joyce8/EMBER2024-capa huggingface dataset:
Function at 0x611f10
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
mov eax, dword [0x6944c8]
cmp dword [eax], 1
jne 0x612005
push 0x6120fc
push 0x61212c
call sub.user32.dll_FindWindowW
test eax, eax
je 0x611f42
mov byte [ebp - 1], 1
jmp 0x6120ef
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403bd8
mov dword [ebp - 0x54], 0x44
mov eax, 0x104
call fcn.00403230
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x611ffe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0x104
push 0
push 0x61214c
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
jne 0x611f9f
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x611fe8
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x611fd2
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x611fe8
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6120ef
mov eax, dword [ebp - 8]
call fcn.0040324c
ret
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x612026
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x6120ef
push 4
push 0x612164
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jne 0x612048
push 0x10
push 0x612164
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
jne 0x612062
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x6120ef
lea eax, [ebp - 0x80]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x612083
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x6120ef
cmp dword [ebp - 0x7c], 4
jne 0x612095
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 1
jmp 0x6120ef
xor eax, eax
mov dword [ebp - 0x10], eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
push 0x10
push 0x612164
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x6120e5
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x6120ef
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x612178
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
xor ebx, ebx
mov eax, dword [0x6944c8]
cmp dword [eax], 1
jne 0x6121a0
push 0x61220c
push 0x61223c
call sub.user32.dll_FindWindowW
test eax, eax
setne bl
jmp 0x612200
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
jne 0x6121bd
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete bl
jmp 0x612200
push 4
push 0x61225c
push esi
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
je 0x612200
push esi
call sub.advapi32.dll_CloseServiceHandle
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x6121e9
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x612200
cmp dword [esp + 4], 4
jne 0x6121fa
push edi
call sub.advapi32.dll_CloseServiceHandle
mov bl, 1
jmp 0x612200
push edi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x612270
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
mov eax, dword [ebp - 8]
call fcn.00406b90
xor eax, eax
push ebp
push 0x6124c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x6122c3
mov byte [ebp - 0xd], 0
push ebx
call sub.advapi32.dll_LockServiceDatabase
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x6124a7
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x14], 0
jne 0x612321
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x41f
je 0x6122f0
mov byte [ebp - 0xd], 0
push 0x10c
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov edi, eax
test edi, edi
lea eax, [ebp - 0x18]
push eax
push 0x10c
push edi
push ebx
call sub.advapi32.dll_QueryServiceLockStatusW
test eax, eax
jne 0x612318
mov byte [ebp - 0xd], 0
cmp dword [edi], 0
push edi
call sub.kernel32.dll_LocalFree
push 2
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x61233f
mov byte [ebp - 0xd], 0
xor edx, edx
push ebp
push 0x612480
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
cmp eax, 4
ja case.default.0x612355
jmp dword [eax*4 + 0x61235c]
xor esi, esi
jmp case.default.0x612355
mov esi, 1
jmp case.default.0x612355
mov esi, 2
jmp case.default.0x612355
mov esi, 3
jmp case.default.0x612355
mov esi, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x110
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
jne 0x6123b5
mov byte [ebp - 0xd], 0
push 0x6124dc
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
setne al
test al, al
jne 0x6123dc
call fcn.0040541c
call fcn.0040541c
jmp 0x6124ae
xor edx, edx
push ebp
push 0x612462
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x6124f8
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040a178
mov ebx, eax
test ebx, ebx
setne al
test al, al
jne 0x612417
call fcn.0040541c
call fcn.0040541c
call fcn.0040541c
jmp 0x6124ae
cmp dword [ebp - 8], 0
je 0x61242a
mov eax, dword [ebp - 8]
call fcn.00406c34
mov dword [ebp - 0x24], eax
jmp 0x61242f
xor eax, eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
mov edx, dword [0x6912ac]
mov eax, dword [ebp - 0x1c]
call ebx
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x61244b
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612469
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6124d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x61253c
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
xor eax, eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push ebp
push 0x6126c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov eax, 2
call fcn.0050fc9c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x6126a7
xor eax, eax
push ebp
push 0x6126a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x240]
xor ecx, ecx
mov edx, 0x22c
call fcn.00403bd8
mov dword [ebp - 0x240], 0x22c
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0050fcbc
mov ebx, eax
jmp 0x612681
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x21c]
mov ecx, 0x104
call fcn.00406db8
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.0047221c
mov edx, dword [ebp - 0x244]
mov eax, 0x6126e0
call fcn.00470760
test al, al
je 0x612671
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x238]
push eax
call sub.Kernel32.dll_ProcessIdToSessionId_1
test eax, eax
je 0x612671
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x6912b0]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x612671
xor eax, eax
push ebp
push 0x61266a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x612653
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.0040541c
call fcn.0040541c
jmp 0x6126a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612671
mov eax, dword [ebp - 0x10]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 8]
call fcn.0050fcdc
mov ebx, eax
test ebx, ebx
jne 0x6125bf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6126a7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6126cc
lea eax, [ebp - 0x248]
mov edx, 2
call fcn.00406ba0
ret

Function at 0x6126fc
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
cmp dword [0x6912b4], 0
je 0x612716
call dword [0x6912b4]
mov dword [ebp - 4], eax
jmp 0x61271b
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x612789
cmp dword [ebp - 4], 0xffffffff
je 0x612789
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x6912b0]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x612784
xor eax, eax
push ebp
push 0x61277d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x612761
call fcn.0040541c
jmp 0x61279d
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x612789
mov eax, dword [ebp - 8]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x612795
cmp dword [ebp - 4], 0xffffffff
jne 0x61279d
call fcn.0061253c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6129a4
Capabilities:
Get session information
Get session user name

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.00406ba8
cmp byte [0x6dca38], 0
je 0x6129db
xor eax, eax
call fcn.0061292c
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x612a4a
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.00612a6c
jmp 0x612a4a
lea eax, [esp + 4]
push eax
lea eax, [esp + 4]
push eax
push 5
call fcn.006126fc
push eax
mov eax, dword [0x6912b0]
push eax
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x612a28
mov eax, ebx
mov edx, dword [esp]
call fcn.00406d64
mov eax, dword [ebx]
mov edx, 0x612a5c
call fcn.00470760
test al, al
je 0x612a1f
mov eax, ebx
xor edx, edx
call fcn.00406ba8
mov eax, dword [esp]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
cmp dword [ebx], 0
jne 0x612a4a
xor eax, eax
call fcn.0061292c
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jbe 0x612a4a
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.00612a6c
pop ecx
pop edx
pop ebx
ret

Function at 0x612c78
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor edx, edx
push ebp
push 0x612e28
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.00403bd8
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.00403bd8
push 0x612e3c
push 0x612e64
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a178
test eax, eax
je 0x612cf7
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x612d03
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x612e1e
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x612d25
mov dword [ebp - 4], 2
cmp dword [ebp - 0x11c], 5
jne 0x612d43
cmp dword [ebp - 0x118], 0
jne 0x612d43
mov dword [ebp - 4], 3
jmp 0x612e1e
cmp dword [ebp - 0x11c], 5
jne 0x612d61
cmp dword [ebp - 0x118], 1
jne 0x612d61
mov dword [ebp - 4], 4
jmp 0x612e1e
cmp dword [ebp - 0x11c], 5
jne 0x612d9b
cmp dword [ebp - 0x118], 2
jne 0x612d9b
cmp byte [ebp - 6], 1
jne 0x612d8f
cmp word [ebp - 0x144], 9
jne 0x612d8f
mov dword [ebp - 4], 4
jmp 0x612e1e
mov dword [ebp - 4], 5
jmp 0x612e1e
cmp dword [ebp - 0x11c], 6
jne 0x612db6
cmp dword [ebp - 0x118], 0
jne 0x612db6
mov dword [ebp - 4], 6
jmp 0x612e1e
cmp dword [ebp - 0x11c], 6
jne 0x612dd1
cmp dword [ebp - 0x118], 1
jne 0x612dd1
mov dword [ebp - 4], 7
jmp 0x612e1e
cmp dword [ebp - 0x11c], 6
jne 0x612df3
mov eax, dword [ebp - 0x118]
cmp eax, 2
je 0x612dea
cmp eax, 3
jne 0x612df3
mov dword [ebp - 4], 8
jmp 0x612e1e
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x612e12
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x612e12
mov dword [ebp - 4], 0xa
jmp 0x612e1e
cmp eax, 0xa
jne 0x612e1e
mov dword [ebp - 4], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x612e32
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6140d4
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
mov eax, dword [ebp - 8]
call fcn.00406b90
xor eax, eax
push ebp
push 0x614154
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00471a2c
test al, al
jne 0x614139
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x614139
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61415b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x6146f8
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
lea eax, [ebp - 0x278]
mov edx, dword [0x46ec28]
call fcn.00407644
xor eax, eax
push ebp
push 0x6148ca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x6148e4
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00471c6c
mov ebx, eax
xor eax, eax
push ebp
push 0x61488c
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x614873
xor eax, eax
push ebp
push 0x614864
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6148f8
mov eax, dword [ebp - 0x264]
call fcn.00470760
test al, al
jne 0x6147c3
mov edx, 0x614908
mov eax, dword [ebp - 0x264]
call fcn.00470760
test al, al
je 0x6147cd
call fcn.0040541c
jmp 0x61486b
test dword [ebp - 0x268], 0x10
jle 0x614835
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x280]
call fcn.0047a47c
mov eax, dword [ebp - 0x280]
call fcn.006146f8
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x288]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
call fcn.0040541c
jmp 0x61486b
lea ecx, [ebp - 0x28c]
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 4]
call fcn.00614600
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61486b
lea eax, [ebp - 0x278]
call fcn.00471cbc
mov ebx, eax
ret
test ebx, ebx
je 0x61478d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x614893
lea eax, [ebp - 0x278]
call fcn.00471ce0
ret
Function at 0x616058
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
lea eax, [ebp - 0x278]
mov edx, dword [0x46ec28]
call fcn.00407644
xor eax, eax
push ebp
push 0x616236
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x616250
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00471c6c
mov ebx, eax
xor eax, eax
push ebp
push 0x6161f8
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x6161df
xor eax, eax
push ebp
push 0x6161d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x616264
mov eax, dword [ebp - 0x264]
call fcn.00470760
test al, al
jne 0x616123
mov edx, 0x616274
mov eax, dword [ebp - 0x264]
call fcn.00470760
test al, al
je 0x61612d
call fcn.0040541c
jmp 0x6161d7
test dword [ebp - 0x268], 0x10
jle 0x61619a
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x280]
call fcn.0047a47c
mov eax, dword [ebp - 0x280]
call fcn.00616058
pop ecx
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x288]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
call fcn.0040541c
jmp 0x6161d7
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.006163f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6161d7
lea eax, [ebp - 0x278]
call fcn.00471cbc
mov ebx, eax
ret
test ebx, ebx
je 0x6160ed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6161ff
lea eax, [ebp - 0x278]
call fcn.00471ce0
ret

Function at 0x61627c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x616341
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6162ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6938a4]
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
lea eax, [ebp - 8]
mov ecx, 0x61635c
call fcn.00406f8c
mov eax, dword [ebp - 8]
call fcn.00471a74
test al, al
je 0x6162e2
push ebp
mov eax, dword [ebp - 8]
call fcn.00616058
pop ecx
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x616326
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x616348
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x616738
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
mov eax, dword [ebp - 8]
call fcn.00406b90
xor eax, eax
push ebp
push 0x6167b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00471a2c
test al, al
jne 0x61679d
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x61679d
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6167bf
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x616e4c
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x617047
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x616fef
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 4]
lea eax, [ebp - 4]
mov ecx, 0x617064
call fcn.00406f8c
mov eax, dword [ebp - 4]
call fcn.00471a2c
test al, al
jne 0x616ea4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x617029
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x616ec8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x617029
xor eax, eax
push ebp
push 0x616fde
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
push 0
push 2
push 0x10
push 0xf01ff
push 0x617080
push 0x6170b4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x616f22
call fcn.0040541c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x617029
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, 0x6170cc
mov dword [ebp - 0x10], eax
push 0xf01ff
push 0x6170b4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x616f61
call fcn.0040541c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x617029
call fcn.00616c7c
xor eax, eax
push ebp
push 0x616fc0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x6170cc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x6943d4]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceW
push 0x64
mov eax, dword [0x6944d4]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x616fc7
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61704e
lea eax, [ebp - 0x18]
call fcn.00406b98
lea eax, [ebp - 4]
call fcn.00406b98
ret
Function at 0x619c20
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
lea eax, [ebp - 0x278]
mov edx, dword [0x46ec28]
call fcn.00407644
xor eax, eax
push ebp
push 0x619e35
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x619e50
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00471c6c
mov ebx, eax
xor eax, eax
push ebp
push 0x619df7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x619dde
xor eax, eax
push ebp
push 0x619dcf
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x619e64
mov eax, dword [ebp - 0x264]
call fcn.00470760
test al, al
jne 0x619ceb
mov edx, 0x619e74
mov eax, dword [ebp - 0x264]
call fcn.00470760
test al, al
je 0x619cf5
call fcn.0040541c
jmp 0x619dd6
test dword [ebp - 0x268], 0x10
jle 0x619d99
mov eax, dword [0x693e4c]
mov eax, dword [eax]
mov edx, 0x619e88
call fcn.005dbcf4
test al, al
je 0x619d38
mov edx, 0x619ea0
mov eax, dword [ebp - 0x264]
call fcn.00470760
test al, al
je 0x619d38
call fcn.0040541c
jmp 0x619dd6
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x280]
call fcn.0047a47c
mov eax, dword [ebp - 0x280]
call fcn.00619c20
pop ecx
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x288]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
call fcn.0040541c
jmp 0x619dd6
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.0061b6e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x619dd6
lea eax, [ebp - 0x278]
call fcn.00471cbc
mov ebx, eax
ret
test ebx, ebx
je 0x619cb5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x619dfe
lea eax, [ebp - 0x278]
call fcn.00471ce0
ret