joyce8/EMBER2024-capa huggingface dataset:
Function at 0x623394
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x64]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0x1fffffff
jne 0x6233fb
cmp ebx, dword [ebp - 8]
jge 0x62341e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x6233c9
jmp 0x62341e
cmp ebx, dword [ebp - 8]
jge 0x62341e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x623400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x623428
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x64]
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0x1fffffff
jne 0x62348f
cmp ebx, dword [ebp - 8]
jge 0x6234b2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x62345d
jmp 0x6234b2
cmp ebx, dword [ebp - 8]
jge 0x6234b2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x20]
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x623494
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x626338
Capabilities:
Find taskbar

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov ebx, eax
push ebx
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_GetWindowRect
push 0
lea eax, [esp + 4]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.004a89a4
push 0x6263cc
push 0x6263d0
call sub.user32.dll_FindWindowW
test eax, eax
je 0x6263c2
push esp
push eax
call sub.user32.dll_GetWindowRect
mov ecx, ebx
mov edx, esp
mov eax, esp
call fcn.00410a04
mov eax, dword [esp + 8]
sub eax, dword [esp]
mov edx, dword [esp + 0xc]
sub edx, dword [esp + 4]
mov esi, dword [ebx]
mov edi, dword [esp]
cmp esi, edi
jne 0x6263b6
mov ecx, dword [ebx + 4]
cmp ecx, dword [esp + 4]
jne 0x6263b6
mov ecx, dword [ebx + 8]
cmp ecx, dword [esp + 8]
jne 0x6263b2
add dword [ebx + 4], edx
jmp 0x6263c2
add dword [ebx], eax
jmp 0x6263c2
cmp edi, esi
jne 0x6263bf
sub dword [ebx + 0xc], edx
jmp 0x6263c2
sub dword [ebx + 8], eax
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x695780
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x280], 0
je 0x69579c
cmp dword [esi + 4], 0
je 0x6957c9
test byte [ebx + 0x65], 1
jne 0x6957bb
mov eax, ebx
call fcn.00536948
test eax, eax
jne 0x6957bb
mov edx, esi
mov eax, ebx
call fcn.0053df6c
jmp 0x6958ba
mov edx, esi
mov eax, ebx
call fcn.00538318
jmp 0x6958ba
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.005315f4
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x6958b3
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0053afa4
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, eax
mov edx, 0x14
mov eax, ebx
call fcn.005332ec
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00695780
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x54]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0053afa4
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6958ba
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6975a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x697657
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.0040aa00
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x6975e2
call fcn.0040961c
jmp 0x69765e
mov eax, ebx
call fcn.00406854
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.0040aa00
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
jne 0x69760b
call fcn.0040961c
jmp 0x69765e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x69766c
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
jne 0x69762c
call fcn.0040961c
jmp 0x69765e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69765e
mov eax, dword [ebp - 8]
call fcn.00406870
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6bc544
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409f8c
mov eax, dword [ebp - 8]
call fcn.00409f8c
xor eax, eax
push ebp
push 0x6bc652
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6bc628
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.004075e4
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], bx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040aa00
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa00
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x6bc5fd
call sub.kernel32.dll_GetLastError_2
lea edx, [ebp - 0x64]
call fcn.004286fc
mov eax, dword [ebp - 0x64]
call fcn.0040aa00
push eax
call sub.kernel32.dll_OutputDebugStringW
mov dword [ebp - 0xc], 1
call fcn.0040961c
jmp 0x6bc62f
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetExitCodeProcess
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bc62f
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bc659
lea eax, [ebp - 0x64]
call fcn.00409ea8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409f08
ret

Function at 0x6cad90
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
push ecx
mov esi, edx
mov ebx, eax
push esp
push 0x64
push 0
call sub.netapi32.dll_NetWkstaGetInfo
test eax, eax
sete al
test al, al
je 0x6cadba
mov edx, dword [esp]
mov edx, dword [edx + 0xc]
mov dword [ebx], edx
mov edx, dword [esp]
mov edx, dword [edx + 0x10]
mov dword [esi], edx
pop edx
pop esi
pop ebx
ret
Function at 0x6cadc0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6caec0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040a2d0
lea eax, [ebp - 4]
call fcn.0040a444
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa00
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x6caeaa
mov eax, ebx
call fcn.00406854
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x6caea3
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa00
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x6cae8d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x6caed4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x6cae8d
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6caeaa
mov eax, dword [ebp - 0x10]
call fcn.00406870
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6caec7
lea eax, [ebp - 4]
call fcn.00409ea8
ret

Function at 0x6cbf18
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6cbfb0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor esi, esi
mov byte [ebp - 9], 0
inc ebx
lea eax, [ebp - 0x28]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6cbf6a
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 4]
jne 0x6cbf61
mov byte [ebp - 9], 1
jmp 0x6cbf9a
push 0x64
call sub.kernel32.dll_Sleep_2
jmp 0x6cbf73
call sub.kernel32.dll_GetLastError_2
mov esi, eax
jmp 0x6cbf78
cmp ebx, 0x1e
jl 0x6cbf44
test esi, esi
jbe 0x6cbf84
push esi
call sub.kernel32.dll_SetLastError
jmp 0x6cbf9a
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.006cbc90
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
call fcn.0040a288
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cbfb7
lea eax, [ebp - 0x2c]
call fcn.00409ea8
ret

Function at 0x6cc2dc
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov esi, eax
xor ebx, ebx
test edx, edx
jbe 0x6cc30b
mov eax, esi
call fcn.006cc0a8
mov edi, eax
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6cc302
mov ebx, dword [esp + 4]
mov edx, edi
mov eax, esi
call fcn.006cc06c
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x6cc374
Capabilities:
Create service
Delete service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x6cc567
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00409ea8
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 9], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6cc3d0
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc588
call fcn.006cbbcc
jmp 0x6cc551
xor eax, eax
push ebp
push 0x6cc54a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x6cc423
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 1
push 3
push 1
push 0xf01ff
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x6cc443
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc5c4
call fcn.006cbbcc
call fcn.0040961c
jmp 0x6cc551
xor eax, eax
push ebp
push 0x6cc501
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6cc47b
cmp dword [ebp - 0x30], 4
jne 0x6cc47b
mov byte [ebp - 9], 1
call fcn.0040961c
call fcn.0040961c
jmp 0x6cc551
lea eax, [ebp - 8]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x6cc4c1
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc610
call fcn.006cbbcc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_DeleteService
call fcn.0040961c
call fcn.0040961c
jmp 0x6cc551
lea ecx, [ebp - 4]
mov edx, 4
mov eax, dword [ebp - 0x14]
call fcn.006cbf18
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x6cc4ea
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc648
call fcn.006cbbcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cc508
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cc56e
lea eax, [ebp - 4]
call fcn.00409ea8
ret
Function at 0x6cc67c
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x6cc901
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00409ea8
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 9], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6cc6db
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc920
call fcn.006cbbcc
jmp 0x6cc8e3
xor eax, eax
push ebp
push 0x6cc8dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x6cc728
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6cc728
cmp dword [ebp - 0x30], 1
jne 0x6cc728
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc95c
call fcn.006cbbcc
cmp dword [ebp - 0x14], 0
je 0x6cc734
cmp dword [ebp - 0x18], 0
jbe 0x6cc74e
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc99c
call fcn.006cbbcc
call fcn.0040961c
jmp 0x6cc8e3
xor eax, eax
push ebp
push 0x6cc88d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x1c
call fcn.004075e4
lea eax, [ebp - 0x34]
push eax
push 1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_ControlService
test eax, eax
je 0x6cc7b5
lea ecx, [ebp - 4]
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.006cbf18
test al, al
jne 0x6cc7b1
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cc9d0
call fcn.006cbbcc
call fcn.0040961c
call fcn.0040961c
jmp 0x6cc8e3
mov byte [ebp - 9], 1
lea ecx, [ebp - 4]
lea edx, [ebp - 0x18]
mov eax, 0x6cca10
call fcn.006cbbcc
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x1c
call fcn.004075e4
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x6cc7f7
cmp dword [ebp - 0x30], 1
jne 0x6cc7f7
mov byte [ebp - 9], 1
lea eax, [ebp - 4]
