Function at 0x14010f29d
Capabilities:
Create service

Disassembly:
push rax
pushf
mov eax, 0x5adc74c7
pushf
not eax
add eax, 0x8576ded6
xor eax, 0xae811ff8
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xbf9ecbb7
xor eax, 0x9789463e
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xdeea0f84
xor eax, 0xb1cc0ade
rol eax, 0x8a
popf
cmp eax, 4
jne 0x14010f2ed
popf
pop rax
jmp 0x14010fc3d
cmp eax, 0
jne 0x14010f2fc
popf
pop rax
jmp 0x14010f329
cmp eax, 3
jne 0x14010f30b
popf
pop rax
jmp 0x14010f902
cmp eax, 1
jne 0x14010f31a
popf
pop rax
jmp 0x14010f3ff
cmp eax, 2
jne 0x14010f329
popf
pop rax
jmp 0x14010f859
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rsi, rdx
mov r14, r8
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
jmp 0x14010f34e
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14010f3b9
push rax
pushf
mov eax, 0x37915dd2
pushf
not eax
add eax, 0xe3d0e35b
xor eax, 0x9ec0e7cf
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x92663e0e
xor eax, 0xc6b11a42
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x91dc5d66
xor eax, 0xb959288c
rol eax, 0x20
popf
pushf
not eax
add eax, 0xc499e31c
xor eax, 0xaa58ec75
rol eax, 0x87
popf
jmp 0x14010f2de
push rax
pushf
mov eax, 0x4f2f15ac
pushf
not eax
add eax, 0xb8fadc4a
xor eax, 0xe6200b49
rol eax, 3
popf
pushf
not eax
add eax, 0xc0ad98d3
xor eax, 0xc18b9ff3
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xafdaf558
xor eax, 0xf52adcc1
rol eax, 0xe9
popf
jmp 0x14010f2de
movabs rcx, 0x70a0aa1119bdf7d4
pushf
not rcx
add rcx, 0x6b050fe7
xor rcx, 0x726cca3a
rol rcx, 0x6a
popf
pushf
not rcx
add rcx, 0x617d7ad0
xor rcx, 0x7dc60bcc
rol rcx, 3
popf
lea rdx, [rbp + 7]
mov qword [rbp + 0x2f], rcx
movabs rax, 0x362b3e6f9fe076b9
pushf
not rax
add rax, 0x4d7ae3fb
xor rax, 0x4ac10a14
rol rax, 0x34
popf
pushf
not rax
add rax, 0x48de3fe0
xor rax, 0x6dc279c7
rol rax, 0x6e
popf
mov qword [rbp + 7], rax
movabs rax, 0x2b3dd3d0f1bf3b2
pushf
not rax
add rax, 0x55e6a07f
xor rax, 0x7a284768
rol rax, 0xf4
popf
pushf
not rax
add rax, 0x639e2ff4
xor rax, 0x4a92cae3
rol rax, 0x53
popf
pushf
not rax
add rax, 0x7afdbcab
xor rax, 0x771cb967
rol rax, 0xa0
popf
pushf
not rax
add rax, 0x72df180b
xor rax, 0x49f6ba08
rol rax, 0xc8
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x337e5b92b814c828
pushf
not rax
add rax, 0x63c7a805
xor rax, 0x63e3ffa4
rol rax, 0xb6
popf
pushf
not rax
add rax, 0x5ef95ed7
xor rax, 0x49036bcc
rol rax, 0x6a
popf
pushf
not rax
add rax, 0x5716d6dc
xor rax, 0x673cf013
rol rax, 0xa8
popf
pushf
not rax
add rax, 0x4a9d3386
xor rax, 0x693cc61f
rol rax, 0x91
popf
movdqa xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x298fcee80293393
pushf
not rax
add rax, 0x7d455192
xor rax, 0x7ea34896
rol rax, 0x47
popf
pushf
not rax
add rax, 0x5a20de83
xor rax, 0x7bb10e75
rol rax, 0x69
popf
pushf
not rax
add rax, 0x63eda7dd
xor rax, 0x40092005
rol rax, 0x52
popf
pushf
not rax
add rax, 0x46363af9
xor rax, 0x7c0a7365
rol rax, 0x6f
popf
mov qword [rbp + 0x1f], rax
movabs rax, 0x8f2dbf6110d74e95
pushf
not rax
add rax, 0x705430e3
xor rax, 0x497e2501
rol rax, 0xc
popf
pushf
not rax
add rax, 0x468abeab
xor rax, 0x6ae2328e
rol rax, 0x9e
popf
movdqa xmm1, xmmword [rbp + 0x17]
mov qword [rbp + 0x27], rax
movabs rax, 0x8e28c6d4ee707bdd
pushf
not rax
add rax, 0x6cebe21d
xor rax, 0x484b4fc3
rol rax, 0xfc
popf
pushf
not rax
add rax, 0x6714385d
xor rax, 0x50d7efdf
rol rax, 0x91
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xa77f7f4a5fc64f1f
pushf
not rax
add rax, 0x4c3d097b
xor rax, 0x74163c4b
rol rax, 0x33
popf
pushf
not rax
add rax, 0x6aac628b
xor rax, 0x6e45c37e
rol rax, 0x43
popf
mov qword [rbp - 0x21], rax
movabs rax, 0x4f6b6c7b5a113e5b
pushf
not rax
add rax, 0x6308a624
xor rax, 0x7da1582b
rol rax, 0xeb
popf
pushf
not rax
add rax, 0x5432295e
xor rax, 0x5694d51e
rol rax, 0x99
popf
pushf
not rax
add rax, 0x61cfc77f
xor rax, 0x6c604c81
rol rax, 6
popf
pushf
not rax
add rax, 0x6b563041
xor rax, 0x5e968339
rol rax, 1
popf
xorps xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0xa7721b9241e8355c
pushf
not rax
add rax, 0x5b91a63e
xor rax, 0x441fc684
rol rax, 0x16
popf
pushf
not rax
add rax, 0x5196dd98
xor rax, 0x59151610
rol rax, 0x5e
popf
pushf
not rax
add rax, 0x49e5ca5d
xor rax, 0x6dec1bf6
rol rax, 0x58
popf
pushf
not rax
add rax, 0x7430166d
xor rax, 0x410d212e
rol rax, 0xdd
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xd9f11dc22725aa57
pushf
not rax
add rax, 0x50220454
xor rax, 0x6881458e
rol rax, 0xb6
popf
pushf
not rax
add rax, 0x5320126d
xor rax, 0x58423f41
rol rax, 0x9d
popf
pushf
not rax
add rax, 0x7625ddb8
xor rax, 0x6e93fe31
rol rax, 0x6e
popf
xorps xmm1, xmmword [rbp - 0x19]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [rbp + 0x27]
mov qword [rbp - 1], rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp - 9], rax
xorps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x17], xmm1
call fcn.1400b8eaf
mov rbx, rax
jmp 0x14010f7d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010f7e1
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1946beea9]
pushf
sub rdx, 0x546b6e89
popf
jmp 0x14010f7fd
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor eax, eax
mov r9d, 0x6b20adda
pushf
not r9d
add r9d, 0xaa114377
xor r9d, 0xbedb6fee
rol r9d, 0x13
popf
pushf
not r9d
add r9d, 0xa4d0563a
xor r9d, 0xa64142ab
rol r9d, 0x39
popf
pushf
not r9d
add r9d, 0xb2a74868
xor r9d, 0xd0484ecb
rol r9d, 0x2c
popf
mov qword [rsp + 0x60], rax
mov r8, rsi
mov qword [rsp + 0x58], rax
mov rdx, rbx
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
jmp 0x14010f8ec
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea rdx, [rbp - 0x29]
mov rbx, rax
test rax, rax
jne 0x14010fc3d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x3d4c7c931eee3760
pushf
not rax
add rax, 0x602586c7
xor rax, 0x41d191e8
rol rax, 0x43
popf
pushf
not rax
add rax, 0x5f62e7af
xor rax, 0x7ac7371b
rol rax, 0xd
popf
pushf
not rax
add rax, 0x5c79b54b
xor rax, 0x6b2d9aee
rol rax, 0x88
popf
mov qword [rbp - 0x29], rax
movabs rax, 0xbe8527b3f8b629ba
pushf
not rax
add rax, 0x64f4d4f3
xor rax, 0x68c5911a
rol rax, 0xbb
popf
pushf
not rax
add rax, 0x524f4e6c
xor rax, 0x7c1a3c6e
rol rax, 0xf5
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xb0be3172d3040086
pushf
not rax
add rax, 0x6b66341c
xor rax, 0x6a13d205
rol rax, 0xfe
popf
pushf
not rax
add rax, 0x480f2920
xor rax, 0x55848960
rol rax, 0xac
popf
pushf
not rax
add rax, 0x7d7874fa
xor rax, 0x671d1ca5
rol rax, 0x40
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x4f64211ba6464b4a
pushf
not rax
add rax, 0x4359aad7
xor rax, 0x636d4cb5
rol rax, 0x5c
popf
pushf
not rax
add rax, 0x7fd0a38a
xor rax, 0x7761cfcc
rol rax, 0x62
popf
mov qword [rbp - 0x11], rax
movabs rax, 0x132701361e72ba57
pushf
not rax
add rax, 0x50dc77eb
xor rax, 0x50f1bb91
rol rax, 0x41
popf
pushf
not rax
add rax, 0x57d75fea
xor rax, 0x5ee04cd1
rol rax, 0x16
popf
pushf
not rax
add rax, 0x7f71f0c0
xor rax, 0x598a082e
rol rax, 0xc
popf
pushf
not rax
add rax, 0x71564253
xor rax, 0x7af49f6f
rol rax, 0xda
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0xde85177bfe634856
pushf
not rax
add rax, 0x5c99b134
xor rax, 0x42306729
rol rax, 0xe4
popf
pushf
not rax
add rax, 0x5e63aec0
xor rax, 0x75685076
rol rax, 0x5a
popf
pushf
not rax
add rax, 0x5b5d27b5
xor rax, 0x5204ee11
rol rax, 0x74
popf
pushf
not rax
add rax, 0x44ec741f
xor rax, 0x71da2ed1
rol rax, 0x97
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x9723955aa8f2749
pushf
not rax
add rax, 0x668da9f7
xor rax, 0x68317bf7
rol rax, 0xb9
popf
pushf
not rax
add rax, 0x54218d80
xor rax, 0x4f5a13cd
rol rax, 0xb2
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x7554715b402db6f0
pushf
not rax
add rax, 0x6457a6b9
xor rax, 0x5d61b8e9
rol rax, 0x5a
popf
pushf
not rax
add rax, 0x553fcf70
xor rax, 0x5f6e3700
rol rax, 0xaa
popf
pushf
not rax
add rax, 0x475ab2bb
xor rax, 0x6bf832bb
rol rax, 0xc2
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8eaf
mov rbx, rax
jmp 0x14010fbaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
jmp 0x14010fbbb
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x19e0d67d9]
pushf
sub rdx, 0x5e0ce7b9
popf
jmp 0x14010fbd7
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
jmp 0x14010fbe1
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xe6f0780ea12630a6
pushf
not rax
add rax, 0x4d134b42
xor rax, 0x6c40bd86
rol rax, 0x23
popf
pushf
not rax
add rax, 0x6c0f083c
xor rax, 0x772650fb
rol rax, 0x93
popf
mov qword [rbp - 0x29], rax
movabs rax, 0x168787b2a9fbf49f
pushf
not rax
add rax, 0x6bd6ac6e
xor rax, 0x6ef79667
rol rax, 0x1e
popf
pushf
not rax
add rax, 0x60596ed6
xor rax, 0x40a0dd78
rol rax, 0x68
popf
mov qword [rbp - 0x21], rax
movabs rax, 0xc1186b27f4f5cb0b
pushf
not rax
add rax, 0x49c1efd2
xor rax, 0x620f983f
rol rax, 0xec
popf
pushf
not rax
add rax, 0x7005af4f
xor rax, 0x422380e1
rol rax, 0xd
popf
pushf
not rax
add rax, 0x4b93d638
xor rax, 0x6df9fb76
rol rax, 6
popf
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], rax
movabs rax, 0x31595e8178f0ddff
pushf
not rax
add rax, 0x55c5f96f
xor rax, 0x7d8f21a6
rol rax, 0x3b
popf
pushf
not rax
add rax, 0x454a5606
xor rax, 0x4e0c4cad
rol rax, 0x6a
popf
pushf
not rax
add rax, 0x4a95bbf7
xor rax, 0x6dcc299a
rol rax, 0x16
popf
mov qword [rbp - 0x11], rax
movabs rax, 0xc4e28c6df85147bd
pushf
not rax
add rax, 0x74054283
xor rax, 0x64aa62ff
rol rax, 0x86
popf
pushf
not rax
add rax, 0x5303c3bf
xor rax, 0x552b2dbe
rol rax, 0xcb
popf
movdqa xmm1, xmmword [rbp - 0x19]
mov qword [rbp + 7], rax
movabs rax, 0x3e782b97a3d2901e
pushf
not rax
add rax, 0x4c001f54
xor rax, 0x78773ad0
rol rax, 0x90
popf
pushf
not rax
add rax, 0x48a59d6e
xor rax, 0x5d3341ff
rol rax, 0x57
popf
pushf
not rax
add rax, 0x7baf6f9a
xor rax, 0x7ea89e68
rol rax, 0xba
popf
pushf
not rax
add rax, 0x7bb0d912
xor rax, 0x40cd6ba9
rol rax, 0xde
popf
mov qword [rbp + 0xf], rax
movabs rax, 0x697b7129ee59a032
pushf
not rax
add rax, 0x7b816313
xor rax, 0x615901d9
rol rax, 0x81
popf
pushf
not rax
add rax, 0x52dd6972
xor rax, 0x464e9a0d
rol rax, 0x1e
popf
pushf
not rax
add rax, 0x6584809e
xor rax, 0x664b0eae
rol rax, 0xe3
popf
pushf
not rax
add rax, 0x73366521
xor rax, 0x7da05620
rol rax, 0xe8
popf
xorps xmm0, xmmword [rbp + 7]
mov qword [rbp + 0x17], rax
movabs rax, 0x2cbe6640fc447a12
pushf
not rax
add rax, 0x73015c10
xor rax, 0x63b911f2
rol rax, 0x38
popf
pushf
not rax
add rax, 0x5da0197a
xor rax, 0x54c9fe43
rol rax, 0x31
popf
pushf
not rax
add rax, 0x7350baa6
xor rax, 0x57bcb987
rol rax, 0x9c
popf
pushf
not rax
add rax, 0x40a4f9c7
xor rax, 0x7edabe06
rol rax, 0x6c
popf
mov qword [rbp + 0x1f], rax
xorps xmm1, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmmword [rbp - 0x29], xmm0
call fcn.1400b8eaf
lea rdx, [0x18c1b8e0a]
pushf
sub rdx, 0x4c1b0dea
popf
mov rcx, rax
jmp 0x14010ff13
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
jmp 0x14010ff1d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
jmp 0x14010ff27
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 0x5d
pushf
not al
add al, 0x17
xor al, 0x5a
rol al, 0x48
popf
pushf
not al
add al, 0xdf
xor al, 0x2f
rol al, 0x35
popf
pushf
not al
add al, 0xff
xor al, 0x4d
rol al, 0x79
popf
pushf
not al
add al, 0x9a
xor al, 0x43
rol al, 0x2e
popf
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret