joyce8/EMBER2024-capa huggingface dataset:
Function at 0x694c90
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push esi
mov esi, 0x791190
cmp dword [esi], 0
je 0x694c8e
xor ecx, ecx
mov edx, 0x694e50
mov eax, dword [esi]
call fcn.005714a8
push 0
push 1
push 0x694e90
call sub.wininet.dll_InternetCheckConnectionW
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [esi], 0
je 0x694cb5
xor ecx, ecx
mov edx, 0x694ed0
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694ccf
push 0
push 1
push 0x694f18
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694ccf
xor eax, eax
jmp 0x694cd1
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694ce6
xor ecx, ecx
mov edx, 0x694f5c
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694d00
push 0
push 1
push 0x694fa8
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694d00
xor eax, eax
jmp 0x694d02
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694d17
xor ecx, ecx
mov edx, 0x694fec
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694d31
push 0
push 1
push 0x695038
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694d31
xor eax, eax
jmp 0x694d33
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694d48
xor ecx, ecx
mov edx, 0x695084
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694d62
push 0
push 1
push 0x6950d8
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694d62
xor eax, eax
jmp 0x694d64
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694d79
xor ecx, ecx
mov edx, 0x695124
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694d93
push 0
push 1
push 0x695178
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694d93
xor eax, eax
jmp 0x694d95
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694daa
xor ecx, ecx
mov edx, 0x6951c8
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694dc4
push 0
push 1
push 0x695224
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694dc4
xor eax, eax
jmp 0x694dc6
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694ddb
xor ecx, ecx
mov edx, 0x695274
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694df5
push 0
push 1
push 0x6952d0
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694df5
xor eax, eax
jmp 0x694df7
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694e0c
xor ecx, ecx
mov edx, 0x695308
mov eax, dword [esi]
call fcn.005714a8
test bl, bl
jne 0x694e26
push 0
push 1
push 0x695348
call sub.wininet.dll_InternetCheckConnectionW
test eax, eax
jne 0x694e26
xor eax, eax
jmp 0x694e28
mov al, 1
mov ebx, eax
cmp dword [esi], 0
je 0x694e3d
xor ecx, ecx
mov edx, 0x695380
mov eax, dword [esi]
call fcn.005714a8
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x695b20
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x695ca1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x695c7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor esi, esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x190]
push eax
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x695bb2
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System__GetMem_qqri
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
jne 0x695bc8
mov esi, edi
cmp dword [esi + 0x40], 6
jne 0x695bc8
mov bl, 1
lea edx, [ebp - 4]
mov eax, dword [esi + 0x24]
call sub.rtl120.bpl__Sysutils_StrPas_qqrpxb
jmp 0x695bc8
cmp dword [ebp - 0x150], 6
jne 0x695bc8
mov bl, 1
lea edx, [ebp - 4]
mov eax, dword [esi + 0x24]
call sub.rtl120.bpl__Sysutils_StrPas_qqrpxb
test bl, bl
je 0x695c68
mov dl, 1
mov eax, dword [0x69da88]
call fcn.0069e1a0
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x14]
mov ecx, 4
mov edx, dword [0x791188]
call fcn.0067b698
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x695c60
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0069e158
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_SameText_qqrx20System_UnicodeStringt1
test al, al
je 0x695c5c
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0069e158
cmp byte [eax + 0x8f], 1
jne 0x695c5c
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0069e158
mov edx, dword [eax + 0x78]
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0069e158
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov byte [ebp - 0xd], 1
inc ebx
dec esi
jne 0x695c02
lea eax, [ebp - 0x14]
call fcn.00413b0c
test edi, edi
je 0x695c73
mov eax, edi
call sub.rtl120.bpl__System__FreeMem_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x695c8b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x695ca8
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x697ef4
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x188], eax
xor eax, eax
push ebp
push 0x6980c0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x698098
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x180]
push eax
push 0
push 0x80
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x69808e
mov eax, dword [ebp - 4]
push eax
call sub.rtl120.bpl__System_GetMemory_qi
pop ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 2
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
jne 0x698084
mov esi, dword [ebp - 8]
test esi, esi
je 0x698084
cmp dword [esi + 0x44], 1
jne 0x698079
mov ebx, dword [esi + 0x1c]
xor edi, edi
test ebx, ebx
je 0x697fab
inc edi
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x697fa3
test edi, edi
jle 0x698079
cmp dword [0x791190], 0
je 0x697ff2
lea eax, [ebp - 0x188]
mov edx, dword [esi + 0x28]
call sub.rtl120.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov ecx, dword [ebp - 0x188]
lea eax, [ebp - 0x184]
mov edx, 0x6980dc
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x184]
xor ecx, ecx
mov eax, dword [0x791190]
call fcn.005714a8
cmp dword [esi + 0x40], 0x47
jne 0x698014
cmp dword [0x791190], 0
je 0x698079
xor ecx, ecx
mov edx, 0x698100
mov eax, dword [0x791190]
call fcn.005714a8
jmp 0x698079
cmp dword [esi + 0x40], 6
jne 0x698036
cmp dword [0x791190], 0
je 0x698079
xor ecx, ecx
mov edx, 0x698158
mov eax, dword [0x791190]
call fcn.005714a8
jmp 0x698079
cmp dword [0x791190], 0
je 0x698079
mov eax, dword [esi + 0x40]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x190]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
mov ecx, dword [ebp - 0x190]
lea eax, [ebp - 0x18c]
mov edx, 0x6981bc
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x18c]
xor ecx, ecx
mov eax, dword [0x791190]
call fcn.005714a8
mov esi, dword [esi + 8]
test esi, esi
jne 0x697f90
mov eax, dword [ebp - 8]
push eax
call sub.rtl120.bpl__System_FreeMemory_qpv
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6980a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6980c7
lea eax, [ebp - 0x190]
mov edx, 4
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x69b98c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x69b994
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x69bbf5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
xor eax, eax
call fcn.004134cc
cmp eax, 1
je 0x69bbda
cmp eax, 2
je 0x69bbda
cmp eax, 8
je 0x69bbda
cmp eax, 0x10
je 0x69bbda
cmp dword [0x7d5a30], 5
je 0x69ba28
cmp dword [0x7d5a30], 6
je 0x69ba28
cmp dword [0x7d5a30], 7
je 0x69ba28
cmp dword [0x7d5a30], 9
je 0x69ba28
cmp dword [0x7d5a30], 0xb
je 0x69ba28
cmp dword [0x7d5a30], 0xc
je 0x69ba28
cmp dword [0x7d5a30], 0xd
je 0x69ba28
cmp dword [0x7d5a30], 2
jne 0x69bbda
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x69ba8a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x791190], 0
je 0x69ba6f
lea edx, [ebp - 0x10]
mov eax, dword [0x7d5a30]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x69bc10
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [0x791190]
call fcn.005714a8
mov eax, dword [ebp - 4]
push eax
push 0x69be14
call fcn.0068827c
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x69bae1
cmp byte [ebp - 5], 0
je 0x69bbda
cmp dword [0x791190], 0
je 0x69bb20
lea edx, [ebp - 0x20]
mov eax, dword [0x7d5a30]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x69bcac
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [0x791190]
call fcn.005714a8
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0xa
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0xea60
jb 0x69bb27
cmp dword [0x791190], 0
je 0x69bb56
xor ecx, ecx
mov edx, 0x69bd00
mov eax, dword [0x791190]
call fcn.005714a8
mov edx, 0x69bd54
mov eax, dword [ebp - 4]
call fcn.0069d6bc
test al, al
jne 0x69bb81
mov edx, 0x69bd78
mov eax, dword [ebp - 4]
call fcn.0069d6bc
test al, al
jne 0x69bb81
call fcn.00694c74
test al, al
je 0x69bbc0
mov dword [0x7d5a30], 0xe
cmp dword [0x791190], 0
je 0x69bbc0
lea edx, [ebp - 0x28]
mov eax, dword [0x7d5a30]
call sub.rtl120.bpl__Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x69bd98
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [0x791190]
call fcn.005714a8
cmp dword [0x791190], 0
je 0x69bbda
xor ecx, ecx
mov edx, 0x69bde8
mov eax, dword [0x791190]
call fcn.005714a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69bbfc
lea eax, [ebp - 0x28]
mov edx, 8
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x6a27d4
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6a289e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x6a287b
push 0xf01ff
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
je 0x6a287b
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6a287b
mov ebx, dword [ebp - 0x20]
cmp ebx, 4
je 0x6a287b
push 0x6a28bc
push dword [ebp - 4]
push 0x6a2908
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call sub.rtl120.bpl__Sysutils_IntToStr_qqrj
push dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 4
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x28]
call fcn.006a247c
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a28a5
lea eax, [ebp - 0x2c]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x6a2b58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a2c54
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.006a25a0
test al, al
je 0x6a2bc4
push 0
push 0
lea eax, [ebp - 4]
mov ecx, ebx
mov edx, 0x6a2c70
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6a2c80
push 0x6a2c90
push 0
call sub.shell32.dll_ShellExecuteW
lea eax, [ebp - 8]
mov ecx, ebx
mov edx, 0x6a2ca8
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 8]
call fcn.006a247c
mov bl, 1
jmp 0x6a2c39
mov eax, ebx
call fcn.006a2940
test al, al
je 0x6a2c17
push 0
push 0
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 0x6a2c70
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x6a2c80
push 0x6a2c90
push 0
call sub.shell32.dll_ShellExecuteW
lea eax, [ebp - 0x10]
mov ecx, ebx
mov edx, 0x6a2ca8
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 0x10]
call fcn.006a247c
mov bl, 1
jmp 0x6a2c39
push 0x6a2d0c
push ebx
push 0x6a2d40
lea eax, [ebp - 0x14]
mov edx, 3
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x14]
call fcn.006a247c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a2c5b
lea eax, [ebp - 0x14]
mov edx, 5
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x6e0e68
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffec0
xor ebx, ebx
mov eax, esp
mov edx, 0x11c
call fcn.004024a4
lea eax, [esp + 0x11c]
mov edx, 0x24
call fcn.004024a4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x6e0f9b
mov eax, dword [esp + 4]
cmp eax, 3
jne 0x6e0eb6
mov bl, 1
jmp 0x6e0f9b
cmp eax, 4
jne 0x6e0ec2
mov bl, 1
jmp 0x6e0f9b
cmp eax, 5
jne 0x6e0f60
mov eax, dword [esp + 8]
sub eax, 1
jb 0x6e0ede
je 0x6e0ee5
dec eax
je 0x6e0eec
jmp 0x6e0f9b
mov bl, 2
jmp 0x6e0f9b
mov bl, 3
jmp 0x6e0f9b
push 0x6e0fa8
push 0x6e0fd0
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.00401b80
test eax, eax
je 0x6e0f11
lea edx, [esp + 0x11c]
push edx
call eax
jmp 0x6e0f1e
lea eax, [esp + 0x11c]
push eax
call sub.kernel32.dll_GetSystemInfo
cmp byte [esp + 0x11a], 1
jne 0x6e0f37
cmp word [esp + 0x11c], 9
jne 0x6e0f37
mov bl, 3
jmp 0x6e0f9b
push 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x6e0f46
mov bl, 6
jmp 0x6e0f9b
movzx eax, word [esp + 0x118]
and ax, 0x8000
cmp ax, 0x8000
jne 0x6e0f5c
mov bl, 5
jmp 0x6e0f9b
mov bl, 4
jmp 0x6e0f9b
cmp eax, 6
jne 0x6e0f9b
mov eax, dword [esp + 8]
sub eax, 1
jb 0x6e0f75
je 0x6e0f87
dec eax
je 0x6e0f99
jmp 0x6e0f9b
cmp byte [esp + 0x11a], 1
je 0x6e0f83
mov bl, 8
jmp 0x6e0f9b
mov bl, 7
jmp 0x6e0f9b
cmp byte [esp + 0x11a], 1
je 0x6e0f95
mov bl, 9
jmp 0x6e0f9b
mov bl, 0xa
jmp 0x6e0f9b
mov bl, 0xb
mov eax, ebx
add esp, 0x140
pop ebx
ret
Function at 0x6e1a10
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6e1aaf
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x6e1a8f
push 4
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
jbe 0x6e1a85
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6e1a7f
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
jmp 0x6e1a94
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e1ab6
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x6e1b28
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6e1c30
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x6e1c0e
push 0x14
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x6e1c08
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x6e1c02
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6e1c02
xor edi, edi
jmp 0x6e1bfc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp edi, 0x1f4
ja 0x6e1c02
cmp dword [ebp - 0x14], 0x64
jbe 0x6e1bd4
push 0x64
call sub.kernel32.dll_Sleep_1
add edi, 0x64
jmp 0x6e1be0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_Sleep_1
add edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6e1c02
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jb 0x6e1c02
cmp dword [ebp - 0x18], 0
je 0x6e1c02
cmp dword [ebp - 0x28], 4
jne 0x6e1bb4
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x28], 4
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e1c37
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x6e1c40
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x6e1d38
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x6e1d16
push 0x24
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jbe 0x6e1d10
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x6e1d0a
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6e1d0a
xor edi, edi
jmp 0x6e1d04
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp edi, 0x1f4
ja 0x6e1d0a
cmp dword [ebp - 0x10], 0x64
jbe 0x6e1ce2
push 0x64
call sub.kernel32.dll_Sleep_1
add edi, 0x64
jmp 0x6e1cee
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_Sleep_1
add edi, dword [ebp - 0x10]
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6e1d0a
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jbe 0x6e1d0a
cmp dword [ebp - 0x24], 1
jne 0x6e1cc2
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x24], 1
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e1d3f
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x6e7c30
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, edi
call sub.rtl120.bpl__System__UStrLen_qqrx20System_UnicodeString
mov ebx, eax
inc ebx
mov eax, ebx
call sub.rtl120.bpl__Sysutils_StrAlloc_qqrui
mov dword [ebp - 0xc], eax
mov edx, ebx
add edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004024a4
mov ecx, ebx
mov edx, edi
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_StrPLCopy_qqrpbx20System_UnicodeStringui
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.004024a4
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.004024a4
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
movzx eax, word [ebp - 4]
mov word [ebp - 0x28], ax
xor edx, edx
push ebp
push 0x6e7dbb
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x6e7cf0
call sub.rtl120.bpl__System__TryFinallyExit_qqrv
jmp 0x6e7dc2
cmp dword [ebp + 0xc], 0
je 0x6e7cfe
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
test esi, esi
jbe 0x6e7d62
cmp byte [ebp + 0x10], 0
je 0x6e7d4d
call sub.kernel32.dll_GetTickCount
mov edi, eax
push 0
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
push 0xa
call sub.kernel32.dll_Sleep_1
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_ProcessMessages_qqrv
cmp ebx, 0xffffffff
jne 0x6e7d38
mov byte [ebp - 0xd], 0
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp esi, eax
jbe 0x6e7d62
cmp ebx, 0x102
je 0x6e7d0f
jmp 0x6e7d62
push esi
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6e7d62
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e7dc2
cmp byte [ebp - 0xd], 0
jne 0x6e7d7d
call sub.kernel32.dll_GetLastError
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x6e7d98
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x6e7da5
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x6e7db2
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_StrDispose_qqrpb
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc