Function at 0x1000c050
Capabilities:
Encode data using xor
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002141d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1002a0f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsd xmm0, qword [0x1002aa78]
ucomisd xmm0, qword [0x10022b90]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3c], edi
lahf
test ah, 0x44
jp 0x1000c255
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
call edi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [0x100227c0]
divsd xmm1, xmm0
movsd xmm0, qword [0x100229f8]
subsd xmm0, xmm1
movsd qword [ebp - 0x18], xmm0
call sub.IMM32.dll_ImmRegisterWordA
fmul qword [0x10022a30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
fstp qword [ebp - 0x34]
call esi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [ebp - 0x34]
divsd xmm1, xmm0
movsd qword [ebp - 0x34], xmm1
call edi
movsd xmm1, qword [ebp - 0x18]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x34]
subsd xmm1, xmm0
movsd qword [0x1002aa68], xmm1
call edi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [0x100227c0]
divsd xmm1, xmm0
movsd xmm0, qword [0x100229b8]
subsd xmm0, xmm1
movsd qword [ebp - 0x34], xmm0
call sub.IMM32.dll_ImmRegisterWordA
fmul qword [0x10022a30]
fstp qword [ebp - 0x18]
call esi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [ebp - 0x18]
divsd xmm1, xmm0
movsd qword [ebp - 0x18], xmm1
call edi
movsd xmm1, qword [ebp - 0x34]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x18]
subsd xmm1, xmm0
movsd qword [0x1002aa30], xmm1
call edi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [0x100227c0]
divsd xmm1, xmm0
movsd xmm0, qword [0x100228e0]
subsd xmm0, xmm1
movsd qword [ebp - 0x34], xmm0
call sub.IMM32.dll_ImmRegisterWordA
fmul qword [0x10022a30]
fstp qword [ebp - 0x18]
call esi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [ebp - 0x18]
divsd xmm1, xmm0
movsd qword [ebp - 0x18], xmm1
call edi
movsd xmm1, qword [ebp - 0x34]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x18]
subsd xmm1, xmm0
movsd qword [0x1002aa58], xmm1
call edi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [0x100227c0]
divsd xmm1, xmm0
movsd xmm0, qword [0x10022830]
subsd xmm0, xmm1
movsd qword [ebp - 0x34], xmm0
call sub.IMM32.dll_ImmRegisterWordA
fmul qword [0x10022a30]
fstp qword [ebp - 0x18]
call esi
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [ebp - 0x18]
divsd xmm1, xmm0
movsd qword [ebp - 0x18], xmm1
call edi
movsd xmm1, qword [ebp - 0x34]
mov edi, dword [ebp - 0x3c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x18]
subsd xmm1, xmm0
movsd qword [0x1002aa78], xmm1
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [edi + 4]
xorps xmm0, xmm0
movq qword [ebp - 0x2c], xmm0
sub esi, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x20], xmm0
sub esi, 0x10
je 0x1000c29b
lea eax, [ebp - 0x35]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.10001920
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
push esi
add eax, 0x10
push eax
push ecx
call fcn.10015c40
mov eax, dword [ebp - 0x28]
add esp, 0xc
sub eax, dword [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.10011180
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub edx, esi
sub edx, 1
js 0x1000c2e3
mov al, byte [esi + edx]
mov ecx, edx
and ecx, 0xf
xor byte [ebp + ecx - 0x20], al
mov cl, byte [ebp + ecx - 0x20]
xor cl, al
mov eax, dword [edi]
mov byte [edx + eax], cl
sub edx, 1
mov esi, dword [ebp - 0x2c]
jns 0x1000c2c4
test esi, esi
je 0x1000c310
mov ecx, dword [ebp - 0x24]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x1000c306
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000c32b
push ecx
push esi
call fcn.10014725
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10014e53
mov esp, ebp
pop ebp
ret
call fcn.10017d9f
int3