Function at 0x10015b66
Capabilities:
Encode data using xor
Modify service

Disassembly:
mov eax, 0x1005e7cd
call fcn.1005dc80
sub esp, 0xcc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x4c], esi
test dl, dl
je 0x10015c63
mov dword [ebp - 0x14], 0x6813
cmp dword [ebp - 0x14], 0x68ab
jle 0x10015c0a
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, edi
mov dword [ebp - 0x18], esi
mov edi, esi
mov esi, ebx
shl edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0xc0]
cdq
push edx
push eax
call fcn.10001b3f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10015bce
mov eax, dword [eax]
push eax
call fcn.10047293
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xc0]
call fcn.1001084f
inc esi
cmp esi, 0x230b
jl 0x10015bb0
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x815
jl 0x10015ba5
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1135
jl 0x10015ba0
cmp dword [ebp - 0x14], 0x6624
jge 0x10015c1e
push str.vos_wfo_iacc_fofdpqkfo_pxtekr_eimqv_kllvhrjs_ieoamy
call fcn.10047293
pop ecx
cmp byte [ebp + 0x1c], 0
je 0x10015c50
mov esi, dword [ebp + 0x20]
mov dword [esi], ebx
jmp 0x10015c46
push 0x73cd
push dword [ebp + 0x18]
mov edx, esi
push 1
push 0x43e1
call fcn.10013f05
add esp, 0x10
inc dword [esi]
cmp dword [esi], 4
jl 0x10015c2b
jmp 0x100161cb
mov ecx, dword [ebp + 0x28]
mov eax, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100161cb
mov dword [ebp - 0x34], 0x26a7
cmp dword [ebp - 0x34], 0x277e
jle 0x10015cfb
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov edx, edi
mov ecx, eax
shl edx, cl
mov edi, ebx
and edx, esi
mov dword [ebp - 0x18], edx
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0xd8]
or eax, edi
cdq
push edx
push eax
call fcn.10001b3f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10015cb1
mov eax, dword [eax]
push eax
call fcn.10047293
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.1001084f
inc edi
cmp edi, 0x265b
jl 0x10015c95
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
inc eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
cmp eax, 0x4437
jl 0x10015c86
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x64
jl 0x10015c81
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x30e8
jl 0x10015c7c
mov esi, dword [ebp - 0x4c]
cmp dword [ebp - 0x34], 0x22d3
jge 0x10015d0f
push str.ibocsj_jpljjkjyt_rsuyxz_chtrspxgd_bjjemeoae_wriaazur_pan_reddbwo_azryuyye_mpcavfzce_fcjsd_yxpe
call fcn.10047293
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10015d41
mov edx, dword [ebp + 8]
mov dword [edx], ebx
cmp dword [edx], 3
jge 0x100161cb
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xbbca6318
inc dword [edx]
cmp dword [edx], 3
jl 0x10015d2a
jmp 0x100161cb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x18], 0x3635
cmp dword [ebp - 0x18], 0x3934
jle 0x10015ddd
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov dword [ebp - 0x14], edi
mov ecx, esi
mov eax, ebx
sar edi, cl
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x44], ebx
mov ecx, eax
mov ebx, edi
mov edi, dword [ebp - 0x44]
sar ebx, cl
mov eax, ebx
mov ecx, 0x10079ad8
xor eax, edi
cdq
push edx
push eax
call fcn.1000fde8
inc edi
cmp edi, 0x7988
jl 0x10015d90
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x34], eax
push 0
pop ebx
cmp eax, 0x4659
jl 0x10015d84
mov edi, dword [ebp - 0x24]
inc esi
cmp esi, 0x16ff
jl 0x10015d75
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x2bd7
jl 0x10015d73
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x44], 0xdc6f79b3
mov dword [ebp - 4], 4
cmp dword [ebp - 0x18], 0x337c
jge 0x10015e21
mov edx, str.rhm_phajqde_imkybjez_yanqywu_rppziomi_rvwbfj_kvyjuqg_alswj_kst_skf_ytypq
mov ecx, 0x10079ad8
call fcn.10012b8c
jmp 0x10015e21
or dword [ebp - 4], 0xffffffff
xor edx, edx
mov dword [ebp - 0x18], 0x197cbb40
inc edx
mov dword [ebp - 0x18], 0x8a88acc1
mov dword [ebp - 0x18], 0xddfdaf0b
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
jmp 0x10015e53
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10015e45
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
jne 0x10015e72
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], edx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
cmp eax, edx
setl cl
add ecx, dword [ebp - 0x20]
jne 0x10015e90
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
lea eax, [ebp - 0x25]
setl cl
xor dl, dl
push ecx
mov dword [ebp - 0x18], ecx
push eax
mov byte [ebp - 0x25], bl
call fcn.10014656
xor eax, eax
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x80], ax
push 1
push ebx
push 0x3b0f
push 0xd48
xor dl, dl
mov dword [ebp - 4], 6
mov ecx, 0x1ecd
call fcn.10014b2c
mov eax, dword [ebp + 0x10]
add esp, 0x18
cmp dword [ebp - 0x4c], eax
ja 0x100160ab
mov dword [ebp - 0x24], 0x725f
cmp dword [ebp - 0x24], 0x72b9
jle 0x10015f6f
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], 0x4d89
mov dword [ebp - 0x30], ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10079ad8
cdq
push edx
push eax
call fcn.1000fde8
inc ebx
cmp ebx, 0x33f2
jl 0x10015f2f
add edi, esi
dec dword [ebp - 0x18]
push 0
pop ebx
jne 0x10015f2c
inc esi
cmp esi, 0x3707
jl 0x10015f23
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push 1
lea ecx, [ebp - 0x98]
call fcn.100100c6
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
call fcn.100100c6
push 1
mov byte [ebp - 4], 8
lea eax, [ebp - 0x98]
push ebx
mov dword [ebp - 0x40], 0xfffffffd
lea ecx, [ebp - 0x64]
push 0x485f
mov dword [ebp - 0x3c], 0xe39f3faa
mov dl, 1
mov dword [ebp - 0x48], ebx
push 0xc0
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x30], 0xfaa9634d
call fcn.10013e8f
add esp, 0x10
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x60]
call fcn.100151fc
pop ecx
lea eax, [ebp - 0x3c]
push eax
push 0x7cd7
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x63e
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x98]
push eax
push ecx
push ecx
lea edx, [ebp - 0x48]
call fcn.10014e58
mov eax, dword [ebp - 0x60]
add esp, 0x24
mov edx, dword [eax]
cmp edx, 0xfff6
jb 0x1001603e
cmp dword [ebp - 0x48], ebx
jne 0x10016016
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x60]
jne 0x1001602c
cmp dword [eax], ebx
jne 0x1001602c
mov ecx, ebx
jmp 0x1001602f
xor ecx, ecx
inc ecx
mov edx, dword [eax]
mov dword [ebp - 0x40], ecx
cmp edx, dword [ebp - 0x40]
je 0x1001603e
xor eax, eax
inc eax
jmp 0x10016040
mov eax, ebx
xor ecx, ecx
cmp eax, 0xffffffff
setle cl
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x60]
setg al
mov dword [ebp - 0x30], eax
call fcn.10010128
lea ecx, [ebp - 0x98]
call fcn.10010128
mov byte [ebp - 4], 9
cmp dword [ebp - 0x24], 0x6f8b
jge 0x1001609f
mov edx, str.rayfket_kfxmpsht_zjprcppkc_npq
mov ecx, 0x10079ad8
call fcn.10012b8c
jmp 0x1001609f
mov dword [ebp - 4], 6
jmp 0x100161ad
push 0x480d
lea eax, [ebp - 0x38]
push eax
push ecx
push ecx
push ebx
push ecx
push ecx
lea eax, [ebp - 0x80]
push eax
push ecx
push ecx
lea eax, [ebp - 0x50]
push eax
push 0x7e84
call fcn.10014714
mov esi, dword [ebp - 0x50]
jmp 0x100160f6
lea eax, [ebp - 0x38]
push eax
push 0x3239
push ecx
push ecx
push 1
push ecx
push ecx
push 0x2157
push ecx
push ecx
lea eax, [ebp - 0x80]
push 0x438a
push eax
call fcn.10014714
add esp, 0x30
cmp dword [ebp - 0x38], esi
jb 0x100160d2
mov dword [ebp - 0x2c], 0x8ade19d2
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10016122
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10016111
push 2
mov dword [ebp - 0x2c], ebx
pop esi
jmp 0x10016197
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x8c]
push 1
call fcn.100100c6
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 0xb
push eax
sub esp, 0x18
lea ecx, [ebp - 0x9c]
call fcn.1001797d
mov dword [ebp - 0x14], esi
add esp, 0x1c
cmp dword [ebp - 0x14], ebx
jl 0x10016185
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0xa8]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], ecx
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
dec dword [ebp - 0x14]
jns 0x10016164
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 6
call fcn.10010128
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jle 0x10016130
sub esp, 0xc
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x68]
call fcn.10015b32
add esp, 0xc
mov ecx, dword [ebp + 0x24]
lea eax, [ebp - 0x80]
cmp ecx, eax
je 0x100161c0
push 0xffffffffffffffff
push ebx
push eax
call fcn.100108e1
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.10010a23
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret