joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70a41c
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
shr dword [esp + edx - 0x8e36], 0xbb
bts dx, 4
movzx cx, byte [eax + edx*2 - 0x11c6c]
lea edi, [edi + edx*8 - 0x471b2]
movzx eax, dl
and dword [esp + edx - 0x8e36], edx
rol dx, 0x63
mov word [edi + edx - 0x71b4], cx
not eax
lea ecx, [edx + edx*4 - 0x3b5da55a]
cdq
sbb ebp, 4
mov eax, dword [ebp]
not dx
xor eax, ebx
not cx
sal cx, 0xc8
adc eax, 0x333936b1
xor eax, 0xe60fd015
dec eax
rol eax, 3
xadd ecx, edx
xor ebx, eax
add esi, eax
mov word [esp + 1], cx
rol dword [esp], 0xaf
adc edx, dword [esp]
pop eax
jp fcn.00705ae3
not al
mov dword [esp + ecx*4 - 0x2d1c4], ecx
xadd ecx, edx
sbb al, 0x8b
ror dx, 0xb
rol cx, 0xe
xor bl, al
sar byte [esp + edx*2 - 0x11c6c], 0xc7
lea eax, [esp + eax + 4]
jbe 0x6c10b2

Function at 0x70a446
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not ecx
lea ecx, [eax + ecx - 0x4cddf8c3]
dec dl
xor ebx, ecx
pop edx
add esi, ecx
and al, 0xb9
mov edx, dword [edi + edx - 0x66aa4ccd]
mov ecx, dword [edi + 4]
add al, al
adc edi, 3
sar ax, 0xec
call fcn.00622518
sub dx, 0xcf8e
xor ebx, ecx
add ebp, ecx
movsx ecx, al
add cx, word [ecx + esi]
xchg dx, ax
call fcn.0062d20d
sub cl, 0x82
neg ax
and al, dh
xor bl, cl
not dword [esp + edx - 0x3ce38530]
call fcn.0072e910
lea eax, [edx*4 - 0x4f640153]
xor ecx, ebx
ror ecx, 1
mov byte [esp], al
lea ecx, [ecx + edx - 0x2b510df0]
jmp 0x5b2db5

Function at 0x713f71
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jmp 0x60c852
cwde
neg dl
shl dword [esp + ecx - 3], cl
adc dl, 0x33
lea eax, [eax + ecx + 0x2a1e8b1f]
jmp 0x680ff4
mov eax, dword [edi]
dec cl
add ecx, edx
xor eax, ebx
rol dl, 0xe3
add edx, ecx
lea eax, [ecx + eax - 0x1fdabae5]
sar cx, 0x29
xor eax, ecx
btc edx, ecx
xor edx, ecx
neg eax
bswap eax
not dx
dec ecx
xor ebx, eax
neg ecx
neg edx
add esi, eax
lea edi, [edi + ecx*8 - 0x11]
movzx eax, dx
btr dx, ax
movzx edx, byte [edi + ecx*2 - 4]
bts cx, ax
sar eax, 0xfb
inc ecx
xor dl, bl
dec cl
inc dl
xor dl, 0x8f
not dl
push eax
shr al, 0xe7
sbb dl, 0x82
jmp 0x5adbca
push eax
xor bl, dl
or cx, 0xcc96
imul eax, ecx
btr eax, eax
lea edx, [esp + edx + 8]
call fcn.00730546
call fcn.0068805f
mov eax, 0xc3a5ed93
movsx ecx, al
mul ecx
sbb edi, 3
cdq
dec eax
jnp 0x67c334
Function at 0x713fe9
Capabilities:
Encode data using xor

Disassembly:
call fcn.0074327f
mov ecx, dword [esi]
shl edx, 0x52
xor ecx, ebx
sub dl, dh
inc ecx
movzx eax, dl
mul ax
ror ecx, 1
call fcn.0042bb90
mov eax, 0x88329b9a
lea edx, [eax + eax*2 + 0x53284131]
sub esi, 4
bt edx, eax
inc eax
mov edx, dword [esi]
push eax
xor edx, ebx
call fcn.00744761
mov ecx, 0x58a5fab8
lea ebp, [ecx + ebp - 0x58a5fabc]
mov edx, dword [ebp + ecx - 0x58a5fab8]
neg cl
ror ecx, 0x5a
xor edx, ebx
movsx eax, cl
sar eax, cl
not edx
dec edx
bt cx, cx
adc cl, 0xb9
xor edx, 0xb51a1e1b
call fcn.0061b569
lea eax, [eax + edx + 0x46c9c8f9]
neg dl
xor dword [esp + edx - 0x3652e9ed], ecx
push ecx
bswap eax
dec word [esp + edx - 0x3652e9ee]
adc dl, byte [esi]
lodsd eax, dword [esi]
leave
xor ebx, eax
push edx
shr byte [esp + edx - 0x3652e9eb], 0xc4
adc edi, eax
neg ecx
add edx, edx
lea ebp, [ecx + ebp - 0x7addb2c8]
bswap ecx
neg dword [esp + edx - 0x6ca5d3df]
movzx ecx, byte [edx + ebp - 0x6ca5d3e2]
lea eax, [edx + edx*4 - 0x39f9ed49]
sal eax, 0xe7
xor cl, bl
not cl
ror cl, 1
add cl, 4
call fcn.00664481
fadd qword [edi]
xchg esi, eax
daa
and al, 0xea
push ds
and dword [edi - 0x36d624c7], 0x3e6f9c9
xor eax, 0xeaf7db44
xchg ecx, eax
aas
js 0x714070
sbb al, 0xaa
jo 0x714132
into
mov edi, 0x7d5d9ce4
invalid
sub edx, 0xb034f9ba
call fcn.00734ee1

Function at 0x714520
Capabilities:
Get file version info

Disassembly:
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp + 0x484], eax
stc
clc
test eax, eax
jbe 0x6109f8
push eax
jmp 0x75ca4a
mov ebx, eax
mov cl, 0xb3
mov dx, si
mov dword [ebp - 0x24], ebx
jmp 0x665be9
add esi, ecx
mov dword [esp + edx*2], eax
push edx
mov ax, word [edi + edx*4]
call fcn.00438c26
push eax
jmp 0x6724df
call fcn.00439fe3
add esp, 4
jmp 0x68df0b

Function at 0x71dd98
Capabilities:
Read file on windows

Disassembly:
xor edx, ebx
xor edx, 0x700a15a8
mov eax, 0x92af7490
neg edx
not edx
lea ecx, [eax*2 - 0x4e635f7d]
rol edx, 1
add ax, 0xa228
xor ebx, edx
inc cl
mov dword [esp + 4], eax
add edi, edx
mov edx, dword [esp + 4]
xadd dword [esp + 4], ecx
mov dword [esp], ecx
mov eax, dword [ebp]
or cx, dx
mov dl, byte [ebp + 4]
adc word [esp + 1], cx
adc ecx, ecx
and ecx, 0x5f831698
lea ebp, [ebp + ecx*8 - 0x2810207a]
setp cl
mov byte [eax + ecx*2 - 0xa040800], dl
not dword [esp + ecx*2 - 0xa0407ff]
call fcn.00687479

Function at 0x728646
Capabilities:
Get file version info

Disassembly:
pop ecx
sub dl, dh
neg al
ror cl, 5
adc al, 0xbc
not cl
xor al, 0x2f
bswap edx
or dl, dh
adc al, cl
xor bl, al
lea ecx, [ecx - 0x7a5be457]
add eax, esp
shl dl, 0x45
jne 0x73cdf1
xor edx, ebx
movsx eax, byte [esp + ecx - 0x54abc37b]
xchg word [esp + eax - 0x1a], cx
rol edx, 2
inc edx
call fcn.00715957
movzx eax, byte [ebp + ecx*4]
mov dword [esp + ecx*8], edx
mov dword [esp + ecx*4], ecx
sar byte [esp + ecx], 0x41
xor al, bl
jmp 0x68c2e4
mov cx, word [eax + edx - 0x2723ffe0]
movzx eax, dx
lea esi, [esi + edx*2 - 0x4e47ffc2]
call fcn.0070a511
Function at 0x72ad6a
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jb 0x74475a
mov edx, dword [ebp + ecx*4 - 0x11ff8130]
neg ecx
mov dword [esp + eax*2 - 0x1c626], eax
sar dword [esp + eax - 0xe313], cl
mov eax, dword ss:[edx + eax*2 - 0x1c626]
sar byte [esp], 0x61
sal cl, 0x66
movsx edx, byte [esp]
mov dword [edx + ebp], eax
mov dword [esp + edx], ecx
jbe 0x6e5f23
pop edx
ror cl, 0xc4
add esi, eax
mov eax, dword [edi + ecx - 0x5264f9bf]
mov dx, word [ecx + edi - 0x5264f9bb]
lea edi, [edi + ecx - 0x5264f9b9]
not cx
btr ecx, 0x17
call fcn.00657e9b
call fcn.005b493a
xor eax, 0x81036baa
xor ebx, eax
sub edx, edx
adc ebp, eax
sub cx, cx
call fcn.00655220
bswap eax
ror word [esp + 1], 0x8c
mov edx, dword [ebp]
sub word [esp + 2], ax
jle 0x66464c
mov cl, byte [esi + 4]
mov edx, 0x29031f11
sal dl, 0x81
dec dx
lea esi, [esi + edx*2 - 0x52063e40]
call fcn.00672736
push ecx
jmp 0x721ef5
neg dword [esp + edx]
mov dword [esp + edx*2], esi
ret
push ebp
call fcn.005f74b8
popfd
cmp esi, edi
mov eax, dword [0x23d23820]
add eax, 0xc7ee43ad
invalid
mov dword [esp + ecx - 0x6024e312], eax
bswap edx
sub ecx, eax
lea edx, [edx + ecx + 0x5ee99939]
inc byte [esp + ecx - 0x6023ffff]
setg cl
shl cl, cl
xor ebx, edx
rol ecx, 0xa5
adc esi, edx
sar dword [esp + ecx*8 - 0x23ff0260], cl
jae 0x5dea2a
add esi, ecx
jmp 0x6963cb

Function at 0x72f9f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
bswap eax
adc cl, cl
call fcn.0075aaa0

Function at 0x7414b7
Capabilities:
Encode data using xor

Disassembly:
ror edx, 1
btr ecx, 0xb3
sal eax, 0xe5
mov dword [esp + ecx - 0x65821fa4], ecx
xor edx, 0xad992c1f
shr dword [esp + ecx - 0x65821fa4], cl
neg ecx
ror edx, 1
ror ecx, 0xc7
dec word [esp]
sbb edx, 0xbab32fab
neg al
xchg dword [esp], eax
xor edx, 0x562cf789
push ecx
rol ecx, 0x7c
xor ebx, edx
add word [esp + eax - 0x65821f9], cx
add esi, edx
sar cx, 0x84
mov edx, 0xb205bcb1
mov di, word [edi + eax - 0x65821f9]
adc dword [esp + eax*8 - 0x32c10fc4], edx
pop edx
pop edx
js fcn.00705ae3
aaa
test eax, 0x14f1e31a
invalid

Function at 0x746862
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
not edx
btc eax, ecx
adc al, 0x1e
btc ecx, eax
bswap edx
shl ecx, 0x7e
sub cx, cx
xor ebx, edx
add esi, edx
mov edx, dword [ecx + edi - 0x80000000]
jmp 0x60c1b6
jb 0x438647
movzx ecx, al
lea ebp, [ecx + ebp - 0x86]
call fcn.005ee9a6
mul al
lea edi, [edi + edx*4 - 0x400c530]
mov dword [esp + edx - 0x100314b], edx
lea eax, [eax + edx*2 + 0x218a6191]
mov dword [edx + edi - 0x100314b], ecx
jb 0x61750c
pop ecx
jae fcn.00705ae3
mov ecx, 0x670bf984
sal cl, cl
neg dl
push ecx
neg ecx
setge cl
sbb dl, 0xa7
call fcn.005b8a06
Function at 0x7468b9
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
xor edx, ebx
not ecx
ror edx, 3
neg edx
lea edx, [edx + ecx + 0xd2d393e]
dec word [esp + eax*4 - 0xe87f]
sal ecx, cl
not edx
neg edx
inc eax
sub edx, 0xefaf43aa
xor ebx, edx
xchg al, cl
add esi, edx
mov byte [esp + eax*2 - 0x73fa], ch
push eax
pop eax
pop eax
pop ecx
jmp fcn.00705ae3
mov edx, dword [ecx + ebp - 0x65963a21]
jae 0x5ab449
mov edx, 0x562aecb0
bts edx, 0x11
mov cx, word [edx + ebp - 0x562aecb0]
movzx eax, dx
imul edx
mov dx, word [ebp + edx*2 - 0x9f52]
adc ebp, 1
not ax
add cx, dx
call fcn.006061a3
sub ebp, 4
mov ecx, 0x4613f88d
mov ecx, dword [ebp + ecx - 0x4613f88d]
call fcn.005b9ec6
sub edi, 2
mov ecx, 0x65963a20
bts ecx, ecx
mov word [ecx + edi - 0x65963a21], ax
mov dword [esp + ecx - 0x65963a21], ecx
movzx eax, cx
lea ebp, [ebp + eax*2 - 0x7446]
jae 0x60b66c

Function at 0x74b2e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [edi + edx*2 - 0x68e2bf04]
adc edi, 3
call fcn.00712776

Function at 0x74be6c
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
and edx, 0xc50fb838
neg al
call fcn.005bad99

Function at 0x7582b3
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 8], 0x11f7f61a
lea esp, [esp + 8]
call fcn.006bb4f8
ror ecx, 2
mul al
neg edx
not ecx
call fcn.006c0a6e
neg ecx
ror edx, 3
add ecx, ecx
call fcn.0062a6e9

Function at 0x7582f2
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
neg ecx
sub eax, 0x6e087c32
mov dword [esp + edx*4 - 0x6440024], edx
ror ecx, 3
xor ecx, 0xee390ea4
neg byte [esp + edx*8 - 0xc880047]
lea ecx, [edx + ecx - 0x724a323b]
xadd ax, dx
xor eax, 0xf383e4a3
not ecx
cbw
call fcn.005f4c36

Function at 0x75862d
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0x51b4a794
not edx
sal al, 6
mov ecx, 0xa9381f15
ror edx, 2
bswap edx
or ax, 0x69a
sbb edx, 0xc6a65a18
xor ebx, edx
bts eax, eax
sar ecx, cl
add esi, edx
movzx edx, cl
and eax, edx
xadd edx, ecx
jmp esi
movsx edx, cx
inc ecx
pop ecx
pop eax
jge fcn.005ae08b
dec dword [ebp - 0x6d49b844]
xchg ebp, eax
sahf
lea edi, [edi + eax*2 - 0x616a6d4a]
mov edx, eax
mov edx, dword [eax + edi - 0x30b536a3]
xor edx, ebx
bswap eax
bt ax, ax
jae 0x6a6bb4
add esi, dword [esi + 0x12]
sub eax, 0x981aa37d
sal byte [esp + eax], cl
std
cmc
loop 0x758638
lcall 0x468c, 0xa42d66e4
adc dword [0x8f6c9882], ebp
xchg edi, eax
rcr ch, cl
and ebp, dword [edi + eax*8]
rol bh, cl
sub dword [esi - 0x28c32d02], edx
sub ebx, eax
rcr bh, cl
int3
Function at 0x75c243
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xor ebx, edx
bswap ecx
rol ecx, 0xbf
add ebp, edx
pop eax
jmp fcn.006d25b7
call fcn.005deeab
mov eax, 0x3ab3171d
lea ebp, [ebp + eax - 0x3ab31721]
mov eax, dword [eax + ebp - 0x3ab3171d]
mov edx, 0x8f30f424
xor eax, ebx
lea ecx, [edx + edx*4 - 0x7de88346]
not eax
btc dx, 8
or dx, dx
neg eax
lea ecx, [edx*8 + 0x1abbfad]
xor dl, ch
xchg cx, dx
lea eax, [eax + edx + 0x3f06e3a]
call fcn.006e0030
movzx edx, word [ebp]
call fcn.00643d96
mov edx, 0x5d83d51b
lea ecx, [edx + edx*2 - 0xf4db850]
movsx eax, dl
mov al, byte [edx + ebp - 0x5d83d51b]
shl edx, cl
push ecx
mov cl, byte [ecx + ebp - 0x93dc6ff]
xor edx, dword [esp]
call fcn.00657aff
mov eax, 0x64b31884
imul eax, eax
sub ax, ax
mov dx, word [ebp + eax - 0x6af10000]
sar ax, 0xce
jbe 0x693c6f
ror edx, 1
dec ecx
dec edx
shr eax, cl
imul ecx, ecx
neg edx
rol cl, 0x64
cwde
xor ebx, edx
add esi, edx
jmp esi
shr dx, cl
mov word [ebp + eax - 0x6af10000], dx
movsx ecx, al
movsx edx, cl
call fcn.00437166
rol eax, 0x57
mov edx, dword [eax + ebp - 0x5119d29d]
mov eax, dword [ebp + eax - 0x5119d299]
mov ecx, dword [ebp + 8]
jb 0x5cd4b8
sal ecx, 0xa2
not ax
je 0x642a1e
xor ecx, ecx
shr ecx, 0x92
rol ax, 1
push edx
neg ax
add ax, 0xe00b
lea edx, [ecx*8 + 0x293d2b0e]
shr byte [esp + ecx + 3], 0x24
xor bx, ax
shr ecx, 0x2c
lea esi, [ecx + esi - 2]
jne 0x75eaf0
mov word [esi + ecx], ax
call fcn.006ef108
mov ecx, 0x61be3604
mov edx, dword [edx + edi - 0x5216e609]
mov eax, ecx
lea edi, [edi + ecx - 0x61be3600]
btr ecx, eax
imul ecx, eax
xor edx, ebx
push eax
dec edx
ror ax, 0x45
mov byte [esp + ecx - 0x4155b00e], al
ror edx, 2
lea eax, [ecx + eax*4 - 0x397d69d6]
not ecx
neg edx
dec word [esp]
xor eax, ecx
dec edx
xor eax, eax
jp 0x5c8a16
mov cl, byte [ebp + eax - 0x6af0fffe]
lea ebp, [eax + ebp - 0x6af0fffe]
bt eax, 3
sal ax, 0x2b
jns 0x5f0d1c
lea eax, [eax*4 + 0x1405cab5]
xor ebx, ecx
imul eax
add edi, ecx
mov dword [esp + edx - 0x190e7cd], edi
ret 0xc
mov dword [esp + 4], 0x4aa8af4a
lea esp, [esp + 4]
call fcn.00713fe9
mov eax, 0x33a53aa2
jmp 0x5ffb7a
xor edx, ebx
sub ax, 0x4e8b
bswap edx
lea edx, [edx + ecx - 0x49b49a7c]
neg ecx
not edx
xadd eax, ecx
adc eax, eax
jg 0x5d08f8
Function at 0x6b7370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x6b738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x6e0074
push ecx
mov edi, eax
call fcn.006cb198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6b73cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.006cb02e
push esi
call fcn.006cafb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x6ba850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x6ba8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x6e5720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6ba8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.006cb1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x6ba8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x6e5720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6ba92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.006cc082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x6ba957
mov word [eax], si
add eax, 2
push eax
call fcn.006cc030
add esp, 4
jmp 0x6ba959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x6ba8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x6ba8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x6baff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x6bb080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x6bb0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x6e0458
push ecx
call fcn.006cb1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.006cb1e1
add esp, 0x10
jmp 0x6bb0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.006cb20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.006cadff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.006bb050
mov eax, dword [0x6e5728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x6bb13b
push esi
call fcn.006bafb0
add esp, 4
mov dword [0x6e5728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x6bb14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.006baff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x6be440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x6be4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x6be48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6be471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6be47e
add edx, ecx
cmp ebx, edx
jb 0x6be48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x6be467
xor ecx, ecx
jmp 0x6be4a2
test eax, eax
jne 0x6be492
xor ecx, ecx
jmp 0x6be4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.006be3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x6be8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x6be921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x6be946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x6be96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x6be993
push ecx
push esi
call fcn.006be4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x6bfc00
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
xor ecx, ecx
mov cx, word [eax + 0x14]
xor esi, esi
mov si, word [eax + 6]
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x6bfc4a
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x6bfc2b
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp ebx, edx
jb 0x6bfc38
add edx, eax
cmp ebx, edx
jb 0x6bfc46
inc edi
add ecx, 0x28
cmp edi, esi
jb 0x6bfc21
pop edi
pop esi
xor eax, eax
pop ebx
ret
test ecx, ecx
jne 0x6bfc50
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov ecx, dword [esp + 0x18]
sub eax, esi
add eax, ebx
pop edi
pop esi
add eax, ecx
pop ebx
ret

Function at 0x6bfc70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x6bfcb0
mov ebx, dword [esp + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x6bfc9b
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6bfca8
add edx, ecx
cmp ebx, edx
jb 0x6bfcb2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x6bfc91
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x6bff60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.006cc145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x6bfffb
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x6bffdd
lea eax, [esp + 0x18]
push eax
jmp 0x6bffe2
push 0x6e5720
call fcn.006cbfd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x6bffb0
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x6bff40
push 4
push ecx
push eax
call fcn.006cc43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x6c0310
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x210
push ebp
push esi
push edi
mov edi, dword [esp + 0x224]
push 0
push 0
mov ebp, dword [esp + 0x228]
push 0
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [edi]
shl eax, 2
push eax
call fcn.006cc145
mov ecx, dword [edi]
add esp, 4
xor esi, esi
mov dword [esp + 0xc], eax
test ecx, ecx
jbe 0x6c03ab
push ebx
mov ebx, eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push esi
push ebp
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x6c038d
lea eax, [esp + 0x18]
push eax
jmp 0x6c0392
push 0x6e5720
call fcn.006cbfd9
add esp, 4
mov dword [ebx], eax
mov eax, dword [edi]
inc esi
add ebx, 4
cmp esi, eax
jb 0x6c0360
mov eax, dword [esp + 0x10]
pop ebx
mov ecx, dword [edi]
push 0x6bff40
push 4
push ecx
push eax
call fcn.006cc43f
mov eax, dword [esp + 0x1c]
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x210
ret
Function at 0x6c1f20
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ecx
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 4], ebp
je 0x6c1fd7
mov eax, dword [esp + 0xc]
push esi
push 0xf01ff
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x6c1fcf
push ebx
push edi
push 0x6e5770
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x6c1fae
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x6e5770
push esi
call ebx
test eax, eax
je 0x6c1fae
mov ebp, 3
cmp dword [0x6e5774], ebp
jne 0x6c1faa
push 0x3e8
call edi
push 0x6e5770
push esi
call ebx
test eax, eax
jne 0x6c1f8f
mov ebp, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call ebx
test eax, eax
jne 0x6c1fc6
push 0x64
call edi
push esi
call ebx
test eax, eax
je 0x6c1fbb
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
pop ecx
ret