joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f0f0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x5f10c
cmp dword [esi + 4], 0
je 0x5f139
test byte [ebx + 0x45], 1
jne 0x5f12b
mov eax, ebx
call fcn.0005e094
test eax, eax
jne 0x5f12b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x5f249
mov edx, esi
mov eax, ebx
call fcn.0005ed68
jmp 0x5f249
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5f242
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.000610c0
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0005c058
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0005f0f0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.000610c0
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f249
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x65ad8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00013e98
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x65af1
test al, 0x10
jne 0x65af5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x65bb8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x65cfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], CreateBrushIndirect
xor eax, eax
mov dword [ebp - 8], eax
xor ecx, ecx
push ebp
push 0x65ca8
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 8]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
neg eax
sbb eax, eax
neg eax
test al, al
je reloc.user32.dll_UpdateWindow
lea eax, [ebp - 0x18]
push eax
push 0x65d0c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
mov edx, 0x10
xor ecx, ecx
mov dword [ebp - 0xc], ecx
test al, al
je reloc.user32.dll_UpdateWindow
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test bl, bl
je 0x65c8a
test esi, 2
je 0x65c76
push 0xffffffffffffffff
push 0xffffffffffffffff
push UnregisterClassA
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00065b34
jmp 0x65c8a
push 0xffffffffffffffff
push 0
push 0x80020004
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00065b34
push TranslateMessage
push esi
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x65cd1
cmp dword [ebp - 8], 0
je 0x65ce0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push reloc.user32.dll_ShowOwnedPopups
lea eax, [ebp - 0x30]
call fcn.00013a54
ret
Function at 0x67f38
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x67fbd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x67fd0
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov eax, 4
call fcn.000126e0
mov ebx, eax
movzx eax, si
mov dword [ebx], eax
push 4
push ebx
push 4
push 0
push 0x68018
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
call fcn.000126f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67fc7
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x68204
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x682d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00014084
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0x400
call fcn.000126e0
mov ebx, eax
mov edx, 0x400
mov eax, ebx
call fcn.000175a4
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x682e8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x6829d
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x3ff
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push 0x6832c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6829d
cmp dword [ebp - 8], 1
jne 0x6829d
lea eax, [ebp - 4]
mov edx, ebx
call fcn.000141dc
cmp dword [ebp - 0x10], 0
je 0x682ac
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, ebx
call fcn.000126f8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.000140c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x682df
lea eax, [ebp - 4]
call fcn.00014084
ret
Function at 0x68704
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x6870c
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
call fcn.00014684
xor eax, eax
push ebp
push 0x68815
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
call fcn.00013c9c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
call fcn.00019d94
lea eax, [ebp - 0x14]
mov edx, 0x800
call fcn.00014640
mov eax, dword [ebp - 0x14]
call fcn.000142b4
push eax
push 0x400
call sub.kernel32.dll_GetCurrentDirectoryW
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00014640
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0001902c
mov eax, dword [ebp - 0x20]
call fcn.00013e98
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.0001bae0
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.00014240
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.000143dc
je 0x687bb
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0006834c
pop ecx
mov eax, dword [ebp - 0x14]
call fcn.0001bb64
test al, al
je 0x687d5
mov eax, dword [ebp - 0x14]
call fcn.000142b4
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6881c
lea eax, [ebp - 0x24]
call fcn.00014084
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00013a78
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0001409c
lea eax, [ebp - 0x10]
call fcn.00013a54
lea eax, [ebp - 0xc]
call fcn.00014084
ret
Function at 0x69640
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00013e88
xor eax, eax
push ebp
push 0x69748
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
push 0x69760
push dword [ebp - 8]
push 0x69770
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00013d94
mov eax, dword [ebp - 0x10]
call fcn.000695dc
pop ecx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x69780
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x69711
mov eax, dword [0x70390]
cmp dword [eax], 0
je 0x696ed
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x69790
call fcn.00013d20
mov eax, dword [ebp - 0x14]
call fcn.00013e98
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0001ae20
mov ebx, eax
jmp 0x69711
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, 0x69790
call fcn.00013d20
mov eax, dword [ebp - 0x18]
call fcn.00013e98
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x69720
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6974f
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00013a78
lea eax, [ebp - 8]
call fcn.00013a54
ret
Function at 0x698a0
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x699e6
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, 0x69a00
call fcn.000697d8
pop ecx
xor ebx, ebx
push 0
call sub.kernel32.dll_SetLastError
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
je 0x6999d
push 0
call sub.kernel32.dll_SetLastError
push 0xf01ff
push 0x69a18
push edi
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x6996e
lea eax, [ebp - 0x24]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
push 0x1f4
call sub.kernel32.dll_Sleep
xor eax, eax
mov dword [ebp - 8], eax
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 8]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
test eax, eax
je 0x69945
mov bl, 1
jmp 0x69995
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push ebp
mov eax, 0x69a28
call fcn.0006983c
pop ecx
push ebp
lea edx, [ebp - 0x28]
mov eax, esi
call fcn.00018f2c
mov eax, dword [ebp - 0x28]
call fcn.0006983c
pop ecx
jmp 0x69995
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push ebp
mov eax, 0x69a4c
call fcn.0006983c
pop ecx
push ebp
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.00018f2c
mov eax, dword [ebp - 0x2c]
call fcn.0006983c
pop ecx
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x699c4
call sub.kernel32.dll_GetLastError_1
mov esi, eax
push ebp
mov eax, 0x69a6c
call fcn.0006983c
pop ecx
push ebp
lea edx, [ebp - 0x30]
mov eax, esi
call fcn.00018f2c
mov eax, dword [ebp - 0x30]
call fcn.0006983c
pop ecx
push 0
call sub.kernel32.dll_SetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x699ed
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00013a78
ret
Function at 0x69b4c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00013e88
xor eax, eax
push ebp
push 0x69d8f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
xor edx, edx
push ebp
push 0x69d29
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
lea eax, [ebp - 0x6c]
mov ecx, dword [ebp - 8]
mov edx, 0x69da8
call fcn.00013d20
mov eax, dword [ebp - 0x6c]
call fcn.00069ae8
pop ecx
lea eax, [ebp - 0x74]
call fcn.00019138
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.0001902c
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x10]
mov ecx, 0x69dc0
call fcn.00013d20
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.000129f0
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x10
call fcn.000129f0
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
push dword [ebp - 0x10]
push 0x69dd4
push dword [ebp - 8]
push 0x69e00
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00013d94
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_SetLastError
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00013e98
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 0x14], eax
call sub.kernel32.dll_GetLastError_1
mov esi, eax
cmp dword [ebp - 0x14], 0
jne 0x69caf
push ebp
lea eax, [ebp - 0x7c]
call fcn.00024104
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
mov edx, 0x69e10
call fcn.00013d20
mov eax, dword [ebp - 0x78]
call fcn.00069a84
pop ecx
push ebp
lea edx, [ebp - 0x80]
mov eax, esi
call fcn.00018f2c
mov eax, dword [ebp - 0x80]
call fcn.00069a84
pop ecx
jmp 0x69d05
push 0xea60
mov eax, dword [ebp - 0x68]
push eax
call sub.user32.dll_WaitForInputIdle
mov dword [ebp - 0x14], eax
push 0x64
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_GetExitCodeProcess
cmp dword [ebp - 0x14], 0x103
jne 0x69cf0
call sub.kernel32.dll_GetTickCount
mov edx, ebx
call fcn.0001a330
cmp eax, 0xea60
jbe 0x69cc0
cmp dword [ebp - 0x14], 0x103
jne 0x69d05
push ebp
mov eax, 0x69e30
call fcn.00069a84
pop ecx
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x69d12
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x69d1f
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x69d61
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69d96
lea eax, [ebp - 0x88]
mov edx, 8
call fcn.00013a78
lea eax, [ebp - 0x10]
call fcn.00013a54
lea eax, [ebp - 8]
call fcn.00013a54
ret
Function at 0x69f38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a002
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, esi
mov edx, ebx
mov eax, 0x6a018
call fcn.00068ab8
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0x6a01c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x69fe0
mov eax, 0x400
call fcn.000126e0
mov ebx, eax
mov dword [ebp - 4], 0x3ff
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x6a04c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x69fd9
cmp dword [ebp - 0xc], 1
jne 0x69fd9
cmp dword [ebp - 4], 1
jbe 0x69fd9
cmp dword [ebp - 4], 0xc8
ja 0x69fd9
mov eax, esi
mov edx, ebx
call fcn.00013c0c
mov eax, ebx
call fcn.000126f8
cmp dword [ebp - 8], 0
je 0x69fef
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a009
ret

Function at 0x6a544
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00013e88
xor eax, eax
push ebp
push 0x6a5fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
je 0x6a586
push 0
call sub.kernel32.dll_SetLastError
test edi, edi
je 0x6a5e3
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00013e98
push eax
push edi
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
je 0x6a5ab
push 0
call sub.kernel32.dll_SetLastError
test esi, esi
je 0x6a5d1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
test eax, eax
jne 0x6a5d1
xor ebx, ebx
test esi, esi
je 0x6a5db
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x6a5e5
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a602
lea eax, [ebp - 4]
call fcn.00013a54
ret
Function at 0x6a844
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x6a974
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x6a98c
call fcn.0006a668
push 0
call sub.kernel32.dll_SetLastError
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x6a88f
push 0
call sub.kernel32.dll_SetLastError
call fcn.0006a644
mov ebx, eax
test esi, esi
je 0x6a92e
push 0xf01ff
push 0x6a9a0
push esi
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
je 0x6a8bb
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6a8c6
call fcn.0006a644
mov ebx, eax
test edi, edi
je 0x6a912
mov eax, 0x6a9b4
call fcn.0006a668
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x6a8eb
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6a8f6
call fcn.0006a644
mov ebx, eax
push edi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x6a907
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6a912
call fcn.0006a644
mov ebx, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x6a923
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6a92e
call fcn.0006a644
mov ebx, eax
mov esi, ebx
push 0
call sub.kernel32.dll_SetLastError
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.000261d0
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x6a9c8
call fcn.00013d20
mov eax, dword [ebp - 0x20]
call fcn.0006a668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a97b
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00013a78
ret
Function at 0x6a9dc
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ab87
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00013c0c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x6aba0
call fcn.00013d20
mov eax, dword [ebp - 0x10]
call fcn.0006a668
xor eax, eax
mov dword [ebp - 8], eax
push 0
call sub.kernel32.dll_SetLastError
mov eax, 0x5000
call fcn.000126e0
mov edi, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
je 0x6aa54
push 0
call sub.kernel32.dll_SetLastError
call fcn.0006a644
mov ebx, eax
test esi, esi
je 0x6ab36
mov eax, 0x6abcc
call fcn.0006a668
push 0xf01ff
push 0x6abdc
push esi
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6aa8d
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6aa98
call fcn.0006a644
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0x6ab1a
lea eax, [ebp - 8]
push eax
push 0xa
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
jne 0x6aaf0
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
jne 0x6aaf0
mov eax, 0x6abf0
call fcn.0006a668
add dword [ebp - 8], 0x64
cmp dword [ebp - 8], 0x5000
ja 0x6aaf0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
test eax, eax
je 0x6aaf0
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6aafb
call fcn.0006a644
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x6ab0f
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6ab1a
call fcn.0006a644
mov ebx, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
test eax, eax
je 0x6ab2b
push 0
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x6ab36
call fcn.0006a644
mov ebx, eax
test ebx, ebx
jne 0x6ab47
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 4]
call fcn.00026668
jmp 0x6ab54
mov edx, 0x6abfc
mov eax, dword [ebp - 4]
call fcn.00026668
mov eax, edi
call fcn.000126f8
push 0
call sub.kernel32.dll_SetLastError
mov eax, 0x6ac08
call fcn.0006a668
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ab8e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00013a78
ret
Function at 0x6b2a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6b365
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6b330
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x702cc], 0
jne 0x6b2fc
mov ecx, dword [0x70618]
mov ecx, dword [ecx]
lea eax, [ebp - 4]
mov edx, 0x6b37c
call fcn.00013d20
mov eax, dword [ebp - 4]
call fcn.00013e98
push eax
push 0xffffffffffffffff
push 0xf001f
call sub.kernel32.dll_OpenFileMappingA
mov dword [0x702cc], eax
cmp dword [0x702cc], 0
je 0x6b326
cmp dword [0x702d0], 0
jne 0x6b326
push 4
push 0
push 0
push 6
mov eax, dword [0x702cc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x702d0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6b348
cmp dword [0x702d0], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b36c
lea eax, [ebp - 4]
call fcn.00013a54
ret
Function at 0x4085a0
Capabilities:
Create thread

Disassembly:
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x20], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x24], eax
call edi
push 0
push 0
push 0
push 0
mov dword [esi + 0x28], eax
call edi
push 0xc
mov dword [esi + 0x30], eax
call fcn.00433925
add esp, 4
test eax, eax
jne 0x4085ff
xor al, al
mov byte [esp + 7], al
push 0x45c1c4
lea eax, [esp + 0xb]
push eax
call fcn.004342fb
push 0
push 0
push eax
push 0x408e50
push 0
push 0
mov dword [eax], esi
mov dword [eax + 8], 0
mov dword [eax + 4], 0x408a10
call fcn.00433828
mov edi, eax
mov eax, dword [esi + 0x2c]
add esp, 0x18
test eax, eax
je 0x408635
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2c], edi
xor eax, eax
pop edi
pop ecx
ret