joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010a820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f4575
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10252964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov al, byte [ecx]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
xor edx, edx
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x24], al
xor edi, edi
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
cmp eax, ecx
je 0x1010a8a8
mov esi, ecx
lea ecx, [ebp - 0x24]
sub esi, eax
push esi
call fcn.10094900
mov edi, dword [ebp - 0x20]
push esi
mov esi, dword [ebp - 0x28]
push esi
push edi
call fcn.101d7d20
mov edx, dword [ebp - 0x20]
sub edi, esi
mov esi, dword [ebp - 0x30]
add esp, 0xc
add edi, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 1
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
mov ecx, dword [ecx + 0x10]
mov eax, ecx
not eax
add eax, eax
xor eax, ecx
xor ecx, ecx
mov dword [ebp - 0x14], eax
sub edi, edx
je 0x1010a8e5
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 0x14]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x1010a8d4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x1010a97f
mov eax, dword [ecx]
lea edx, [ebp - 0x24]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
je 0x1010a911
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x1010a903
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1010a95d
mov esi, dword [ebp - 0x18]
sub esi, eax
mov edx, esi
je 0x1010a932
mov ecx, eax
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub edx, 1
jne 0x1010a927
mov dword [ebp - 4], 2
cmp esi, 0x1000
jb 0x1010a953
mov ecx, dword [eax - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1010a97a
mov eax, ecx
push esi
push eax
call fcn.101c1346
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101c1860
mov esp, ebp
pop ebp
ret 4
call fcn.100f24b4
call fcn.101c290d
int3
Function at 0x1010aee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f4674
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10252964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0xebc], 0
lea esi, [edi + 0xebc]
jne 0x1010afd9
mov dword [ebp - 0x14], 0
call fcn.1010c3b0
push eax
lea ecx, [ebp - 0x14]
call fcn.100e1520
cmp byte [esi], 0
mov dword [ebp - 4], 0
jne 0x1010afd1
cmp dword [edi + 0xec0], 0
jne 0x1010af79
push 4
call fcn.101c1316
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x1010af71
mov ecx, eax
mov dword [eax], 0
call fcn.100e14f0
jmp 0x1010af73
xor eax, eax
mov dword [edi + 0xec0], eax
mov dword [ebp - 0x18], esi
mov ecx, edi
mov byte [ebp - 4], 2
mov byte [0x1024fe50], 0xf0
call fcn.10124900
test al, al
jne 0x1010afa1
lea ecx, [ebp - 0x14]
mov byte [esi], 1
call fcn.100e1590
xor al, al
jmp 0x1010afdb
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.1010b140
call fcn.101332c0
test al, al
jne 0x1010afc0
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
call fcn.10131eb0
mov ecx, eax
call fcn.101331b0
mov byte [esi], 1
lea ecx, [ebp - 0x14]
call fcn.100e1590
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101c1860
mov esp, ebp
pop ebp
ret

Function at 0x1011d4d0
Capabilities:
Read file via mapping

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
push dword [esp + 0xc]
call fcn.1011d510
mov ecx, dword [esi + 0x18]
cmp ecx, 0xffffffff
je 0x1011d506
push 0
push 0
push 0
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x1011d501
xor al, al
pop esi
ret 8
mov dword [esi + 0x14], eax
mov al, 1
pop esi
ret 8

Function at 0x1011d9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f7200
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10252964]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [edi], 0x10055574
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov byte [edi + 0x14], 1
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [edi + 0x18], 0x10044c40
lea esi, [edi + 0x34]
mov dword [ebp - 4], 0
push 0x48
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.101c1316
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x3c], fcn.1007dc40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1011de60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f72e0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10252964]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], 0x10055580
mov esi, dword [edi + 0x74]
cmp esi, dword [edi + 0x78]
je 0x1011deac
mov ecx, dword [esi]
test ecx, ecx
je 0x1011dea1
mov eax, dword [ecx]
push 1
call dword [eax]
add esi, 4
cmp esi, dword [edi + 0x78]
jne 0x1011de95
mov esi, dword [edi + 0x74]
lea ecx, [edi + 0x74]
mov dword [edi + 0x78], esi
call fcn.10077320
mov dword [edi + 0x58], 0x10044c38
mov ecx, dword [edi + 0x70]
cmp ecx, 0x10
jb 0x1011df00
mov eax, dword [edi + 0x5c]
inc ecx
mov dword [ebp - 4], 0
cmp ecx, 0x1000
jb 0x1011deef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1011e02a
mov eax, edx
push ecx
push eax
call fcn.101c1346
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0xf
mov byte [edi + 0x5c], 0
mov dword [edi + 0x3c], 0x10044c38
mov ecx, dword [edi + 0x54]
cmp ecx, 0x10
jb 0x1011df5b
mov eax, dword [edi + 0x40]
inc ecx
mov dword [ebp - 4], 1
cmp ecx, 0x1000
jb 0x1011df4a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1011e02a
mov eax, edx
push ecx
push eax
call fcn.101c1346
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0xf
mov byte [edi + 0x40], 0
mov dword [edi + 0x20], 0x10044c38
mov ecx, dword [edi + 0x38]
cmp ecx, 0x10
jb 0x1011dfb6
mov eax, dword [edi + 0x24]
inc ecx
mov dword [ebp - 4], 2
cmp ecx, 0x1000
jb 0x1011dfa5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1011e02a
mov eax, edx
push ecx
push eax
call fcn.101c1346
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0xf
mov byte [edi + 0x24], 0
mov dword [edi + 4], 0x10044c38
mov ecx, dword [edi + 0x1c]
cmp ecx, 0x10
jb 0x1011e006
mov eax, dword [edi + 8]
inc ecx
mov dword [ebp - 4], 3
cmp ecx, 0x1000
jb 0x1011dffc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1011e02a
mov eax, edx
push ecx
push eax
call fcn.101c1346
add esp, 8
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0xf
mov byte [edi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100f24b4
int3
Function at 0x10129cd0
Capabilities:
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x134]
sub esp, 0x134
push 0xffffffffffffffff
push 0x101f8346
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10252964]
xor eax, ebp
mov dword [ebp + 0x130], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x13c]
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea ecx, [ebp + 4]
movq qword [ebp + 4], xmm0
mov dword [ebp + 0xc], 0
call fcn.100dd060
push 0x101
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x10], 1
push 0
push eax
call fcn.101d82a0
add esp, 0xc
mov dword [ebp], 0x101
lea eax, [ebp]
push eax
lea eax, [ebp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x10129ded
mov eax, dword [ebp]
dec eax
mov dword [ebp + 0x24], 0
mov dword [ebp + 0x28], 0xf
mov byte [ebp + 0x14], 0
push eax
lea eax, [ebp + 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x10], 0x10044c38
call fcn.100d60e0
lea eax, [ebp + 4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp + 0x10]
call fcn.100d73c0
mov edx, dword [ebp + 0x28]
mov byte [ebp - 4], 0
mov dword [ebp + 0x10], 0x10044c38
cmp edx, 0x10
jb 0x10129ded
mov ecx, dword [ebp + 0x14]
inc edx
mov eax, ecx
mov byte [ebp - 4], 3
cmp edx, 0x1000
jb 0x10129ddf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10129e9c
push edx
push ecx
call fcn.101c1346
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp + 4]
call fcn.100dd140
mov edx, eax
mov dword [ebp + 0x24], 0
mov ecx, edx
mov dword [ebp + 0x28], 0xf
mov byte [ebp + 0x14], 0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10129e10
sub ecx, esi
push ecx
push edx
lea ecx, [ebp + 0x14]
call fcn.1007e870
lea eax, [ebp + 0x14]
mov byte [ebp - 4], 4
push eax
lea eax, [edi + 0x1d0]
push eax
call fcn.101681d0
mov edx, dword [ebp + 0x28]
add esp, 8
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x10129e72
mov ecx, dword [ebp + 0x14]
inc edx
mov eax, ecx
mov byte [ebp - 4], 5
cmp edx, 0x1000
jb 0x10129e68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10129ea1
push edx
push ecx
call fcn.101c1346
add esp, 8
lea ecx, [ebp + 4]
call fcn.10077210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x130]
xor ecx, ebp
call fcn.101c1860
lea esp, [ebp + 0x134]
pop ebp
ret
call fcn.100f24b4
call fcn.100f24b4
int3
Function at 0x1012ae10
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10252964]
xor eax, esp
mov dword [esp + 0x104], eax
push edi
mov edi, ecx
mov al, byte [edi + 0x224]
test al, al
jne 0x1012afeb
push ebx
push esi
push pe_nt_image_headers32
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.101d82a0
add esp, 0xc
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
push 0x1005658c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x1012afe7
test esi, esi
je 0x1012afe7
cmp esi, 0x20
jae 0x1012afe7
mov ecx, 0x10056598
lea eax, [esp + 0x10]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1012aeb0
test dl, dl
je 0x1012aeac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1012aeb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1012ae90
xor eax, eax
jmp 0x1012aeb5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1012afe7
mov ecx, 0x100565a0
lea eax, [esp + 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1012aee6
test dl, dl
je 0x1012aee2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1012aee6
add eax, 2
add ecx, 2
test dl, dl
jne 0x1012aec6
xor eax, eax
jmp 0x1012aeeb
sbb eax, eax
or eax, 1
test eax, eax
je 0x1012afe7
mov ecx, 0x100565a8
lea eax, [esp + 0x10]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1012af20
test dl, dl
je 0x1012af1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1012af20
add eax, 2
add ecx, 2
test dl, dl
jne 0x1012af00
xor eax, eax
jmp 0x1012af25
sbb eax, eax
or eax, 1
test eax, eax
je 0x1012afe7
push 8
lea eax, [esp + 0x14]
push 0x100565b0
push eax
call fcn.100f5c60
add esp, 0xc
test eax, eax
jne 0x1012af9f
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebx
push eax
lea eax, [esp + 0x14]
push 0x100565bc
push eax
call fcn.1013bd00
add esp, 0xc
cmp eax, 1
jne 0x1012af81
mov eax, dword [esp + 0xc]
inc eax
and eax, 0x800000ff
jns 0x1012af78
dec eax
or eax, 0xffffff00
inc eax
movzx ebx, byte [eax + 0x10056120]
jmp 0x1012afbb
xor edx, edx
test esi, esi
je 0x1012afc2
movsx ecx, byte [esp + edx + 0x10]
inc edx
movzx eax, bx
xor ecx, eax
movzx ebx, byte [ecx + 0x10056120]
cmp edx, esi
jb 0x1012af87
jmp 0x1012afbb
xor edx, edx
test esi, esi
je 0x1012afc2
movsx ecx, byte [esp + edx + 0x10]
inc edx
movzx eax, bx
xor ecx, eax
movzx ebx, byte [ecx + 0x10056120]
cmp edx, esi
jb 0x1012afa5
xor eax, eax
cmp ax, bx
jne 0x1012afc7
mov ebx, 0xff
pop esi
mov byte [edi + 0x224], bl
mov al, bl
pop ebx
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.101c1860
add esp, 0x108
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x108]
pop edi
xor ecx, esp
call fcn.101c1860
add esp, 0x108
ret
Function at 0x10130b80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f8e55
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10252964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], edi
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], 0
call fcn.100dd060
push 0x8010
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1007e370
push 0x8000
mov esi, eax
mov dword [ebp - 0x18], 0x8000
push 0
push esi
mov dword [ebp - 0x14], 0x800f
call fcn.101d82a0
mov byte [esi + 0x8000], 0
add esp, 0xc
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 0x10044c38
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, esi
mov byte [ebp - 4], 2
push eax
push 0x10056220
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x10130cc8
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.100dcf70
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
mov dword [ebp - 0x2c], 0x10044c38
cmp edx, 0x10
jb 0x10130c91
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 3
cmp edx, 0x1000
jb 0x10130c87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10130d27
push edx
push ecx
call fcn.101c1346
add esp, 8
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.10077210
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101c1860
mov esp, ebp
pop ebp
ret
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.10080460
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100d73c0
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.100dcf70
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
mov dword [ebp - 0x2c], 0x10044c38
cmp edx, 0x10
jb 0x10130c91
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
mov byte [ebp - 4], 4
cmp edx, 0x1000
jb 0x10130c87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10130c87
call fcn.100f24b4
int3
Function at 0x101332c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f92ed
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10252964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1024ff50], 0xffffffff
jne 0x1013334b
mov dword [ebp - 0x14], 0
call fcn.10137cb0
push eax
lea ecx, [ebp - 0x14]
call fcn.100e1520
cmp dword [0x1024ff50], 0xffffffff
mov dword [ebp - 4], 0
je 0x10133325
lea ecx, [ebp - 0x14]
mov bl, 1
call fcn.100e1590
mov al, bl
jmp 0x1013334d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x1013333e
lea ecx, [ebp - 0x14]
xor bl, bl
call fcn.100e1590
mov al, bl
jmp 0x1013334d
lea ecx, [ebp - 0x14]
mov dword [0x1024ff50], eax
call fcn.100e1590
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101c1860
mov esp, ebp
pop ebp
ret
Function at 0x1013d540
Capabilities:
Query service status

Disassembly:
sub esp, 0x20
mov eax, dword [0x10252964]
xor eax, esp
mov dword [esp + 0x1c], eax
imul ecx, dword [esp + 0x24], 0x3e8
mov eax, 0x51eb851f
push ebx
push ebp
push esi
push reloc.WS2_32.dll_accept
mul ecx
push 0
mov esi, edx
xor bh, bh
push 0
shr esi, 5
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x1013d5ff
push edi
push accept
push 0x10056680
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x1013d5f7
mov bl, byte [esp + 0x38]
nop dword [eax]
lea eax, [esp + 0x10]
mov dword [esp + 0x28], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [esp + 0x18], xmm0
movq qword [esp + 0x28], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1013d5f0
mov eax, dword [esp + 0x14]
cmp eax, 2
je 0x1013d5dd
cmp eax, 4
je 0x1013d5ee
test bl, bl
jne 0x1013d5f0
test esi, esi
je 0x1013d5f0
dec esi
push 0x64
call fcn.100e14e0
add esp, 4
cmp dword [esp + 0x14], 4
jne 0x1013d5a0
mov bh, 1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov ecx, dword [esp + 0x28]
mov al, bh
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101c1860
add esp, 0x20
ret 8
Function at 0x1013d620
Capabilities:
Check if process is running under wine
Get file version info

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10252964]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, ecx
cmp byte [esi + 8], 1
jne 0x1013d64a
mov al, byte [esi + 9]
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101c1860
add esp, 0x1c
ret
mov eax, dword [0x10056634]
mov dword [esp + 0x14], eax
mov ax, word [0x10056638]
push ebx
mov word [esp + 0x1c], ax
xor bl, bl
push ebp
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0
push eax
mov dword [esp + 0x20], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
test ebp, ebp
je 0x1013d70b
xor edx, edx
mov ecx, ebp
add ecx, 0x32
push edi
setb dl
neg edx
or edx, ecx
push edx
call fcn.100f58b0
mov edi, eax
add esp, 4
test edi, edi
je 0x1013d70a
push edi
push ebp
push dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1013d701
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
push 0x1005663c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1013d701
cmp dword [esp + 0x1c], 0
je 0x1013d701
push 4
push 0x10056664
push dword [esp + 0x18]
call fcn.100f5c60
add esp, 0xc
movzx ebx, bl
test eax, eax
mov ecx, 1
cmove ebx, ecx
push edi
call fcn.100f260c
add esp, 4
pop edi
lea eax, [esp + 0x10]
push eax
push 1
push 0
push 0x1005666c
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1013d74e
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
mov byte [esi + 8], 1
mov al, 1
mov byte [esi + 9], 1
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101c1860
add esp, 0x1c
ret
mov byte [esi + 8], 1
cmp bl, 1
jne 0x1013d76e
pop ebp
mov byte [esi + 9], bl
mov al, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.101c1860
add esp, 0x1c
ret
mov al, byte [esi + 9]
mov ecx, dword [esp + 0x24]
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.101c1860
add esp, 0x1c
ret
Function at 0x10141d10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
xor ecx, ecx
push ebx
xor bl, bl
test edx, edx
je 0x10141dc8
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
cmp edx, 0x20
jb 0x10141dab
push edi
mov edi, edx
lea eax, [ebp + 0x10]
mov ebx, esi
and edi, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
sub ebx, ebp
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + esi]
add ecx, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [ebx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp ecx, edi
jb 0x10141d43
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd ebx, xmm2
pop edi
cmp ecx, edx
jae 0x10141dc2
sub esi, ebp
lea eax, [ecx + ebp]
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or bl, cl
sub edx, 1
jne 0x10141db2
pop esi
pop ebp
mov al, bl
pop ebx
ret
mov al, bl
pop ebx
ret

Function at 0x10141ea0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
xor ecx, ecx
test edx, edx
je 0x10141f64
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
cmp edx, 0x40
jb 0x10141f4c
lea eax, [edx - 1]
lea ebx, [edx - 1]
add eax, esi
add ebx, edi
cmp edi, eax
ja 0x10141ed5
cmp ebx, esi
jae 0x10141f4c
push ebp
mov ebp, edx
lea ebx, [esi + 0x30]
mov edx, esi
lea eax, [edi + 0x10]
and ebp, 0xffffffc0
sub edx, edi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x10]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x40
lea ebx, [ebx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [esi + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ebx - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, ebp
jb 0x10141ef1
mov esi, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
pop ebp
cmp ecx, edx
jae 0x10141f61
sub esi, edi
lea eax, [ecx + edi]
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x10141f53
pop edi
pop esi
pop ebx
pop ecx
ret