call fcn.00409ea8
cmp byte [ebp - 9], 0
je 0x6cc809
mov eax, 0x6cca4c
call fcn.00432134
jmp 0x6cc813
mov eax, 0x6cca80
call fcn.00432134
cmp byte [ebp + 8], 0
jne 0x6cc828
call fcn.0040961c
call fcn.0040961c
jmp 0x6cc8e3
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x6cc876
cmp dword [ebp - 4], 0
je 0x6cc86e
push dword [ebp - 4]
push 0x6ccab8
lea ecx, [ebp - 0x38]
lea edx, [ebp - 0x18]
mov eax, 0x6ccacc
call fcn.006cbbcc
push dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040acf4
mov eax, dword [ebp - 4]
call fcn.00432134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cc894
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cc908
lea eax, [ebp - 0x38]
call fcn.00409ea8
lea eax, [ebp - 4]
call fcn.00409ea8
ret
Function at 0x6cda0c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x6cda15
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10014], edx
mov ebx, eax
lea esi, [ebp - 0x1c]
xor eax, eax
push ebp
push 0x6cdb08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.006cded0
test al, al
je 0x6cdaef
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
lea eax, [ebp - 0x1000f]
xor ecx, ecx
mov edx, 0xfff3
call fcn.004075e4
mov eax, esi
xor ecx, ecx
mov edx, 0x1c
call fcn.004075e4
mov dword [esi], 2
xor eax, eax
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0xfff3
lea eax, [ebp - 0x1000f]
mov dword [esi + 0x10], eax
mov edx, esi
mov eax, ebx
call fcn.006cd568
test al, al
je 0x6cdabe
cmp dword [esi + 0x14], 0
jle 0x6cdaef
lea edx, [ebp - 0x1000f]
mov ecx, dword [esi + 0x14]
mov eax, ebx
call fcn.006cd910
jmp 0x6cdadd
call fcn.006cd218
mov edx, eax
lea eax, [ebp - 0x10014]
call fcn.0040aa68
mov eax, dword [ebp - 0x10014]
call fcn.00432134
jmp 0x6cdaef
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x1f4
jbe 0x6cda59
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6cdb0f
lea eax, [ebp - 0x10014]
call fcn.00409ea8
ret
Function at 0x6d22c4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x6d22f2
mov eax, ebx
call fcn.006d2d80
cmp dword [ebx + 0x40], 0
je 0x6d22eb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x6d2363
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x6d2355
cmp dword [ebx + 8], 0
je 0x6d2314
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x6d2326
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x6d2355
cmp dword [ebx + 8], 0
je 0x6d2307
cmp eax, 3
je 0x6d2339
dec eax
jne 0x6d2307
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x6d2307
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x6d2307
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x6d2381
cmp dword [ebx + 0x14], 0xcc
je 0x6d2381
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.006d238c
pop ebx
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xf435e8b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x37595123
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00405c60
mov eax, dword [ebp + 8]
add esp, 0xc
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x2c], eax
mov eax, str.quiet
cmove eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4015ff
mov eax, dword [ebp - 4]
test eax, eax
je 0x4015ff
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x4015ff
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
Function at 0x402f50
Capabilities:
Delete directory
Delete file

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x1c]
mov dword [edi], vtable.TempFolder.0
cmp esi, dword [edi + 0x20]
je 0x402f87
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esp, [esp]
cmp dword [esi + 0x14], 8
jb 0x402f7a
mov eax, dword [esi]
jmp 0x402f7c
mov eax, esi
push eax
call ebx
add esi, 0x18
cmp esi, dword [edi + 0x20]
jne 0x402f70
cmp byte [edi + 0x28], 0
je 0x402f9f
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x402f98
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x402ffa
mov ebx, dword [edi + 0x20]
cmp esi, ebx
je 0x402fda
lea ecx, [ecx]
cmp dword [esi + 0x14], 8
jb 0x402fc0
push dword [esi]
call fcn.00404a15
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
add esi, 0x18
cmp esi, ebx
jne 0x402fb0
push dword [edi + 0x1c]
call fcn.00404a15
add esp, 4
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
cmp dword [edi + 0x18], 8
jb 0x40300b
push dword [edi + 4]
call fcn.00404a15
add esp, 4
mov dword [edi + 0x18], 7
xor eax, eax
mov dword [edi + 0x14], 0
mov word [edi + 4], ax
pop edi
pop esi
pop ebx
ret