joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x41ab32
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 0x10]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ebp, [esi + 0x14]
mov dword [esp + 0x1c], 0
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
lea ebx, [esi + 0x18]
mov byte [esp + 0x1c], 1
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x24]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x28]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x2c]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString_2
push 0x42a5c8
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 5
mov dword [esi + 0x30], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 2
call sub.MFC42.DLL_CString::operator_1
push 0x42a5c8
lea ecx, [esi + 0x2c]
call sub.MFC42.DLL_CString::operator_1
push 0x42a5c8
mov ecx, edi
call sub.MFC42.DLL_CString::operator_1
push 0x42a5c8
mov ecx, ebp
call sub.MFC42.DLL_CString::operator_1
push 0x42a5c8
mov ecx, ebx
call sub.MFC42.DLL_CString::operator_1
push 0x42a5c8
lea ecx, [esi + 0x24]
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0xffffffff
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x401250
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x41abb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [esp + 0x88]
mov eax, dword [esp + 0x84]
xor ebx, ebx
mov dword [esi], ebx
mov ecx, dword [eax - 8]
cmp ecx, ebx
mov dword [esp + 0x7c], ebx
jne 0x4012b4
lea ecx, [esp + 0x84]
mov dword [esi], 3
mov dword [esp + 0x7c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
add esp, 0x78
ret
lea ecx, [esp + 0x88]
lea edx, [esp + 0xc]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push edx
mov dword [esp + 0xb4], ebx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 1
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40132c
push ebx
push ebx
push str.CXSyncExeApp::CreateDirectory_GrantAccess___:_Fail_to_get_Everyone_SID___
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp + 0x84]
mov dword [esp + 0x7c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
add esp, 0x78
ret
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x3c]
push ebx
push edx
push 1
mov dword [esp + 0x48], 0x10000000
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 3
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], 5
mov dword [esp + 0x64], eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
lea eax, [esp + 0x24]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov ecx, dword [esp + 0xc]
push ebx
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edx, dword [esp + 0x88]
lea ecx, [esp + 0x18]
lea eax, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
pop edi
jne 0x4013d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, dword [esp + 0x88]
cmp eax, ebx
je 0x4013e6
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x4013f5
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esi]
xor eax, eax
cmp ecx, ebx
lea ecx, [esp + 0x84]
sete al
mov esi, eax
mov dword [esp + 0x7c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x74]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret
Function at 0x4049d0
Capabilities:
Delete file

Disassembly:
sub esp, 0x24
lea eax, [esp]
push esi
mov esi, ecx
push edi
push eax
lea edi, [esi + 8]
push edi
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jl 0x404a53
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x1c]
shl ecx, 0x14
cmp eax, ecx
jl 0x404a53
mov eax, dword [esi]
test eax, eax
je 0x404a11
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi], 0
mov ecx, esi
call fcn.00404c70
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi], 0
jne 0x404a53
push 0x424338
push edi
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x404a49
mov dword [esi + 0x110], 1
pop edi
pop esi
add esp, 0x24
ret
mov dword [esi + 0x110], 0
pop edi
pop esi
add esp, 0x24
ret
Function at 0x404a60
Capabilities:
Delete file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41b118
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, 1
mov eax, dword [esi + 0x528]
xor edi, edi
cmp eax, ebx
jge 0x404aa4
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esi + 0x53c]
mov ecx, dword [esi + 0x538]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s_________.log
push edx
mov dword [esp + 0x58], edi
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi + 0x528]
add esp, 0xc
neg eax
mov ecx, esp
mov dword [esp + 0x24], esp
lea eax, [eax + eax*2]
lea edx, [esp + 0x24]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
mov dword [ecx], eax
lea ecx, [esp + 0x20]
push ecx
push edx
call sub.MFC42.DLL_CTime::GetTickCount
mov ecx, eax
call fcn.00401960
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x18]
push str._Y_m_d
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x50], bl
call sub.MFC42.DLL_CTime::Format
mov ecx, dword [eax]
mov edx, dword [esi + 0x53c]
push ecx
push edx
lea eax, [esp + 0x18]
push str._s__s.log
push eax
mov byte [esp + 0x58], 2
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
call fcn.0041a2be
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 3
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x404bb6
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
mov esi, eax
call sub.MFC42.DLL_CFileFind::GetFileName
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x50], 4
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jg 0x404c0e
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
push edx
call sub.MFC42.DLL_CFileFind::GetFilePath
mov eax, dword [eax]
push eax
call ebp
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
inc edi
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 3
call sub.MFC42.DLL_CString::CString
test esi, esi
jne 0x404bbc
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], bl
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x40]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3c
ret
Function at 0x404c70
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x108
mov edx, ecx
mov ecx, 0x41
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
lea esi, [edx + 8]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push esi
lea eax, [esp + 0xc]
push str._s.bak
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
pop esi
add esp, 0x108
ret

Function at 0x404cc0
Capabilities:
Create directory

Disassembly:
sub esp, 0x110
push ebp
push esi
lea ebp, [ecx + 8]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0xf], al
test ecx, ecx
mov dword [esp + 0x10], ecx
jle 0x404d3f
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_strncpy]
cmp byte [esi + ebp], 0x5c
jne 0x404d2d
mov al, byte [esp + 0x13]
test al, al
jne 0x404d02
mov byte [esp + 0x13], 1
jmp 0x404d2d
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
push esi
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push ebp
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [esp + 0x14]
inc esi
cmp esi, ecx
jl 0x404ced
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x110
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x110
ret

Function at 0x404dd0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x20
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push 0x1e
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 8]
push eax
call sub.WSOCK32.dll_gethostname
test eax, eax
pop edi
jge 0x404e2a
call sub.WSOCK32.dll_WSAGetLastError
mov ecx, dword [0x42a950]
push eax
push str.CSockUtil::GetLocalIpAddr__gethostname___Fail__ErrCode___d
push 4
push ecx
call fcn.00404890
add esp, 0x10
or eax, 0xffffffff
add esp, 0x20
ret
lea edx, [esp]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x404e5c
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov eax, dword [0x42a950]
push str.CSockUtil::GetLocalIpAddr__gethostbyname___Fail__ErrCode___d
push 4
push eax
call fcn.00404890
add esp, 0x10
mov eax, 0xfffffffe
add esp, 0x20
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WSOCK32.dll_inet_ntoa
push eax
mov eax, dword [esp + 0x28]
push 0x424030
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
xor eax, eax
add esp, 0x20
ret
Function at 0x405290
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x41b1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0xa
lea ecx, [esi + 0x34]
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CPtrList::CPtrList
xor edi, edi
push 0xa
lea ecx, [esi + 0x50]
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0x6c]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0x88]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0xa4]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CPtrList::CPtrList
push 0xa
lea ecx, [esi + 0xc0]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CPtrList::CPtrList
lea ecx, [esi + 0xdc]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x1c]
xor eax, eax
mov dword [esi], 0x41dd90
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x30], edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0x10], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x405390
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41b21a
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x14
mov dword [esi + 0xe8], eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x4053e7
push 0
push 0
push 0
push 0
push 1
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko
mov ecx, eax
call sub.MFC42.DLL_CInternetSession::CInternetSession
jmp 0x4053e9
xor eax, eax
mov edx, dword [esi + 0xe8]
mov dword [esi + 0xe0], eax
push 0
push 0
mov di, word [edx + 0xc]
mov edx, dword [edx + 0x10]
push edi
push edx
mov ecx, eax
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CInternetSession::GetHttpConnection
test eax, eax
mov dword [esi + 0xe4], eax
jne 0x405446
mov ecx, dword [esi + 0xe8]
mov eax, dword [0x42a950]
and edi, 0xffff
mov edx, dword [ecx + 0x10]
push edi
push edx
push str.CSyncEngine::DownloadListFileFromServer__GetHttpConnection__s___d__returns_NULL
push 1
push eax
call fcn.00404890
add esp, 0x14
or eax, 0xffffffff
jmp 0x4054ba
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea ebp, [esi + 0xc]
lea ebx, [esi + 8]
lea edi, [esi + 4]
push ecx
mov ecx, dword [0x42a950]
push edx
push eax
push str.CSyncEngine::InitSyncEngine__m_dwConnectTimeOut_d__m_dwSendTimeOut_d__m_dwRecvTimeOut_d
push 1
push ecx
call fcn.00404890
mov eax, dword [edi]
add esp, 0x18
test eax, eax
jbe 0x405489
mov ecx, dword [esi + 0xe4]
push 0
push 4
push edi
push 2
call sub.MFC42.DLL_CInternetConnection::SetOption
cmp dword [ebx], 0
jbe 0x4054a0
mov ecx, dword [esi + 0xe4]
push 0
push 4
push ebx
push 5
call sub.MFC42.DLL_CInternetConnection::SetOption
cmp dword [ebp], 0
jbe 0x4054b8
mov ecx, dword [esi + 0xe4]
push 0
push 4
push ebp
push 6
call sub.MFC42.DLL_CInternetConnection::SetOption
xor eax, eax
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 4
Function at 0x405930
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
test eax, eax
je 0x405956
mov eax, dword [0x42a950]
push str.CSyncEngine::StartSyncThread__m_pSyncThread_is_Not_NULL
push 3
push eax
call fcn.00404890
add esp, 0xc
mov eax, 2
pop esi
ret
push 0
push 4
push 0
push 0
push esi
push 0x4059c0
call sub.MFC42.DLL_AfxBeginThread
test eax, eax
mov dword [esi + 0x30], eax
jne 0x40598d
mov ecx, dword [0x42a950]
push str.CSyncEngine::StartSyncThread__AfxBeginThread___Fail__ErrCode___d
push 4
push ecx
call fcn.00404890
add esp, 0xc
mov eax, 1
pop esi
ret
mov dword [eax + 0x28], 0
mov edx, dword [0x42a950]
push str.CSyncEngine::StartSyncThread__Start_m_pSyncThread...
push 2
push edx
call fcn.00404890
mov eax, dword [esi + 0x30]
add esp, 0xc
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
ret
Function at 0x408d60
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, ecx
push ebp
push edi
mov ecx, dword [ebx + 0x2c]
push 0x42a5c8
add ecx, 0x37c
mov ebp, 1
call fcn.00403990
mov ecx, dword [ebx + 0x2c]
push 0x4265e0
add ecx, 0x434
call fcn.00403990
mov edi, dword [ebx + 0x38]
test edi, edi
je 0x408e1b
push esi
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 8]
cmp dword [esi + 0x1c], 6
jne 0x408e11
mov eax, dword [esi + 0x30]
test eax, eax
je 0x408e11
push esi
mov ecx, ebx
call fcn.00408e30
test eax, eax
jge 0x408e11
mov eax, dword [esi + 0x14]
mov ecx, dword [0x42a950]
push eax
push str.CSyncEngine::HandleRegistryTypeFiles__Delete_Local_Flle___s
push 3
push ecx
call fcn.00404890
mov eax, dword [esi + 0x14]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x408e0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [0x42a950]
push edx
push str.CSyncEngine::HandleRegistryTypeFiles__DeleteFile__s__Error__ErrCode___d
push 4
push eax
call fcn.00404890
mov ecx, dword [0x42a950]
add esp, 0x14
call fcn.00404d50
xor ebp, ebp
test edi, edi
jne 0x408d9c
cmp ebp, 1
pop esi
jne 0x408e21
pop edi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x408e30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41b500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x28]
lea edx, [esp + 8]
mov dword [esp + 0x20], 0
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x14]
push ecx
push 0x4266d8
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi]
mov ecx, dword [0x42a950]
add esp, 0xc
push eax
push str.CSyncEngine::ProcessRegistryFile__Cmd_Str_:_regedit__s__s
push 1
push ecx
call fcn.00404890
add esp, 0x10
mov ecx, esi
push 0x5c
call sub.MFC42.DLL_CString::ReverseFind
mov edi, eax
lea edx, [esp + 0xc]
push edi
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
inc edi
lea eax, [esp + 0x10]
push edi
push eax
mov ecx, esi
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::Mid
push 0x424094
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 2
call fcn.0041a252
mov ecx, dword [esp + 0xc]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
mov byte [esp + 0x2c], 3
call sub.MFC42.DLL_operator
mov eax, dword [eax]
push 0
push eax
mov eax, dword [esp + 0x10]
push eax
push str.regedit
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x28]
mov edi, eax
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
cmp edi, 0x20
jle 0x408f7c
mov ecx, dword [esi]
mov edx, dword [0x42a950]
push ecx
push str.CSyncEngine::ProcessRegistryFile___s
push 1
push edx
call fcn.00404890
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
mov eax, dword [esi]
mov ecx, dword [0x42a950]
push eax
push 0x426604
push 1
push ecx
call fcn.00404890
add esp, 0x10
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
or eax, 0xffffffff
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x409360
Capabilities:
Access peb ldr_data
Create process on windows
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x41b580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [0x42a804]
lea ecx, [esp + 8]
push eax
push str._s_regsvr32.exe
push ecx
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
add esp, 0xc
mov eax, dword [edx + 0x14]
lea esi, [edx + 0x14]
mov edx, dword [0x42a950]
push eax
push ecx
push str.CSyncEngine::ProcessRegisterFileByRegSvr32__Cmd_Str_:__s__s__s
push 1
push edx
call fcn.00404890
add esp, 0x14
mov ecx, esi
push 0x5c
call sub.MFC42.DLL_CString::ReverseFind
mov edi, eax
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::Left
inc edi
lea ecx, [esp + 0x10]
push edi
push ecx
mov ecx, esi
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::Mid
mov edx, dword [esp + 0x14]
mov byte [esp + 0x24], 3
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 8]
push str.__s
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator_2
lea edx, [esp + 0x10]
mov byte [esp + 0x24], 4
push edx
push eax
lea eax, [esp + 0x34]
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 5
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jg 0x4094f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
push eax
mov eax, dword [0x42a950]
push edx
push str.CSyncEngine::ProcessRegisterFileByRegSvr32__WinExec__s__Fail__ErrCode___d
push 4
push eax
call fcn.00404890
mov ecx, dword [0x42a950]
add esp, 0x14
call fcn.00404d50
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 4
mov ecx, dword [esi]
mov edx, dword [0x42a950]
push eax
push ecx
push str.CSyncEngine::ProcessRegisterFileByRegSvr32__File__s__is_registered._RetVal___d
push 2
push edx
call fcn.00404890
add esp, 0x14
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4