Function at 0x14010f0b7
Capabilities:
Create service

Disassembly:
push rax
pushf
mov eax, 0x66452267
pushf
not eax
add eax, 0xdc4266f9
xor eax, 0xd2bd517b
rol eax, 0x89
popf
pushf
not eax
add eax, 0xfe221fb0
xor eax, 0xf2c8923a
rol eax, 0
popf
pushf
not eax
add eax, 0xb7d9112b
xor eax, 0xcb66b977
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xd44e060a
xor eax, 0xe247227a
rol eax, 0x93
popf
cmp eax, 4
jne 0x14010f11a
popf
pop rax
jmp 0x14010fa3f
cmp eax, 0
jne 0x14010f129
popf
pop rax
jmp 0x14010f156
cmp eax, 3
jne 0x14010f138
popf
pop rax
jmp 0x14010f71f
cmp eax, 1
jne 0x14010f147
popf
pop rax
jmp 0x14010f206
cmp eax, 2
jne 0x14010f156
popf
pop rax
jmp 0x14010f676
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rsi, rdx
mov r14, r8
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
jmp 0x14010f17b
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14010f1c0
push rax
pushf
mov eax, 0x4409ecba
pushf
not eax
add eax, 0xb8d21e59
xor eax, 0xec480086
rol eax, 6
popf
pushf
not eax
add eax, 0xeb42f6cf
xor eax, 0xc936b0a8
rol eax, 0xa7
popf
jmp 0x14010f10b
push rax
pushf
mov eax, 0x4c7a2c82
pushf
not eax
add eax, 0x8e541ac4
xor eax, 0xc7e4247c
rol eax, 0x8d
popf
pushf
not eax
add eax, 0x887da2ee
xor eax, 0xade210be
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xe6a9d22e
xor eax, 0x8bd1ef95
rol eax, 0x66
popf
jmp 0x14010f10b
movabs rcx, 0xcd6f263c711d4bc2
pushf
not rcx
add rcx, 0x5f9aa8e9
xor rcx, 0x6c5b3f31
rol rcx, 0x53
popf
pushf
not rcx
add rcx, 0x56d794cf
xor rcx, 0x457462ff
rol rcx, 0x10
popf
pushf
not rcx
add rcx, 0x71a62790
xor rcx, 0x7c75fd68
rol rcx, 0xc7
popf
lea rdx, [rbp + 7]
mov qword [rbp + 0x2f], rcx
movabs rax, 0xac635ba54d587792
pushf
not rax
add rax, 0x40bede8a
xor rax, 0x5cade40e
rol rax, 0x88
popf
pushf
not rax
add rax, 0x5b8456ff
xor rax, 0x549a772a
rol rax, 0xbc
popf
pushf
not rax
add rax, 0x6ebd40da
xor rax, 0x43e73848
rol rax, 0x28
popf
mov qword [rbp + 7], rax
movabs rax, 0x7f90a2ef9d6263aa
pushf
not rax
add rax, 0x76767362
xor rax, 0x4b38d87c
rol rax, 0xd8
popf
pushf
not rax
add rax, 0x7c8dfa69
xor rax, 0x40cd9d40
rol rax, 0x44
popf
pushf
not rax
add rax, 0x55c72fd8
xor rax, 0x7bab4544
rol rax, 0x2e
popf
mov qword [rbp + 0xf], rax
movabs rax, 0xb1dc9b9938e6b685
pushf
not rax
add rax, 0x4560917f
xor rax, 0x684ad872
rol rax, 0xb1
popf
pushf
not rax
add rax, 0x74f508ec
xor rax, 0x701219b7
rol rax, 0x81
popf
pushf
not rax
add rax, 0x51049ac0
xor rax, 0x7e0401a1
rol rax, 0x12
popf
pushf
not rax
add rax, 0x5e39c014
xor rax, 0x5a2f06bb
rol rax, 0x6d
popf
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x7a4a5048c4207f0e
pushf
not rax
add rax, 0x41868cd0
xor rax, 0x74bdb649
rol rax, 0x98
popf
pushf
not rax
add rax, 0x6e2cee26
xor rax, 0x713a3d9c
rol rax, 0xe4
popf
mov qword [rbp + 0x1f], rax
movabs rax, 0x80e6f52319b33330
pushf
not rax
add rax, 0x427aa5a0
xor rax, 0x785179c7
rol rax, 0xa6
popf
pushf
not rax
add rax, 0x49a83b47
xor rax, 0x423c2953
rol rax, 0xc1
popf
pushf
not rax
add rax, 0x622c922d
xor rax, 0x5647c04c
rol rax, 0x59
popf
pushf
not rax
add rax, 0x723f766a
xor rax, 0x407b4445
rol rax, 0xad
popf
movdqa xmm1, xmmword [rbp + 0x17]
mov qword [rbp + 0x27], rax
movabs rax, 0x8763297d492086cb
pushf
not rax
add rax, 0x7345379a
xor rax, 0x6b6b0194
rol rax, 0xb9
popf
pushf
not rax
add rax, 0x580a5a45
xor rax, 0x47e28912
rol rax, 0xf9
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xcdea53fca674cd45
pushf
not rax
add rax, 0x72426752
xor rax, 0x66c14854
rol rax, 0xd5
popf
pushf
not rax
add rax, 0x60ce890d
xor rax, 0x524df622
rol rax, 0x52
popf
pushf
not rax
add rax, 0x72aa9d5c
xor rax, 0x51bac769
rol rax, 0x5f
popf
mov qword [rbp - 0x21], rax
movabs rax, 0x34579555c9e2068e
pushf
not rax
add rax, 0x6b728409
xor rax, 0x471ecc4f
rol rax, 0x2a
popf
pushf
not rax
add rax, 0x518b7742
xor rax, 0x636008d3
rol rax, 0x91
popf
pushf
not rax
add rax, 0x5c277f59
xor rax, 0x442c3a8f
rol rax, 0x64
popf
xorps xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x58b883db818a052d
pushf
not rax
add rax, 0x58c6035d
xor rax, 0x73ea9f77
rol rax, 0xa9
popf
pushf
not rax
add rax, 0x57dfbdcf
xor rax, 0x616ad205
rol rax, 0x6e
popf
pushf
not rax
add rax, 0x620cf10d
xor rax, 0x5f50a128
rol rax, 0x6d
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x403c35c85ae17cc0
pushf
not rax
add rax, 0x79a0f413
xor rax, 0x507671c6
rol rax, 0xc1
popf
pushf
not rax
add rax, 0x61fcef41
xor rax, 0x68f9a0dc
rol rax, 0xda
popf
pushf
not rax
add rax, 0x653b89f9
xor rax, 0x4625c3da
rol rax, 0x51
popf
xorps xmm1, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [rbp + 0x27]
mov qword [rbp - 1], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp - 9], rax
xorps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x17], xmm1
call fcn.1400b9268
mov rbx, rax
jmp 0x14010f5df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010f5eb
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x186e05928]
pushf
sub rdx, 0x46dfd908
popf
jmp 0x14010f607
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
mov r9d, 0x6b9e506f
pushf
not r9d
add r9d, 0xb665c238
xor r9d, 0xb44c9225
rol r9d, 0xe2
popf
pushf
not r9d
add r9d, 0x8cbd902f
xor r9d, 0xa14f83ad
rol r9d, 0xbc
popf
pushf
not r9d
add r9d, 0xae167984
xor r9d, 0xeadb8179
rol r9d, 0x23
popf
mov qword [rsp + 0x60], rax
mov r8, rsi
mov qword [rsp + 0x58], rax
mov rdx, rbx
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
jmp 0x14010f709
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rdx, [rbp - 0x29]
mov rbx, rax
test rax, rax
jne 0x14010fa3f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0xde16530cbee889ea
pushf
not rax
add rax, 0x4c6a341a
xor rax, 0x6f193b9b
rol rax, 0x4c
popf
pushf
not rax
add rax, 0x5c205c47
xor rax, 0x400936bd
rol rax, 0x9a
popf
pushf
not rax
add rax, 0x6adca0a7
xor rax, 0x476a8493
rol rax, 0x3d
popf
mov qword [rbp - 0x29], rax
movabs rax, 0x48b1505054477787
pushf
not rax
add rax, 0x53f6623e
xor rax, 0x56a23bb4
rol rax, 0x3c
popf
pushf
not rax
add rax, 0x46a24a09
xor rax, 0x45a820cc
rol rax, 0xac
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xf1b6854489272c39
pushf
not rax
add rax, 0x7d8b4a06
xor rax, 0x4d0cc419
rol rax, 0x78
popf
pushf
not rax
add rax, 0x75409f9a
xor rax, 0x77b44907
rol rax, 0x11
popf
pushf
not rax
add rax, 0x653c9b02
xor rax, 0x4b21b4eb
rol rax, 0xe3
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x1229e2ec872c6cf9
pushf
not rax
add rax, 0x69a1a407
xor rax, 0x47fa7541
rol rax, 0x62
popf
pushf
not rax
add rax, 0x71b1a1dc
xor rax, 0x5b5b5594
rol rax, 0x64
popf
pushf
not rax
add rax, 0x622de85f
xor rax, 0x69efeecc
rol rax, 4
popf
pushf
not rax
add rax, 0x4fa00f12
xor rax, 0x700dbc4d
rol rax, 0x81
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x8622f640f9b7dad2
pushf
not rax
add rax, 0x71c5d9c1
xor rax, 0x7ca36b34
rol rax, 0x1d
popf
pushf
not rax
add rax, 0x47c4b711
xor rax, 0x4b4f2041
rol rax, 0xf0
popf
pushf
not rax
add rax, 0x77df83d9
xor rax, 0x5716763e
rol rax, 0x90
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0xb2370e8889ff4818
pushf
not rax
add rax, 0x7ba08468
xor rax, 0x6830dd22
rol rax, 0x5c
popf
pushf
not rax
add rax, 0x5846daef
xor rax, 0x6204138c
rol rax, 0x9f
popf
mov qword [rbp + 0xf], rax
movabs rax, 0xb1b6b97b533ffb8
pushf
not rax
add rax, 0x6b0c7c96
xor rax, 0x53b44996
rol rax, 0xa
popf
pushf
not rax
add rax, 0x4d17904c
xor rax, 0x62d371b6
rol rax, 0xec
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x409e06598c20fc5f
pushf
not rax
add rax, 0x6e4ab439
xor rax, 0x74e9ff30
rol rax, 0xc3
popf
pushf
not rax
add rax, 0x5e8fd203
xor rax, 0x559ba093
rol rax, 0xc0
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b9268
mov rbx, rax
jmp 0x14010f99e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010f9aa
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1a6621e7f]
pushf
sub rdx, 0x66619e5f
popf
jmp 0x14010f9c6
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
jmp 0x14010f9d0
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xbac3bce0390d5ace
pushf
not rax
add rax, 0x6b8e17c8
xor rax, 0x740b4f10
rol rax, 0x53
popf
pushf
not rax
add rax, 0x6abad131
xor rax, 0x762ececf
rol rax, 0xf7
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xeb41afca01871291
pushf
not rax
add rax, 0x5f03d004
xor rax, 0x41184fc2
rol rax, 0xab
popf
pushf
not rax
add rax, 0x663cfbb0
xor rax, 0x78719420
rol rax, 0xcb
popf
pushf
not rax
add rax, 0x45c373ed
xor rax, 0x485ebe6d
rol rax, 0x17
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xd83b4df246a4b286
pushf
not rax
add rax, 0x4072990c
xor rax, 0x583d3419
rol rax, 0x10
popf
pushf
not rax
add rax, 0x44e2383f
xor rax, 0x591abd2d
rol rax, 0xd8
popf
pushf
not rax
add rax, 0x6e20b311
xor rax, 0x583f3205
rol rax, 0xa3
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0xa854a035b02cb865
pushf
not rax
add rax, 0x5ec0a8c7
xor rax, 0x61e3e6f4
rol rax, 0x91
popf
pushf
not rax
add rax, 0x7b0c7b61
xor rax, 0x6d0e6903
rol rax, 0xb8
popf
pushf
not rax
add rax, 0x4da7451e
xor rax, 0x4c7fed5c
rol rax, 0x13
popf
pushf
not rax
add rax, 0x41848ba3
xor rax, 0x65d8afe0
rol rax, 0xc8
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xc6eb3a67247eebc9
pushf
not rax
add rax, 0x492a85c0
xor rax, 0x75660235
rol rax, 0xc5
popf
pushf
not rax
add rax, 0x44eeb40b
xor rax, 0x6b560a8f
rol rax, 0x88
popf
pushf
not rax
add rax, 0x64887dfb
xor rax, 0x750f272f
rol rax, 0x9e
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0x5093393639ba4678
pushf
not rax
add rax, 0x54710953
xor rax, 0x55fe31e8
rol rax, 0x60
popf
pushf
not rax
add rax, 0x5d542384
xor rax, 0x6e349e65
rol rax, 0x2e
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x470ae3938709670e
pushf
not rax
add rax, 0x6088b448
xor rax, 0x5b1b4882
rol rax, 0xe7
popf
pushf
not rax
add rax, 0x72f8f8b0
xor rax, 0x64b19ed6
rol rax, 0xd3
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x9636131cd9b41824
pushf
not rax
add rax, 0x55367e43
xor rax, 0x740bbe60
rol rax, 0xe9
popf
pushf
not rax
add rax, 0x4a85dbce
xor rax, 0x77bde78b
rol rax, 0xc3
popf
pushf
not rax
add rax, 0x7e41d5ea
xor rax, 0x625b59ca
rol rax, 0x83
popf
pushf
not rax
add rax, 0x791f472f
xor rax, 0x4d8ef332
rol rax, 0xbe
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b9268
lea rdx, [0x1a70ee556]
pushf
sub rdx, 0x670e6536
popf
mov rcx, rax
jmp 0x14010fcfe
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
jmp 0x14010fd08
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
jmp 0x14010fd12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 0x7b
pushf
not al
add al, 0x68
xor al, 0x6d
rol al, 0xe7
popf
pushf
not al
add al, 0xda
xor al, 0xca
rol al, 0x34
popf
pushf
not al
add al, 0x16
xor al, 0xc8
rol al, 0xcc
popf
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret