Function at 0x1400b615a
Capabilities:
Authenticate hmac
Create service
Enumerate services
Query service configuration
Start service

Disassembly:
push rax
pushf
mov eax, 0x9194bcd8
pushf
not eax
add eax, 0x62eadd2a
xor eax, 0x742add55
rol eax, 0x40
popf
pushf
not eax
add eax, 0x6b0be890
xor eax, 0x1878c22e
rol eax, 0x3b
popf
pushf
not eax
add eax, 0x43a2b908
xor eax, 0x35c12dd8
rol eax, 0x85
popf
pushf
not eax
add eax, 0x7688b9fa
xor eax, 0x48436db5
rol eax, 0x95
popf
cmp eax, 0x11
jne 0x1400b61bd
popf
pop rax
jmp 0x1400b6ea8
cmp eax, 0x1f
jne 0x1400b61cc
popf
pop rax
jmp 0x1400b7925
cmp eax, 0x24
jne 0x1400b61db
popf
pop rax
jmp 0x1400b7d81
cmp eax, 0x17
jne 0x1400b61ea
popf
pop rax
jmp 0x1400b7223
cmp eax, 0x35
jne 0x1400b61f9
popf
pop rax
jmp 0x1400b86c3
cmp eax, 0x36
jne 0x1400b6208
popf
pop rax
jmp 0x1400b8762
cmp eax, 5
jne 0x1400b6217
popf
pop rax
jmp 0x1400b67b4
cmp eax, 0xb
jne 0x1400b6226
popf
pop rax
jmp 0x1400b6af3
cmp eax, 0x23
jne 0x1400b6235
popf
pop rax
jmp 0x1400b7c1a
cmp eax, 0xd
jne 0x1400b6244
popf
pop rax
jmp 0x1400b6c9a
cmp eax, 0x15
jne 0x1400b6253
popf
pop rax
jmp 0x1400b70c6
cmp eax, 0x22
jne 0x1400b6262
popf
pop rax
jmp 0x1400b7b7d
cmp eax, 0x16
jne 0x1400b6271
popf
pop rax
jmp 0x1400b7124
cmp eax, 0x1e
jne 0x1400b6280
popf
pop rax
jmp 0x1400b7886
cmp eax, 0x2e
jne 0x1400b628f
popf
pop rax
jmp 0x1400b83f8
cmp eax, 0x25
jne 0x1400b629e
popf
pop rax
jmp 0x1400b7e16
cmp eax, 0x1d
jne 0x1400b62ad
popf
pop rax
jmp 0x1400b7755
cmp eax, 0x38
jne 0x1400b62bc
popf
pop rax
jmp 0x1400b8880
cmp eax, 6
jne 0x1400b62cb
popf
pop rax
jmp 0x1400b686c
cmp eax, 0xa
jne 0x1400b62da
popf
pop rax
jmp 0x1400b6a87
cmp eax, 0x19
jne 0x1400b62e9
popf
pop rax
jmp 0x1400b742b
cmp eax, 0x30
jne 0x1400b62f8
popf
pop rax
jmp 0x1400b84c9
cmp eax, 0x20
jne 0x1400b6307
popf
pop rax
jmp 0x1400b7976
cmp eax, 0x29
jne 0x1400b6316
popf
pop rax
jmp 0x1400b8042
cmp eax, 0x26
jne 0x1400b6325
popf
pop rax
jmp 0x1400b7e62
cmp eax, 0x14
jne 0x1400b6334
popf
pop rax
jmp 0x1400b708c
cmp eax, 0x32
jne 0x1400b6343
popf
pop rax
jmp 0x1400b8573
cmp eax, 0xf
jne 0x1400b6352
popf
pop rax
jmp 0x1400b6e10
cmp eax, 0x13
jne 0x1400b6361
popf
pop rax
jmp 0x1400b6fe1
cmp eax, 0x1a
jne 0x1400b6370
popf
pop rax
jmp 0x1400b75a5
cmp eax, 3
jne 0x1400b637f
popf
pop rax
jmp 0x1400b66e6
cmp eax, 9
jne 0x1400b638e
popf
pop rax
jmp 0x1400b69db
cmp eax, 0x37
jne 0x1400b639d
popf
pop rax
jmp 0x1400b8820
cmp eax, 0x39
jne 0x1400b63ac
popf
pop rax
jmp 0x1400b88de
cmp eax, 0x34
jne 0x1400b63bb
popf
pop rax
jmp 0x1400b8607
cmp eax, 0x2c
jne 0x1400b63ca
popf
pop rax
jmp 0x1400b827a
cmp eax, 0x2d
jne 0x1400b63d9
popf
pop rax
jmp 0x1400b8390
cmp eax, 0xc
jne 0x1400b63e8
popf
pop rax
jmp 0x1400b6b87
cmp eax, 0x33
jne 0x1400b63f7
popf
pop rax
jmp 0x1400b85ab
cmp eax, 0x1b
jne 0x1400b6406
popf
pop rax
jmp 0x1400b7627
cmp eax, 0xe
jne 0x1400b6415
popf
pop rax
jmp 0x1400b6d65
cmp eax, 0x27
jne 0x1400b6424
popf
pop rax
jmp 0x1400b7f1e
cmp eax, 0x1c
jne 0x1400b6433
popf
pop rax
jmp 0x1400b765f
cmp eax, 0x12
jne 0x1400b6442
popf
pop rax
jmp 0x1400b6f3d
cmp eax, 1
jne 0x1400b6451
popf
pop rax
jmp 0x1400b65ea
cmp eax, 0x2a
jne 0x1400b6460
popf
pop rax
jmp 0x1400b80f1
cmp eax, 0x28
jne 0x1400b646f
popf
pop rax
jmp 0x1400b7faf
cmp eax, 0x21
jne 0x1400b647e
popf
pop rax
jmp 0x1400b7a1c
cmp eax, 0x31
jne 0x1400b648d
popf
pop rax
jmp 0x1400b852a
cmp eax, 8
jne 0x1400b649c
popf
pop rax
jmp 0x1400b6992
cmp eax, 0x2f
jne 0x1400b64ab
popf
pop rax
jmp 0x1400b8468
cmp eax, 0
jne 0x1400b64ba
popf
pop rax
jmp 0x1400b6514
cmp eax, 0x10
jne 0x1400b64c9
popf
pop rax
jmp 0x1400b6e70
cmp eax, 0x2b
jne 0x1400b64d8
popf
pop rax
jmp 0x1400b813b
cmp eax, 2
jne 0x1400b64e7
popf
pop rax
jmp 0x1400b6621
cmp eax, 0x18
jne 0x1400b64f6
popf
pop rax
jmp 0x1400b738e
cmp eax, 4
jne 0x1400b6505
popf
pop rax
jmp 0x1400b671f
cmp eax, 7
jne 0x1400b6514
popf
pop rax
jmp 0x1400b6914
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r12, rcx
xor r13d, r13d
mov rcx, qword [rcx + 0x10]
mov rax, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400b65a4
push rax
pushf
mov eax, 0x47c21f46
pushf
not eax
add eax, 0x17e6cb40
xor eax, 0x45ccec75
rol eax, 0xb7
popf
pushf
not eax
add eax, 0x6ad78b85
xor eax, 0x54a5f626
rol eax, 0xea
popf
pushf
not eax
add eax, 0x154c3e0d
xor eax, 0x6fc70e4c
rol eax, 0x54
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x911bb30a
pushf
not eax
add eax, 0x60f05bc8
xor eax, 0x21e0a410
rol eax, 0x23
popf
pushf
not eax
add eax, 0x492aec3a
xor eax, 0x4ddf9485
rol eax, 0x17
popf
pushf
not eax
add eax, 0x56ab9299
xor eax, 0x2ede680e
rol eax, 0x21
popf
jmp 0x1400b61ae
mov rax, qword [r12]
push rax
pushf
mov eax, 0xe0ba93c6
pushf
not eax
add eax, 0x54afde99
xor eax, 0x110336de
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x6766965e
xor eax, 0x46a8f75a
rol eax, 0x46
popf
jmp 0x1400b61ae
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
call fcn.14010f382
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.1400b406f
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
mov rax, qword [rbp - 0x60]
lea rdi, [rcx + rax*2]
mov rbx, rdi
mov rdx, rdi
call fcn.1400b4be3
cmp rax, rdi
je 0x1400b66a0
push rax
pushf
mov eax, 0xea64fe61
pushf
not eax
add eax, 0xa95c6c6
xor eax, 0x75cacac7
rol eax, 0x12
popf
pushf
not eax
add eax, 0x7adb29be
xor eax, 0x704de1d5
rol eax, 0xd4
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xb5e11a02
pushf
not eax
add eax, 0x28bda97
xor eax, 0x5094f767
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x6dbc6266
xor eax, 0x44c0f584
rol eax, 0x51
popf
pushf
not eax
add eax, 0x76f96dca
xor eax, 0x9b28bb6
rol eax, 0xa9
popf
jmp 0x1400b61ae
nop word [rax + rax]
push rax
pushf
mov eax, 0xd5d6f4da
pushf
not eax
add eax, 0x7bad8b63
xor eax, 0x15d191a8
rol eax, 0x65
popf
pushf
not eax
add eax, 0x67beeb16
xor eax, 0x6ede06ff
rol eax, 0xc7
popf
jmp 0x1400b61ae
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400b676e
push rax
pushf
mov eax, 0x6cbf8059
pushf
not eax
add eax, 0x474acf8c
xor eax, 0x69b20194
rol eax, 0x98
popf
pushf
not eax
add eax, 0x22ab450c
xor eax, 0x7e4e622b
rol eax, 0x93
popf
pushf
not eax
add eax, 0x348495b4
xor eax, 0x47d46800
rol eax, 0xe3
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xf59e8f6d
pushf
not eax
add eax, 0x1a4766e6
xor eax, 0x4bea3bfc
rol eax, 0xa0
popf
pushf
not eax
add eax, 0x3bcfbae8
xor eax, 0xa0314e2
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x2539fb5
xor eax, 0x75f3eab1
rol eax, 0x4b
popf
jmp 0x1400b61ae
cmp cx, 0x2f
jne 0x1400b6813
push rax
pushf
mov eax, 0xc7db070
pushf
not eax
add eax, 0x88de079
xor eax, 0x7988040b
rol eax, 0x44
popf
pushf
not eax
add eax, 0x52cdd427
xor eax, 0x628944d5
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x116ad489
xor eax, 0x2b7fdd14
rol eax, 0x56
popf
pushf
not eax
add eax, 0x351271d7
xor eax, 0x484ec538
rol eax, 0xfe
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x48f1756d
pushf
not eax
add eax, 0x1dc0434f
xor eax, 0x5a0951dc
rol eax, 0x14
popf
pushf
not eax
add eax, 0xe15b149
xor eax, 0x24cf393
rol eax, 0x69
popf
pushf
not eax
add eax, 0x17ced25a
xor eax, 0x509058b3
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x2902188b
xor eax, 0x5c041058
rol eax, 0xa1
popf
jmp 0x1400b61ae
add rax, 2
cmp rax, rdi
jne 0x1400b68ce
push rax
pushf
mov eax, 0xe03d5f5a
pushf
not eax
add eax, 0x2757bd65
xor eax, 0x286f425c
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x661964a7
xor eax, 0x1093e034
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xdd669f3
xor eax, 0xa018c8c
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x3dea10a2
xor eax, 0x76a9497d
rol eax, 0x33
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xba0e52df
pushf
not eax
add eax, 0x830e91d
xor eax, 0x44eb667d
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x348b71ef
xor eax, 0x54a00281
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x75ee3444
xor eax, 0x50678d0b
rol eax, 0x40
popf
jmp 0x1400b61ae
cmp rax, rdi
je 0x1400b694c
push rax
pushf
mov eax, 0xcbb8819e
pushf
not eax
add eax, 0x28c1b52
xor eax, 0x2bce4df6
rol eax, 0x17
popf
pushf
not eax
add eax, 0x312c6538
xor eax, 0xe9d964d
rol eax, 0x75
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x4bff394f
pushf
not eax
add eax, 0x2723796d
xor eax, 0x49022d0f
rol eax, 0x66
popf
pushf
not eax
add eax, 0xd1f08f6
xor eax, 0x6e2aabb6
rol eax, 0x91
popf
pushf
not eax
add eax, 0x3aeca0f2
xor eax, 0x581cc59f
rol eax, 0xea
popf
jmp 0x1400b61ae
nop dword [rax]
push rax
pushf
mov eax, 0x6356e1c2
pushf
not eax
add eax, 0x63f95f8d
xor eax, 0x6b439f93
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x23c52009
xor eax, 0x1751a44d
rol eax, 0xb3
popf
pushf
not eax
add eax, 0x2846d590
xor eax, 0x2f6bfa28
rol eax, 0x5b
popf
jmp 0x1400b61ae
lea rcx, [rbx - 2]
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x1400b6a41
push rax
pushf
mov eax, 0x197e1318
pushf
not eax
add eax, 0x1db9f4ac
xor eax, 0x7a058806
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x3bb8ccac
xor eax, 0x799ee61d
rol eax, 6
popf
pushf
not eax
add eax, 0x2241a67d
xor eax, 0x315bd2f5
rol eax, 0x79
popf
pushf
not eax
add eax, 0x3f6257a9
xor eax, 0x775828ee
rol eax, 0x49
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x2dbd22ee
pushf
not eax
add eax, 0x4f77237f
xor eax, 0x4a74fb6
rol eax, 0x40
popf
pushf
not eax
add eax, 0x69bc4860
xor eax, 0x35c4b00
rol eax, 0x42
popf
pushf
not eax
add eax, 0x5dff36aa
xor eax, 0x3ef46dc7
rol eax, 2
popf
jmp 0x1400b61ae
cmp dx, 0x2f
je 0x1400b6ac0
push rax
pushf
mov eax, 0x83b4cbdd
pushf
not eax
add eax, 0x79897671
xor eax, 0x4286ede8
rol eax, 0x74
popf
pushf
not eax
add eax, 0x7d2edb78
xor eax, 0xe736653
rol eax, 8
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xc3f989f0
pushf
not eax
add eax, 0x125b53fa
xor eax, 0x5f3d10ed
rol eax, 0x29
popf
pushf
not eax
add eax, 0x300bdfad
xor eax, 0x765a178a
rol eax, 0x50
popf
jmp 0x1400b61ae
mov rbx, rcx
cmp rax, rcx
jne 0x1400b6b2e
push rax
pushf
mov eax, 0xe570e367
pushf
not eax
add eax, 0x7dbc9c32
xor eax, 0x43f1b74
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x643bb859
xor eax, 0x2c6829c4
rol eax, 0x44
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x40fdeb6f
pushf
not eax
add eax, 0x194ac628
xor eax, 0x15a9701c
rol eax, 0xca
popf
pushf
not eax
add eax, 0x20eda971
xor eax, 0x3ba368ad
rol eax, 0x10
popf
pushf
not eax
add eax, 0x415532b6
xor eax, 0x25b4e9af
rol eax, 0
popf
pushf
not eax
add eax, 0x3c94eb9
xor eax, 0x1c54c13e
rol eax, 0x96
popf
jmp 0x1400b61ae
push rbx
not rbx
add rdi, rbx
pop rbx
add rdi, 1
sar rdi, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400b8914
nop
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rax, qword [rsp + 0x70]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp - 8], rax
call fcn.14010f382
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
lea r8, [rbp - 0x10]
mov edx, eax
lea rcx, [rbp]
call fcn.1400baf7a
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400b6c54
push rax
pushf
mov eax, 0xe64c2d4a
pushf
not eax
add eax, 0xe496f35
xor eax, 0x2cfe4272
rol eax, 0x56
popf
pushf
not eax
add eax, 0x2fbefd1
xor eax, 0x18d87603
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x3ad569c9
xor eax, 0x53798046
rol eax, 0x17
popf
pushf
not eax
add eax, 0x22bc9083
xor eax, 0x7f2ba993
rol eax, 0x4d
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xe17ed04d
pushf
not eax
add eax, 0x66b79355
xor eax, 0x619a0c96
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x1b75c51
xor eax, 0x754e4813
rol eax, 0xea
popf
pushf
not eax
add eax, 0x3a5fd995
xor eax, 0x788f030d
rol eax, 0xd1
popf
jmp 0x1400b61ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6d0c
push rax
pushf
mov eax, 0xc31f5d72
pushf
not eax
add eax, 0x2d833c73
xor eax, 0x6332c51f
rol eax, 0x25
popf
pushf
not eax
add eax, 0x75ac4f1
xor eax, 0x21e830f7
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x3cefbbdd
xor eax, 0x21d81c56
rol eax, 0xc0
popf
pushf
not eax
add eax, 0x68211543
xor eax, 0x4342f377
rol eax, 0x91
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x6bdcd0a5
pushf
not eax
add eax, 0x59387e4
xor eax, 0x16d696c9
rol eax, 0xd
popf
pushf
not eax
add eax, 0x79b52b93
xor eax, 0x2cc439ac
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x2e6259a6
xor eax, 0x5a9a2934
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x674f0481
xor eax, 0x693d0ad3
rol eax, 0x34
popf
jmp 0x1400b61ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6db6
push rax
pushf
mov eax, 0xcffc445f
pushf
not eax
add eax, 0xa4c3977
xor eax, 0x2720d54
rol eax, 4
popf
pushf
not eax
add eax, 0xf97d792
xor eax, 0x7bb8535e
rol eax, 0xc4
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x1d333fa3
pushf
not eax
add eax, 0xe5d4409
xor eax, 0x29770475
rol eax, 0x7f
popf
pushf
not eax
add eax, 0x191bedd1
xor eax, 0x76c2144e
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x6b6f87bb
xor eax, 0x608975a5
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x1d3e7568
xor eax, 0x1466d986
rol eax, 0x1b
popf
jmp 0x1400b61ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140114059
push rax
pushf
mov eax, 0x5fafbe64
pushf
not eax
add eax, 0x387f2b0d
xor eax, 0x649b282e
rol eax, 0x36
popf
pushf
not eax
add eax, 0x663e5d2e
xor eax, 0x448f4a3c
rol eax, 0xdb
popf
jmp 0x1400b61ae
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x1400b6f0a
push rax
pushf
mov eax, 0x8eb43746
pushf
not eax
add eax, 0x72d12763
xor eax, 0x36850c9c
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x6c97c101
xor eax, 0xa2a1eb1
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x631c81d7
xor eax, 0x759aebe3
rol eax, 0xc
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x48a9b1c8
pushf
not eax
add eax, 0x52012513
xor eax, 0x66ad877d
rol eax, 4
popf
pushf
not eax
add eax, 0x15e343e8
xor eax, 0x163f0071
rol eax, 0xb1
popf
jmp 0x1400b61ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6f88
push rax
pushf
mov eax, 0x9efc91c4
pushf
not eax
add eax, 0x475a2e84
xor eax, 0x3ccf2643
rol eax, 0x10
popf
pushf
not eax
add eax, 0x8c7fe2b
xor eax, 0x4dcbf198
rol eax, 0x15
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x7bd92c4e
pushf
not eax
add eax, 0x592c295
xor eax, 0x5dcf56d5
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x49d6643c
xor eax, 0x3a3e9063
rol eax, 0x56
popf
pushf
not eax
add eax, 0x54f15852
xor eax, 0x35c549c9
rol eax, 0x63
popf
pushf
not eax
add eax, 0x4ee45054
xor eax, 0xf1ed76d
rol eax, 0x87
popf
jmp 0x1400b61ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b7032
push rax
pushf
mov eax, 0x223268c4
pushf
not eax
add eax, 0x5b31fa17
xor eax, 0x48c4c166
rol eax, 0xce
popf
pushf
not eax
add eax, 0x34da8aa
xor eax, 0x2f108c9b
rol eax, 0xae
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x3ce750eb
pushf
not eax
add eax, 0x87d52f3
xor eax, 0x36dbd7a3
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x51c4a2a4
xor eax, 0x41e4f775
rol eax, 0x83
popf
pushf
not eax
add eax, 0x6f256c56
xor eax, 0x2c1f6730
rol eax, 0x50
popf
pushf
not eax
add eax, 0x785620eb
xor eax, 0x796a27c1
rol eax, 0xda
popf
jmp 0x1400b61ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140114059
push rax
pushf
mov eax, 0x1b0f1b1e
pushf
not eax
add eax, 0x58cd6f35
xor eax, 0x76a3c16
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x37cc4fe4
xor eax, 0x33c457fb
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x71433e99
xor eax, 0x16cc297b
rol eax, 0x78
popf
pushf
not eax
add eax, 0x5ff66633
xor eax, 0x663567dc
rol eax, 0xc3
popf
jmp 0x1400b61ae
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
xor edx, edx
xor ecx, ecx
mov r8d, 0x6b508bc2
pushf
not r8d
add r8d, 0x1a8eb324
xor r8d, 0x69595106
rol r8d, 0x2e
popf
pushf
not r8d
add r8d, 0x4377b474
xor r8d, 0x65c3c2a4
rol r8d, 0x9f
popf
jmp 0x1400b7172
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r14, rax
test rax, rax
je 0x1400b71dd
push rax
pushf
mov eax, 0x8ab7dc66
pushf
not eax
add eax, 0x3a5645cb
xor eax, 0x923c633
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x11a05f16
xor eax, 0x5d1046c5
rol eax, 0x16
popf
pushf
not eax
add eax, 0x473f2866
xor eax, 0x21158269
rol eax, 0x3c
popf
pushf
not eax
add eax, 0x2ac18ba8
xor eax, 0x6ebe84d2
rol eax, 0xcd
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x1fb857ad
pushf
not eax
add eax, 0x324fbcec
xor eax, 0x329ab934
rol eax, 0x55
popf
pushf
not eax
add eax, 0x1e2edf79
xor eax, 0x7cb6660b
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x7e91e436
xor eax, 0x7bac607e
rol eax, 0x17
popf
jmp 0x1400b61ae
mov dword [rbp - 0x20], r13d
mov dword [rbp - 0x1c], r13d
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov edx, 0xfee0da69
pushf
not edx
add edx, 0x56a3f4d1
xor edx, 0x8c28e4e
rol edx, 2
popf
pushf
not edx
add edx, 0x4b88dfe1
xor edx, 0x6f6f7f5b
rol edx, 0xa4
popf
pushf
not edx
add edx, 0x75dc7bd9
xor edx, 0x572b26dc
rol edx, 0x15
popf
pushf
not edx
add edx, 0x6f11ca14
xor edx, 0xccb9949
rol edx, 0x97
popf
mov r8d, 0xafac8881
pushf
not r8d
add r8d, 0x182380a5
xor r8d, 0x3c4b1e05
rol r8d, 0xd0
popf
pushf
not r8d
add r8d, 0x188a23a1
xor r8d, 0x52c49635
rol r8d, 1
popf
pushf
not r8d
add r8d, 0x59f31ad
xor r8d, 0x44507fc0
rol r8d, 0x3a
popf
mov rcx, r14
jmp 0x1400b72f7
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400b735a
push rax
pushf
mov eax, 0x119cd358
pushf
not eax
add eax, 0x7c3e75ad
xor eax, 0x28c57fff
rol eax, 0x92
popf
pushf
not eax
add eax, 0xafb8903
xor eax, 0x1ea0b77b
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x190699b8
xor eax, 0x21fb56ee
rol eax, 0xac
popf
pushf
not eax
add eax, 0x47e0dc30
xor eax, 0x3810c9d7
rol eax, 0xcf
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xd8c7ae12
pushf
not eax
add eax, 0x7f835b69
xor eax, 0x68c0e88a
rol eax, 0x24
popf
pushf
not eax
add eax, 0x6038216a
xor eax, 0x7883c20d
rol eax, 0x7c
popf
jmp 0x1400b61ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400b73f8
push rax
pushf
mov eax, 0xb0571826
pushf
not eax
add eax, 0x420326c9
xor eax, 0x496ea171
rol eax, 0x2b
popf
pushf
not eax
add eax, 0x14bf5a65
xor eax, 0x569ddaca
rol eax, 0x52
popf
pushf
not eax
add eax, 0x4f424776
xor eax, 0x597d2d43
rol eax, 0x96
popf
pushf
not eax
add eax, 0xa480285
xor eax, 0x3963dded
rol eax, 0xa1
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x6e4a8295
pushf
not eax
add eax, 0x5e68f52b
xor eax, 0x678de803
rol eax, 0x19
popf
pushf
not eax
add eax, 0x44b00671
xor eax, 0x1780dc0b
rol eax, 0xfc
popf
jmp 0x1400b61ae
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.1401147ce
mov r15, rax
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rbp - 0x20]
mov dword [rsp + 0x20], ecx
mov r9, r15
mov edx, 0x9f368729
pushf
not edx
add edx, 0x70f45772
xor edx, 0xad3f8b6
rol edx, 0xf8
popf
pushf
not edx
add edx, 0x4add408f
xor edx, 0x1d235c02
rol edx, 0x88
popf
pushf
not edx
add edx, 0x3b61215a
xor edx, 0x1a12bd08
rol edx, 0x2a
popf
mov r8d, 0xef200cd7
pushf
not r8d
add r8d, 0x3db02f98
xor r8d, 0x4e9b11aa
rol r8d, 0x33
popf
pushf
not r8d
add r8d, 0x72f04773
xor r8d, 0x7e2892d0
rol r8d, 0xa4
popf
pushf
not r8d
add r8d, 0xbc84b54
xor r8d, 0x433aeeb9
rol r8d, 0xc4
popf
mov rcx, r14
jmp 0x1400b74f8
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400b755f
push rax
pushf
mov eax, 0xabc243f3
pushf
not eax
add eax, 0x1a37dedf
xor eax, 0x4c03773b
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x3ddfc67a
xor eax, 0x15973f37
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x66ce6218
xor eax, 0x3f493228
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x4df2f70b
xor eax, 0x3bfc1f46
rol eax, 0x4d
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x779b717c
pushf
not eax
add eax, 0x474047c0
xor eax, 0x2a50a943
rol eax, 0x29
popf
pushf
not eax
add eax, 0x6da43795
xor eax, 0x52005831
rol eax, 0xf0
popf
pushf
not eax
add eax, 0x7ef9ce1c
xor eax, 0x1162f775
rol eax, 0xef
popf
jmp 0x1400b61ae
mov ebx, r13d
cmp dword [rbp - 0x1c], r13d
jbe 0x1400b75f4
push rax
pushf
mov eax, 0xa581931f
pushf
not eax
add eax, 0x24ffbdcc
xor eax, 0x43fe0450
rol eax, 0x49
popf
pushf
not eax
add eax, 0xf5eccf0
xor eax, 0x56291c10
rol eax, 0x60
popf
pushf
not eax
add eax, 0x5a4427ad
xor eax, 0x27a5f46
rol eax, 0x2b
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x233a0c16
pushf
not eax
add eax, 0x38e7633e
xor eax, 0x4338d908
rol eax, 0x2b
popf
pushf
not eax
add eax, 0x17ce7324
xor eax, 0x6b58d86f
rol eax, 0xb3
popf
jmp 0x1400b61ae
nop dword [rax + rax]
push rax
pushf
mov eax, 0xf9bf3cc0
pushf
not eax
add eax, 0x13166893
xor eax, 0x3a04baa6
rol eax, 0x15
popf
pushf
not eax
add eax, 0x653c1d73
xor eax, 0x36b0b300
rol eax, 0x92
popf
jmp 0x1400b61ae
mov eax, ebx
lea rcx, [rax + rax*2]
add rcx, rcx
mov r8d, 0xdbc52120
pushf
not r8d
add r8d, 0x74070f16
xor r8d, 0x204f21ea
rol r8d, 0x16
popf
pushf
not r8d
add r8d, 0x14a238a7
xor r8d, 0xcb435f3
rol r8d, 0x18
popf
mov rdx, qword [r15 + rcx*8]
mov rcx, r14
jmp 0x1400b76a8
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x1400b76fc
push rax
pushf
mov eax, 0x3945c5a9
pushf
not eax
add eax, 0x1a66ca1
xor eax, 0x15b1294a
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x5ad58066
xor eax, 0x31881d9d
rol eax, 0x14
popf
pushf
not eax
add eax, 0x54b11503
xor eax, 0x35f39272
rol eax, 0x56
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xf660cd42
pushf
not eax
add eax, 0x68d4859e
xor eax, 0x58a0f31c
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x4786d0c7
xor eax, 0x1c1de2d9
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x304117a9
xor eax, 0x1b18b10a
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x7651ff0
xor eax, 0x23deb057
rol eax, 0x44
popf
jmp 0x1400b61ae
mov ecx, 0x62476297
pushf
not ecx
add ecx, 0x1b3b9991
xor ecx, 0x77b19066
rol ecx, 0x1a
popf
pushf
not ecx
add ecx, 0x73c0df49
xor ecx, 0x763cbc77
rol ecx, 0x34
popf
pushf
not ecx
add ecx, 0x1d09ff57
xor ecx, 0x55ac2ab4
rol ecx, 0x16
popf
pushf
not ecx
add ecx, 0x7b4a1d8d
xor ecx, 0x639b0e
rol ecx, 0x5d
popf
call fcn.1401147ce
mov rsi, rax
mov dword [rbp - 0x10], r13d
lea r9, [rbp - 0x10]
mov r8d, 0xcfe110a4
pushf
not r8d
add r8d, 0x3c4ea1e9
xor r8d, 0x2e9876ad
rol r8d, 0xdd
popf
pushf
not r8d
add r8d, 0x17a55f3b
xor r8d, 0x2ec4a042
rol r8d, 0xf0
popf
pushf
not r8d
add r8d, 0x769a8919
xor r8d, 0x75e0c796
rol r8d, 0x54
popf
mov rdx, rax
mov rcx, rdi
jmp 0x1400b7816
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x1400b7853
push rax
pushf
mov eax, 0x46409780
pushf
not eax
add eax, 0x5b2403ff
xor eax, 0x59cccead
rol eax, 0x2c
popf
pushf
not eax
add eax, 0x2890b765
xor eax, 0x2e63be92
rol eax, 0x37
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x6b6e44e7
pushf
not eax
add eax, 0x5f1578ec
xor eax, 0x785e2b12
rol eax, 7
popf
pushf
not eax
add eax, 0x7bb49092
xor eax, 0x78e5054c
rol eax, 0x2a
popf
jmp 0x1400b61ae
lea rdx, [0x1a8c230fe]
pushf
sub rdx, 0x68bf25b6
popf
mov rcx, qword [rsi + 0x10]
jmp 0x1400b789d
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400b78df
push rax
pushf
mov eax, 0x43b45528
pushf
not eax
add eax, 0x5dc43d58
xor eax, 0x7a596c7b
rol eax, 0x16
popf
pushf
not eax
add eax, 0x7b603c24
xor eax, 0x66482772
rol eax, 0xdc
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x44b3d89e
pushf
not eax
add eax, 0x37b8a978
xor eax, 0xdb74c7b
rol eax, 0xba
popf
pushf
not eax
add eax, 0x1f7cce7a
xor eax, 0x3a3c8cc2
rol eax, 0x72
popf
pushf
not eax
add eax, 0x6522b047
xor eax, 0x250c094c
rol eax, 9
popf
jmp 0x1400b61ae
mov rcx, rdi
jmp 0x1400b7929
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0xcb9764dc
pushf
not eax
add eax, 0x10105050
xor eax, 0x760e2f6
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x29c9f16b
xor eax, 0x2d95edb6
rol eax, 0x58
popf
pushf
not eax
add eax, 0x7ec44d0c
xor eax, 0x19cc2f6e
rol eax, 0xf9
popf
jmp 0x1400b61ae
inc ebx
cmp ebx, dword [rbp - 0x1c]
jb 0x1400b79d6
push rax
pushf
mov eax, 0x4daa0977
pushf
not eax
add eax, 0x6977cbc0
xor eax, 0x5f260901
rol eax, 0x54
popf
pushf
not eax
add eax, 0x4c893a57
xor eax, 0x50922231
rol eax, 0x66
popf
pushf
not eax
add eax, 0x40112c78
xor eax, 0x79d1a7ad
rol eax, 0x38
popf
pushf
not eax
add eax, 0x3dc29812
xor eax, 0x12a728ab
rol eax, 0xd3
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x3dfb6adf
pushf
not eax
add eax, 0x503326b4
xor eax, 0x12f6732f
rol eax, 0x30
popf
pushf
not eax
add eax, 0x616ac595
xor eax, 0x7e7c6245
rol eax, 0x85
popf
pushf
not eax
add eax, 0x1e9a9fc6
xor eax, 0x5c240ce9
rol eax, 0x74
popf
jmp 0x1400b61ae
mov rcx, r15
call fcn.140114059
mov dword [rbp - 0x20], r13d
mov dword [rbp - 0x1c], r13d
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov edx, 0x98d1397d
pushf
not edx
add edx, 0x683c9d8b
xor edx, 0x3d1f4ff9
rol edx, 0xcb
popf
pushf
not edx
add edx, 0x740418f2
xor edx, 0x3fe73a26
rol edx, 0xf6
popf
pushf
not edx
add edx, 0x3a66d0ec
xor edx, 0x43ecfa03
rol edx, 0x62
popf
pushf
not edx
add edx, 0x23c81918
xor edx, 0x14aa30af
rol edx, 0xe4
popf
mov r8d, 0xcee3ff19
pushf
not r8d
add r8d, 0x5805719
xor r8d, 0x32032376
rol r8d, 0x38
popf
pushf
not r8d
add r8d, 0x72fb9e62
xor r8d, 0x477046bd
rol r8d, 0xde
popf
pushf
not r8d
add r8d, 0x732bf432
xor r8d, 0x5f8a461d
rol r8d, 0xa5
popf
mov rcx, r14
jmp 0x1400b7af9
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1400b7b49
push rax
pushf
mov eax, 0x9c61b0c9
pushf
not eax
add eax, 0x52ceb5cc
xor eax, 0x1e0c066f
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x31463a30
xor eax, 0x357e5c64
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x6dff3fff
xor eax, 0x70434164
rol eax, 0xd8
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x2986a97a
pushf
not eax
add eax, 0x595bc050
xor eax, 0x48696cd5
rol eax, 0xb
popf
pushf
not eax
add eax, 0x47516ccc
xor eax, 0x630d698e
rol eax, 0x4e
popf
jmp 0x1400b61ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400b7bc1
push rax
pushf
mov eax, 0x6e865f3
pushf
not eax
add eax, 0x6db653e8
xor eax, 0x5be77c7e
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x5b3dcee0
xor eax, 0x72252b05
rol eax, 2
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x5c0ddd7e
pushf
not eax
add eax, 0xe200ecc
xor eax, 0x415f8b02
rol eax, 0xd
popf
pushf
not eax
add eax, 0x60cd1292
xor eax, 0x5ae17022
rol eax, 7
popf
pushf
not eax
add eax, 0x4aa9ee
xor eax, 0x2e9df232
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x53185a14
xor eax, 0x226c0947
rol eax, 0x75
popf
jmp 0x1400b61ae
mov eax, dword [rbp - 0x20]
add eax, 0x30
mov dword [rbp - 0x20], eax
mov ecx, eax
call fcn.1401147ce
mov rdi, rax
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rbp - 0x20]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov edx, 0x30deb685
pushf
not edx
add edx, 0x42e90992
xor edx, 0x144f3839
rol edx, 0x96
popf
pushf
not edx
add edx, 0x56b6930a
xor edx, 0x656504d7
rol edx, 0x81
popf
pushf
not edx
add edx, 0x4bed50ac
xor edx, 0x73db45ba
rol edx, 0xcf
popf
mov r8d, 0x5626be62
pushf
not r8d
add r8d, 0x574c1041
xor r8d, 0x7df1b40b
rol r8d, 0xc7
popf
pushf
not r8d
add r8d, 0xa1fd290
xor r8d, 0x543500af
rol r8d, 0x8a
popf
pushf
not r8d
add r8d, 0x71bc3003
xor r8d, 0xa1e3554
rol r8d, 0xb9
popf
mov rcx, r14
jmp 0x1400b7ce7
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1400b7d3b
push rax
pushf
mov eax, 0xf526c727
pushf
not eax
add eax, 0x27db0b86
xor eax, 0x3dea8618
rol eax, 0x7f
popf
pushf
not eax
add eax, 0x6160d120
xor eax, 0x9eb6ee9
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x3a97aed6
xor eax, 0x25d754d4
rol eax, 0xe
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x698f32be
pushf
not eax
add eax, 0x1e375416
xor eax, 0x4523aefb
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x31cd4a4f
xor eax, 0xa8618c0
rol eax, 7
popf
pushf
not eax
add eax, 0x788c34aa
xor eax, 0x6b99b7a
rol eax, 0xe0
popf
jmp 0x1400b61ae
mov ebx, r13d
cmp dword [rbp - 0x1c], r13d
jbe 0x1400b7dd0
push rax
pushf
mov eax, 0x8e668ed4
pushf
not eax
add eax, 0x16f1f65a
xor eax, 0x46b6417b
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x58875684
xor eax, 0x2fd5ab0d
rol eax, 0x71
popf
pushf
not eax
add eax, 0x5f329d39
xor eax, 0x7758195f
rol eax, 0x53
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xf67567c6
pushf
not eax
add eax, 0x2419a073
xor eax, 0x3031f4b9
rol eax, 6
popf
pushf
not eax
add eax, 0x6a769d3
xor eax, 0x6f562ffd
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x4fc52ee6
xor eax, 0x74d9a5b8
rol eax, 0xcf
popf
jmp 0x1400b61ae
nop word [rax + rax]
push rax
pushf
mov eax, 0x4dce39a9
pushf
not eax
add eax, 0x7c7dc544
xor eax, 0x79266c35
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x49eb7532
xor eax, 0x2192095a
rol eax, 0x62
popf
pushf
not eax
add eax, 0x8967eae
xor eax, 0x324c53bc
rol eax, 0x3f
popf
jmp 0x1400b61ae
mov eax, ebx
lea rcx, [rax + rax*2]
add rcx, rcx
movups xmm6, xmmword [rdi + rcx*8 + 0x10]
lea rdx, [0x19d48fd5c]
pushf
sub rdx, 0x5d4567ec
popf
mov rcx, qword [rdi + rcx*8]
jmp 0x1400b7e87
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400b7ec5
push rax
pushf
mov eax, 0xc282ec0b
pushf
not eax
add eax, 0x5033fc0c
xor eax, 0x5575f595
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x786aab75
xor eax, 0x4bbf054d
rol eax, 0x93
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x376f5059
pushf
not eax
add eax, 0x3611fa61
xor eax, 0x32a3d71a
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x1f583cc0
xor eax, 0x779b6f9d
rol eax, 0x81
popf
pushf
not eax
add eax, 0x1ca6ba62
xor eax, 0x41b6b06f
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x41656ec0
xor eax, 0x892d77a
rol eax, 0x66
popf
jmp 0x1400b61ae
psrldq xmm6, 4
movd eax, xmm6
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x1400b7f68
push rax
pushf
mov eax, 0xfebb236e
pushf
not eax
add eax, 0x78326176
xor eax, 0xacc2ec9
rol eax, 0xa8
popf
pushf
not eax
add eax, 0x737759c5
xor eax, 0x38668b53
rol eax, 0x44
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0xec2eb58b
pushf
not eax
add eax, 0x6f4ebb20
xor eax, 0x2bbdc656
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x224207fe
xor eax, 0x59a4e439
rol eax, 4
popf
pushf
not eax
add eax, 0x111202d0
xor eax, 0x138cd313
rol eax, 0xc6
popf
jmp 0x1400b61ae
inc ebx
cmp ebx, dword [rbp - 0x1c]
jb 0x1400b7fe9
push rax
pushf
mov eax, 0x71452b91
pushf
not eax
add eax, 0x1740ee2e
xor eax, 0x286fe947
rol eax, 0
popf
pushf
not eax
add eax, 0x91bb7e7
xor eax, 0x7bae8c0b
rol eax, 0x70
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x9c60d593
pushf
not eax
add eax, 0x1065b548
xor eax, 0x18005bf9
rol eax, 0x32
popf
pushf
not eax
add eax, 0x68fd7073
xor eax, 0x4177b28d
rol eax, 0xf2
popf
pushf
not eax
add eax, 0x7b226cbc
xor eax, 0x7e3b93c4
rol eax, 0xf2
popf
pushf
not eax
add eax, 0x64ea174d
xor eax, 0x5bee49f6
rol eax, 0x96
popf
jmp 0x1400b61ae
mov rcx, rdi
call fcn.140114059
cmp qword [r12 + 0x18], 0xf
jbe 0x1400b8098
push rax
pushf
mov eax, 0xf04231dd
pushf
not eax
add eax, 0x286da09f
xor eax, 0x30a9d499
rol eax, 0x83
popf
pushf
not eax
add eax, 0x26843c5b
xor eax, 0x7222a8f7
rol eax, 0x27
popf
pushf
not eax
add eax, 0x27f2a4d1
xor eax, 0x191ee5c
rol eax, 0x7f
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x5cd6dc6b
pushf
not eax
add eax, 0x26066219
xor eax, 0x5b77fd5a
rol eax, 0x44
popf
pushf
not eax
add eax, 0x36351eb8
xor eax, 0x1dd17489
rol eax, 0x19
popf
pushf
not eax
add eax, 0x4bc58945
xor eax, 0x408b9933
rol eax, 3
popf
pushf
not eax
add eax, 0x39a7e281
xor eax, 0x509f2bec
rol eax, 0xbb
popf
jmp 0x1400b61ae
mov r12, qword [r12]
push rax
pushf
mov eax, 0x51a4b197
pushf
not eax
add eax, 0x1a4232f5
xor eax, 0x2d5aaccc
rol eax, 0x77
popf
pushf
not eax
add eax, 0x21354234
xor eax, 0xcf9280
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x1430fadf
xor eax, 0x54dad76a
rol eax, 0x45
popf
jmp 0x1400b61ae
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
lea rdx, [rbp]
cmova rdx, qword [rbp]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov r9d, 0x82961f9
pushf
not r9d
add r9d, 0x4703ade9
xor r9d, 0x5d1b622a
rol r9d, 0x43
popf
pushf
not r9d
add r9d, 0x211177a1
xor r9d, 0x3c51dae3
rol r9d, 0x19
popf
pushf
not r9d
add r9d, 0x37b19802
xor r9d, 0x2e75251c
rol r9d, 0x80
popf
pushf
not r9d
add r9d, 0x66c64c3f
xor r9d, 0x407ebb38
rol r9d, 0x38
popf
mov rcx, r14
jmp 0x1400b81f3
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
test rax, rax
jne 0x1400b8247
push rax
pushf
mov eax, 0x2ef09fdc
pushf
not eax
add eax, 0x18a3db21
xor eax, 0x2390b7b0
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x38837d12
xor eax, 0x1c383b89
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x65423ef3
xor eax, 0x30c701da
rol eax, 0x61
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x78e1ee5f
pushf
not eax
add eax, 0x732dbe5e
xor eax, 0x634bccde
rol eax, 0x7f
popf
pushf
not eax
add eax, 0x42a080da
xor eax, 0x6207f4b
rol eax, 0xe4
popf
jmp 0x1400b61ae
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
mov r8d, 0xc23f7b08
pushf
not r8d
add r8d, 0x27977d0f
xor r8d, 0x25e496a0
rol r8d, 0x97
popf
pushf
not r8d
add r8d, 0x2816585d
xor r8d, 0x78a7badd
rol r8d, 0x9f
popf
pushf
not r8d
add r8d, 0x73359a5c
xor r8d, 0x549fedf2
rol r8d, 0xdd
popf
pushf
not r8d
add r8d, 0xc942393
xor r8d, 0x3761b112
rol r8d, 0xa
popf
mov rcx, r14
jmp 0x1400b82f6
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x1400b8337
push rax
pushf
mov eax, 0x3c9d063c
pushf
not eax
add eax, 0x74c1c4f4
xor eax, 0x35cbbe89
rol eax, 0x23
popf
pushf
not eax
add eax, 0xd0b8e4a
xor eax, 0x4d938c5b
rol eax, 0x84
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x2ab87ece
pushf
not eax
add eax, 0x11ac4aca
xor eax, 0x3d29ba48
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x3a50b204
xor eax, 0x562668b8
rol eax, 0x27
popf
pushf
not eax
add eax, 0x72638c
xor eax, 0x38ae40e
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x1b053bd0
xor eax, 0x5ed3335b
rol eax, 0xa6
popf
jmp 0x1400b61ae
mov rcx, r14
jmp 0x1400b8394
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400b85ab
mov rcx, r15
call fcn.140114059
mov rcx, rdi
jmp 0x1400b8404
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400b7a24
xor r8d, r8d
xor edx, edx
mov rcx, rbx
jmp 0x1400b8471
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
setne dil
mov rcx, rbx
jmp 0x1400b8481
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r14
jmp 0x1400b848b
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400b8607
mov rcx, rdi
jmp 0x1400b8573
mov rcx, r15
push rax
pushf
mov eax, 0xfcc52eb7
pushf
not eax
add eax, 0x5dcd852
xor eax, 0x13bebe7b
rol eax, 0x89
popf
pushf
not eax
add eax, 0x2f8257d3
xor eax, 0x73128558
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x104125c3
xor eax, 0x63de4ea2
rol eax, 0x27
popf
jmp 0x1400b61ae
call fcn.140114059
push rax
pushf
mov eax, 0x374b3773
pushf
not eax
add eax, 0x7c94f81b
xor eax, 0x403f0bcb
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x1c953add
xor eax, 0x51293500
rol eax, 0x9f
popf
jmp 0x1400b61ae
xor dil, dil
push rax
pushf
mov eax, 0xd439495c
pushf
not eax
add eax, 0x5e01f229
xor eax, 0x6a7b8c4d
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x35b987e8
xor eax, 0x504ad841
rol eax, 0xab
popf
pushf
not eax
add eax, 0xbe1982c
xor eax, 0x53088a04
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x45b94419
xor eax, 0x33bedad5
rol eax, 0xd6
popf
jmp 0x1400b61ae
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400b866a
push rax
pushf
mov eax, 0xa90efa01
pushf
not eax
add eax, 0x64fb91ef
xor eax, 0x191e04d5
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x36df7c4a
xor eax, 0x6876c70b
rol eax, 0x50
popf
pushf
not eax
add eax, 0x727ea841
xor eax, 0x57d8090c
rol eax, 0x20
popf
pushf
not eax
add eax, 0x83ff40a
xor eax, 0x73c70993
rol eax, 0xaa
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x29e5d2cb
pushf
not eax
add eax, 0x6e2b7fb6
xor eax, 0x4b6722d8
rol eax, 0x61
popf
pushf
not eax
add eax, 0xcf93174
xor eax, 0x554eedea
rol eax, 0xee
popf
pushf
not eax
add eax, 0x59094ccd
xor eax, 0x2d9c6835
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x755f47fc
xor eax, 0x26b7dc03
rol eax, 3
popf
jmp 0x1400b61ae
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b8709
push rax
pushf
mov eax, 0x5c67017
pushf
not eax
add eax, 0x35db6c1e
xor eax, 0x2fafcb78
rol eax, 0xb3
popf
pushf
not eax
add eax, 0x37eee359
xor eax, 0x7bfde549
rol eax, 0xc0
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x36d7ed48
pushf
not eax
add eax, 0x262d86c4
xor eax, 0x554f0cc5
rol eax, 0x12
popf
pushf
not eax
add eax, 0x4f81b4d4
xor eax, 0x788f5216
rol eax, 0x71
popf
pushf
not eax
add eax, 0x6f0243c1
xor eax, 0x60a04047
rol eax, 0x31
popf
pushf
not eax
add eax, 0x27971fa9
xor eax, 0x1fc279e2
rol eax, 0x7c
popf
jmp 0x1400b61ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
push rcx
not rcx
add rax, rcx
pop rcx
add rax, 1
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b87d9
push rax
pushf
mov eax, 0xaacf8f36
pushf
not eax
add eax, 0x25b02f42
xor eax, 0x71b6895a
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x7531f383
xor eax, 0x4f48b2e
rol eax, 0xff
popf
pushf
not eax
add eax, 0x4275351d
xor eax, 0x6e31ae6f
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xb9f27e5
xor eax, 0x34ede1f8
rol eax, 0x71
popf
jmp 0x1400b61ae
push rax
pushf
mov eax, 0x9b361120
pushf
not eax
add eax, 0x575c4e77
xor eax, 0x438a90e6
rol eax, 0xb3
popf
pushf
not eax
add eax, 0x43a225c3
xor eax, 0x4c3d8095
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x6de1f114
xor eax, 0x854dd3f
rol eax, 0xd
popf
jmp 0x1400b61ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140114059
push rax
pushf
mov eax, 0x449540d3
pushf
not eax
add eax, 0x23369654
xor eax, 0x64226a72
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x159b6bd8
xor eax, 0x47fd488e
rol eax, 0xf3
popf
pushf
not eax
add eax, 0x1864becb
xor eax, 0x274e1f86
rol eax, 0xca
popf
pushf
not eax
add eax, 0x4d56e457
xor eax, 0x6a453444
rol eax, 0x94
popf
jmp 0x1400b61ae
movzx eax, dil
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140112590
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret