Function at 0x1400213d0
Capabilities:
Encode data using xor
Query service status
Start service
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x120], rbx
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rbp + 8], rax
call fcn.140024880
cmp rax, 0xffffffffffffffff
je 0x140021418
mov rcx, rax
call qword [0x1400472c0]
xor eax, eax
jmp 0x14002172e
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rcx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400214b7
mov dword [rbp - 0x78], 0x46f0
mov eax, dword [rbp - 0x78]
xor eax, 0x2e
mov word [rbp - 0x74], ax
mov eax, dword [rbp - 0x78]
inc ax
xor eax, 0x74
mov word [rbp - 0x72], ax
mov eax, dword [rbp - 0x78]
add ax, 2
xor eax, 0x4a
mov word [rbp - 0x70], ax
mov eax, dword [rbp - 0x78]
add ax, 3
xor eax, 0x6d
mov word [rbp - 0x6e], ax
xor eax, eax
mov word [rbp - 0x6c], ax
movzx eax, word [rbp - 0x74]
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rbp + rdx*2 - 0x74]
mov ecx, dword [rbp - 0x78]
add ecx, edx
xor ecx, eax
mov word [rbp + rdx*2 - 0x74], cx
inc rdx
cmp rdx, 4
jb 0x140021480
mov word [rbp - 0x6c], bx
lea rcx, [rbp - 0x74]
call fcn.14001c7d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
jmp 0x14002172e
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x30], 1
mov rdx, qword [0x140063e00]
add rdx, 0x10
cmp qword [rdx + 0x18], 8
jb 0x1400214ea
mov rdx, qword [rdx]
mov r8d, 0x14
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140021562
mov eax, 0x36
mov word [rbp - 0x58], ax
mov eax, 0x3a
mov word [rbp - 0x56], ax
mov eax, 0x4e
mov word [rbp - 0x54], ax
mov eax, 0x78
mov word [rbp - 0x52], ax
xor ebx, ebx
mov word [rbp - 0x50], bx
movzx eax, word [rbp - 0x58]
nop
movzx ecx, word [rbp + rbx*2 - 0x58]
sub ecx, 8
mov word [rbp + rbx*2 - 0x58], cx
inc rbx
cmp rbx, 4
jb 0x140021530
lea rcx, [rbp - 0x58]
call fcn.14001c7d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
or ebx, 0xe0ff0000
jmp 0x140021722
lea rcx, [rsp + 0x38]
mov qword [rbp - 0x80], rcx
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x31], 1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140021611
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x140021611
mov dword [rbp - 0x28], 0x744e
mov eax, 0x7460
mov word [rbp - 0x24], ax
mov eax, 0x7403
mov word [rbp - 0x22], ax
mov eax, 0x747a
mov word [rbp - 0x20], ax
mov eax, 0x7415
mov word [rbp - 0x1e], ax
xor eax, eax
mov word [rbp - 0x1c], ax
movzx eax, word [rbp - 0x24]
xor ebx, ebx
mov r8d, ebx
nop dword [rax]
movzx edx, word [rbp + r8*2 - 0x24]
mov eax, dword [rbp - 0x28]
movzx ecx, ax
mov eax, edx
xor eax, ecx
mov word [rbp + r8*2 - 0x24], ax
inc r8
cmp r8, 4
jb 0x1400215e0
mov word [rbp - 0x1c], bx
lea rcx, [rbp - 0x24]
call fcn.14001c7d0
jmp 0x14002170a
lea rdx, [rbp - 0x18]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140021663
mov eax, dword [rbp - 0x14]
cmp eax, 4
je 0x140021832
cmp eax, 1
je 0x1400217c4
add eax, 0xfffffffe
cmp eax, 1
ja 0x14002174b
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x18]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140021624
mov dword [rbp - 0x38], 0xd28
mov eax, 0xd06
mov word [rbp - 0x34], ax
mov eax, 0xd40
mov word [rbp - 0x32], ax
mov eax, 0xd6e
mov word [rbp - 0x30], ax
mov eax, 0xd73
mov word [rbp - 0x2e], ax
xor eax, eax
mov word [rbp - 0x2c], ax
movzx eax, word [rbp - 0x34]
xor ebx, ebx
mov r8d, ebx
nop dword [rax]
movzx edx, word [rbp + r8*2 - 0x34]
mov eax, dword [rbp - 0x38]
movzx ecx, ax
mov eax, edx
xor eax, ecx
mov word [rbp + r8*2 - 0x34], ax
inc r8
cmp r8, 4
jb 0x1400216a0
mov word [rbp - 0x2c], bx
mov rcx, qword [0x140063e00]
test rcx, rcx
je 0x14002170a
lea rdx, [rbp - 0x34]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rdx + rax*2], bx
jne 0x1400216e0
lea r8d, [rax*2 + 2]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea rdx, [rbp - 0x34]
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.140021a50
nop
lea rcx, [rsp + 0x68]
call fcn.140021a50
mov eax, ebx
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.14002fb30
mov rbx, qword [rsp + 0x120]
add rsp, 0x110
pop rbp
ret
mov dword [rbp - 0x68], 0xe3e9
mov eax, dword [rbp - 0x68]
xor eax, 0x2e
mov word [rbp - 0x64], ax
mov eax, dword [rbp - 0x68]
inc ax
xor eax, 0x6a
mov word [rbp - 0x62], ax
mov eax, dword [rbp - 0x68]
add ax, 2
xor eax, 0x69
mov word [rbp - 0x60], ax
mov eax, dword [rbp - 0x68]
add ax, 3
xor eax, 0x56
mov word [rbp - 0x5e], ax
xor eax, eax
mov word [rbp - 0x5c], ax
movzx eax, word [rbp - 0x64]
xor ebx, ebx
mov edx, ebx
movzx eax, word [rbp + rdx*2 - 0x64]
mov ecx, dword [rbp - 0x68]
add ecx, edx
xor ecx, eax
mov word [rbp + rdx*2 - 0x64], cx
inc rdx
cmp rdx, 4
jb 0x140021793
mov word [rbp - 0x5c], bx
lea rcx, [rbp - 0x64]
call fcn.14001c7d0
mov ebx, 0xe0010001
jmp 0x140021717
call fcn.140024880
cmp rax, 0xffffffffffffffff
jne 0x140021829
mov eax, 0x35
mov word [rbp - 0x48], ax
mov eax, 0x3d
mov word [rbp - 0x46], ax
mov eax, 0x3a
mov word [rbp - 0x44], ax
mov eax, 0x62
mov word [rbp - 0x42], ax
xor ebx, ebx
mov word [rbp - 0x40], bx
movzx eax, word [rbp - 0x48]
nop dword [rax]
movzx ecx, word [rbp + rbx*2 - 0x48]
sub ecx, 7
mov word [rbp + rbx*2 - 0x48], cx
inc rbx
cmp rbx, 4
jb 0x140021800
lea rcx, [rbp - 0x48]
call fcn.14001c7d0
mov ebx, 0xe0010001
jmp 0x140021717
mov rcx, rax
call qword [0x1400472c0]
xor ebx, ebx
jmp 0x140021717