4655d51a
xor rax, 0x43a96975
rol rax, 0xf3
popf
pushf
not rax
add rax, 0x56fbda24
xor rax, 0x5939dabb
rol rax, 0x87
popf
pushf
not rax
add rax, 0x47d9779d
xor rax, 0x462e10c4
rol rax, 0x7a
popf
movdqa xmm1, xmmword [rbp + 0x17]
mov qword [rbp + 0x27], rax
movabs rax, 0x668982d7f2c11f36
pushf
not rax
add rax, 0x7044bba1
xor rax, 0x55ad93ac
rol rax, 0xa4
popf
pushf
not rax
add rax, 0x4e5f2004
xor rax, 0x7d738af5
rol rax, 0xe4
popf
pushf
not rax
add rax, 0x7bc0ed16
xor rax, 0x452e44f9
rol rax, 0xf1
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xd8296ac7ae02f876
pushf
not rax
add rax, 0x6752e625
xor rax, 0x45d6c073
rol rax, 0x27
popf
pushf
not rax
add rax, 0x41ff32a6
xor rax, 0x658c40cf
rol rax, 0x97
popf
pushf
not rax
add rax, 0x6b37ccea
xor rax, 0x63a250c4
rol rax, 0
popf
pushf
not rax
add rax, 0x6320bf13
xor rax, 0x44df13c2
rol rax, 0x4e
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xff8059c1e471f326
pushf
not rax
add rax, 0x4b082e3f
xor rax, 0x78e3f1d1
rol rax, 0x90
popf
pushf
not rax
add rax, 0x44f5eec3
xor rax, 0x71fcbea8
rol rax, 0xe0
popf
pushf
not rax
add rax, 0x5f1d3cc3
xor rax, 0x7ff3c625
rol rax, 0x58
popf
xorps xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0xc81ee3613a4578dd
pushf
not rax
add rax, 0x7845bb30
xor rax, 0x56ec853c
rol rax, 0xdf
popf
pushf
not rax
add rax, 0x626a5771
xor rax, 0x676f13a8
rol rax, 0xdd
popf
pushf
not rax
add rax, 0x51e234e7
xor rax, 0x466750d0
rol rax, 0xd6
popf
pushf
not rax
add rax, 0x62b6a46a
xor rax, 0x6f284153
rol rax, 0xb9
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x3443541ec99538e5
pushf
not rax
add rax, 0x770d3aac
xor rax, 0x64f239d9
rol rax, 0x2d
popf
pushf
not rax
add rax, 0x5b0f5a6d
xor rax, 0x6c1a6b02
rol rax, 0x61
popf
xorps xmm1, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [rbp + 0x27]
mov qword [rbp - 1], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp - 9], rax
xorps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x17], xmm1
call fcn.1400b8127
mov rbx, rax
jmp 0x14010d09c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010d0a8
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1b6273a7c]
pushf
sub rdx, 0x7626c06c
popf
jmp 0x14010d0c4
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
mov r9d, 0x3b74ad2
pushf
not r9d
add r9d, 0x8b8c35b9
xor r9d, 0xd5e15265
rol r9d, 0x60
popf
pushf
not r9d
add r9d, 0xe4fb4c02
xor r9d, 0x92db9080
rol r9d, 0x9f
popf
mov qword [rsp + 0x60], rax
mov r8, rsi
mov qword [rsp + 0x58], rax
mov rdx, rbx
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
jmp 0x14010d19a
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rdx, [rbp - 0x29]
mov rbx, rax
test rax, rax
jne 0x14010d519
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x47257e8d556b3c20
pushf
not rax
add rax, 0x5573b1f1
xor rax, 0x501508fe
rol rax, 0xd1
popf
pushf
not rax
add rax, 0x74f0b921
xor rax, 0x455423dc
rol rax, 0x86
popf
pushf
not rax
add rax, 0x5b841d12
xor rax, 0x4e7b6499
rol rax, 0x84
popf
mov qword [rbp - 0x29], rax
movabs rax, 0x78df84972287ae94
pushf
not rax
add rax, 0x6e9c7d3d
xor rax, 0x71d1ee20
rol rax, 0xe7
popf
pushf
not rax
add rax, 0x6a4e91d8
xor rax, 0x76589edc
rol rax, 0x49
popf
pushf
not rax
add rax, 0x7bb99a73
xor rax, 0x5810bfe1
rol rax, 0x22
popf
pushf
not rax
add rax, 0x76e1fb64
xor rax, 0x54710a07
rol rax, 0x12
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xd2bfdeb51d421e9d
pushf
not rax
add rax, 0x408a93ac
xor rax, 0x542fa933
rol rax, 0xf6
popf
pushf
not rax
add rax, 0x6bce83a6
xor rax, 0x4b74d69f
rol rax, 0xa9
popf
pushf
not rax
add rax, 0x448bb085
xor rax, 0x6dd2aa15
rol rax, 0x84
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x39c553bdcf37dceb
pushf
not rax
add rax, 0x6c38d8ba
xor rax, 0x76ae26bb
rol rax, 0x99
popf
pushf
not rax
add rax, 0x6c4e3ebc
xor rax, 0x6729c89f
rol rax, 0x60
popf
pushf
not rax
add rax, 0x5b0c7487
xor rax, 0x43eed7cd
rol rax, 0x4e
popf
pushf
not rax
add rax, 0x73d3f8a3
xor rax, 0x70375424
rol rax, 0xd5
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x22e3b3f4dc6e4867
pushf
not rax
add rax, 0x597d98e3
xor rax, 0x759861aa
rol rax, 0xfc
popf
pushf
not rax
add rax, 0x74de9221
xor rax, 0x79810eef
rol rax, 0x63
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0x68b9a51023af32fe
pushf
not rax
add rax, 0x71d08e7e
xor rax, 0x7eedbfa4
rol rax, 0xd5
popf
pushf
not rax
add rax, 0x66790fcc
xor rax, 0x5f7f6da9
rol rax, 0x8d
popf
pushf
not rax
add rax, 0x736551b3
xor rax, 0x657ca885
rol rax, 9
popf
mov qword [rbp + 0xf], rax
movabs rax, 0xffaf49d210b6d142
pushf
not rax
add rax, 0x53b7fafd
xor rax, 0x63bc0a5a
rol rax, 0x12
popf
pushf
not rax
add rax, 0x46609439
xor rax, 0x5d25cc5c
rol rax, 0xaa
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0xa1d56977685d67e5
pushf
not rax
add rax, 0x6bef831f
xor rax, 0x6e696bfa
rol rax, 0x67
popf
pushf
not rax
add rax, 0x7ed601f1
xor rax, 0x6265fcfe
rol rax, 0x6f
popf
pushf
not rax
add rax, 0x4746a956
xor rax, 0x54bd5c22
rol rax, 0x18
popf
pushf
not rax
add rax, 0x7056ffb5
xor rax, 0x4c947f17
rol rax, 0xee
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8127
mov rbx, rax
jmp 0x14010d48b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010d497
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1ab71bd4e]
pushf
sub rdx, 0x6b71433e
popf
jmp 0x14010d4b3
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
jmp 0x14010d4bd
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x68be412ff9f62a11
pushf
not rax
add rax, 0x444d3e9a
xor rax, 0x456b2d58
rol rax, 0x8a
popf
pushf
not rax
add rax, 0x7a0f42a4
xor rax, 0x67b09d4f
rol rax, 0xe8
popf
pushf
not rax
add rax, 0x6800d937
xor rax, 0x50c0cb1f
rol rax, 0x41
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xa8efd097c41ab29e
pushf
not rax
add rax, 0x4acf9228
xor rax, 0x695e018a
rol rax, 0xb9
popf
pushf
not rax
add rax, 0x7c843175
xor rax, 0x600a581f
rol rax, 0xa
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xbf5e514197f373b0
pushf
not rax
add rax, 0x49cc85a9
xor rax, 0x57f0ecc5
rol rax, 0xc0
popf
pushf
not rax
add rax, 0x7189d8d3
xor rax, 0x6d3ee0e9
rol rax, 0xa5
popf
pushf
not rax
add rax, 0x77f633ce
xor rax, 0x5482311f
rol rax, 0x39
popf
pushf
not rax
add rax, 0x6649e7e7
xor rax, 0x576c31a7
rol rax, 0xc5
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x4e1fb725d2854512
pushf
not rax
add rax, 0x6dd8d232
xor rax, 0x78701c96
rol rax, 0xff
popf
pushf
not rax
add rax, 0x43f39ecf
xor rax, 0x7abb95bb
rol rax, 0x8e
popf
pushf
not rax
add rax, 0x74f90314
xor rax, 0x6c7905a5
rol rax, 0xb3
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xe847b388e1ae8b46
pushf
not rax
add rax, 0x6e6cc9a0
xor rax, 0x76a869b9
rol rax, 0x3d
popf
pushf
not rax
add rax, 0x6c61a506
xor rax, 0x781a900d
rol rax, 0x48
popf
pushf
not rax
add rax, 0x73e05946
xor rax, 0x68080af1
rol rax, 0x3e
popf
pushf
not rax
add rax, 0x514c1e56
xor rax, 0x4803711d
rol rax, 0x36
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0xbb6a04cacfb52b06
pushf
not rax
add rax, 0x5684b149
xor rax, 0x5695f42c
rol rax, 0x68
popf
pushf
not rax
add rax, 0x4b3eac1e
xor rax, 0x625180ff
rol rax, 0x60
popf
pushf
not rax
add rax, 0x52bc1e99
xor rax, 0x6119ca1a
rol rax, 0xfb
popf
pushf
not rax
add rax, 0x70b4c9b4
xor rax, 0x58a86ee4
rol rax, 0x7a
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x82a3f2a550805dc7
pushf
not rax
add rax, 0x79b88421
xor rax, 0x493d09f8
rol rax, 0x33
popf
pushf
not rax
add rax, 0x63fc8a9c
xor rax, 0x492ddeca
rol rax, 0x77
popf
pushf
not rax
add rax, 0x462c88b3
xor rax, 0x54fbd79b
rol rax, 0xe3
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x3eaebe59edde0904
pushf
not rax
add rax, 0x70935316
xor rax, 0x69fa820d
rol rax, 0x8e
popf
pushf
not rax
add rax, 0x4e9c89d2
xor rax, 0x7036263f
rol rax, 0x5e
popf
pushf
not rax
add rax, 0x5a613179
xor rax, 0x769c0865
rol rax, 0x68
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8127
lea rdx, [0x1881adf2f]
pushf
sub rdx, 0x481a651f
popf
mov rcx, rax
jmp 0x14010d81d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
jmp 0x14010d827
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
jmp 0x14010d831
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 6
pushf
not al
add al, 0xfa
xor al, 0x49
rol al, 0x38
popf
pushf
not al
add al, 0xdd
xor al, 0x20
rol al, 0xf7
popf
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret