joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61899c
Capabilities:
Create process on windows
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
push ebx
push esi
mov eax, dword [0x69a4fc]
cmp dword [eax], 1
jne 0x618a91
push 0x618b88
push 0x618bb8
call sub.user32.dll_FindWindowW
test eax, eax
je 0x6189ce
mov byte [ebp - 1], 1
jmp 0x618b7b
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00403bd8
mov dword [ebp - 0x54], 0x44
mov eax, 0x104
call fcn.00403230
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x618a8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0x104
push 0
push 0x618bd8
push 0
call sub.kernel32.dll_SearchPathW
test eax, eax
jne 0x618a2b
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x618a74
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x210
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x618a5e
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x618a74
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618b7b
mov eax, dword [ebp - 8]
call fcn.0040324c
ret
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x618ab2
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x618b7b
push 4
push 0x618bf0
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jne 0x618ad4
push 0x10
push 0x618bf0
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
test esi, esi
jne 0x618aee
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x618b7b
lea eax, [ebp - 0x80]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x618b0f
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x618b7b
cmp dword [ebp - 0x7c], 4
jne 0x618b21
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 1
jmp 0x618b7b
xor eax, eax
mov dword [ebp - 0x10], eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
push 0x10
push 0x618bf0
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x618b71
push esi
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete byte [ebp - 1]
jmp 0x618b7b
push esi
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x618c04
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
xor ebx, ebx
mov eax, dword [0x69a4fc]
cmp dword [eax], 1
jne 0x618c2c
push 0x618c98
push 0x618cc8
call sub.user32.dll_FindWindowW
test eax, eax
setne bl
jmp 0x618c8c
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov esi, eax
test esi, esi
jne 0x618c49
call sub.kernel32.dll_GetLastError_1
test eax, eax
sete bl
jmp 0x618c8c
push 4
push 0x618ce8
push esi
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
je 0x618c8c
push esi
call sub.advapi32.dll_CloseServiceHandle
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x618c75
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x618c8c
cmp dword [esp + 4], 4
jne 0x618c86
push edi
call sub.advapi32.dll_CloseServiceHandle
mov bl, 1
jmp 0x618c8c
push edi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x618cfc
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
mov eax, dword [ebp - 8]
call fcn.00406b90
xor eax, eax
push ebp
push 0x618f55
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x618d4f
mov byte [ebp - 0xd], 0
push ebx
call sub.advapi32.dll_LockServiceDatabase
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x618f33
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x14], 0
jne 0x618dad
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x41f
je 0x618d7c
mov byte [ebp - 0xd], 0
push 0x10c
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov edi, eax
test edi, edi
lea eax, [ebp - 0x18]
push eax
push 0x10c
push edi
push ebx
call sub.advapi32.dll_QueryServiceLockStatusW
test eax, eax
jne 0x618da4
mov byte [ebp - 0xd], 0
cmp dword [edi], 0
push edi
call sub.kernel32.dll_LocalFree
push 2
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x618dcb
mov byte [ebp - 0xd], 0
xor edx, edx
push ebp
push 0x618f0c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
cmp eax, 4
ja case.default.0x618de1
jmp dword [eax*4 + 0x618de8]
xor esi, esi
jmp case.default.0x618de1
mov esi, 1
jmp case.default.0x618de1
mov esi, 2
jmp case.default.0x618de1
mov esi, 3
jmp case.default.0x618de1
mov esi, 4
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x110
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
jne 0x618e41
mov byte [ebp - 0xd], 0
push 0x618f68
call sub.kernel32.dll_GetModuleHandleW_2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
setne al
test al, al
jne 0x618e68
call fcn.0040541c
call fcn.0040541c
jmp 0x618f3a
xor edx, edx
push ebp
push 0x618eee
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x618f84
mov eax, dword [ebp - 0x20]
push eax
call fcn.0040a198
mov ebx, eax
test ebx, ebx
setne al
test al, al
jne 0x618ea3
call fcn.0040541c
call fcn.0040541c
call fcn.0040541c
jmp 0x618f3a
cmp dword [ebp - 8], 0
je 0x618eb6
mov eax, dword [ebp - 8]
call fcn.00406c34
mov dword [ebp - 0x24], eax
jmp 0x618ebb
xor eax, eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
mov edx, dword [0x6972fc]
mov eax, dword [ebp - 0x1c]
call ebx
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x618ed7
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618ef5
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x618f5c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x618fb0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], 1
xor edx, edx
push ebp
push 0x619160
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, 0x11c
call fcn.00403bd8
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_GetVersionExW
lea eax, [ebp - 0x144]
xor ecx, ecx
mov edx, 0x24
call fcn.00403bd8
push 0x619174
push 0x61919c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a198
test eax, eax
je 0x61902f
lea edx, [ebp - 0x144]
push edx
call eax
jmp 0x61903b
lea eax, [ebp - 0x144]
push eax
call sub.kernel32.dll_GetSystemInfo_1
cmp dword [ebp - 0x110], 2
jne 0x619156
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffffd
sub eax, 2
jae 0x61905d
mov dword [ebp - 4], 2
cmp dword [ebp - 0x11c], 5
jne 0x61907b
cmp dword [ebp - 0x118], 0
jne 0x61907b
mov dword [ebp - 4], 3
jmp 0x619156
cmp dword [ebp - 0x11c], 5
jne 0x619099
cmp dword [ebp - 0x118], 1
jne 0x619099
mov dword [ebp - 4], 4
jmp 0x619156
cmp dword [ebp - 0x11c], 5
jne 0x6190d3
cmp dword [ebp - 0x118], 2
jne 0x6190d3
cmp byte [ebp - 6], 1
jne 0x6190c7
cmp word [ebp - 0x144], 9
jne 0x6190c7
mov dword [ebp - 4], 4
jmp 0x619156
mov dword [ebp - 4], 5
jmp 0x619156
cmp dword [ebp - 0x11c], 6
jne 0x6190ee
cmp dword [ebp - 0x118], 0
jne 0x6190ee
mov dword [ebp - 4], 6
jmp 0x619156
cmp dword [ebp - 0x11c], 6
jne 0x619109
cmp dword [ebp - 0x118], 1
jne 0x619109
mov dword [ebp - 4], 7
jmp 0x619156
cmp dword [ebp - 0x11c], 6
jne 0x61912b
mov eax, dword [ebp - 0x118]
cmp eax, 2
je 0x619122
cmp eax, 3
jne 0x61912b
mov dword [ebp - 4], 8
jmp 0x619156
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jne 0x61914a
mov edx, dword [ebp - 0x118]
sub edx, 4
jne 0x61914a
mov dword [ebp - 4], 0xa
jmp 0x619156
cmp eax, 0xa
jne 0x619156
mov dword [ebp - 4], 0xa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61916a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x61a40c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
mov eax, dword [ebp - 8]
call fcn.00406b90
xor eax, eax
push ebp
push 0x61a48c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00471a44
test al, al
jne 0x61a471
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x61a471
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61a493
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x61aa30
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
lea eax, [ebp - 0x278]
mov edx, dword [0x46ec40]
call fcn.00407644
xor eax, eax
push ebp
push 0x61ac02
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x61ac1c
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00471c84
mov ebx, eax
xor eax, eax
push ebp
push 0x61abc4
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x61abab
xor eax, eax
push ebp
push 0x61ab9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x61ac30
mov eax, dword [ebp - 0x264]
call fcn.00470778
test al, al
jne 0x61aafb
mov edx, 0x61ac40
mov eax, dword [ebp - 0x264]
call fcn.00470778
test al, al
je 0x61ab05
call fcn.0040541c
jmp 0x61aba3
test dword [ebp - 0x268], 0x10
jle 0x61ab6d
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x280]
call fcn.0047a824
mov eax, dword [ebp - 0x280]
call fcn.0061aa30
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x288]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
call fcn.0040541c
jmp 0x61aba3
lea ecx, [ebp - 0x28c]
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 4]
call fcn.0061a938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61aba3
lea eax, [ebp - 0x278]
call fcn.00471cd4
mov ebx, eax
ret
test ebx, ebx
je 0x61aac5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61abcb
lea eax, [ebp - 0x278]
call fcn.00471cf8
ret
Function at 0x61c390
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
lea eax, [ebp - 0x278]
mov edx, dword [0x46ec40]
call fcn.00407644
xor eax, eax
push ebp
push 0x61c56e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x61c588
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00471c84
mov ebx, eax
xor eax, eax
push ebp
push 0x61c530
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x61c517
xor eax, eax
push ebp
push 0x61c508
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x61c59c
mov eax, dword [ebp - 0x264]
call fcn.00470778
test al, al
jne 0x61c45b
mov edx, 0x61c5ac
mov eax, dword [ebp - 0x264]
call fcn.00470778
test al, al
je 0x61c465
call fcn.0040541c
jmp 0x61c50f
test dword [ebp - 0x268], 0x10
jle 0x61c4d2
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x280]
call fcn.0047a824
mov eax, dword [ebp - 0x280]
call fcn.0061c390
pop ecx
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x288]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
call fcn.0040541c
jmp 0x61c50f
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.0061c728
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c50f
lea eax, [ebp - 0x278]
call fcn.00471cd4
mov ebx, eax
ret
test ebx, ebx
je 0x61c425
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c537
lea eax, [ebp - 0x278]
call fcn.00471cf8
ret

Function at 0x61c5b4
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x61c679
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x61c624
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6998d4]
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
lea eax, [ebp - 8]
mov ecx, 0x61c694
call fcn.00406f8c
mov eax, dword [ebp - 8]
call fcn.00471a8c
test al, al
je 0x61c61a
push ebp
mov eax, dword [ebp - 8]
call fcn.0061c390
pop ecx
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61c65e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c680
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x61ca70
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
mov eax, dword [ebp - 8]
call fcn.00406b90
xor eax, eax
push ebp
push 0x61caf0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00471a44
test al, al
jne 0x61cad5
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x61cad5
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61caf7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x61d184
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x61d37f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x61d327
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 4]
lea eax, [ebp - 4]
mov ecx, 0x61d39c
call fcn.00406f8c
mov eax, dword [ebp - 4]
call fcn.00471a44
test al, al
jne 0x61d1dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d361
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x61d200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d361
xor eax, eax
push ebp
push 0x61d316
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
push 0
push 2
push 0x10
push 0xf01ff
push 0x61d3b8
push 0x61d3ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x61d25a
call fcn.0040541c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d361
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, 0x61d404
mov dword [ebp - 0x10], eax
push 0xf01ff
push 0x61d3ec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x61d299
call fcn.0040541c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d361
call fcn.0061cfb4
xor eax, eax
push ebp
push 0x61d2f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x61d404
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x69a408]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceW
push 0x64
mov eax, dword [0x69a508]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d2ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d386
lea eax, [ebp - 0x18]
call fcn.00406b98
lea eax, [ebp - 4]
call fcn.00406b98
ret
Function at 0x61ff58
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
lea eax, [ebp - 0x278]
mov edx, dword [0x46ec40]
call fcn.00407644
xor eax, eax
push ebp
push 0x62016d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x620188
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.00471c84
mov ebx, eax
xor eax, eax
push ebp
push 0x62012f
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x620116
xor eax, eax
push ebp
push 0x620107
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x62019c
mov eax, dword [ebp - 0x264]
call fcn.00470778
test al, al
jne 0x620023
mov edx, 0x6201ac
mov eax, dword [ebp - 0x264]
call fcn.00470778
test al, al
je 0x62002d
call fcn.0040541c
jmp 0x62010e
test dword [ebp - 0x268], 0x10
jle 0x6200d1
mov eax, dword [0x699e7c]
mov eax, dword [eax]
mov edx, 0x6201c0
call fcn.005e2960
test al, al
je 0x620070
mov edx, 0x6201d8
mov eax, dword [ebp - 0x264]
call fcn.00470778
test al, al
je 0x620070
call fcn.0040541c
jmp 0x62010e
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x284]
lea edx, [ebp - 0x280]
call fcn.0047a824
mov eax, dword [ebp - 0x280]
call fcn.0061ff58
pop ecx
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00406f8c
mov eax, dword [ebp - 0x288]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
call fcn.0040541c
jmp 0x62010e
lea eax, [ebp - 0x28c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00621a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62010e
lea eax, [ebp - 0x278]
call fcn.00471cd4
mov ebx, eax
ret
test ebx, ebx
je 0x61ffed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x620136
lea eax, [ebp - 0x278]
call fcn.00471cf8
ret
Function at 0x6201e0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6202d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x620281
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0061ff58
pop ecx
mov eax, dword [0x6998d4]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
lea eax, [ebp - 0xc]
mov ecx, 0x6202f0
call fcn.00406f8c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x69a388]
mov eax, dword [eax]
call eax
mov eax, dword [0x6998d4]
mov eax, dword [eax]
mov edx, dword [eax + 0x40]
lea eax, [ebp - 8]
mov ecx, 0x620354
call fcn.00406f8c
mov eax, dword [ebp - 8]
call fcn.00471a8c
test al, al
je 0x620277
push ebp
mov eax, dword [ebp - 8]
call fcn.0061ff58
pop ecx
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6202bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6202dd
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00406ba0
ret

Function at 0x6214f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
mov eax, dword [ebp - 8]
call fcn.00406b90
xor eax, eax
push ebp
push 0x621570
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00471a44
test al, al
jne 0x621555
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [ebp - 8]
call fcn.00406c34
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x621555
mov eax, dword [ebp - 4]
call fcn.00406c34
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621577
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ba0
ret
Function at 0x621d58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x621e7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x621e98
call fcn.0061ac48
test al, al
je 0x621e62
push 0x621ec4
push 0x621ef4
call sub.user32.dll_FindWindowW
mov ebx, eax
test ebx, ebx
jbe 0x621e28
push 0
push 1
push 0x2aad
push ebx
call sub.user32.dll_PostMessageW
test eax, eax
je 0x621def
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
jmp 0x621dd9
push 0x3e8
mov eax, dword [0x69a508]
mov eax, dword [eax]
call eax
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x2ee0
jae 0x621e58
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x621e98
call fcn.0061ac48
test al, al
jne 0x621dbd
jmp 0x621e58
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 8]
call fcn.004714d4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x621f20
call fcn.00406f8c
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
mov eax, dword [0x69a164]
mov eax, dword [eax]
call eax
jmp 0x621e58
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10]
call fcn.004714d4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x621f6c
call fcn.00406f8c
mov eax, dword [ebp - 0xc]
call fcn.00406c34
push eax
mov eax, dword [0x69a164]
mov eax, dword [eax]
call eax
mov eax, 0x621e98
call fcn.00515b10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x621e84
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406ba0
ret