joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496def
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00486be4
mov dword [ebp - 0x14], eax
cmp dword [0xaa31d0], esi
jne 0x496ee2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x496e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x496fc2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x496fc2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x496fc2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaa31d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaa31d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaa31d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa31e0], eax
test eax, eax
je 0x496edf
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa31dc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x496f07
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x496efa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x496f1c
push 4
pop eax
jmp 0x496fc4
cmp dword [ebp - 0x14], esi
je 0x496f1c
push dword [0xaa31d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x496f01
mov eax, dword [0xaa31dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x496f7a
cmp dword [0xaa31e0], edi
je 0x496f7a
push eax
call ebx
push dword [0xaa31e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x496f7a
test eax, eax
je 0x496f7a
call ecx
test eax, eax
je 0x496f6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x496f6f
test byte [ebp - 8], 1
jne 0x496f7a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x496faa
mov eax, dword [0xaa31d4]
cmp eax, edi
je 0x496fa7
push eax
call ebx
test eax, eax
je 0x496fa7
call eax
mov esi, eax
test esi, esi
je 0x496fa7
mov eax, dword [0xaa31d8]
cmp eax, edi
je 0x496fa7
push eax
call ebx
test eax, eax
je 0x496fa7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaa31d0]
call ebx
test eax, eax
je 0x496fc2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x496fc4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048608b
mov esp, ebp
pop ebp
ret
Function at 0x48a3b2
Capabilities:
Parse pe header

Disassembly:
pushal
xor edx, edx
mov esi, dword fs:[edx]
lodsd eax, dword [esi]
cmp eax, 0xffffffff
je 0x48a3c2
mov esi, eax
jmp 0x48a3b8
mov edi, dword [esi + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
je 0x48a3da
sub edi, 0x10000
jmp 0x48a3cb
mov ebx, edi
add ebx, dword [ebx + 0x3c]
cmp word [ebx], 0x4550
je 0x48a3e8
jmp 0x48a3cb
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x48a3ee
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x48a40d
cmp eax, dword [esp + 0x28]
je 0x48a424
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x48a404
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
mov dword [esp + 0x1c], eax
popal
ret 8
Function at 0x401000
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x43ad02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x10]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
lea ebp, [esi + 0x14]
mov dword [esp + 0x1c], 0
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_3
lea ebx, [esi + 0x18]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString_3
push 0x450728
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 5
mov dword [esi + 0x30], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 2
call sub.MFC42.DLL_CString::operator_1
push 0x450728
lea ecx, [esi + 0x2c]
call sub.MFC42.DLL_CString::operator_1
push 0x450728
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
push 0x450728
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
push 0x450728
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_1
push 0x450728
lea ecx, [esi + 0x24]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401250
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x43ad88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [esp + 0x88]
mov eax, dword [esp + 0x84]
xor ebx, ebx
mov dword [esi], ebx
mov ecx, dword [eax - 8]
cmp ecx, ebx
mov dword [esp + 0x7c], ebx
jne 0x4012b4
lea ecx, [esp + 0x84]
mov dword [esi], 3
mov dword [esp + 0x7c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
add esp, 0x78
ret
lea ecx, [esp + 0x88]
lea edx, [esp + 0xc]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push edx
mov dword [esp + 0xb4], ebx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 1
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40132c
push ebx
push ebx
push str.CXSyncExeApp::CreateDirectory_GrantAccess___:_Fail_to_get_Everyone_SID___
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp + 0x84]
mov dword [esp + 0x7c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
add esp, 0x78
ret
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x3c]
push ebx
push edx
push 1
mov dword [esp + 0x48], 0x10000000
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 3
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 5
mov dword [esp + 0x64], eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
lea eax, [esp + 0x24]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov ecx, dword [esp + 0xc]
push ebx
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edx, dword [esp + 0x88]
lea ecx, [esp + 0x18]
lea eax, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
pop edi
jne 0x4013d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, dword [esp + 0x88]
cmp eax, ebx
je 0x4013e6
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x4013f5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esi]
xor eax, eax
cmp ecx, ebx
lea ecx, [esp + 0x84]
sete al
mov esi, eax
mov dword [esp + 0x7c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x74]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret
Function at 0x404aa0
Capabilities:
Delete file

Disassembly:
sub esp, 0x24
lea eax, [esp]
push esi
mov esi, ecx
push edi
push eax
lea edi, [esi + 8]
push edi
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jl 0x404b23
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x1c]
shl ecx, 0x14
cmp eax, ecx
jl 0x404b23
mov eax, dword [esi]
test eax, eax
je 0x404ae1
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi], 0
mov ecx, esi
call fcn.00404d40
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi], 0
jne 0x404b23
push 0x44a358
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x404b19
mov dword [esi + 0x110], 1
pop edi
pop esi
add esp, 0x24
ret
mov dword [esi + 0x110], 0
pop edi
pop esi
add esp, 0x24
ret
Function at 0x404b30
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43b228
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, 1
mov eax, dword [esi + 0x528]
xor edi, edi
cmp eax, ebx
jge 0x404b74
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 0x53c]
mov ecx, dword [esi + 0x538]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s_________.log
push edx
mov dword [esp + 0x58], edi
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi + 0x528]
add esp, 0xc
neg eax
mov ecx, esp
mov dword [esp + 0x24], esp
lea eax, [eax + eax*2]
lea edx, [esp + 0x24]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
mov dword [ecx], eax
lea ecx, [esp + 0x20]
push ecx
push edx
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, eax
call fcn.00401960
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x18]
push str._Y_m_d
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x50], bl
call sub.MFC42.DLL_CTime::Format
mov ecx, dword [eax]
mov edx, dword [esi + 0x53c]
push ecx
push edx
lea eax, [esp + 0x18]
push str._s__s.log
push eax
mov byte [esp + 0x58], 2
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
call fcn.0043a3d0
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 3
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x404c86
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
mov esi, eax
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x50], 4
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jg 0x404cde
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
push edx
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
inc edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 3
call sub.MFC42.DLL_CString::CString
test esi, esi
jne 0x404c8c
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x40]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3c
ret
Function at 0x404d40
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x108
mov edx, ecx
mov ecx, 0x41
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
lea esi, [edx + 8]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push esi
lea eax, [esp + 0xc]
push str._s.bak
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
add esp, 0x108
ret

Function at 0x404d90
Capabilities:
Create directory

Disassembly:
sub esp, 0x110
push ebp
push esi
lea ebp, [ecx + 8]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0xf], al
test ecx, ecx
mov dword [esp + 0x10], ecx
jle 0x404e0f
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strncpy]
cmp byte [esi + ebp], 0x5c
jne 0x404dfd
mov al, byte [esp + 0x13]
test al, al
jne 0x404dd2
mov byte [esp + 0x13], 1
jmp 0x404dfd
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
push esi
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push ebp
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x14]
inc esi
cmp esi, ecx
jl 0x404dbd
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x110
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x110
ret

Function at 0x405fb0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x20
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x1e
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
pop edi
jge 0x40600a
call sub.WSOCK32.dll_WSAGetLastError
mov ecx, dword [0x450ba4]
push eax
push str.CSockUtil::GetLocalIpAddr__gethostname___Fail__ErrCode___d
push 4
push ecx
call fcn.00404960
add esp, 0x10
or eax, 0xffffffff
add esp, 0x20
ret
lea edx, [esp]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x40603c
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov eax, dword [0x450ba4]
push str.CSockUtil::GetLocalIpAddr__gethostbyname___Fail__ErrCode___d
push 4
push eax
call fcn.00404960
add esp, 0x10
mov eax, 0xfffffffe
add esp, 0x20
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WSOCK32.dll_inet_ntoa
push eax
mov eax, dword [esp + 0x28]
push 0x44a040
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
xor eax, eax
add esp, 0x20
ret
Function at 0x406680
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43b528
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x68
test eax, eax
ja 0x4066b1
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
add esp, 0x74
ret
lea ecx, [esp + 4]
push 0x64
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
jg 0x4066d4
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
add esp, 0x74
ret
lea edx, [esp + 4]
lea ecx, [esp + 0x78]
push edx
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x78]
mov dword [esp + 0x70], 0
call sub.MFC42.DLL_CString::MakeUpper
mov eax, dword [esp + 0x78]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x406720
lea ecx, [esp + 0x78]
mov dword [esp + 0x70], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
add esp, 0x74
ret
push esi
lea ecx, [esp + 4]
push 3
push ecx
lea ecx, [esp + 0x84]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
push 0x44a4d0
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 4]
test eax, eax
sete dl
and edx, 0xff
mov esi, edx
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x74
ret

Function at 0x406860
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43b58b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0xa
lea ecx, [esi + 0x34]
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CPtrList::CPtrList
xor edi, edi
push 0xa
lea ecx, [esi + 0x50]
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0xa4]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0xc0]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CPtrList::CPtrList
lea ecx, [esi + 0xdc]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x1c]
xor eax, eax
mov dword [esi], 0x4400e0
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x30], edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x406960
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43b5aa
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x14
mov dword [esi + 0xe8], eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x4069b7
push 0
push 0
push 0
push 0
push 1
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko
mov ecx, eax
call sub.MFC42.DLL_CInternetSession::CInternetSession
jmp 0x4069b9
xor eax, eax
mov edx, dword [esi + 0xe8]
mov dword [esi + 0xe0], eax
push 0
push 0
mov di, word [edx + 0xc]
mov edx, dword [edx + 0x10]
push edi
push edx
mov ecx, eax
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CInternetSession::GetHttpConnection
test eax, eax
mov dword [esi + 0xe4], eax
jne 0x406a16
mov ecx, dword [esi + 0xe8]
mov eax, dword [0x450ba4]
and edi, 0xffff
mov edx, dword [ecx + 0x10]
push edi
push edx
push str.CSyncEngine::DownloadListFileFromServer__GetHttpConnection__s___d__returns_NULL
push 1
push eax
call fcn.00404960
add esp, 0x14
or eax, 0xffffffff
jmp 0x406a8a
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea ebp, [esi + 0xc]
lea ebx, [esi + 8]
lea edi, [esi + 4]
push ecx
mov ecx, dword [0x450ba4]
push edx
push eax
push str.CSyncEngine::InitSyncEngine__m_dwConnectTimeOut_d__m_dwSendTimeOut_d__m_dwRecvTimeOut_d
push 1
push ecx
call fcn.00404960
mov eax, dword [edi]
add esp, 0x18
test eax, eax
jbe 0x406a59
mov ecx, dword [esi + 0xe4]
push 0
push 4
push edi
push 2
call sub.MFC42.DLL_CInternetConnection::SetOption
cmp dword [ebx], 0
jbe 0x406a70
mov ecx, dword [esi + 0xe4]
push 0
push 4
push ebx
push 5
call sub.MFC42.DLL_CInternetConnection::SetOption
cmp dword [ebp], 0
jbe 0x406a88
mov ecx, dword [esi + 0xe4]
push 0
push 4
push ebp
push 6
call sub.MFC42.DLL_CInternetConnection::SetOption
xor eax, eax
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x406f00
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
je 0x406f26
mov eax, dword [0x450ba4]
push str.CSyncEngine::StartSyncThread__m_pSyncThread_is_Not_NULL
push 3
push eax
call fcn.00404960
add esp, 0xc
mov eax, 2
pop esi
ret
push 0
push 4
push 0
push 0
push esi
push 0x406f90
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x30], eax
jne 0x406f5d
mov ecx, dword [0x450ba4]
push str.CSyncEngine::StartSyncThread__AfxBeginThread___Fail__ErrCode___d
push 4
push ecx
call fcn.00404960
add esp, 0xc
mov eax, 1
pop esi
ret
mov dword [eax + 0x28], 0
mov edx, dword [0x450ba4]
push str.CSyncEngine::StartSyncThread__Start_m_pSyncThread...
push 2
push edx
call fcn.00404960
mov eax, dword [esi + 0x30]
add esp, 0xc
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
ret
Function at 0x40a190
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43b940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x28]
lea edx, [esp + 8]
mov dword [esp + 0x20], 0
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x14]
push ecx
push 0x44c614
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi]
mov ecx, dword [0x450ba4]
add esp, 0xc
push eax
push str.CSyncEngine::ProcessRegistryFile__Cmd_Str_:_regedit__s__s
push 1
push ecx
call fcn.00404960
add esp, 0x10
mov ecx, esi
push 0x5c
call sub.MFC42.DLL_CString::ReverseFind
mov edi, eax
lea edx, [esp + 0xc]
push edi
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
inc edi
lea eax, [esp + 0x10]
push edi
push eax
mov ecx, esi
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::Mid
push 0x44a0a4
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString_1
mov ecx, dword [esp + 0xc]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 0
push eax
mov eax, dword [esp + 0x10]
push eax
push str.regedit
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x28]
mov edi, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
cmp edi, 0x20
jle 0x40a2dc
mov ecx, dword [esi]
mov edx, dword [0x450ba4]
push ecx
push str.CSyncEngine::ProcessRegistryFile___s
push 1
push edx
call fcn.00404960
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
mov eax, dword [esi]
mov ecx, dword [0x450ba4]
push eax
push 0x44c540
push 1
push ecx
call fcn.00404960
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
or eax, 0xffffffff
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4