Function at 0x100370fe
Capabilities:
Encode data using xor
Query service status

Disassembly:
mov eax, 0x100596e1
call fcn.10057e90
sub esp, 0x168
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0x10], bl
je 0x10037a9f
movdqa xmm0, xmmword [0x10065cb0]
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x68], edx
lea ecx, [ebp - 0x84]
push dword [ebp - 0x68]
mov dword [ebp - 0x8c], 0xd8cb4c23
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x84], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call fcn.10006820
push ecx
lea eax, [ebp - 0x84]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x88], 3
push eax
lea edx, [ebp - 0x88]
call fcn.10038d93
add esp, 8
mov byte [ebp - 0x29], bl
lea edx, [ebp - 0x29]
mov ecx, 0x137
call fcn.10038455
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x84]
call fcn.1000140a
push 0x7c
pop eax
push 2
mov dword [ebp - 0x44], 0x4804d900
mov ecx, ebx
mov word [ebp - 0x40], 0x9b3
mov byte [ebp - 0x3e], 0x52
mov word [ebp - 0x3c], ax
pop esi
cmp esi, 2
jne 0x100371d8
push 5
pop ecx
push ecx
pop esi
jmp 0x10037201
movzx edx, byte [ebp + esi - 0x43]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x46]
movzx ecx, word [ebp + eax*2 - 0x3c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x44]
add ecx, edx
mov word [ebp + eax*2 - 0x3c], cx
mov ecx, ebx
add esi, 2
cmp esi, 7
jb 0x100371cc
xor eax, eax
mov dword [ebp - 0x108], 7
mov word [ebp - 0x3a], ax
lea ecx, [ebp - 0x11c]
mov word [ebp - 0x11c], ax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x10c], ebx
call fcn.1000ed02
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 1
call fcn.10036f2d
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.10004836
mov dword [ebp - 0x1c], 0x24f84b81
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x24], 0x7c4c
cmp dword [ebp - 0x24], 0x7d94
jle 0x100372f6
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], esi
and esi, edi
mov dword [ebp - 0x48], ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x15c]
xor eax, edi
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100372ba
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x15c]
call fcn.10001542
inc edi
cmp edi, 0x5488
jl 0x1003729e
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4ad4
jl 0x10037294
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x6208
jl 0x1003728f
cmp dword [ebp - 0x24], 0x78c7
jge 0x1003730a
push str.wem_rkfsp_zggz
call fcn.10040c20
pop ecx
mov dword [ebp - 4], 3
mov dword [ebp - 0x24], 0xe21a
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10037335
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf0], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10037324
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x24]
je 0x10037399
mov ecx, dword [ebp - 0xe8]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 0xfffffff9
mov edx, dword [ebp - 0xe8]
setle al
sub edx, eax
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
add edx, 0xffff1509
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
inc edx
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x20]
je 0x10037399
xor eax, eax
inc eax
jmp 0x1003739b
mov eax, ebx
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x28], 0xb9e
cmp dword [ebp - 0x28], 0xc67
jle 0x10037415
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, esi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x24], ebx
shl edi, cl
mov esi, ebx
mov ebx, dword [ebp - 0x24]
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x10073038
xor eax, edi
cdq
push edx
push eax
call fcn.10004272
inc esi
cmp esi, 0x50f9
jl 0x100373ca
inc ebx
push 0
mov dword [ebp - 0x24], ebx
cmp ebx, 0x30fb
pop ebx
jl 0x100373c5
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5aa3
jl 0x100373bb
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1203
jl 0x100373b6
mov dword [ebp - 0x20], 0xffffffe9
jmp 0x100374c5
mov dword [ebp - 0x6c], 0x857617c0
cmp dword [ebp - 0x6c], ebx
je 0x100374a0
mov dword [ebp - 0x48], 6
lea ecx, [ebp - 0xc8]
push 2
call fcn.100013ad
push 0x3cca
push ebx
push 0x17d2
push 0x3f89
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 6
push ecx
xor eax, eax
lea ecx, [ebp - 0xc8]
push ecx
inc eax
mov edx, 0x4a7c
push eax
push 0x6383
push 0x15b
push eax
mov dword [ebp - 0x24], eax
mov ecx, 0x6d29
push 0x3ef3
call fcn.10038502
add esp, 0x2c
lea ecx, [ebp - 0xc8]
inc dword [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.1000140a
jmp 0x100374c2
push 1
push ecx
push 0x2da0
lea eax, [ebp - 0x6c]
mov edx, 0x5cce
push eax
push ecx
mov ecx, 0x518e
call fcn.100370d5
mov eax, dword [ebp - 0x14]
add esp, 0x14
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x25
jl 0x10037421
mov byte [ebp - 4], 7
cmp dword [ebp - 0x28], 0xb05
jge 0x10037509
mov edx, str.stwgairo_itpthq_wcjkfin_qfdu_svbajoj_fiputjund_ybz
mov ecx, 0x10073038
call fcn.100062fd
jmp 0x10037509
mov dword [ebp - 4], 3
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0x84b81147
mov dword [ebp - 0x28], 0x5050
cmp dword [ebp - 0x28], 0x52ed
jle 0x10037574
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x14], ebx
lea ecx, [ebx + esi]
mov eax, edi
shl eax, cl
mov ecx, 0x10073038
cdq
push edx
push eax
call fcn.10004272
inc ebx
cmp ebx, 0x30c2
jl 0x10037542
inc esi
push 0
pop ebx
cmp esi, 0x779b
jl 0x1003753f
inc edi
cmp edi, 0x42a6
jl 0x1003753d
mov dword [ebp - 0x14], 0x39ed080c
mov byte [ebp - 4], 9
cmp dword [ebp - 0x28], 0x4c94
jge 0x100375b5
mov edx, str.oqz_waaseffpe_vkewisgdu_nmokk_mwomhkx_fwxakb_son_eimhdqr_iovjr
mov ecx, 0x10073038
call fcn.100062fd
jmp 0x100375b5
mov dword [ebp - 4], 3
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x14], 0x34eea2a3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x14], 0x5bfc88eb
mov dword [ebp - 0x14], 0x76038591
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], 0x65420764
mov dword [ebp - 0x24], 0x7bb0
cmp dword [ebp - 0x24], 0x7e5a
jle 0x1003765e
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov edi, esi
mov esi, 0x77f3
mov eax, edi
lea ecx, [ebp - 0x144]
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037636
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x144]
call fcn.10001542
dec edi
dec esi
jne 0x1003761c
mov esi, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x2639
jl 0x10037615
mov dword [ebp - 0x14], 0xc54c9751
cmp dword [ebp - 0x24], 0x786f
jge 0x10037679
push str.ktzhgpi_qwkbzwqw_pqbmu_njhox_fya_wjntyag_pnk_goi_aocv
call fcn.10040c20
pop ecx
mov dword [ebp - 4], 3
mov dword [ebp - 0x14], 0xdcee34ed
mov dword [ebp - 0x14], 0x13e19f23
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x1c], 0xf0ebf903
mov dword [ebp - 0x18], 0x689e
cmp dword [ebp - 0x18], 0x6c40
jle 0x1003770c
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], 0x1a8d
mov eax, esi
lea ecx, [ebp - 0x174]
or eax, edi
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100376d9
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x174]
call fcn.10001542
dec esi
dec dword [ebp - 0x28]
jne 0x100376bd
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x331c
jl 0x100376b3
inc edi
cmp edi, 0x4b2b
jl 0x100376ae
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 0x66fc
jge 0x10037723
push str.holpvw_cmelpuhng_keeljbxl_dacejlp_aembqxhxj_nghdp_luyl_mqfzcxdl
call fcn.10040c20
pop ecx
mov dword [ebp - 4], 3
mov ecx, ebx
push 0xa
pop eax
push 2
mov dword [ebp - 0x60], 0x701bd02
mov dword [ebp - 0x5c], 0x90042d03
mov word [ebp - 0x58], 0xf5fe
mov byte [ebp - 0x56], 5
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0x29
mov word [ebp - 0x74], ax
pop esi
mov dword [ebp - 0x64], ecx
cmp esi, 6
jne 0x10037768
push 5
pop ecx
push 9
mov dword [ebp - 0x64], ecx
pop esi
jmp 0x100377a6
movzx edx, byte [ebp + esi - 0x5f]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x62]
movzx ecx, word [ebp + eax*2 - 0x78]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x60]
add ecx, edx
lea edx, [ebp - 0x64]
push ecx
push ecx
mov word [ebp + eax*2 - 0x78], cx
mov ecx, 0x7354
push 1
call fcn.10037007
mov ecx, dword [ebp - 0x64]
add esp, 0xc
add esi, 2
cmp esi, 0xd
jb 0x10037758
xor eax, eax
lea ecx, [ebp - 0x104]
mov word [ebp - 0x70], ax
inc eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x4c], 0x24b54114
mov dword [ebp - 0x34], 0x67457993
push eax
call fcn.100013ad
push 0x5d3
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0xf
push ebx
push eax
mov edx, 0x529e
lea ecx, [ebp - 0x30]
call fcn.10037b4e
add esp, 0xc
mov dword [ebp - 0x30], ebx
jmp 0x10037810
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x94], 0x45cb296a
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x100377ff
lea eax, [ebp - 0x4c]
mov edx, 0x11cb
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
push ecx
push ecx
lea eax, [ebp - 0x50]
push eax
push ecx
push 1
mov ecx, 0x4d1a
call fcn.1003704b
add esp, 0x20
mov dword [ebp - 0x34], ebx
mov edi, 0xb108f980
cmp dword [ebp - 0x34], ebx
jg 0x10037a1c
mov dword [ebp - 0x18], 0xda781b5f
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x20], 0xc5a4a104
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x98], edi
push 1
call fcn.100013ad
push ecx
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x10
push eax
push 0x1c79
mov edx, 0x5425
lea ecx, [ebp - 0xf8]
call fcn.10039188
add esp, 0xc
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x38], ebx
jl 0x10037977
mov dword [ebp - 0x1c], 0x2a6add33
xor edx, edx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x4c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, 0x40a9711f
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10037913
cmp dword [ebp - 0x1c], ebx
je 0x10037913
xor eax, eax
inc eax
jmp 0x10037915
mov eax, ebx
add eax, 0xcc6a3362
xor edx, edx
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
cmp dword [ebp - 0x4c], edx
je 0x1003793b
cmp dword [ebp - 0x18], ebx
jne 0x1003793b
mov eax, ebx
jmp 0x1003793e
xor eax, eax
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x50], ebx
je 0x10037953
cmp dword [ebp - 0x1c], ebx
je 0x10037953
xor eax, eax
inc eax
jmp 0x10037955
mov eax, ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x20], ebx
jmp 0x10037969
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x1003795d
dec dword [ebp - 0x38]
jns 0x100378b1
mov dword [ebp - 0x28], 0x5a62
cmp dword [ebp - 0x28], 0x5b2e
jle 0x100379b5
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10073038
cdq
push edx
push eax
call fcn.10004272
inc edi
cmp edi, 0x2ce2
jl 0x1003798b
inc esi
cmp esi, 0x347c
jl 0x10037989
mov edi, 0xb108f980
mov dword [ebp - 0xa0], 1
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x28], 0x5964
jge 0x100379fe
mov edx, str.dipquv_ulgbbo_llvfvxe_jqwyfmpnd_ypojkikt_uln_lvbrcb_ebi_qucdnfcz
mov ecx, 0x10073038
call fcn.100062fd
jmp 0x100379fe
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0xf
call fcn.1000140a
inc dword [ebp - 0x34]
jmp 0x10037845
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 3
call fcn.1000140a
xor eax, eax
mov dword [ebp - 0xcc], 7
mov word [ebp - 0xe0], ax
lea ecx, [ebp - 0xe0]
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd0], ebx
push eax
call fcn.1000ed02
xor eax, eax
mov byte [ebp - 4], 0x13
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xe0]
push eax
push ecx
lea ecx, [ebp - 0xb0]
call fcn.10037eed
pop ecx
pop ecx
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0xb0]
push eax
call fcn.1003a82a
push ebx
push 1
lea ecx, [ebp - 0xe0]
call fcn.10004836
lea ecx, [ebp - 0xb0]
call fcn.1003abe1
jmp 0x10037ac2
mov byte [ebp - 0x2a], bl
cmp byte [ebp - 0x2a], bl
je 0x10037ac2
push ecx
push 0x5e58
push ecx
push ecx
push ebx
mov edx, 0x5b9
mov ecx, 0x5b50
call fcn.10039109
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret