Function at 0x1400c1ed0
Capabilities:
Authenticate hmac
Parse pe header
Query service status
Start service

Disassembly:
push rax
pushf
mov eax, 0x1a54d221
pushf
not eax
add eax, 0xca0850b1
xor eax, 0x9d18b62c
rol eax, 0xad
popf
pushf
not eax
add eax, 0xf7fc37ab
xor eax, 0x89f1e3a9
rol eax, 0x75
popf
pushf
not eax
add eax, 0xbf4e99eb
xor eax, 0xefc0aa1e
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x97d78c09
xor eax, 0xecd09a35
rol eax, 0xe1
popf
cmp eax, 4
jne 0x1400c1f33
popf
pop rax
jmp 0x1400c28b9
cmp eax, 0
jne 0x1400c1f42
popf
pop rax
jmp 0x1400c1fe7
cmp eax, 3
jne 0x1400c1f51
popf
pop rax
jmp 0x1400c2609
cmp eax, 1
jne 0x1400c1f60
popf
pop rax
jmp 0x1400c20b6
cmp eax, 0xa
jne 0x1400c1f6f
popf
pop rax
jmp 0x1400c3156
cmp eax, 7
jne 0x1400c1f7e
popf
pop rax
jmp 0x1400c2df0
cmp eax, 6
jne 0x1400c1f8d
popf
pop rax
jmp 0x1400c2d5e
cmp eax, 0xb
jne 0x1400c1f9c
popf
pop rax
jmp 0x1400c32fc
cmp eax, 0xc
jne 0x1400c1fab
popf
pop rax
jmp 0x1400c3595
cmp eax, 8
jne 0x1400c1fba
popf
pop rax
jmp 0x1400c2f83
cmp eax, 5
jne 0x1400c1fc9
popf
pop rax
jmp 0x1400c2981
cmp eax, 2
jne 0x1400c1fd8
popf
pop rax
jmp 0x1400c251e
cmp eax, 9
jne 0x1400c1fe7
popf
pop rax
jmp 0x1400c304d
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140084080]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400c2018
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1400c205d
push rax
pushf
mov eax, 0xa2d03b28
pushf
not eax
add eax, 0xfc3d2103
xor eax, 0xb1aee8d5
rol eax, 5
popf
pushf
not eax
add eax, 0x995a0a3d
xor eax, 0x8138683f
rol eax, 0x8b
popf
jmp 0x1400c1f24
push rax
pushf
mov eax, 0xb7eeb9c2
pushf
not eax
add eax, 0xc54cf9c1
xor eax, 0xae534eb3
rol eax, 0xd
popf
pushf
not eax
add eax, 0xf8077b5e
xor eax, 0x8f9f4a6c
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xfd167728
xor eax, 0xa1a9bb16
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xcf29175b
xor eax, 0xfbb3a1e5
rol eax, 0x71
popf
jmp 0x1400c1f24
movabs rdx, 0xcf1a6340292ac5ba
pushf
not rdx
add rdx, 0x7959eb63
xor rdx, 0x4ef6a2bb
rol rdx, 0x45
popf
pushf
not rdx
add rdx, 0x767e938e
xor rdx, 0x566e7b93
rol rdx, 6
popf
pushf
not rdx
add rdx, 0x62f6bc64
xor rdx, 0x5e5199f6
rol rdx, 0x82
popf
pushf
not rdx
add rdx, 0x743daacd
xor rdx, 0x57f7818d
rol rdx, 0xaa
popf
movabs rax, 0x1457e86b60ebc767
pushf
not rax
add rax, 0x59ab28e8
xor rax, 0x40ea126e
rol rax, 0x6b
popf
pushf
not rax
add rax, 0x7277bcc1
xor rax, 0x4471e2c4
rol rax, 0x82
popf
mov qword [rbp + 0x17], rax
movabs rcx, 0x3ad902db539c5baa
pushf
not rcx
add rcx, 0x764346cb
xor rcx, 0x49648a03
rol rcx, 0x9e
popf
pushf
not rcx
add rcx, 0x584a1697
xor rcx, 0x45e8cf36
rol rcx, 0x96
popf
pushf
not rcx
add rcx, 0x7b4a3834
xor rcx, 0x49ed8d77
rol rcx, 0xf5
popf
mov qword [rbp - 0x19], rcx
movabs rax, 0x929f61172e0babd0
pushf
not rax
add rax, 0x61395abe
xor rax, 0x72ca54b6
rol rax, 0x8b
popf
pushf
not rax
add rax, 0x7382d2fd
xor rax, 0x742b77b4
rol rax, 0xc5
popf
mov qword [rbp + 0x1f], rax
movabs rcx, 0xbf129e40d1c0baf4
pushf
not rcx
add rcx, 0x6c422771
xor rcx, 0x53b560e1
rol rcx, 0x1a
popf
pushf
not rcx
add rcx, 0x47f3eac5
xor rcx, 0x41255a55
rol rcx, 0xbe
popf
pushf
not rcx
add rcx, 0x491ece73
xor rcx, 0x699d61f8
rol rcx, 0xda
popf
movdqa xmm0, xmmword [rbp + 0x17]
movabs rax, 0x129a99f9c8bf5e23
pushf
not rax
add rax, 0x4638d757
xor rax, 0x4177db48
rol rax, 0x17
popf
pushf
not rax
add rax, 0x6b069186
xor rax, 0x6ca6f366
rol rax, 0x77
popf
pushf
not rax
add rax, 0x7f5c9f16
xor rax, 0x6bba01ed
rol rax, 0x2f
popf
pushf
not rax
add rax, 0x7bc383e7
xor rax, 0x7a590523
rol rax, 0x24
popf
mov qword [rbp + 0x27], rax
movabs r8, 0x3a0b3a60a481bc38
pushf
not r8
add r8, 0x695a7731
xor r8, 0x44f3f19f
rol r8, 0x76
popf
pushf
not r8
add r8, 0x54e86702
xor r8, 0x54904ee0
rol r8, 0x69
popf
mov qword [rbp - 0x11], rcx
movabs rax, 0x63398d63dad8a1a6
pushf
not rax
add rax, 0x4164e4d7
xor rax, 0x461e1cac
rol rax, 0x56
popf
pushf
not rax
add rax, 0x7608bb8a
xor rax, 0x633e9264
rol rax, 0x13
popf
pushf
not rax
add rax, 0x6d46ab1e
xor rax, 0x42fd93f1
rol rax, 0x7d
popf
xorps xmm0, xmmword [rbp - 0x19]
movabs rcx, 0x18eec499e40a1f40
pushf
not rcx
add rcx, 0x6f534926
xor rcx, 0x5920d8fe
rol rcx, 0x4d
popf
pushf
not rcx
add rcx, 0x7c241aff
xor rcx, 0x737949f3
rol rcx, 0x55
popf
pushf
not rcx
add rcx, 0x572390ef
xor rcx, 0x55e56ba5
rol rcx, 0xad
popf
mov qword [rbp + 0x2f], rax
movabs rax, 0x86f643a028ab6aac
pushf
not rax
add rax, 0x623f7364
xor rax, 0x4d24bca3
rol rax, 0xe2
popf
pushf
not rax
add rax, 0x46805760
xor rax, 0x6b3ea310
rol rax, 0xd2
popf
pushf
not rax
add rax, 0x49a1775a
xor rax, 0x40b63c64
rol rax, 0xe5
popf
pushf
not rax
add rax, 0x40dad914
xor rax, 0x452b4500
rol rax, 7
popf
movdqa xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0x37], rax
movabs rax, 0xd5bd2e39a1899b2a
pushf
not rax
add rax, 0x6d82288d
xor rax, 0x74f261ff
rol rax, 0x5c
popf
pushf
not rax
add rax, 0x7c2fd919
xor rax, 0x46425afa
rol rax, 0x13
popf
mov qword [rbp + 0x3f], rdx
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [rbp + 0x37]
mov qword [rbp - 9], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp + 0xf], rdx
lea rdx, [rbp + 0x17]
mov qword [rbp - 1], rax
xorps xmm1, xmmword [rbp - 9]
mov qword [rbp + 7], r8
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 0x27], xmm1
movdqa xmmword [rbp + 0x37], xmm0
call fcn.1400b8f2a
mov rbx, rax
jmp 0x1400c2490
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x1400c249c
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1b9c5a9ca]
pushf
sub rdx, 0x79c5293a
popf
jmp 0x1400c24b8
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x1400c38bd
mov r8d, 0x452641a6
pushf
not r8d
add r8d, 0xcc7684ea
xor r8d, 0xe0ba4fc9
rol r8d, 0xa
popf
pushf
not r8d
add r8d, 0xc2656884
xor r8d, 0x8570bb1e
rol r8d, 0x39
popf
pushf
not r8d
add r8d, 0xd20e23a7
xor r8d, 0xdccfcc9b
rol r8d, 0x56
popf
mov qword [rsp + 0xc8], rdi
mov rdx, rbx
mov rcx, rsi
jmp 0x1400c257e
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400c25c3
push rax
pushf
mov eax, 0xf42a3c8f
pushf
not eax
add eax, 0xcc77bca9
xor eax, 0xbd23c41c
rol eax, 0x74
popf
pushf
not eax
add eax, 0xf918e91f
xor eax, 0xb8c29222
rol eax, 0x5d
popf
jmp 0x1400c1f24
push rax
pushf
mov eax, 0xb24d486d
pushf
not eax
add eax, 0xbe7a3407
xor eax, 0x8d2cb3fa
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xc0c79f33
xor eax, 0xdc88f940
rol eax, 0xec
popf
pushf
not eax
add eax, 0xd12798ad
xor eax, 0xdec1d0f6
rol eax, 0xa7
popf
jmp 0x1400c1f24
movabs rax, 0x9231bae55ff3192d
pushf
not rax
add rax, 0x4220e7fa
xor rax, 0x7b9b1ea0
rol rax, 0x86
popf
pushf
not rax
add rax, 0x598cf1bb
xor rax, 0x41a9080e
rol rax, 0x45
popf
pushf
not rax
add rax, 0x52c55058
xor rax, 0x78b814fb
rol rax, 0x38
popf
pushf
not rax
add rax, 0x6a440959
xor rax, 0x4e2e866c
rol rax, 0xb0
popf
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x19], rax
movabs rcx, 0xe8bb42b04f9bf66a
pushf
not rcx
add rcx, 0x5a5d6ecb
xor rcx, 0x76c8a3f1
rol rcx, 0x7d
popf
pushf
not rcx
add rcx, 0x5c8acdaf
xor rcx, 0x78ed2674
rol rcx, 0xeb
popf
mov qword [rbp + 0x17], rcx
movabs rax, 0x9d13ffe3617fb2bc
pushf
not rax
add rax, 0x61b9d189
xor rax, 0x70cce179
rol rax, 0x99
popf
pushf
not rax
add rax, 0x4efed7f9
xor rax, 0x73d0dd2f
rol rax, 0x6b
popf
mov qword [rbp - 0x11], rax
movabs rcx, 0xb822adf4ea4a8efc
pushf
not rcx
add rcx, 0x71a8d16c
xor rcx, 0x742c0e64
rol rcx, 0x1a
popf
pushf
not rcx
add rcx, 0x43b878e0
xor rcx, 0x5b19fcb3
rol rcx, 0xc8
popf
movdqa xmm0, xmmword [rbp - 0x19]
movabs rax, 0x4dcc24aa7b7f100d
pushf
not rax
add rax, 0x53cf4c2b
xor rax, 0x599e8560
rol rax, 0x9c
popf
pushf
not rax
add rax, 0x766120ac
xor rax, 0x40891dd6
rol rax, 0x7a
popf
mov qword [rbp - 9], rax
movabs rax, 0x6940f4d8160bc99
pushf
not rax
add rax, 0x403478b5
xor rax, 0x615462d5
rol rax, 0x3c
popf
pushf
not rax
add rax, 0x6fe81c71
xor rax, 0x5281621b
rol rax, 0x5f
popf
mov qword [rbp + 0x1f], rcx
movabs rcx, 0xacccbab82b274851
pushf
not rcx
add rcx, 0x4a0e4dfa
xor rcx, 0x733554f9
rol rcx, 0xc6
popf
pushf
not rcx
add rcx, 0x540151e6
xor rcx, 0x4615363e
rol rcx, 0x36
popf
pushf
not rcx
add rcx, 0x42a5392c
xor rcx, 0x745883fa
rol rcx, 0xd3
popf
xorps xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 1], rax
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x27], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp + 0x2f], rax
xorps xmm1, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 9], xmm1
movdqa xmmword [rbp - 0x19], xmm0
call fcn.1400b8f2a
mov rbx, rax
jmp 0x1400c2834
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x1400c2840
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x188b5647d]
pushf
sub rdx, 0x48b4e3ed
popf
jmp 0x1400c285c
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
jmp 0x1400c2866
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400c38b5
lea rdx, [rbp - 0x39]
mov rcx, rdi
jmp 0x1400c28c1
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400c2928
push rax
pushf
mov eax, 0xff18b4f7
pushf
not eax
add eax, 0x8d94e5e8
xor eax, 0xa18b2db8
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xde9a8e9f
xor eax, 0xfc917973
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x8a0e74d8
xor eax, 0xa70919d9
rol eax, 0x11
popf
pushf
not eax
add eax, 0xd876ff22
xor eax, 0x9f54c91d
rol eax, 0xf8
popf
jmp 0x1400c1f24
push rax
pushf
mov eax, 0xf5340de9
pushf
not eax
add eax, 0x82cdcc4b
xor eax, 0xd56898e5
rol eax, 0x40
popf
pushf
not eax
add eax, 0xce2cf9ee
xor eax, 0xd875f636
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xbf9201f3
xor eax, 0xd4556921
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x98680476
xor eax, 0xc77c8c54
rol eax, 0x30
popf
jmp 0x1400c1f24
movabs r8, 0xd28cc51a6d38be39
pushf
not r8
add r8, 0x4893cfd6
xor r8, 0x7a9ba91c
rol r8, 0xcf
popf
pushf
not r8
add r8, 0x7aca918a
xor r8, 0x7348982a
rol r8, 0xb1
popf
pushf
not r8
add r8, 0x605ade05
xor r8, 0x62513ee7
rol r8, 0x9f
popf
movabs rdx, 0x3f0285fcf16358c6
pushf
not rdx
add rdx, 0x4b576e87
xor rdx, 0x538859d4
rol rdx, 0x7b
popf
pushf
not rdx
add rdx, 0x6311ad0d
xor rdx, 0x7a4a5239
rol rdx, 0x6a
popf
pushf
not rdx
add rdx, 0x734b4578
xor rdx, 0x5d0312de
rol rdx, 0xc1
popf
mov qword [rbp + 0x3f], rdx
movabs rax, 0x6d3466c2ef8ea604
pushf
not rax
add rax, 0x4d57f2fa
xor rax, 0x6db44d14
rol rax, 0x91
popf
pushf
not rax
add rax, 0x6f7a0920
xor rax, 0x639248a2
rol rax, 0x5a
popf
pushf
not rax
add rax, 0x75c5ee04
xor rax, 0x50dd26ed
rol rax, 0xec
popf
pushf
not rax
add rax, 0x6fb534eb
xor rax, 0x5a522c6e
rol rax, 0x50
popf
mov qword [rbp + 0x17], rax
movabs rcx, 0x6bc96890523f68e6
pushf
not rcx
add rcx, 0x58c12feb
xor rcx, 0x6ceadc07
rol rcx, 0xfe
popf
pushf
not rcx
add rcx, 0x51146022
xor rcx, 0x58f22d4a
rol rcx, 0x8c
popf
mov qword [rbp - 0x19], rcx
movabs rax, 0x717afc4e2628996a
pushf
not rax
add rax, 0x78b22cd5
xor rax, 0x5bc40793
rol rax, 0xc5
popf
pushf
not rax
add rax, 0x72534820
xor rax, 0x4f9e36e4
rol rax, 0xdd
popf
pushf
not rax
add rax, 0x4a4e98ad
xor rax, 0x6adaf4e5
rol rax, 0x61
popf
pushf
not rax
add rax, 0x795d0fb7
xor rax, 0x70dd93c2
rol rax, 0xac
popf
mov qword [rbp + 0x1f], rax
movabs rcx, 0xba03cdc9d5f2c648
pushf
not rcx
add rcx, 0x65deca75
xor rcx, 0x5fa65617
rol rcx, 0xd0
popf
pushf
not rcx
add rcx, 0x47445b27
xor rcx, 0x7c3abcc5
rol rcx, 0x7e
popf
pushf
not rcx
add rcx, 0x7a930162
xor rcx, 0x7879dfd2
rol rcx, 0x82
popf
movdqa xmm0, xmmword [rbp + 0x17]
movabs rax, 0x726b141979501c6
pushf
not rax
add rax, 0x7dc15a40
xor rax, 0x654d444d
rol rax, 0xf0
popf
pushf
not rax
add rax, 0x4b3a243e
xor rax, 0x7dfff201
rol rax, 0xa5
popf
pushf
not rax
add rax, 0x604d0162
xor rax, 0x7e2cd1a9
rol rax, 0x84
popf
pushf
not rax
add rax, 0x7ce28390
xor rax, 0x5c9b182f
rol rax, 0x74
popf
mov qword [rbp + 0x27], rax
movabs rax, 0xc09a98d0fcb4dd69
pushf
not rax
add rax, 0x6fadf9d2
xor rax, 0x586403c8
rol rax, 0xc1
popf
pushf
not rax
add rax, 0x50fc79b3
xor rax, 0x5c9db0c8
rol rax, 0xb
popf
mov qword [rbp - 0x11], rcx
movabs rcx, 0x728628669d96e3f1
pushf
not rcx
add rcx, 0x7bb5b545
xor rcx, 0x49fe694d
rol rcx, 4
popf
pushf
not rcx
add rcx, 0x78129952
xor rcx, 0x7090b3a2
rol rcx, 0x5e
popf
xorps xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 0x2f], rax
movabs rax, 0xf5136921b198407
pushf
not rax
add rax, 0x58bfd929
xor rax, 0x6a7f70ca
rol rax, 0xb9
popf
pushf
not rax
add rax, 0x5e0e1a1b
xor rax, 0x5ecd85c2
rol rax, 0x12
popf
movdqa xmm1, xmmword [rbp + 0x27]
mov qword [rbp + 0x37], r8
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [rbp + 0x37]
mov qword [rbp - 9], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp + 0xf], rdx
lea rdx, [rbp + 0x17]
mov qword [rbp - 1], rax
xorps xmm1, xmmword [rbp - 9]
mov qword [rbp + 7], r8
xorps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 0x27], xmm1
movdqa xmmword [rbp + 0x37], xmm0
call fcn.1400b8f2a
mov rbx, rax
jmp 0x1400c2d08
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x1400c3525
cmp dword [rbp - 0x35], 4
jne 0x1400c2d97
push rax
pushf
mov eax, 0x97ce83b4
pushf
not eax
add eax, 0x8165413b
xor eax, 0xfb0d76ec
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xd52a0f71
xor eax, 0xcbdc29bc
rol eax, 0
popf
jmp 0x1400c1f24
push rax
pushf
mov eax, 0xdb83e0c9
pushf
not eax
add eax, 0xa824919d
xor eax, 0xd7247c5d
rol eax, 0x65
popf
pushf
not eax
add eax, 0xb518deb7
xor eax, 0x98ef8025
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xcc32278f
xor eax, 0xfbf52ef7
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xb8f67124
xor eax, 0x9d1ba481
rol eax, 0x18
popf
jmp 0x1400c1f24
movabs rax, 0x34f446949fc63030
pushf
not rax
add rax, 0x53206366
xor rax, 0x784c8542
rol rax, 0x9d
popf
pushf
not rax
add rax, 0x60788224
xor rax, 0x50093f4f
rol rax, 0x3c
popf
pushf
not rax
add rax, 0x72178d23
xor rax, 0x641096de
rol rax, 0x6e
popf
pushf
not rax
add rax, 0x5e7b3257
xor rax, 0x4c9f5b4d
rol rax, 0x6b
popf
mov qword [rbp - 0x19], rax
movabs rax, 0x7877d5eaf2c2c173
pushf
not rax
add rax, 0x51c429b6
xor rax, 0x52f14985
rol rax, 0x3d
popf
pushf
not rax
add rax, 0x54280c62
xor rax, 0x78f09538
rol rax, 0x25
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x2e1d1edfdc25fd3e
pushf
not rax
add rax, 0x7939ad40
xor rax, 0x4ccf8059
rol rax, 0x3e
popf
pushf
not rax
add rax, 0x7fb3e43d
xor rax, 0x73e425ed
rol rax, 0xf8
popf
mov qword [rbp - 9], rax
movabs rax, 0xe3b6c5792ae8348b
pushf
not rax
add rax, 0x6c436613
xor rax, 0x507d2bf1
rol rax, 0xc8
popf
pushf
not rax
add rax, 0x7d3883e0
xor rax, 0x4e5b8b17
rol rax, 0xf6
popf
pushf
not rax
add rax, 0x7003226c
xor rax, 0x59043a7c
rol rax, 0xa6
popf
pushf
not rax
add rax, 0x4f4fe5ac
xor rax, 0x452fdf16
rol rax, 0x12
popf
jmp 0x1400c370b
xor r8d, r8d
xor edx, edx
mov rcx, rdi
jmp 0x1400c2f8c
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400c2ff3
push rax
pushf
mov eax, 0xb4fce0df
pushf
not eax
add eax, 0xcef93dc2
xor eax, 0xae1e6559
rol eax, 5
popf
pushf
not eax
add eax, 0xb68afdd6
xor eax, 0x9f8a0ce4
rol eax, 0x36
popf
pushf
not eax
add eax, 0x8d5d36ee
xor eax, 0xaad2b49e
rol eax, 0x95
popf
pushf
not eax
add eax, 0xfe7ed3e0
xor eax, 0xe1d06fb1
rol eax, 0x36
popf
jmp 0x1400c1f24
push rax
pushf
mov eax, 0x45fe9533
pushf
not eax
add eax, 0xb920175c
xor eax, 0xec08b932
rol eax, 0xde
popf
pushf
not eax
add eax, 0xf36c2d11
xor eax, 0xc612793d
rol eax, 0
popf
pushf
not eax
add eax, 0xe50850cc
xor eax, 0x97b93e8d
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xcb7acbad
xor eax, 0xa5845b71
rol eax, 0x44
popf
jmp 0x1400c1f24
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rcx, 0x40e45d12f536773a
pushf
not rcx
add rcx, 0x709aab8c
xor rcx, 0x72633393
rol rcx, 7
popf
pushf
not rcx
add rcx, 0x61752949
xor rcx, 0x6ce78752
rol rcx, 0xfa
popf
pushf
not rcx
add rcx, 0x4b1a4734
xor rcx, 0x49d8951c
rol rcx, 0xf5
popf
lea rdx, [rbp - 0x19]
mov qword [rbp + 0x17], rcx
movabs rcx, 0xb09d67c5ab31f14
pushf
not rcx
add rcx, 0x784721ec
xor rcx, 0x72004da6
rol rcx, 0xc4
popf
pushf
not rcx
add rcx, 0x42d1a547
xor rcx, 0x6c7ae1c4
rol rcx, 0x97
popf
pushf
not rcx
add rcx, 0x56a746df
xor rcx, 0x6b3cb528
rol rcx, 0x3c
popf
mov qword [rbp + 0x1f], rcx
movabs rcx, 0x4313c27450c1d5f9
pushf
not rcx
add rcx, 0x452492a9
xor rcx, 0x440be509
rol rcx, 0xb1
popf
pushf
not rcx
add rcx, 0x7bcaa6c7
xor rcx, 0x66dbec8e
rol rcx, 0xea
popf
mov qword [rbp + 0x27], rcx
mov ebx, eax
cmp eax, 0x420
jne 0x1400c32fc
movabs rax, 0x8220689147737d2b
pushf
not rax
add rax, 0x56c68de4
xor rax, 0x448b2fe9
rol rax, 0xe1
popf
pushf
not rax
add rax, 0x46cf7824
xor rax, 0x49f3dbaa
rol rax, 0x1a
popf
pushf
not rax
add rax, 0x71f575b6
xor rax, 0x498d9d50
rol rax, 0xc7
popf
pushf
not rax
add rax, 0x77f5111a
xor rax, 0x462f7428
rol rax, 0
popf
mov qword [rbp - 0x19], rax
movabs rax, 0xa1457b9598546cb8
pushf
not rax
add rax, 0x570ebbbe
xor rax, 0x747c8bdf
rol rax, 0x8c
popf
pushf
not rax
add rax, 0x4336f3b9
xor rax, 0x74c8ac12
rol rax, 0xd0
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xa671ba1dd4a6a622
pushf
not rax
add rax, 0x5a6488f6
xor rax, 0x64a2fe34
rol rax, 0xd7
popf
pushf
not rax
add rax, 0x6907c55c
xor rax, 0x44a169ae
rol rax, 0xef
popf
mov qword [rbp - 9], rax
movabs rax, 0x7bddb65136ab19e2
pushf
not rax
add rax, 0x4d204fa5
xor rax, 0x67a3c509
rol rax, 0x62
popf
pushf
not rax
add rax, 0x7a290eb1
xor rax, 0x5ed1a015
rol rax, 0x7c
popf
pushf
not rax
add rax, 0x45f1b456
xor rax, 0x4f489c25
rol rax, 0xb5
popf
pushf
not rax
add rax, 0x7dc2f59a
xor rax, 0x6c22abf7
rol rax, 0x5c
popf
jmp 0x1400c3801
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0xbf23c0fd7e1ca424
pushf
not rax
add rax, 0x688ca5bd
xor rax, 0x49da65d3
rol rax, 0xdb
popf
pushf
not rax
add rax, 0x6f7da3c9
xor rax, 0x48f7d096
rol rax, 0xea
popf
pushf
not rax
add rax, 0x5d5275c0
xor rax, 0x59c1d5c5
rol rax, 0x7d
popf
pushf
not rax
add rax, 0x42d3fb34
xor rax, 0x7b9c2c56
rol rax, 0x7a
popf
mov qword [rbp - 0x19], rax
movabs rax, 0xd8799dc63ef9bb24
pushf
not rax
add rax, 0x4aaa234c
xor rax, 0x52c4aad2
rol rax, 0x58
popf
pushf
not rax
add rax, 0x4422ea5a
xor rax, 0x6d25fca4
rol rax, 0x48
popf
pushf
not rax
add rax, 0x7aa5593f
xor rax, 0x6316621a
rol rax, 8
popf
pushf
not rax
add rax, 0x5afabdc1
xor rax, 0x6557cacf
rol rax, 0x2a
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xfa1d0de4e3f7e776
pushf
not rax
add rax, 0x68b13906
xor rax, 0x58b88124
rol rax, 0x24
popf
pushf
not rax
add rax, 0x4b9fbd1b
xor rax, 0x69ae1465
rol rax, 0x3e
popf
pushf
not rax
add rax, 0x6bd31775
xor rax, 0x6d75c75e
rol rax, 0x97
popf
pushf
not rax
add rax, 0x67d31b01
xor rax, 0x509dbb11
rol rax, 0x84
popf
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 0x17]
mov qword [rbp - 9], rax
movabs rax, 0x2a357d5db4e52e9
pushf
not rax
add rax, 0x5dc42389
xor rax, 0x615fbc34
rol rax, 0x8d
popf
pushf
not rax
add rax, 0x7913d2a8
xor rax, 0x5c9aac39
rol rax, 0xd2
popf
pushf
not rax
add rax, 0x6a7fb02b
xor rax, 0x72867693
rol rax, 0x89
popf
pushf
not rax
add rax, 0x58e3d28e
xor rax, 0x65ae06ee
rol rax, 0xb9
popf
mov qword [rbp - 1], rax
movabs rax, 0xc4eac7f9b603cfa4
pushf
not rax
add rax, 0x41c36905
xor rax, 0x67075b11
rol rax, 0xf9
popf
pushf
not rax
add rax, 0x59c4849a
xor rax, 0x7de5ea79
rol rax, 0x60
popf
pushf
not rax
add rax, 0x7f35d126
xor rax, 0x6efacd7a
rol rax, 0xeb
popf
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x2f], rax
xorps xmm1, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 9], xmm1
movdqa xmmword [rbp - 0x19], xmm0
call fcn.1400b8f2a
mov edx, ebx
mov rcx, rax
jmp 0x1400c3525
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1b8e40d0e]
pushf
sub rdx, 0x78e38c7e
popf
jmp 0x1400c3541
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
jmp 0x1400c354b
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
jmp 0x1400c3555
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x1400c38b5
movabs rax, 0x807804abddf334f6
pushf
not rax
add rax, 0x4ba5f122
xor rax, 0x5d08bce9
rol rax, 0xba
popf
pushf
not rax
add rax, 0x7ff48a41
xor rax, 0x7be5fa0b
rol rax, 0xd6
popf
pushf
not rax
add rax, 0x7652c2a6
xor rax, 0x5a5a692e
rol rax, 0xa0
popf
pushf
not rax
add rax, 0x41ad35da
xor rax, 0x43454f6e
rol rax, 0x60
popf
mov qword [rbp - 0x19], rax
movabs rax, 0xe4a440f76672d1cb
pushf
not rax
add rax, 0x6c8bf48c
xor rax, 0x403d87a7
rol rax, 0xde
popf
pushf
not rax
add rax, 0x72a3ffec
xor rax, 0x496f3fde
rol rax, 0xff
popf
pushf
not rax
add rax, 0x798f82d4
xor rax, 0x4642cd4c
rol rax, 0xca
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x8912919f03899914
pushf
not rax
add rax, 0x4551c9c3
xor rax, 0x5c853b9f
rol rax, 0x22
popf
pushf
not rax
add rax, 0x5e9c6fa5
xor rax, 0x5fcdf435
rol rax, 0x69
popf
pushf
not rax
add rax, 0x53dd622e
xor rax, 0x78e07624
rol rax, 0xe0
popf
mov qword [rbp - 9], rax
movabs rax, 0x4dba2e116e290eb3
pushf
not rax
add rax, 0x4391836b
xor rax, 0x5a00ec34
rol rax, 0xec
popf
pushf
not rax
add rax, 0x42bbd9b7
xor rax, 0x5b5e5e34
rol rax, 0x85
popf
pushf
not rax
add rax, 0x51ed5a91
xor rax, 0x639ddadc
rol rax, 0x48
popf
pushf
not rax
add rax, 0x4b1e2fa9
xor rax, 0x5f62ddb7
rol rax, 0x44
popf
movabs rcx, 0xa6a91415ba68b682
pushf
not rcx
add rcx, 0x658fac75
xor rcx, 0x6dcb7fb2
rol rcx, 0xba
popf
pushf
not rcx
add rcx, 0x57ec2307
xor rcx, 0x768dd688
rol rcx, 0x57
popf
pushf
not rcx
add rcx, 0x669891e5
xor rcx, 0x4fc4e5ca
rol rcx, 0xc9
popf
lea rdx, [rbp - 0x19]
mov qword [rbp + 0x17], rcx
movabs rcx, 0x2509aa410d46247b
pushf
not rcx
add rcx, 0x6658438c
xor rcx, 0x4ef4fb87
rol rcx, 0x62
popf
pushf
not rcx
add rcx, 0x5e93ba58
xor rcx, 0x69bb9d12
rol rcx, 0x47
popf
mov qword [rbp + 0x1f], rcx
movabs rcx, 0x5d7999755633cd84
pushf
not rcx
add rcx, 0x48008ad3
xor rcx, 0x7c014ca5
rol rcx, 0x47
popf
pushf
not rcx
add rcx, 0x719a8514
xor rcx, 0x5fc2b4cc
rol rcx, 0x3c
popf
pushf
not rcx
add rcx, 0x629125e6
xor rcx, 0x781cab6e
rol rcx, 0x93
popf
mov qword [rbp + 0x27], rcx
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 0x17]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp - 1], rax
movabs rax, 0x442338ac2a7ae0cd
pushf
not rax
add rax, 0x7a3f8709
xor rax, 0x4f2109f9
rol rax, 0xa8
popf
pushf
not rax
add rax, 0x6034c015
xor rax, 0x58d24bd0
rol rax, 0x59
popf
movdqa xmm1, xmmword [rbp - 9]
mov qword [rbp + 0x2f], rax
xorps xmm1, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 9], xmm1
movdqa xmmword [rbp - 0x19], xmm0
call fcn.1400b8f2a
lea rdx, [0x18ec54a89]
pushf
sub rdx, 0x4ec4c9f9
popf
mov rcx, rax
jmp 0x1400c387f
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
jmp 0x1400c3889
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
jmp 0x1400c3893
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 0xff
pushf
not al
add al, 0xc5
xor al, 0x9d
rol al, 0xad
popf
pushf
not al
add al, 0x9c
xor al, 0x10
rol al, 0x71
popf
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400e25f6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret