joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12a201d7
Capabilities:
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x12a37538]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x40c], eax
mov ecx, dword [0x12a37010]
mov ebx, 0x12a37010
cmp ecx, ebx
je 0x12a20232
test byte [ecx + 0x1c], 1
je 0x12a20232
cmp byte [ecx + 0x19], 5
jb 0x12a20232
push dword [ebp + 0xc]
push esi
push 0x12a02c88
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.12a1eea8
mov ecx, dword [0x12a37010]
movzx eax, word [esi]
push 2
pop edx
xor edi, edi
cmp dx, ax
je 0x12a20251
push 0x17
pop edx
cmp dx, ax
je 0x12a20251
mov edi, 0x80070057
jmp 0x12a2031c
push 2
push 0
push 0
push 0x401
lea eax, [ebp - 0x408]
push eax
push 0x80
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x12a202c3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
test eax, eax
jle 0x12a2028b
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x12a20294
mov edi, 0x80004005
mov ecx, dword [0x12a37010]
cmp ecx, ebx
je 0x12a20356
test byte [ecx + 0x1c], 2
je 0x12a2031c
cmp byte [ecx + 0x19], 2
jb 0x12a2031c
push eax
push 0x12a02c88
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.12a039b3
jmp 0x12a20316
cmp dword [ebp + 0xc], edi
je 0x12a20304
push 0x17
pop eax
cmp ax, word [esi]
jne 0x12a20304
lea eax, [ebp - 0x408]
push 0x25
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
pop ecx
test eax, eax
je 0x12a202e8
mov byte [eax], 0
lea eax, [ebp - 0x408]
push eax
push 0x12a02d8c
push dword [ebp - 0x40c]
call fcn.12a1168a
add esp, 0xc
jmp 0x12a20316
mov ecx, dword [ebp - 0x40c]
lea eax, [ebp - 0x408]
push eax
call fcn.12a11589
mov ecx, dword [0x12a37010]
cmp ecx, ebx
je 0x12a20356
test byte [ecx + 0x1c], 1
je 0x12a20356
movzx eax, byte [ecx + 0x19]
xor edx, edx
test edi, edi
setl dl
dec edx
and edx, 3
inc edx
inc edx
cmp eax, edx
jl 0x12a20356
mov eax, dword [ebp - 0x40c]
push dword [eax]
push edi
push 0x12a02c88
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.12a21011
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.12a19f5c
leave
ret 0xc
Function at 0x12a21350
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x230
mov eax, 0x12a32cc8
call fcn.12a1a02e
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x230], ebx
mov eax, dword [0x12a37010]
cmp eax, 0x12a37010
je 0x12a21398
test byte [eax + 0x1c], 1
je 0x12a21398
cmp byte [eax + 0x19], 5
jb 0x12a21398
push ebx
push dword [esi]
push 0x12a02fd0
push 0x59
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a21011
lea eax, [ebp - 0x21c]
xor edi, edi
push eax
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x21c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x21c], edi
je 0x12a2150e
push 0x12a01610
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x234], eax
cmp eax, edi
je 0x12a2151c
push 0x12a0162c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x22c], eax
cmp eax, edi
je 0x12a21500
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], edi
mov eax, dword [esi]
push 0x2011f
push ebx
push eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], edi
call fcn.12a03fc5
mov dword [ebp - 0x214], eax
mov eax, dword [0x12a37010]
cmp eax, 0x12a37010
je 0x12a21471
test byte [eax + 0x1c], 2
je 0x12a21471
mov edx, dword [ebp - 0x214]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x12a21471
push ebx
push dword [esi]
push dword [ebp - 0x214]
push 0x12a02fd0
push 0x5a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a20f38
cmp dword [ebp - 0x214], edi
jne 0x12a214f5
mov ebx, 0x100
jmp 0x12a2149d
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.12a21350
mov dword [ebp - 0x214], eax
cmp eax, edi
jne 0x12a214cc
lea eax, [ebp - 0x23c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x228]
mov dword [ebp - 0x218], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x12a21480
lea ecx, [ebp - 0x228]
call fcn.12a03f52
cmp dword [ebp - 0x214], edi
jne 0x12a214f5
push edi
push ebx
push dword [ebp - 0x230]
push dword [esi]
call dword [ebp - 0x22c]
mov dword [ebp - 0x214], eax
lea ecx, [ebp - 0x228]
call fcn.12a03f52
push dword [ebp - 0x234]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x12a2151c
push ebx
mov ecx, esi
call fcn.12a0480f
mov dword [ebp - 0x214], eax
mov eax, dword [0x12a37010]
cmp eax, 0x12a37010
je 0x12a2155e
test byte [eax + 0x1c], 1
je 0x12a2155e
mov edx, dword [ebp - 0x214]
movzx ecx, byte [eax + 0x19]
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x12a2155e
push dword [ebp - 0x214]
push 0x12a02fd0
push 0x5b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, dword [ebp - 0x214]
call fcn.12a1a0c0
ret 8
Function at 0x12a22b54
Capabilities:
Get user security identifier

Disassembly:
push 0xe0
mov eax, 0x12a32e4f
call fcn.12a1a02e
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe0], eax
call fcn.12a1ab4a
test ebx, ebx
je 0x12a22cdd
and dword [ebp - 0xd8], 0
and dword [ebp - 4], 0
mov esi, 0x80
push esi
lea ecx, [ebp - 0xd8]
call fcn.12a21687
mov ecx, dword [ebp - 0xd8]
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push ecx
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0xe0]
mov ebx, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xdc], 0x44
mov dword [ebp - 0xe8], esi
call ebx
test eax, eax
jne 0x12a22c5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x12a22cbd
cmp dword [ebp - 0xdc], 0x44
jbe 0x12a22c08
push 0x80004005
call fcn.12a03c93
mov eax, dword [ebp - 0xe8]
cmp eax, esi
jbe 0x12a22c2c
add eax, eax
push eax
lea ecx, [ebp - 0xd8]
call fcn.12a216ab
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xe4], eax
lea eax, [edi + 0x4c]
push eax
lea eax, [ebp - 0xe8]
push eax
push dword [ebp - 0xe4]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xec]
push dword [ebp - 0xe0]
call ebx
test eax, eax
je 0x12a22cbd
lea eax, [ebp - 0x54]
push eax
lea eax, [edi + 4]
push eax
push dword [ebp - 0xdc]
mov byte [edi + 0x48], 1
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x12a22cbd
push dword [ebp - 0xe4]
lea ecx, [edi + 0x54]
call fcn.12a083b9
push dword [ebp - 0xec]
lea ecx, [edi + 0x50]
call fcn.12a083b9
push dword [ebp - 0xe0]
lea ecx, [edi + 0x5c]
call fcn.12a083b9
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x12a22cb9
lea ecx, [ebp - 0xd8]
call fcn.12a0467e
mov al, 1
jmp 0x12a22cdf
mov ecx, edi
call fcn.12a1ab4a
lea eax, [ebp - 0xd4]
cmp dword [ebp - 0xd8], eax
je 0x12a22cdd
lea ecx, [ebp - 0xd8]
call fcn.12a0467e
xor al, al
call fcn.12a1a0c0
ret 8
Function at 0x12a22d76
Capabilities:
Get session user name

Disassembly:
push 0x6c
mov eax, 0x12a32ea4
call fcn.12a1a02e
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [0x12a37010]
mov esi, 0x12a37010
cmp eax, esi
je 0x12a22db7
test byte [eax + 0x1c], 1
je 0x12a22db7
cmp byte [eax + 0x19], 5
jb 0x12a22db7
push 0x12a02fd0
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a03957
mov eax, 0x7fff
push eax
mov ecx, edi
mov dword [ebp - 0x78], eax
call fcn.12a07278
lea ecx, [ebp - 0x78]
push ecx
push eax
push 2
call sub.SspiCli.dll_GetUserNameExW
movzx ebx, al
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a22dfe
test byte [eax + 0x1c], 2
je 0x12a22dfe
cmp byte [eax + 0x19], 4
jb 0x12a22dfe
push ebx
push 0x12a02fd0
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
push 0xffffffffffffffff
mov ecx, edi
call fcn.12a1ad10
lea ecx, [ebp - 0x70]
call fcn.12a1aeb5
and dword [ebp - 4], 0
cmp ebx, 1
jne 0x12a22ec3
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a22e45
test byte [eax + 0x1c], 2
je 0x12a22e45
cmp byte [eax + 0x19], 4
jb 0x12a22e45
push dword [edi]
push 0x12a02fd0
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a06b9f
mov edi, dword [edi]
push 0
push edi
lea ecx, [ebp - 0x70]
call fcn.12a22b54
movzx ebx, al
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a22e82
test byte [eax + 0x1c], 2
je 0x12a22e82
cmp byte [eax + 0x19], 4
jb 0x12a22e82
push ebx
push 0x12a02fd0
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, dword [0x12a37010]
cmp ebx, 1
jne 0x12a22ec8
lea ecx, [ebp - 0x70]
call fcn.12a22cec
mov edi, dword [ebp - 0x74]
push eax
mov ecx, edi
call fcn.12a083b9
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a22eeb
test byte [eax + 0x1c], 2
je 0x12a22ec8
cmp byte [eax + 0x19], 4
jb 0x12a22ec8
push dword [edi]
push 0x12a02fd0
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a06b9f
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a22eeb
test byte [eax + 0x1c], 1
je 0x12a22eeb
cmp byte [eax + 0x19], 5
jb 0x12a22eeb
push ebx
push 0x12a02fd0
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
lea ecx, [ebp - 0x70]
call fcn.12a1aef4
mov eax, ebx
call fcn.12a1a0c0
ret 8
Function at 0x12a22f02
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x1c
mov eax, 0x12a32ed6
call fcn.12a19fbb
mov eax, dword [0x12a37010]
mov edi, 0x12a37010
cmp eax, edi
je 0x12a22f3a
test byte [eax + 0x1c], 1
je 0x12a22f3a
cmp byte [eax + 0x19], 5
jb 0x12a22f3a
push 0x12a02fd0
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a03957
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push esi
push esi
push esi
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyW]
mov ebx, eax
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a22f8e
test byte [eax + 0x1c], 2
je 0x12a22f8e
cmp byte [eax + 0x19], 4
jb 0x12a22f8e
push ebx
push 0x12a02fd0
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, dword [0x12a37010]
inc dword [ebp - 0x14]
cmp ebx, esi
jne 0x12a230a8
push 0x12a3979c
lea ecx, [ebp - 0x10]
call fcn.12a07196
mov dword [ebp - 4], esi
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a22fd3
test byte [eax + 0x1c], 2
je 0x12a22fd3
cmp byte [eax + 0x19], 4
jb 0x12a22fd3
push dword [ebp - 0x1c]
push 0x12a02fd0
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x1c], esi
jbe 0x12a23098
cmp ebx, esi
jne 0x12a23098
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], eax
call fcn.12a21f27
push eax
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a2303b
test byte [eax + 0x1c], 2
je 0x12a2303b
cmp byte [eax + 0x19], 4
jb 0x12a2303b
push ebx
push 0x12a02fd0
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, ebx
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
push eax
call fcn.12a1ad10
cmp ebx, esi
jne 0x12a23089
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.12a0fca6
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a23089
test byte [eax + 0x1c], 2
je 0x12a23089
cmp byte [eax + 0x19], 4
jb 0x12a23089
push dword [ebp - 0x10]
push 0x12a02fd0
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a06b9f
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jb 0x12a22fdf
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.12a06e65
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a230d9
test byte [eax + 0x1c], 1
je 0x12a230d9
movzx ecx, byte [eax + 0x19]
mov edx, ebx
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x12a230d9
push ebx
push 0x12a02fd0
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, ebx
call fcn.12a1a0a7
ret 8
Function at 0x12a230e8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x18
mov eax, 0x12a32efe
call fcn.12a19fbb
mov eax, dword [0x12a37010]
mov edi, 0x12a37010
cmp eax, edi
je 0x12a23120
test byte [eax + 0x1c], 1
je 0x12a23120
cmp byte [eax + 0x19], 5
jb 0x12a23120
push 0x12a02fd0
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a03957
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyW]
mov ebx, eax
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a23174
test byte [eax + 0x1c], 2
je 0x12a23174
cmp byte [eax + 0x19], 4
jb 0x12a23174
push ebx
push 0x12a02fd0
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, dword [0x12a37010]
inc dword [ebp - 0x10]
cmp ebx, esi
jne 0x12a2326b
push 0x12a3979c
lea ecx, [ebp - 0x1c]
call fcn.12a07196
mov dword [ebp - 4], esi
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a231b9
test byte [eax + 0x1c], 2
je 0x12a231b9
cmp byte [eax + 0x19], 4
jb 0x12a231b9
push dword [ebp - 0x18]
push 0x12a02fd0
push 0x47
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x18], esi
jbe 0x12a2325b
cmp ebx, esi
jne 0x12a2325b
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx]
mov eax, dword [ebp - 0x10]
push esi
push esi
lea ecx, [ebp - 0x24]
push ecx
push esi
lea ecx, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
call fcn.12a21f27
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueW]
mov ebx, eax
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a23224
test byte [eax + 0x1c], 2
je 0x12a23224
cmp byte [eax + 0x19], 4
jb 0x12a23224
push ebx
push 0x12a02fd0
push 0x48
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, ebx
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
call fcn.12a1ad10
cmp ebx, esi
jne 0x12a2324c
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.12a1b26b
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jb 0x12a231c5
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.12a06e65
mov eax, dword [0x12a37010]
cmp eax, edi
je 0x12a2329c
test byte [eax + 0x1c], 1
je 0x12a2329c
movzx ecx, byte [eax + 0x19]
mov edx, ebx
neg edx
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x12a2329c
push ebx
push 0x12a02fd0
push 0x49
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, ebx
call fcn.12a1a0a7
ret 8
Function at 0x12a23597
Capabilities:
Query service status

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [0x12a37010]
mov esi, 0x12a37010
mov edi, 0x12a030d4
cmp eax, esi
je 0x12a235cb
test byte [eax + 0x1c], 1
je 0x12a235cb
push edi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a03957
mov ecx, dword [ebp - 4]
and dword [ebp - 8], 0
push ebx
push 0
call fcn.12a2348c
mov ebx, eax
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a23600
test byte [eax + 0x1c], 2
je 0x12a23600
cmp byte [eax + 0x19], 4
jb 0x12a23600
push ebx
push edi
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
cmp ebx, 1
pop ebx
jne 0x12a23679
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push 0
push dword [eax + 8]
call dword [sym.imp.API_MS_WIN_Service_Management_L2_1_0.dll_QueryServiceStatusEx]
cmp eax, 1
je 0x12a23650
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x12a37010]
cmp ecx, esi
je 0x12a23679
test byte [ecx + 0x1c], 2
je 0x12a23679
cmp byte [ecx + 0x19], 4
jb 0x12a23679
push eax
push edi
push 0x11
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.12a039b3
jmp 0x12a23679
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a23679
test byte [eax + 0x1c], 2
je 0x12a23679
cmp byte [eax + 0x19], 4
jb 0x12a23679
push edi
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a03957
mov ecx, dword [ebp - 4]
call fcn.12a233fc
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a236a7
test byte [eax + 0x1c], 1
je 0x12a236a7
cmp byte [eax + 0x19], 5
jb 0x12a236a7
push dword [ebp - 8]
push edi
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret
Function at 0x12a236b3
Capabilities:
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov dword [ebp - 8], ecx
mov eax, dword [0x12a37010]
mov esi, 0x12a37010
mov edi, 0x12a030d4
cmp eax, esi
je 0x12a236e6
test byte [eax + 0x1c], 1
je 0x12a236e6
push edi
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a03957
mov ecx, dword [ebp - 8]
push 0
call fcn.12a2348c
mov dword [ebp - 4], eax
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a23719
test byte [eax + 0x1c], 2
je 0x12a23719
cmp byte [eax + 0x19], 4
jb 0x12a23719
push dword [ebp - 4]
push edi
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
cmp dword [ebp - 4], 1
jne 0x12a23762
mov eax, dword [ebp - 8]
push 0
push 0
push dword [eax + 8]
call dword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_StartServiceW]
mov dword [ebp - 4], eax
cmp eax, 1
je 0x12a23762
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x12a37010]
cmp ecx, esi
je 0x12a23762
test byte [ecx + 0x1c], 2
je 0x12a23762
cmp byte [ecx + 0x19], 4
jb 0x12a23762
push eax
push edi
push 0x22
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.12a039b3
mov ecx, dword [ebp - 8]
call fcn.12a233fc
mov eax, dword [0x12a37010]
cmp eax, esi
je 0x12a23790
test byte [eax + 0x1c], 1
je 0x12a23790
cmp byte [eax + 0x19], 5
jb 0x12a23790
push dword [ebp - 4]
push edi
push 0x23
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.12a039b3
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x12a26f8a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push dword [ebp + 0x10]
push 0x50
call fcn.12a25ebc
test eax, eax
mov dword [ebp - 4], eax
jne 0x12a26fa5
leave
ret
push ebx
push esi
push edi
cld
mov edi, dword [ebp - 4]
mov eax, 0
mov ecx, 0x50
or ecx, ecx
je 0x12a26fbc
rep stosb byte es:[edi], al
mov eax, dword [ebp - 4]
push 0x14
xor esi, esi
pop ebx
mov eax, esi
shr eax, 2
mov edx, eax
mov eax, dword [ebp - 4]
shl edx, 2
add eax, edx
mov ecx, esi
sub ecx, edx
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
shl ecx, 3
shl edx, cl
or dword [eax], edx
inc esi
cmp esi, ebx
jb 0x12a26fc4
and dword [ebp - 0x24], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x4c], 0x123174bb
mov dword [ebp - 0x48], 0x86521ff8
mov dword [ebp - 0x44], 0x98d2438b
mov dword [ebp - 0x40], 0x7966ce12
mov dword [ebp - 0x3c], 0xc5d92014
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov esi, 0x12a38a64
mov ecx, dword [ebp - 8]
mov eax, edi
cld
or ecx, ecx
je 0x12a27037
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
xor edx, edx
push 5
mov eax, ecx
pop esi
div esi
mov eax, dword [ebp + edx*4 - 0x4c]
xor dword [ebp + ecx*4 - 0x24], eax
inc ecx
cmp ecx, esi
jb 0x12a27039
lea eax, [ebp - 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
cld
or ecx, ecx
je 0x12a27070
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0x10]
lea eax, [ebp - 0x38]
push dword [ebp + 0xc]
push 0
push 0x12a394f4
push dword [0x12a38a78]
push eax
push ebx
push dword [ebp - 4]
call fcn.12a2ed75
lea eax, [ebp - 0x38]
mov byte [eax], 0
inc eax
dec ebx
jne 0x12a27093
mov eax, dword [ebp - 4]
push 0x50
pop ecx
pop edi
pop esi
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x12a270a3
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.12a25edc
xor eax, eax
inc eax
leave
ret
Function at 0x12a29b90
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x12a29ccb
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x12a29ca0
test eax, eax
jne 0x12a29ca0
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x12a29be0
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x12a29ccb
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x12a29ca0
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc