joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4085d0
Capabilities:
Persist via run registry key

Disassembly:
push 0x54
mov eax, 0x44883d
call fcn.00447ac5
mov edi, dword [ebp + 8]
xor ebx, ebx
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov word [ebp - 0x28], ax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x40]
push str.OneDrive
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x40], ax
call fcn.0040acef
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
xor eax, eax
mov dword [ebp - 0x50], ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x4c], esi
mov word [ebp - 0x60], ax
call fcn.0040acef
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
push ebx
lea eax, [ebp - 0x40]
mov ecx, SysReAllocString
push eax
lea edx, [ebp - 0x60]
call fcn.004176e0
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.0040521a
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.0040521a
test esi, esi
js 0x408674
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov edx, str.OneDrive
cmovae ecx, dword [ebp - 0x28]
push ecx
call fcn.00420a18
test al, al
jne 0x4086b0
push 2
pop eax
push ebx
push eax
push 1
push 0x165ef449
push 0x456784
push str.OOBERequestHandler::CheckOneDriveRunsOnStartup
push 0x28d
push str.d:dbs_shodct0629_224505_0cmdpclientonedriveProductFileCoAuthDesktopLibOOBERequestHandler.cpp
lea ecx, [ebp - 0x48]
mov dword [edi], eax
call dword [sym.imp.LoggingPlatform.DLL_public:_void___thiscall_StructuredEvent::constructor_char_const___int__char_const___struct__GUID_const___unsigned_int__unsigned_int__unsigned_int__unsigned_int_]
push ebx
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.LoggingPlatform.DLL_void___stdcall_LoggingWriteStructuredEvent_struct_StructuredEvent_const___struct_StructuredEventParameter__const_]
call dword [sym.imp.LoggingPlatform.DLL_void___stdcall_LoggingRotateIfNeeded_void_]
lea ecx, [ebp - 0x28]
call fcn.0040521a
call fcn.00447a6f
ret 4

Function at 0x41815b
Capabilities:
Enumerate gui resources

Disassembly:
push 0x74
mov eax, 0x44a72d
call fcn.00447ac5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x78], 0x8096
and dword [ebp - 4], 0
mov edi, dword [edx + 0x24]
test edi, edi
je 0x4181a3
mov eax, dword [edi]
mov esi, dword [eax]
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
call dword [0x4529ac]
mov ecx, edi
call esi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
lea ecx, [ebp - 0x48]
inc ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040a7be
push dword [ebp - 0x80]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0040a7be
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x78]
push eax
push 0x417e90
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x4181de
cmp dword [ebp - 0x18], 0
ja 0x4181e0
xor bl, bl
lea ecx, [ebp - 0x78]
call 0x4181f2
mov al, bl
call fcn.00447a6f
ret 8
Function at 0x419d09
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x44acd0
call fcn.00447ac5
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x238], eax
call fcn.0041ea5e
xor edx, edx
mov eax, 0x200
cmp dword [ebp + 8], 1
mov ecx, 0x100
cmove edx, eax
xor eax, eax
cmp dword [ebp + 8], 2
cmove eax, ecx
and dword [ebp - 0x234], 0
or edx, eax
or edx, 0x20019
cmp dword [esi + 0x14], 8
jb 0x419d5f
mov esi, dword [esi]
lea eax, [ebp - 0x234]
push eax
push edx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x419e38
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0xff
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x419e0b
and dword [ebp - 0x220], eax
lea ecx, [ebp - 0x230]
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x21c], 7
call fcn.0040acef
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x230]
and dword [ebp - 4], edi
push eax
call fcn.0041eab0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.0040521a
jmp 0x419e13
cmp edi, 0x103
jne 0x419e1e
inc ebx
test edi, edi
je 0x419d89
jmp 0x419e2c
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00447a6f
ret 8

Function at 0x419e42
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x44ad10
call fcn.00447ac5
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x234], eax
call fcn.0041ea5e
movzx eax, byte [ebp + 8]
and dword [ebp - 0x230], 0
shl eax, 8
or eax, 0x20019
cmp dword [esi + 0x14], 8
jb 0x419e80
mov esi, dword [esi]
lea ecx, [ebp - 0x230]
push ecx
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x419f59
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x419f2c
and dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x22c]
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x218], 7
call fcn.0040acef
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
and dword [ebp - 4], edi
push eax
call fcn.0041eab0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.0040521a
jmp 0x419f34
cmp edi, 0x103
jne 0x419f3f
inc ebx
test edi, edi
je 0x419eaa
jmp 0x419f4d
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00447a6f
ret 8
Function at 0x41c319
Capabilities:
Get session user name

Disassembly:
push 0x14
mov eax, 0x44b3fd
call fcn.00447ac5
mov esi, ecx
push 0x45785c
call fcn.0040acef
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
push 2
mov dword [ebp - 0x14], ebx
call dword [sym.imp.Secur32.dll_GetUserNameExW]
cmp dword [ebp - 0x14], ebx
jbe 0x41c388
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041e420
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x20]
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x41c37c
push dword [ebp - 0x20]
mov ecx, esi
call fcn.0040acef
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0041e3fc
cmp dword [esi + 0x10], ebx
jne 0x41c399
push str.
mov ecx, esi
call fcn.0040acef
call fcn.00447a6f
ret

Function at 0x41c39f
Capabilities:
Get hostname

Disassembly:
push 0x26c
mov eax, 0x44b456
call fcn.00447ac5
mov esi, ecx
push 7
xor edi, edi
xor eax, eax
pop ebx
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x248], ax
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], edi
call fcn.0041c319
xor eax, eax
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x21c], ebx
mov word [ebp - 0x230], ax
inc eax
lea ecx, [ebp - 0x230]
push 0x45785c
mov byte [ebp - 4], al
call fcn.0040acef
push 0x202
lea eax, [ebp - 0x214]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x218], 0x101
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x41c44a
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040acef
cmp dword [ebp - 0x220], 0
jne 0x41c463
push str.
lea ecx, [ebp - 0x230]
call fcn.0040acef
push esi
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x230]
call fcn.0041c53e
mov bl, al
test bl, bl
jne 0x41c520
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x218], edi
push str.IsTest
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x264], esi
mov word [ebp - 0x278], ax
call fcn.0040acef
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x260]
xor eax, eax
mov dword [ebp - 0x250], edi
push str.SoftwareMicrosoftSQMClient
mov dword [ebp - 0x24c], esi
mov word [ebp - 0x260], ax
call fcn.0040acef
lea eax, [ebp - 0x218]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push eax
push edi
lea eax, [ebp - 0x278]
push eax
lea edx, [ebp - 0x260]
call fcn.0041792a
lea ecx, [ebp - 0x260]
mov esi, eax
call fcn.0040521a
lea ecx, [ebp - 0x278]
call fcn.0040521a
test esi, esi
js 0x41c520
xor eax, eax
movzx ebx, bl
inc eax
cmp dword [ebp - 0x218], eax
cmove ebx, eax
lea ecx, [ebp - 0x230]
call fcn.0040521a
lea ecx, [ebp - 0x248]
call fcn.0040521a
mov al, bl
call fcn.00447a6f
ret
Function at 0x41ca77
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [ecx + 0x14], 8
push esi
push edi
mov esi, ecx
jb 0x41ca83
mov esi, dword [ecx]
mov edi, dword [ecx + 0x10]
mov ecx, 0x811c9dc5
push 0
pop edx
add edi, edi
je 0x41caa3
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, edi
jb 0x41ca92
pop edi
mov eax, ecx
pop esi
ret

Function at 0x41caa8
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push 0x2c
mov eax, 0x44b4cd
call fcn.00447ac5
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
mov dword [esi + 4], eax
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], ebx
call fcn.0041c85d
mov edi, eax
test edi, edi
js 0x41cbc5
push 0xf0000040
push 0x18
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
setne cl
test eax, eax
je 0x41cb20
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x800c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
setne cl
test cl, cl
je 0x41cbaa
push 4
pop ecx
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], ecx
push eax
lea eax, [ebp - 0x1c]
push eax
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41cbaa
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmovae ecx, dword [ebp - 0x38]
add eax, eax
push ebx
push eax
push ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
setne bl
test eax, eax
je 0x41cba4
mov eax, dword [ebp - 0x1c]
mov ecx, esi
push eax
mov dword [ebp - 0x20], eax
call fcn.0041e349
push 0
lea eax, [ebp - 0x20]
push eax
push dword [esi]
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 0x14]
test eax, eax
setne bl
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
jne 0x41cbc5
jmp 0x41cbc0
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esi]
mov dword [esi + 4], eax
mov ecx, dword [esi]
mov eax, 0x80004005
cmp ecx, dword [esi + 4]
lea ecx, [ebp - 0x38]
cmove edi, eax
call fcn.0040521a
mov eax, edi
call fcn.00447a6f
ret
Function at 0x429d2f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push 0x3c
mov eax, 0x44d57d
call fcn.00447ac5
mov edi, edx
mov ebx, ecx
call 0x42961f
test al, al
je 0x429e39
mov edx, ebx
lea ecx, [ebp - 0x2c]
call fcn.00429e3f
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [edi + 0x24], ecx
je 0x429da0
mov dword [ebp - 0x38], ecx
xor eax, eax
push str.EnsureDesktopIniForPrimaryKnownFolder_start
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.0040acef
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.0042a34c
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.0040521a
xor ecx, ecx
mov eax, dword [0x47be60]
mov dword [ebp - 0x30], ecx
mov esi, dword [eax + 0x60]
lea eax, [ebp - 0x30]
push eax
push ecx
push 0x800
push ebx
mov ecx, esi
call dword [0x4529ac]
mov ecx, 0x47be60
call esi
xor ebx, ebx
mov esi, eax
cmp dword [edi + 0x24], ebx
je 0x429e07
xor eax, eax
mov dword [ebp - 0x38], ebx
push str.SHGetKnownFolderPath_with_KF_FLAG_INIT_result_for
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
call fcn.0040acef
push esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
mov ecx, edi
push eax
call fcn.0042a34c
lea ecx, [ebp - 0x48]
call fcn.0040521a
test esi, esi
js 0x429e31
mov esi, dword [ebp - 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429e25
or eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x30]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x2c]
call fcn.0040521a
call fcn.00447a6f
ret
Function at 0x42d143
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xe0
mov eax, 0x44dc32
call fcn.00447ac5
mov esi, edx
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0xac]
push 0x98
push ebx
mov dword [ebp - 0xbc], ebx
push eax
mov dword [edi], ebx
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea ecx, [ebp - 0xac]
call fcn.0041e2c9
mov dword [ebp - 4], ebx
cmp byte [ebp + 8], bl
je 0x42d197
mov edx, str.Wow6432Node_
lea ecx, [ebp - 0xac]
call fcn.0041f170
mov edx, str.CLSID_
lea ecx, [ebp - 0xac]
call fcn.0041f170
mov edx, esi
mov ecx, eax
call fcn.0041f170
mov edx, str.LocalServer32
mov ecx, eax
call fcn.0041f170
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0041ef40
push 5
pop eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb4]
cmp dword [ebp - 0xd8], 8
mov esi, SysReAllocString
push ecx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xec]
cmovae eax, dword [ebp - 0xec]
push 0x20019
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42d261
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0041ef40
cmp dword [ebp - 0xc0], 8
lea ecx, [ebp - 0xb4]
push 0xf
pop eax
push ecx
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xd4]
cmovae eax, dword [ebp - 0xd4]
push 0x20119
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0xb5], bl
test eax, eax
jne 0x42d268
mov byte [ebp - 0xb5], 1
mov eax, dword [ebp - 0xb0]
test al, 2
je 0x42d28c
and eax, 0xfffffffd
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xb0], eax
call fcn.0040521a
mov eax, dword [ebp - 0xb0]
test al, 1
je 0x42d29b
lea ecx, [ebp - 0xec]
call fcn.0040521a
cmp byte [ebp - 0xb5], 0
je 0x42d311
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], ebx
push eax
push ebx
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0xb4]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x42d305
push dword [ebp - 0xb0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x42d305
lea eax, [ebp - 0xb0]
push eax
push esi
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0xb4]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x42d2fd
mov dword [edi], esi
mov bl, 1
jmp 0x42d305
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
push dword [ebp - 0xb4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x5c]
call fcn.0041e297
lea ecx, [ebp - 0x5c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov al, bl
call fcn.00447a6f
ret 4

Function at 0x42f712
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x42f862
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CreateProcessW]

Function at 0x42fbd2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]
Function at 0x42fcf2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
pop ebp
ret 0x28

Function at 0x42ff52
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCheckConnectionW]

Function at 0x430db0
Capabilities:
Enumerate processes

Disassembly:
push 0x274
mov eax, 0x44e1ad
call fcn.00447ac5
mov esi, ecx
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x248], esi
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push ebx
mov dword [ebp - 4], ebx
push 2
mov dword [ebp - 0x240], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov edi, eax
lea eax, [ebp - 0x238]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
cmp edi, 0xffffffff
je 0x430f0a
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x430efb
xor eax, eax
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], ax
lea ecx, [ebp - 0x260]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x24c], 7
push eax
call fcn.0040acef
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x278]
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x260]
push eax
call fcn.0040a7be
mov byte [ebp - 4], 2
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x430ec5
mov eax, dword [ebp - 0x280]
mov dword [ecx], eax
mov eax, dword [ebp - 0x27c]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x278]
add ecx, 8
push eax
call fcn.00416444
add dword [esi + 4], 0x20
jmp 0x430ed4
lea eax, [ebp - 0x280]
push eax
push ecx
mov ecx, esi
call 0x430f12
lea ecx, [ebp - 0x278]
call fcn.0040521a
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], bl
call fcn.0040521a
lea eax, [ebp - 0x23c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x430e37
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.00447a6f
ret
Function at 0x437ad0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push 0x40
mov eax, 0x44f37d
call fcn.00447ac5
mov esi, dword [ebp + 8]
mov eax, esi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x30], 1
cmp dword [esi + 0x14], 8
jb 0x437af6
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040ad18
and dword [ebp - 4], 0
lea edx, [ebp - 0x30]
push edi
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00437c84
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], eax
call fcn.0040521a
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x30], 2
jb 0x437b30
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040ad18
push edi
push ebx
lea edx, [ebp - 0x30]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.00437c84
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0040521a
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
push 0x45f0e0
mov word [ebp - 0x28], ax
call fcn.0040acef
mov dword [ebp - 4], 2
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x437b88
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.004163c5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x1010b
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea eax, [ebp - 0x2c]
push eax
push 0x1010b
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x437c0e
cmp dword [esi + 0x14], 8
jb 0x437bed
mov esi, dword [esi]
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2c]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00437c6a
lea ecx, [ebp - 0x28]
call fcn.0040521a
mov eax, dword [ebp - 0x34]
test ebx, ebx
cmovne edi, ebx
test eax, eax
cmovne edi, eax
mov eax, edi
call fcn.00447a6f
ret 0xc
Function at 0x4380fd
Capabilities:
Accept command line arguments

Disassembly:
push 0x230
mov eax, 0x44f4b2
call fcn.00447ac5
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
xor ecx, ecx
mov dword [ebp - 0x234], ecx
xor eax, eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x234], 1
call fcn.0041d5b5
mov bl, al
test bl, bl
jne 0x4381c5
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4381c5
lea eax, [ebp - 0x218]
push str.FileSyncConfig.exe
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x4381c5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x230]
call fcn.0040ad18
push ecx
push str._allusers
lea ecx, [ebp - 0x230]
call fcn.0041eb86
cmp eax, 0xffffffff
lea ecx, [ebp - 0x230]
setne bl
call fcn.0040521a
mov edx, esi
mov cl, bl
call fcn.0041ac10
push 0x459780
mov ecx, esi
call fcn.004162a6
mov dl, 1
mov ecx, edi
call fcn.004380c4
mov edx, eax
lea ecx, [ebp - 0x230]
call fcn.00420473
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00416426
lea ecx, [ebp - 0x230]
call fcn.0040521a
mov eax, esi
call fcn.00447a6f
ret 4

Function at 0x43de20
Capabilities:
Get common file path

Disassembly:
push 0x2bc
mov eax, 0x4500c0
call fcn.00447ac5
mov edi, ecx
push str.Expected_non_NULL_sync_engine_log_location
push str._pSyncEngineLogPath___NULL_
push str.WatsonReport::GetSyncEngineLogLocation
test edi, edi
push 0xf7
setne al
movzx eax, al
push str.d:dbs_shodct0629_224505_0cmdhclientonedriveProductUXSharedWatsonReport.cpp
push eax
call fcn.0043cf85
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
mov esi, 0x80004005
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
lea eax, [ebp - 0x218]
push ebx
push 0x1c
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x43df50
push 0x98
lea eax, [ebp - 0x2b0]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea ecx, [ebp - 0x2b0]
call fcn.0041e2c9
lea edx, [ebp - 0x218]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2b0]
call fcn.0041f170
mov esi, str._
mov ecx, eax
mov edx, esi
call fcn.0041f410
cmp dword [0x475a88], 8
mov edx, 0x475a74
mov ecx, eax
cmovae edx, dword [0x475a74]
call fcn.0041f170
mov edx, esi
mov ecx, eax
call fcn.0041f410
cmp dword [0x4759e0], 8
mov edx, 0x4759cc
mov ecx, eax
cmovae edx, dword [0x4759cc]
call fcn.0041f170
lea eax, [ebp - 0x2c8]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.0041ef40
lea eax, [ebp - 0x2c8]
mov ecx, edi
push eax
call fcn.0040a898
lea ecx, [ebp - 0x2c8]
call fcn.0040521a
lea ecx, [ebp - 0x260]
mov esi, ebx
call fcn.0041e297
lea ecx, [ebp - 0x260]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov eax, esi
call fcn.00447a6f
ret