Passwords for Windows services are stored in the registry under:
When you configure a Windows service to run as a different account, the Service Control Manager uses the
LsaStorePrivateData function to store the password, and the corresponding
LsaRetrievePrivateData function to retrieve it.
So it is reversible encryption of some kind, but sorry, the exact encryption algorithm and technique are not publically documented. And helping you further reverse engineer it would be fun, but not a good idea for me.