Function at 0x14001cce0
Capabilities:
Create service
Encode data using xor
Modify service
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x14005f020]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, rdx
mov r15, rcx
call fcn.14001c830
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14001ce6d
mov r8d, 0x10
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14001ce03
mov r8, r14
mov rdx, r15
mov rcx, rax
call fcn.14001cc60
test eax, eax
je 0x14001cd77
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14001d207
mov dword [rbp - 1], 0xf013
mov eax, 0xf03d
mov word [rbp + 3], ax
mov eax, 0xf070
mov word [rbp + 5], ax
mov eax, 0xf021
mov word [rbp + 7], ax
mov eax, 0xf076
mov word [rbp + 9], ax
xor eax, eax
xor ebx, ebx
mov word [rbp + 0xb], ax
movzx eax, word [rbp + 3]
mov r8d, ebx
nop dword [rax]
nop word [rax + rax]
movzx edx, word [rbp + r8*2 + 3]
mov eax, dword [rbp - 1]
movzx ecx, ax
mov eax, edx
xor eax, ecx
mov word [rbp + r8*2 + 3], ax
inc r8
cmp r8, 4
jb 0x14001cdc0
lea rcx, [rbp + 3]
mov word [rbp + 0xb], bx
call fcn.14001c7d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001cefa
mov eax, 0x3a
xor ebx, ebx
mov word [rbp - 0x31], ax
mov edx, ebx
mov eax, 0x57
mov word [rbp - 0x2f], ax
mov eax, 0x86
mov word [rbp - 0x2d], ax
mov eax, 0x79
mov word [rbp - 0x2b], ax
mov word [rbp - 0x29], bx
movzx eax, word [rbp - 0x31]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rbp + rdx*2 - 0x31]
sub ecx, 0xc
mov word [rbp + rdx*2 - 0x31], cx
inc rdx
cmp rdx, 4
jb 0x14001ce40
lea rcx, [rbp - 0x31]
call fcn.14001c7d0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001cefa
mov eax, 0x33
xor ebx, ebx
mov word [rbp - 0x51], ax
mov edx, ebx
mov eax, 0x48
mov word [rbp - 0x4f], ax
mov word [rbp - 0x4d], ax
mov eax, 0x56
mov word [rbp - 0x4b], ax
mov word [rbp - 0x49], bx
movzx eax, word [rbp - 0x51]
nop dword [rax + rax]
movzx ecx, word [rbp + rdx*2 - 0x51]
sub ecx, 5
mov word [rbp + rdx*2 - 0x51], cx
inc rdx
cmp rdx, 4
jb 0x14001cea0
mov rcx, qword [0x140063e00]
test rcx, rcx
je 0x14001cefa
lea rdx, [rbp - 0x51]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rdx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x14001ced0
mov rcx, qword [rcx + 0x70]
lea r8d, [rax*2 + 2]
lea r9, [rbp - 0x59]
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x14001d205
mov qword [rsp + 0x60], rbx
mov r9d, 0xf01ff
mov qword [rsp + 0x58], rbx
mov r8, r14
mov qword [rsp + 0x50], rbx
mov rdx, r14
mov qword [rsp + 0x48], rbx
mov rcx, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rdi, rax
test rax, rax
je 0x14001cfd9
mov r8, r14
mov rdx, r15
mov rcx, rax
call fcn.14001cc60
test eax, eax
jne 0x14001cd5b
mov eax, 0x2f
mov rdx, rbx
mov word [rbp - 0x21], ax
mov eax, 0x4e
mov word [rbp - 0x1f], ax
mov eax, 0x65
mov word [rbp - 0x1d], ax
mov eax, 0x5a
mov word [rbp - 0x1b], ax
mov word [rbp - 0x19], bx
movzx eax, word [rbp - 0x21]
nop
movzx ecx, word [rbp + rdx*2 - 0x21]
dec ecx
mov word [rbp + rdx*2 - 0x21], cx
inc rdx
cmp rdx, 4
jb 0x14001cfb0
lea rcx, [rbp - 0x21]
call fcn.14001c7d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001d02f
mov eax, 0x34
mov rdx, rbx
mov word [rbp - 0x11], ax
mov eax, 0x39
mov word [rbp - 0xf], ax
mov eax, 0x3e
mov word [rbp - 0xd], ax
mov eax, 0x60
mov word [rbp - 0xb], ax
mov word [rbp - 9], bx
movzx eax, word [rbp - 0x11]
nop dword [rax + rax]
movzx ecx, word [rbp + rdx*2 - 0x11]
sub ecx, 6
mov word [rbp + rdx*2 - 0x11], cx
inc rdx
cmp rdx, 4
jb 0x14001d010
lea rcx, [rbp - 0x11]
call fcn.14001c7d0
mov r8d, 0xf01ff
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14001d192
mov qword [rsp + 0x50], r14
mov edx, 1
mov qword [rsp + 0x48], rbx
mov r9d, edx
mov qword [rsp + 0x40], rbx
mov rcx, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r8d, [rdx + 2]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14001d0fa
mov dword [rbp + 0xf], 0x309b
mov eax, 0x30b5
mov word [rbp + 0x13], ax
mov ecx, 0x30e1
mov word [rbp + 0x15], cx
mov eax, 0x30f8
mov word [rbp + 0x17], ax
mov r8, rbx
xor eax, eax
mov word [rbp + 0x19], cx
mov word [rbp + 0x1b], ax
movzx eax, word [rbp + 0x13]
nop dword [rax]
movzx edx, word [rbp + r8*2 + 0x13]
mov eax, dword [rbp + 0xf]
movzx ecx, ax
mov eax, edx
xor eax, ecx
mov word [rbp + r8*2 + 0x13], ax
inc r8
cmp r8, 4
jb 0x14001d0c0
lea rcx, [rbp + 0x13]
mov word [rbp + 0x1b], bx
call fcn.14001c7d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001d1fc
mov r8, r14
mov rdx, r15
mov rcx, rdi
call fcn.14001cc60
test eax, eax
jne 0x14001cd5b
mov dword [rbp - 0x41], 0x4716
mov rdx, rbx
mov eax, dword [rbp - 0x41]
xor eax, 0x2e
mov word [rbp - 0x3d], ax
mov eax, dword [rbp - 0x41]
inc ax
xor eax, 0x55
mov word [rbp - 0x3b], ax
mov eax, dword [rbp - 0x41]
add ax, 2
xor eax, 0x76
mov word [rbp - 0x39], ax
mov eax, dword [rbp - 0x41]
add ax, 3
xor eax, 0x43
mov word [rbp - 0x37], ax
xor eax, eax
mov word [rbp - 0x35], ax
movzx eax, word [rbp - 0x3d]
nop word [rax + rax]
movzx eax, word [rbp + rdx*2 - 0x3d]
mov ecx, dword [rbp - 0x41]
add ecx, edx
xor ecx, eax
mov word [rbp + rdx*2 - 0x3d], cx
inc rdx
cmp rdx, 4
jb 0x14001d160
lea rcx, [rbp - 0x3d]
mov word [rbp - 0x35], bx
call fcn.14001c7d0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14001d1fc
mov dword [rbp + 0x1f], 0xeefe
mov eax, 0xeed0
mov word [rbp + 0x23], ax
mov r8, rbx
mov eax, 0xee83
mov word [rbp + 0x25], ax
mov eax, 0xee93
mov word [rbp + 0x27], ax
mov eax, 0xee8a
mov word [rbp + 0x29], ax
xor eax, eax
mov word [rbp + 0x2b], ax
movzx eax, word [rbp + 0x23]
nop word [rax + rax]
movzx edx, word [rbp + r8*2 + 0x23]
mov eax, dword [rbp + 0x1f]
movzx ecx, ax
mov eax, edx
xor eax, ecx
mov word [rbp + r8*2 + 0x23], ax
inc r8
cmp r8, 4
jb 0x14001d1d0
lea rcx, [rbp + 0x23]
mov word [rbp + 0x2b], bx
call fcn.14001c7d0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14002fb30
mov rbx, qword [rsp + 0x140]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret