Function at 0x14010f290
Capabilities:
Create service

Disassembly:
push rax
pushf
mov eax, 0x58000f17
pushf
not eax
add eax, 0xac590c35
xor eax, 0xf72c7925
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xfe50f673
xor eax, 0xb7607ac6
rol eax, 0x64
popf
pushf
not eax
add eax, 0xb7b5554d
xor eax, 0xcf936277
rol eax, 0xa6
popf
cmp eax, 4
jne 0x14010f2e0
popf
pop rax
jmp 0x14010fc86
cmp eax, 0
jne 0x14010f2ef
popf
pop rax
jmp 0x14010f31c
cmp eax, 3
jne 0x14010f2fe
popf
pop rax
jmp 0x14010f8dc
cmp eax, 1
jne 0x14010f30d
popf
pop rax
jmp 0x14010f405
cmp eax, 2
jne 0x14010f31c
popf
pop rax
jmp 0x14010f84c
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rsi, rdx
mov r14, r8
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
jmp 0x14010f341
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14010f3ac
push rax
pushf
mov eax, 0x4bb95560
pushf
not eax
add eax, 0x98552396
xor eax, 0xa3d85bef
rol eax, 0x57
popf
pushf
not eax
add eax, 0x97416c56
xor eax, 0x9117142f
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xd4bf48cc
xor eax, 0xfa370ce3
rol eax, 0x36
popf
pushf
not eax
add eax, 0xcefc8230
xor eax, 0xa52bcd01
rol eax, 0xfc
popf
jmp 0x14010f2d1
push rax
pushf
mov eax, 0xf8e88f35
pushf
not eax
add eax, 0x8882070d
xor eax, 0x866eaa45
rol eax, 0x98
popf
pushf
not eax
add eax, 0xf4337f2e
xor eax, 0xdb0b2f27
rol eax, 0x19
popf
pushf
not eax
add eax, 0xce7bf5a2
xor eax, 0xc3ff9aee
rol eax, 0xf
popf
pushf
not eax
add eax, 0xc3273043
xor eax, 0xadc7a1c5
rol eax, 0xc0
popf
jmp 0x14010f2d1
movabs rcx, 0x583b4a7571af8b53
pushf
not rcx
add rcx, 0x7e0a390f
xor rcx, 0x5ff1c522
rol rcx, 0xb8
popf
pushf
not rcx
add rcx, 0x464709fe
xor rcx, 0x4930b771
rol rcx, 0x8e
popf
lea rdx, [rbp + 7]
mov qword [rbp + 0x2f], rcx
movabs rax, 0x5e0a7184d89d1f3c
pushf
not rax
add rax, 0x580ed25b
xor rax, 0x71340653
rol rax, 0
popf
pushf
not rax
add rax, 0x5d428ce4
xor rax, 0x68e22580
rol rax, 0xa6
popf
pushf
not rax
add rax, 0x4ec9d38c
xor rax, 0x68ac2b81
rol rax, 0x79
popf
mov qword [rbp + 7], rax
movabs rax, 0xc202692f81df8d06
pushf
not rax
add rax, 0x4cb30a6b
xor rax, 0x76889848
rol rax, 0x39
popf
pushf
not rax
add rax, 0x5cfdd75b
xor rax, 0x7f3f5f8b
rol rax, 0x9c
popf
mov qword [rbp + 0xf], rax
movabs rax, 0xa18911de48f1afc1
pushf
not rax
add rax, 0x68bf5c95
xor rax, 0x66c4f02c
rol rax, 0x8f
popf
pushf
not rax
add rax, 0x5c752b6d
xor rax, 0x67b1926c
rol rax, 0x50
popf
pushf
not rax
add rax, 0x6be30446
xor rax, 0x5c04d54d
rol rax, 0x4f
popf
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0xd2fa7047aa925a9f
pushf
not rax
add rax, 0x69449def
xor rax, 0x5b8255a2
rol rax, 0x55
popf
pushf
not rax
add rax, 0x549bda8c
xor rax, 0x67334554
rol rax, 0x29
popf
mov qword [rbp + 0x1f], rax
movabs rax, 0x13621bf6187538b6
pushf
not rax
add rax, 0x4fe9dc53
xor rax, 0x5a5caedf
rol rax, 0xa2
popf
pushf
not rax
add rax, 0x5a3004ae
xor rax, 0x6e9e3ae6
rol rax, 0xeb
popf
pushf
not rax
add rax, 0x79fdc05b
xor rax, 0x78268fc8
rol rax, 0x4c
popf
movdqa xmm1, xmmword [rbp + 0x17]
mov qword [rbp + 0x27], rax
movabs rax, 0xc818fd9882b7fa71
pushf
not rax
add rax, 0x6a84fc33
xor rax, 0x55fb6f7f
rol rax, 0x80
popf
pushf
not rax
add rax, 0x702df37c
xor rax, 0x616643f1
rol rax, 0x38
popf
pushf
not rax
add rax, 0x6ef04e41
xor rax, 0x558e1bb9
rol rax, 0x49
popf
pushf
not rax
add rax, 0x69d32e67
xor rax, 0x46f2e5de
rol rax, 0x59
popf
mov qword [rbp - 0x29], rax
movabs rax, 0x99aa982c674cb3f8
pushf
not rax
add rax, 0x65923c03
xor rax, 0x4e1baacc
rol rax, 0x49
popf
pushf
not rax
add rax, 0x42c897e7
xor rax, 0x5a7f5ac7
rol rax, 0xc2
popf
pushf
not rax
add rax, 0x5104fdf9
xor rax, 0x49261d54
rol rax, 0x52
popf
pushf
not rax
add rax, 0x7ef27961
xor rax, 0x5cbb91e6
rol rax, 0xc6
popf
mov qword [rbp - 0x21], rax
movabs rax, 0x73f013bed6cd2e52
pushf
not rax
add rax, 0x6ca7a59b
xor rax, 0x5b8051d3
rol rax, 0x2b
popf
pushf
not rax
add rax, 0x53fcb94b
xor rax, 0x4a4c0aad
rol rax, 0x9d
popf
pushf
not rax
add rax, 0x4cede81b
xor rax, 0x55cdd145
rol rax, 0xf0
popf
pushf
not rax
add rax, 0x43a55403
xor rax, 0x7689aec6
rol rax, 0x2d
popf
xorps xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x4047f8300ed0fefd
pushf
not rax
add rax, 0x439c06f9
xor rax, 0x4cca466a
rol rax, 0xb5
popf
pushf
not rax
add rax, 0x47497629
xor rax, 0x61c623d7
rol rax, 1
popf
pushf
not rax
add rax, 0x6d5964ab
xor rax, 0x7b98ac41
rol rax, 0x59
popf
pushf
not rax
add rax, 0x738b7e3b
xor rax, 0x663017c6
rol rax, 0x3b
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xdc5ba2bae4bbcf2e
pushf
not rax
add rax, 0x5bf55ff6
xor rax, 0x50bf8a4b
rol rax, 0xe5
popf
pushf
not rax
add rax, 0x6431ef54
xor rax, 0x57aed1f4
rol rax, 0x9a
popf
xorps xmm1, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [rbp + 0x27]
mov qword [rbp - 1], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp - 9], rax
xorps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x17], xmm1
call fcn.1400b8cc6
mov rbx, rax
jmp 0x14010f7db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010f7e7
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x19c538876]
pushf
sub rdx, 0x5c530856
popf
jmp 0x14010f803
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
mov r9d, 0xc3c59df9
pushf
not r9d
add r9d, 0xb4edc885
xor r9d, 0xadf1ff5e
rol r9d, 0x57
popf
pushf
not r9d
add r9d, 0xb0e43702
xor r9d, 0xb9f5c9d7
rol r9d, 0x6a
popf
mov qword [rsp + 0x60], rax
mov r8, rsi
mov qword [rsp + 0x58], rax
mov rdx, rbx
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
jmp 0x14010f8c6
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rdx, [rbp - 0x29]
mov rbx, rax
test rax, rax
jne 0x14010fc86
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0xbb61bc25e0c0ec97
pushf
not rax
add rax, 0x78ae127b
xor rax, 0x644bc5c8
rol rax, 0x42
popf
pushf
not rax
add rax, 0x6f4dc9ea
xor rax, 0x487da5fb
rol rax, 0x47
popf
pushf
not rax
add rax, 0x55413f7f
xor rax, 0x7081652e
rol rax, 0x32
popf
pushf
not rax
add rax, 0x4f4fe9ba
xor rax, 0x74c8d019
rol rax, 0x4f
popf
mov qword [rbp - 0x29], rax
movabs rax, 0x5e2efecb3ad99022
pushf
not rax
add rax, 0x5eb742dd
xor rax, 0x6c339ab1
rol rax, 0xff
popf
pushf
not rax
add rax, 0x4b098f8c
xor rax, 0x6f1c0612
rol rax, 6
popf
pushf
not rax
add rax, 0x73227ff4
xor rax, 0x60569a34
rol rax, 0x59
popf
mov qword [rbp - 0x21], rax
movabs rax, 0x30e79ccdba364c4f
pushf
not rax
add rax, 0x7d969c93
xor rax, 0x6ab08a54
rol rax, 0x93
popf
pushf
not rax
add rax, 0x650745d6
xor rax, 0x7d85af75
rol rax, 0x55
popf
pushf
not rax
add rax, 0x560f3eba
xor rax, 0x610d1e32
rol rax, 0x89
popf
pushf
not rax
add rax, 0x7a0d7026
xor rax, 0x4352d076
rol rax, 0x76
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0xab8938a13a25cf36
pushf
not rax
add rax, 0x55708666
xor rax, 0x7f66de12
rol rax, 0x48
popf
pushf
not rax
add rax, 0x6b50feff
xor rax, 0x6ce8f9e1
rol rax, 0x70
popf
pushf
not rax
add rax, 0x40971347
xor rax, 0x468abf83
rol rax, 0x18
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x4ffd555a24ce75eb
pushf
not rax
add rax, 0x61fc2765
xor rax, 0x6fff26a8
rol rax, 0x28
popf
pushf
not rax
add rax, 0x5bf395b3
xor rax, 0x4475dd18
rol rax, 0x93
popf
pushf
not rax
add rax, 0x60425ec0
xor rax, 0x7b67f1fd
rol rax, 0x61
popf
pushf
not rax
add rax, 0x4c2d3ed7
xor rax, 0x595e5a77
rol rax, 0x19
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0x4a1acf7d1877596
pushf
not rax
add rax, 0x5391e22f
xor rax, 0x64d7baea
rol rax, 6
popf
pushf
not rax
add rax, 0x71f5ac38
xor rax, 0x5e097478
rol rax, 0xf2
popf
pushf
not rax
add rax, 0x45c59771
xor rax, 0x68fabe4a
rol rax, 0x45
popf
mov qword [rbp + 0xf], rax
movabs rax, 0xf72543fbe0fab1cf
pushf
not rax
add rax, 0x6c72502b
xor rax, 0x437fb72a
rol rax, 0x25
popf
pushf
not rax
add rax, 0x73a1e364
xor rax, 0x65fc7166
rol rax, 0x39
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x2445d519d8eda5f8
pushf
not rax
add rax, 0x4f5434b0
xor rax, 0x7dbe5c06
rol rax, 0x1f
popf
pushf
not rax
add rax, 0x70c5c23f
xor rax, 0x6e50922b
rol rax, 0x95
popf
pushf
not rax
add rax, 0x5669e28e
xor rax, 0x6ef4b7b2
rol rax, 0x89
popf
pushf
not rax
add rax, 0x529990ee
xor rax, 0x4e98b70f
rol rax, 0xfb
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8cc6
mov rbx, rax
jmp 0x14010fbe5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010fbf1
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1bd96b62f]
pushf
sub rdx, 0x7d96360f
popf
jmp 0x14010fc0d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
jmp 0x14010fc17
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x32d480a253e55078
pushf
not rax
add rax, 0x443cd701
xor rax, 0x5f997ae5
rol rax, 0x3e
popf
pushf
not rax
add rax, 0x595c6fd9
xor rax, 0x61337c43
rol rax, 2
popf
pushf
not rax
add rax, 0x565c8c78
xor rax, 0x77a7e5fc
rol rax, 0xb7
popf
pushf
not rax
add rax, 0x410e04b3
xor rax, 0x453e09e4
rol rax, 0xeb
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xe42482bea7189cc0
pushf
not rax
add rax, 0x5bb5518c
xor rax, 0x4716120c
rol rax, 0x41
popf
pushf
not rax
add rax, 0x4ab7aea7
xor rax, 0x5d1e23b5
rol rax, 0x96
popf
mov qword [rbp - 0x21], rax
movabs rax, 0x1814cba9a919dab6
pushf
not rax
add rax, 0x4866d804
xor rax, 0x67d2fec6
rol rax, 0x2a
popf
pushf
not rax
add rax, 0x5ac028fc
xor rax, 0x5547520b
rol rax, 0xbd
popf
pushf
not rax
add rax, 0x6ea7a95e
xor rax, 0x6a0da0e1
rol rax, 0xf8
popf
pushf
not rax
add rax, 0x6a2a68be
xor rax, 0x6d1fbc88
rol rax, 0x8e
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0xa8a8d6dc832cebb7
pushf
not rax
add rax, 0x5da150e7
xor rax, 0x4a24a8b4
rol rax, 0xa3
popf
pushf
not rax
add rax, 0x6fb9847f
xor rax, 0x5d675e56
rol rax, 0x77
popf
pushf
not rax
add rax, 0x689e9cfc
xor rax, 0x7a4a8e56
rol rax, 0x36
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x380be5b0dca9cfdd
pushf
not rax
add rax, 0x54d21744
xor rax, 0x7096e226
rol rax, 0xe7
popf
pushf
not rax
add rax, 0x5e87a9a9
xor rax, 0x6e77ad26
rol rax, 0x95
popf
pushf
not rax
add rax, 0x58878a96
xor rax, 0x6461434e
rol rax, 0x53
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0x190ccde29295178
pushf
not rax
add rax, 0x40a8a457
xor rax, 0x66c66348
rol rax, 0xfa
popf
pushf
not rax
add rax, 0x59fc5dfc
xor rax, 0x6029d187
rol rax, 0x8a
popf
pushf
not rax
add rax, 0x5cb81291
xor rax, 0x511466f5
rol rax, 0x53
popf
pushf
not rax
add rax, 0x586db86e
xor rax, 0x5c18cc75
rol rax, 0x54
popf
mov qword [rbp + 0xf], rax
movabs rax, 0xcf66038964e3fd45
pushf
not rax
add rax, 0x6ebda027
xor rax, 0x72ab319a
rol rax, 0x4d
popf
pushf
not rax
add rax, 0x596a1790
xor rax, 0x7dee67f9
rol rax, 0x93
popf
pushf
not rax
add rax, 0x6d7d4df4
xor rax, 0x44bae9d5
rol rax, 0x18
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0xd9aa8dc7419dcbf7
pushf
not rax
add rax, 0x70d6507a
xor rax, 0x7866eff7
rol rax, 0xaf
popf
pushf
not rax
add rax, 0x76d9a883
xor rax, 0x4341a6b0
rol rax, 0x70
popf
pushf
not rax
add rax, 0x5d6c66e0
xor rax, 0x665d7422
rol rax, 0xb6
popf
pushf
not rax
add rax, 0x633579cd
xor rax, 0x7d173c26
rol rax, 0x2b
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8cc6
lea rdx, [0x1a2474ef5]
pushf
sub rdx, 0x6246ced5
popf
mov rcx, rax
jmp 0x14010ffa1
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
jmp 0x14010ffab
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
jmp 0x14010ffb5
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, reloc.WLDAP32.dll_Ordinal_30
pushf
not al
add al, 0xcc
xor al, 0x31
rol al, 0xa8
popf
pushf
not al
add al, 0x39
xor al, 0x8c
rol al, 0x7c
popf
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret