Function at 0x14010f3a9
Capabilities:
Create service

Disassembly:
push rax
pushf
mov eax, 0x3238df01
pushf
not eax
add eax, 0xed2bf8a4
xor eax, 0xac2737cd
rol eax, 0x54
popf
pushf
not eax
add eax, 0x8337d983
xor eax, 0x9c466c40
rol eax, 0x7e
popf
cmp eax, 4
jne 0x14010f3e6
popf
pop rax
jmp 0x14010fde4
cmp eax, 0
jne 0x14010f3f5
popf
pop rax
jmp 0x14010f422
cmp eax, 3
jne 0x14010f404
popf
pop rax
jmp 0x14010fa69
cmp eax, 1
jne 0x14010f413
popf
pop rax
jmp 0x14010f50b
cmp eax, 2
jne 0x14010f422
popf
pop rax
jmp 0x14010f9c0
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rsi, rdx
mov r14, r8
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
jmp 0x14010f447
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14010f4b2
push rax
pushf
mov eax, 0xbc469177
pushf
not eax
add eax, 0xdd2e4003
xor eax, 0xad52aa8f
rol eax, 0xde
popf
pushf
not eax
add eax, 0xfee51045
xor eax, 0xf1e35f2d
rol eax, 2
popf
pushf
not eax
add eax, 0x84a8c396
xor eax, 0xe04dc0f1
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xc256b4f8
xor eax, 0xae931343
rol eax, 0xc8
popf
jmp 0x14010f3d7
push rax
pushf
mov eax, 0xa8645b32
pushf
not eax
add eax, 0x8c9b87e6
xor eax, 0xe2b32a9b
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xa7d9caaa
xor eax, 0xc285adb6
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xa79fed98
xor eax, 0x896be981
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xc5f3543a
xor eax, 0xc1fdbf43
rol eax, 0x1b
popf
jmp 0x14010f3d7
movabs rcx, 0x55673e7f61cb3c5c
pushf
not rcx
add rcx, 0x5d7e78fc
xor rcx, 0x55998d10
rol rcx, 0x3f
popf
pushf
not rcx
add rcx, 0x71f1dcd5
xor rcx, 0x6e992b3c
rol rcx, 0x32
popf
pushf
not rcx
add rcx, 0x4539f654
xor rcx, 0x57cb09e9
rol rcx, 0
popf
lea rdx, [rbp + 7]
mov qword [rbp + 0x2f], rcx
movabs rax, 0xba0af0eb5bc94fe3
pushf
not rax
add rax, 0x5342d28c
xor rax, 0x42b63906
rol rax, 0x24
popf
pushf
not rax
add rax, 0x4955d965
xor rax, 0x445349cb
rol rax, 0xff
popf
mov qword [rbp + 7], rax
movabs rax, 0x6d915284547eef3d
pushf
not rax
add rax, 0x6cf9b96e
xor rax, 0x49d498e9
rol rax, 0x91
popf
pushf
not rax
add rax, 0x4be9ea7b
xor rax, 0x4636a8e6
rol rax, 0x78
popf
pushf
not rax
add rax, 0x5b00d4a3
xor rax, 0x7560c6c8
rol rax, 0x7e
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x1ade377db2d94e11
pushf
not rax
add rax, 0x6a6549f5
xor rax, 0x47fec5a1
rol rax, 0xa8
popf
pushf
not rax
add rax, 0x55237522
xor rax, 0x6edad32a
rol rax, 0x14
popf
pushf
not rax
add rax, 0x7e6f62f0
xor rax, 0x58af8f03
rol rax, 0xae
popf
pushf
not rax
add rax, 0x487ae49e
xor rax, 0x6404cba7
rol rax, 0xf3
popf
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x9b8e095d2aa60c23
pushf
not rax
add rax, 0x426eda15
xor rax, 0x7253d06b
rol rax, 4
popf
pushf
not rax
add rax, 0x61cf8b4c
xor rax, 0x7fb55c06
rol rax, 0xe7
popf
pushf
not rax
add rax, 0x7f289b49
xor rax, 0x4f293791
rol rax, 7
popf
mov qword [rbp + 0x1f], rax
movabs rax, 0xed170ec2cf7185c1
pushf
not rax
add rax, 0x6f2ae9c5
xor rax, 0x63bb1ee1
rol rax, 0x9a
popf
pushf
not rax
add rax, 0x795e157a
xor rax, 0x4c20083c
rol rax, 0xc1
popf
movdqa xmm1, xmmword [rbp + 0x17]
mov qword [rbp + 0x27], rax
movabs rax, 0xf6b44b17e4ddbe60
pushf
not rax
add rax, 0x540f74bb
xor rax, 0x5b14dd8a
rol rax, 0x57
popf
pushf
not rax
add rax, 0x7401ff55
xor rax, 0x4d462ae7
rol rax, 0x5b
popf
pushf
not rax
add rax, 0x57e45211
xor rax, 0x6b1f2a31
rol rax, 0x74
popf
pushf
not rax
add rax, 0x630ff484
xor rax, 0x579b6732
rol rax, 0x9f
popf
mov qword [rbp - 0x29], rax
movabs rax, 0x2c125afd7bce0d74
pushf
not rax
add rax, 0x65eb5173
xor rax, 0x5742a7e6
rol rax, 0xde
popf
pushf
not rax
add rax, 0x7f250320
xor rax, 0x453fa5f0
rol rax, 0xf4
popf
pushf
not rax
add rax, 0x7369c799
xor rax, 0x6e5f313e
rol rax, 0x19
popf
pushf
not rax
add rax, 0x5d34a365
xor rax, 0x706ac0f9
rol rax, 0xd8
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xf2687dcfb33fa5c0
pushf
not rax
add rax, 0x409aae41
xor rax, 0x421d9c46
rol rax, 0xfa
popf
pushf
not rax
add rax, 0x6120a66f
xor rax, 0x4e904797
rol rax, 0x57
popf
pushf
not rax
add rax, 0x59c246cb
xor rax, 0x607c8b1c
rol rax, 0x9b
popf
pushf
not rax
add rax, 0x700f997f
xor rax, 0x45a255c8
rol rax, 0xd2
popf
xorps xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x1b7e1fb100cb5e0b
pushf
not rax
add rax, 0x5470d96f
xor rax, 0x4f82f643
rol rax, 0xd7
popf
pushf
not rax
add rax, 0x705b8603
xor rax, 0x7fb97856
rol rax, 0xa0
popf
pushf
not rax
add rax, 0x417a25fb
xor rax, 0x4d81f271
rol rax, 0x48
popf
pushf
not rax
add rax, 0x553e8800
xor rax, 0x745513ba
rol rax, 0x51
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x37398a3390b83a7a
pushf
not rax
add rax, 0x63fc24ad
xor rax, 0x6ecbe876
rol rax, 0xcc
popf
pushf
not rax
add rax, 0x7043740a
xor rax, 0x5ecfc7c3
rol rax, 0xb6
popf
pushf
not rax
add rax, 0x561e48b7
xor rax, 0x4e6b70bf
rol rax, 0x5c
popf
xorps xmm1, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [rbp + 0x27]
mov qword [rbp - 1], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp - 9], rax
xorps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x17], xmm1
call fcn.1400b8f2a
mov rbx, rax
jmp 0x14010f929
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010f935
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x18b658e6b]
pushf
sub rdx, 0x4b650ddb
popf
jmp 0x14010f951
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
mov r9d, 0x9ab55f3
pushf
not r9d
add r9d, 0x9123426a
xor r9d, 0xd07c49da
rol r9d, 0x80
popf
pushf
not r9d
add r9d, 0xde9861e5
xor r9d, 0xa56e39b2
rol r9d, 0xab
popf
pushf
not r9d
add r9d, 0xbe4e5564
xor r9d, 0xd5e2078c
rol r9d, 0x4a
popf
mov qword [rsp + 0x60], rax
mov r8, rsi
mov qword [rsp + 0x58], rax
mov rdx, rbx
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
jmp 0x14010fa53
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rdx, [rbp - 0x29]
mov rbx, rax
test rax, rax
jne 0x14010fde4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0xe2b053dd06822d5b
pushf
not rax
add rax, 0x411bd0d7
xor rax, 0x7fd0457d
rol rax, 0xcb
popf
pushf
not rax
add rax, 0x51095301
xor rax, 0x7c0ccc7e
rol rax, 0x95
popf
pushf
not rax
add rax, 0x6de8da92
xor rax, 0x51b26eb7
rol rax, 0x15
popf
pushf
not rax
add rax, 0x516069de
xor rax, 0x5552d87b
rol rax, 0x97
popf
mov qword [rbp - 0x29], rax
movabs rax, 0x3ea442107122521e
pushf
not rax
add rax, 0x52511efe
xor rax, 0x4d4befee
rol rax, 0x72
popf
pushf
not rax
add rax, 0x45339ed3
xor rax, 0x4bfa174b
rol rax, 0x64
popf
pushf
not rax
add rax, 0x455f30a7
xor rax, 0x6b52298b
rol rax, 0xde
popf
pushf
not rax
add rax, 0x70c5cfb3
xor rax, 0x4503e623
rol rax, 0x79
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xe71f1a00d76cccd3
pushf
not rax
add rax, 0x5264852e
xor rax, 0x60f0362c
rol rax, 0x80
popf
pushf
not rax
add rax, 0x7f715125
xor rax, 0x778835e4
rol rax, 6
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0xaccddf415debff18
pushf
not rax
add rax, 0x720db289
xor rax, 0x4ffc8fcf
rol rax, 0x91
popf
pushf
not rax
add rax, 0x68f1f578
xor rax, 0x7d53230e
rol rax, 0x9e
popf
pushf
not rax
add rax, 0x560e8b46
xor rax, 0x65263d3c
rol rax, 0x3c
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xbcdfa3745f0ee2dd
pushf
not rax
add rax, 0x4b0d6b26
xor rax, 0x49a0506b
rol rax, 0xd1
popf
pushf
not rax
add rax, 0x71a120d1
xor rax, 0x70f5bf32
rol rax, 0x70
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0x8f10d0067ff0c36d
pushf
not rax
add rax, 0x68f2ffdc
xor rax, 0x42b80a54
rol rax, 0xae
popf
pushf
not rax
add rax, 0x660b5171
xor rax, 0x6b3a2d71
rol rax, 0xea
popf
pushf
not rax
add rax, 0x745e05e6
xor rax, 0x7e8372de
rol rax, 0x10
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x8d3c0b2f587d4610
pushf
not rax
add rax, 0x7413adfd
xor rax, 0x4962ffba
rol rax, 0x54
popf
pushf
not rax
add rax, 0x56a34558
xor rax, 0x4109b9eb
rol rax, 1
popf
pushf
not rax
add rax, 0x6eba5259
xor rax, 0x62ee9a68
rol rax, 0x44
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x6c7aeda6310b5d8f
pushf
not rax
add rax, 0x6e266d2f
xor rax, 0x782216e1
rol rax, 0x25
popf
pushf
not rax
add rax, 0x7e22c54c
xor rax, 0x49592dc7
rol rax, 0xe1
popf
pushf
not rax
add rax, 0x4a768b31
xor rax, 0x4b47b551
rol rax, 0xad
popf
pushf
not rax
add rax, 0x6441f4b4
xor rax, 0x55fb0b32
rol rax, 0x93
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8f2a
mov rbx, rax
jmp 0x14010fd43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010fd4f
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1b7d57bc3]
pushf
sub rdx, 0x77d4fb33
popf
jmp 0x14010fd6b
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
jmp 0x14010fd75
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xa6986a830df4f79
pushf
not rax
add rax, 0x77150513
xor rax, 0x59daa35f
rol rax, 7
popf
pushf
not rax
add rax, 0x5d337663
xor rax, 0x72b484ef
rol rax, 0x1e
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xa07ed2b62b27e356
pushf
not rax
add rax, 0x4ccb3505
xor rax, 0x46cdcbe0
rol rax, 0xf
popf
pushf
not rax
add rax, 0x5b6309e7
xor rax, 0x44ef3da0
rol rax, 0x96
popf
mov qword [rbp - 0x21], rax
movabs rax, 0x1b610b610efbbf29
pushf
not rax
add rax, 0x69f014df
xor rax, 0x714e07c8
rol rax, 0xdf
popf
pushf
not rax
add rax, 0x669e8459
xor rax, 0x6b3dbc8a
rol rax, 0x14
popf
pushf
not rax
add rax, 0x41a90d3b
xor rax, 0x6ba6407d
rol rax, 0xda
popf
pushf
not rax
add rax, 0x6b9a6c44
xor rax, 0x5ee361a9
rol rax, 0xb7
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0xa1d50ccb4159325f
pushf
not rax
add rax, 0x467b0607
xor rax, 0x60455e44
rol rax, 0x61
popf
pushf
not rax
add rax, 0x48effa84
xor rax, 0x5a5d1afb
rol rax, 0x97
popf
pushf
not rax
add rax, 0x78426271
xor rax, 0x733a8899
rol rax, 0x66
popf
pushf
not rax
add rax, 0x7b642493
xor rax, 0x72e6b905
rol rax, 0x21
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xf3695b8543c7460
pushf
not rax
add rax, 0x6a6e22cc
xor rax, 0x5a2a1660
rol rax, 0xb6
popf
pushf
not rax
add rax, 0x48a326f4
xor rax, 0x6d015340
rol rax, 0xd2
popf
pushf
not rax
add rax, 0x41a18ab8
xor rax, 0x5a593ac3
rol rax, 0x82
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0xd941f3275ba24c91
pushf
not rax
add rax, 0x4ad85063
xor rax, 0x73a07778
rol rax, 0x1a
popf
pushf
not rax
add rax, 0x655d00b9
xor rax, 0x5724ec1d
rol rax, 0x1e
popf
pushf
not rax
add rax, 0x6a6a649b
xor rax, 0x4ab6e4eb
rol rax, 0xcb
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x558ae5ae617ecd33
pushf
not rax
add rax, 0x59d1183d
xor rax, 0x724bd121
rol rax, 0xe0
popf
pushf
not rax
add rax, 0x75a6d11f
xor rax, 0x54dfaf23
rol rax, 0xbc
popf
pushf
not rax
add rax, 0x6081da7d
xor rax, 0x436bca14
rol rax, 0xd8
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x830af73db715a06a
pushf
not rax
add rax, 0x574b5bda
xor rax, 0x6e27efe4
rol rax, 0x89
popf
pushf
not rax
add rax, 0x6cbebeec
xor rax, 0x44ca8a8c
rol rax, 0x28
popf
pushf
not rax
add rax, 0x417b03e9
xor rax, 0x75dd66e2
rol rax, 0xde
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8f2a
lea rdx, [0x1b37c392f]
pushf
sub rdx, 0x737bb89f
popf
mov rcx, rax
jmp 0x1401100ba
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
jmp 0x1401100c4
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
jmp 0x1401100ce
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, reloc.WLDAP32.dll_Ordinal_50
pushf
not al
add al, 0xe2
xor al, 0xc9
rol al, 0xac
popf
pushf
not al
add al, 0x69
xor al, 0x28
rol al, 0x40
popf
pushf
not al
add al, 0xaa
xor al, 0x44
rol al, 0xf5
popf
pushf
not al
add al, 0xe5
xor al, 0xfd
rol al, 0x69
popf
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret