Function at 0x140051344
Capabilities:
Start service

Disassembly:
push rax
pushf
mov eax, 0x6c66d814
pushf
not eax
add eax, 0x101413aa
xor eax, 0x526aad67
rol eax, 0x28
popf
pushf
not eax
add eax, 0x33ce0b78
xor eax, 0x2188acad
rol eax, 0xec
popf
pushf
not eax
add eax, 0xdcf88c7
xor eax, 0x5e5e22b4
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x69ef57d6
xor eax, 0x3e05bd77
rol eax, 0x58
popf
cmp eax, 7
jne 0x1400513a7
popf
pop rax
jmp 0x140051874
cmp eax, 0xa
jne 0x1400513b6
popf
pop rax
jmp 0x140051a93
cmp eax, 5
jne 0x1400513c5
popf
pop rax
jmp 0x140051764
cmp eax, 3
jne 0x1400513d4
popf
pop rax
jmp 0x14005168e
cmp eax, 0xd
jne 0x1400513e3
popf
pop rax
jmp 0x140051c83
cmp eax, 9
jne 0x1400513f2
popf
pop rax
jmp 0x140051a07
cmp eax, 0xb
jne 0x140051401
popf
pop rax
jmp 0x140051b89
cmp eax, 2
jne 0x140051410
popf
pop rax
jmp 0x140051606
cmp eax, 8
jne 0x14005141f
popf
pop rax
jmp 0x140051963
cmp eax, 1
jne 0x14005142e
popf
pop rax
jmp 0x140051574
cmp eax, 0xc
jne 0x14005143d
popf
pop rax
jmp 0x140051c20
cmp eax, 0
jne 0x14005144c
popf
pop rax
jmp 0x140051479
cmp eax, 4
jne 0x14005145b
popf
pop rax
jmp 0x1400516f9
cmp eax, 0xe
jne 0x14005146a
popf
pop rax
jmp 0x140051cd3
cmp eax, 6
jne 0x140051479
popf
pop rax
jmp 0x1400517ec
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
lea rdx, [0x1b1620e9c]
pushf
sub rdx, 0x715f95f4
popf
xor ebx, ebx
xor ecx, ecx
lea r8d, [rbx + 1]
jmp 0x1400514b0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x14005151b
push rax
pushf
mov eax, 0x149e704f
pushf
not eax
add eax, 0x66818e6f
xor eax, 0x28224fdb
rol eax, 0xd
popf
pushf
not eax
add eax, 0x361e0c16
xor eax, 0x6f8cd3eb
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x6c7690d
xor eax, 0x421f57d1
rol eax, 0xae
popf
pushf
not eax
add eax, 0xd1a9404
xor eax, 0x34d818b7
rol eax, 0xb3
popf
jmp 0x140051398
push rax
pushf
mov eax, 0xb7581039
pushf
not eax
add eax, 0x4fff9b8f
xor eax, 0x4dc5ea2f
rol eax, 0x59
popf
pushf
not eax
add eax, 0x452cc1e2
xor eax, 0x15a792f5
rol eax, 0x78
popf
pushf
not eax
add eax, 0x79e4d673
xor eax, 0x2e04c8b9
rol eax, 0x15
popf
pushf
not eax
add eax, 0x4754d4a0
xor eax, 0x3700a2d0
rol eax, 0xc9
popf
jmp 0x140051398
lea r8d, [rbx + 0x14]
mov rdx, rdi
mov rcx, rax
jmp 0x14005157f
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400515c0
push rax
pushf
mov eax, 0x2c3cbb87
pushf
not eax
add eax, 0x2d3f8b13
xor eax, 0x7002248
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x3588960c
xor eax, 0x1d7cdfff
rol eax, 0xf9
popf
jmp 0x140051398
push rax
pushf
mov eax, 0x9d1ef127
pushf
not eax
add eax, 0x494c182e
xor eax, 0x6f0b9a3c
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x667caca6
xor eax, 0xb917c6d
rol eax, 0x98
popf
pushf
not eax
add eax, 0x7160c3f9
xor eax, 0x2a64fcd5
rol eax, 0x33
popf
jmp 0x140051398
mov rcx, rax
call fcn.14005120d
mov edi, eax
cmp eax, 4
je 0x14005165b
push rax
pushf
mov eax, 0xf6aa0432
pushf
not eax
add eax, 0xf7aa1ab
xor eax, 0x42e46747
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x7ec32636
xor eax, 0x7f05fd2f
rol eax, 0x80
popf
pushf
not eax
add eax, 0x17c25712
xor eax, 0x6b4bd7a2
rol eax, 0xc5
popf
jmp 0x140051398
push rax
pushf
mov eax, 0xb1d8db35
pushf
not eax
add eax, 0x77a9dcf3
xor eax, 0x26adcc69
rol eax, 0x39
popf
pushf
not eax
add eax, 0x3003365d
xor eax, 0x463c3cc3
rol eax, 0x42
popf
jmp 0x140051398
cmp eax, 6
je 0x1400516c6
push rax
pushf
mov eax, 0x4ceb8464
pushf
not eax
add eax, 0x7f0cdf30
xor eax, 0x395b770c
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x3e46ee67
xor eax, 0x5eb18f8
rol eax, 0xb8
popf
jmp 0x140051398
push rax
pushf
mov eax, 0x6f57aa6
pushf
not eax
add eax, 0x1d5c6857
xor eax, 0x510edbe5
rol eax, 0x66
popf
pushf
not eax
add eax, 0x38268d86
xor eax, 0x5418f834
rol eax, 0x47
popf
jmp 0x140051398
cmp eax, 3
jne 0x140051731
push rax
pushf
mov eax, 0x2bca21da
pushf
not eax
add eax, 0x207b22b1
xor eax, 0xb075bf0
rol eax, 0x64
popf
pushf
not eax
add eax, 0x22f27583
xor eax, 0x27a4c313
rol eax, 0x4d
popf
jmp 0x140051398
push rax
pushf
mov eax, 0xb6d8dce1
pushf
not eax
add eax, 0x400c9c4d
xor eax, 0x7ff79467
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x463456e0
xor eax, 0x2c46ce81
rol eax, 0x20
popf
jmp 0x140051398
mov ebp, 0x31e7cf1d
pushf
not ebp
add ebp, 0x19d424d
xor ebp, 0x30cc135d
rol ebp, 0x7c
popf
pushf
not ebp
add ebp, 0x479bfc39
xor ebp, 0x17b06631
rol ebp, 0xae
popf
push rax
pushf
mov eax, 0xbe4b998c
pushf
not eax
add eax, 0x171ba4b1
xor eax, 0x542c8102
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x6c9bc214
xor eax, 0x4b5005f5
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x4e126399
xor eax, 0x16e19f1e
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x70776619
xor eax, 0x76102aa4
rol eax, 0x4c
popf
jmp 0x140051398
mov rcx, rsi
call fcn.14005120d
mov edi, eax
cmp eax, 4
je 0x14005182e
push rax
pushf
mov eax, 0xcb9c8d24
pushf
not eax
add eax, 0x50302f4d
xor eax, 0x5dd46fd2
rol eax, 0xba
popf
pushf
not eax
add eax, 0x5021423f
xor eax, 0x645c2307
rol eax, 0x6b
popf
jmp 0x140051398
push rax
pushf
mov eax, 0x56a478e3
pushf
not eax
add eax, 0x145ff2e6
xor eax, 0x6b24199e
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xd76a931
xor eax, 0x368c72a0
rol eax, 0x35
popf
pushf
not eax
add eax, 0x1aef8625
xor eax, 0x5627004b
rol eax, 0x4b
popf
jmp 0x140051398
mov ecx, 0x1ab69ac6
pushf
not ecx
add ecx, 0x1bd4b04a
xor ecx, 0x75861f0a
rol ecx, 0x27
popf
pushf
not ecx
add ecx, 0x1430a7f
xor ecx, 0x4691e2ac
rol ecx, 0x61
popf
pushf
not ecx
add ecx, 0x132976c6
xor ecx, 0x2bd12854
rol ecx, 0x1e
popf
jmp 0x1400518b9
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 0xffffffff
jne 0x14005190a
push rax
pushf
mov eax, 0xf162af2
pushf
not eax
add eax, 0x3e3cecbd
xor eax, 0x3401b2f9
rol eax, 0xe
popf
pushf
not eax
add eax, 0x63ed98da
xor eax, 0x6b857684
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x6535f00e
xor eax, 0x2a0486e8
rol eax, 0x70
popf
jmp 0x140051398
push rax
pushf
mov eax, 0xe97c6070
pushf
not eax
add eax, 0x66e0b1dd
xor eax, 0x5ef00341
rol eax, 0x19
popf
pushf
not eax
add eax, 0x15102d11
xor eax, 0x460d34ad
rol eax, 0x29
popf
pushf
not eax
add eax, 0x6a9e5f72
xor eax, 0x1e09ca13
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x11b294cd
xor eax, 0x300a056d
rol eax, 0xb7
popf
jmp 0x140051398
cmp edi, 1
jne 0x1400519ae
push rax
pushf
mov eax, 0x6b3afb6
pushf
not eax
add eax, 0x2cd742e8
xor eax, 0x4dcc71bf
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x74771229
xor eax, 0x7ca36c81
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x178d58bb
xor eax, 0x1d5a36ee
rol eax, 0xbe
popf
jmp 0x140051398
push rax
pushf
mov eax, 0xa2f1195d
pushf
not eax
add eax, 0x7138557a
xor eax, 0xd1cdfcb
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x408f4d42
xor eax, 0xce8e10a
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x7ffcf90e
xor eax, 0xf3b220
rol eax, 0xac
popf
pushf
not eax
add eax, 0x59c26468
xor eax, 0x48017022
rol eax, 0x52
popf
jmp 0x140051398
xor r8d, r8d
xor edx, edx
mov rcx, rsi
jmp 0x140051a10
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140051a4d
push rax
pushf
mov eax, 0xb30ba517
pushf
not eax
add eax, 0x617523f8
xor eax, 0xa7800e
rol eax, 0x49
popf
pushf
not eax
add eax, 0x8933cc1
xor eax, 0x3a955f63
rol eax, 0xc5
popf
jmp 0x140051398
push rax
pushf
mov eax, 0xdfb72ff5
pushf
not eax
add eax, 0x5a5caec9
xor eax, 0x5479af0a
rol eax, 0xc7
popf
pushf
not eax
add eax, 0x5f3c0994
xor eax, 0x245376bb
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x433d311c
xor eax, 0x5080d31
rol eax, 0xe9
popf
jmp 0x140051398
mov ecx, 0x9cc0943b
pushf
not ecx
add ecx, 0x41f63cb8
xor ecx, 0x3de441cc
rol ecx, 0x3d
popf
pushf
not ecx
add ecx, 0x5ca26e9a
xor ecx, 0x33ba95f6
rol ecx, 0xbc
popf
pushf
not ecx
add ecx, 0x5d723fa5
xor ecx, 0x5cf14af
rol ecx, 1
popf
jmp 0x140051ad7
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.14005120d
cmp eax, 4
jne 0x140051b43
push rax
pushf
mov eax, 0x924ee371
pushf
not eax
add eax, 0x132f8eee
xor eax, 0x4477c334
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x7c8d01bb
xor eax, 0x76ad4f4b
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x6a7f34df
xor eax, 0x77be5daa
rol eax, 0xae
popf
pushf
not eax
add eax, 0x6f019e08
xor eax, 0x3e7a6b6e
rol eax, 0xa9
popf
jmp 0x140051398
push rax
pushf
mov eax, 0x268e1ae3
pushf
not eax
add eax, 0x4095ddc4
xor eax, 0x7c813c78
rol eax, 0x27
popf
pushf
not eax
add eax, 0x1d375a1a
xor eax, 0x11efc2ac
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x1f4b2602
xor eax, 0x30005daa
rol eax, 0x25
popf
jmp 0x140051398
mov bl, 0x1f
pushf
not bl
add bl, 0x33
xor bl, 0x5e
rol bl, 0xd1
popf
pushf
not bl
add bl, 0x26
xor bl, 0x31
rol bl, 0x8d
popf
pushf
not bl
add bl, 0x15
xor bl, 0x14
rol bl, 0xc1
popf
pushf
not bl
add bl, 0x2a
xor bl, 0x56
rol bl, 0x11
popf
push rax
pushf
mov eax, 0x6a511aca
pushf
not eax
add eax, 0x3e8a692a
xor eax, 0x1af2c2d4
rol eax, 0x18
popf
pushf
not eax
add eax, 0x5a569e31
xor eax, 0x1755f422
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x788be709
xor eax, 0x4402b3
rol eax, 0x20
popf
pushf
not eax
add eax, 0x444b13cc
xor eax, 0x3383c56d
rol eax, 0x4c
popf
jmp 0x140051398
mov rcx, rsi
jmp 0x140051c24
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0xbecd8161
pushf
not eax
add eax, 0x43f9ba1a
xor eax, 0x739e04e8
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x2fb00543
xor eax, 0x4a1342f9
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x52b42723
xor eax, 0x2f6ff10e
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x2d4e0022
xor eax, 0x32541667
rol eax, 0x6f
popf
jmp 0x140051398
mov rcx, r14
jmp 0x140051c87
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push rax
pushf
mov eax, 0x6e1d86cc
pushf
not eax
add eax, 0x321986ca
xor eax, 0x56daedb2
rol eax, 0x4c
popf
pushf
not eax
add eax, 0x1b87ef78
xor eax, 0x22fd5657
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x480ad004
xor eax, 0x2f6e3f5
rol eax, 0x16
popf
jmp 0x140051398
mov rbp, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret