joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10147ed1
Capabilities:
Check if file exists

Disassembly:
push 0x2c
mov eax, 0x10324be3
call fcn.1027911b
mov esi, dword [ebp + 8]
push esi
call fcn.1014a13d
mov dword [ebp - 0x2c], eax
mov edi, edx
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.10149d37
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10147f31
call fcn.10161df6
test al, al
je 0x10147fde
lea eax, [ebp - 0x28]
push eax
push str.Drive__s_is_not_available_for_install
push 3
call fcn.100e2645
jmp 0x10147fde
lea eax, [ebp - 0x28]
push eax
call fcn.1012d695
mov esi, edx
mov ebx, eax
cmp esi, edi
jb 0x10147fa0
ja 0x10147f49
cmp ebx, dword [ebp - 0x2c]
jb 0x10147fa0
call fcn.10161df6
test al, al
je 0x10147f87
mov eax, dword [ebp - 0x2c]
shrd eax, edi, 0x14
shrd ebx, esi, 0x14
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
shr esi, 0x14
push eax
lea eax, [ebp - 0x30]
shr edi, 0x14
push eax
push str.Setup_requires_installed_space__llu_MB._Avaliable_space_in_drive__s_is__llu_MB
push 3
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], edi
call fcn.10146d0d
call fcn.10161df6
test al, al
je 0x10147f9c
push str.Catalyst_free_space_check_requirement_check_passed
push 3
call fcn.10146975
mov bl, 1
jmp 0x10147ff5
call fcn.10161df6
test al, al
je 0x10147fde
mov eax, dword [ebp - 0x2c]
shrd eax, edi, 0x14
shrd ebx, esi, 0x14
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
shr esi, 0x14
push eax
lea eax, [ebp - 0x30]
shr edi, 0x14
push eax
push str.Setup_requires_installed_space__llu_MB._Avaliable_space_in_drive__s_is__llu_MB
push 3
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], edi
call fcn.10146d0d
call fcn.10161df6
test al, al
je 0x10147ff3
push str.Catalyst_free_space_check_requirement_check_failed
push 2
call fcn.10146975
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10007cb3
mov al, bl
call fcn.102790cd
ret 4

Function at 0x10148a54
Capabilities:
Get disk information

Disassembly:
push 0x20
mov eax, 0x10328d65
call fcn.1027911b
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.10149dd3
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
jne 0x10148a83
push 1
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.1012b7ac
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x10148ac5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
call fcn.10161df6
test al, al
je 0x10148add
lea eax, [ebp - 0x2c]
push eax
push esi
push str.Catalyst_path_exists_check_failed:_checked_path___s__error_0x_X08
push 2
call fcn.10146b7b
jmp 0x10148add
call fcn.10161df6
test al, al
je 0x10148adb
push esi
push str.Catalyst_path_exists_check_passed:_The_path__s_exists
push 3
call fcn.1000a1d3
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10007cb3
mov al, bl
call fcn.102790cd
ret 4
Function at 0x1014a36f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp + 8]
cmp edx, 0xffffffff
je 0x1014a3f0
and dword [ebp - 0x390], 0
cmp dword [eax + 0x14], 0x10
jb 0x1014a39e
mov ecx, dword [eax]
jmp 0x1014a3a0
mov ecx, eax
push esi
push 0
lea esi, [ebp - 0x390]
push esi
push dword [eax + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
test eax, eax
jne 0x1014a3de
cmp byte [ebp + 0xc], al
je 0x1014a3da
push str.write_to_file_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.100222be
jmp 0x1014a402
xor al, al
jmp 0x1014a3e0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
push str.trying_to_write_to_a_from_a_file_thats_not_open
push 0x15
lea ecx, [ebp - 0x38c]
call fcn.10117094
push 0x1060513c
lea eax, [ebp - 0x38c]
push eax
call fcn.1027a8f4
int3

Function at 0x1014cfac
Capabilities:
Encrypt data using rc4 prga
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x1014cfbb
or eax, 0xffffffff
jmp 0x1014d00c
movzx eax, word [edx]
mov ecx, 0x1505
push esi
xor esi, esi
jmp 0x1014cfe9
cmp ax, 0x41
jb 0x1014cfdc
cmp ax, 0x5a
ja 0x1014cfdc
movzx eax, ax
add eax, 0x20
jmp 0x1014cfdf
movzx eax, ax
imul ecx, ecx, 0x21
xor ecx, eax
inc esi
movzx eax, word [edx + esi*2]
test ax, ax
jne 0x1014cfc8
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
pop ebp
ret 4
Function at 0x1014daa1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x218], 0
lea ecx, [ebp - 0x240]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push 1
push 0x10668544
call fcn.10111f52
test byte [esi + 0x20], 2
jne 0x1014dc99
cmp dword [esi + 0x14], ebx
je 0x1014daf6
push dword [esi + 0x14]
mov ecx, 0x1066855c
call fcn.101538cf
and dword [esi + 0x14], ebx
mov byte [esi + 0x1d], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x14]
push 8
push eax
push 0x1004
push dword [esi + 4]
call edi
test eax, eax
je 0x1014dbf5
lea eax, [ebp - 0x234]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push str.CpgScript
push 0
call fcn.1014bd95
mov dword [ebp - 0x218], eax
test eax, eax
js 0x1014dbf5
mov eax, dword [ebp - 0x230]
xor ecx, ecx
push 4
xor ebx, ebx
pop edx
inc ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov ecx, 0x1066855c
call fcn.10153889
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1014db74
mov dword [ebp - 0x218], 0x8007000e
jmp 0x1014dc8c
xor edi, edi
cmp dword [ebp - 0x230], edi
jbe 0x1014dbc2
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x234]
push dword [eax + edi*4]
call fcn.10150ae8
mov dword [ebp - 0x218], eax
test eax, eax
js 0x1014dbb2
movzx edx, byte [esi + 0x1d]
mov ecx, dword [esi + 0x14]
mov eax, dword [ebp - 0x21c]
mov dword [ecx + edx*4], eax
inc byte [esi + 0x1d]
jmp 0x1014dbb9
cmp eax, 0x8007000e
je 0x1014dbdb
inc edi
cmp edi, dword [ebp - 0x230]
jb 0x1014db7e
cmp byte [esi + 0x1d], 0
jne 0x1014dc74
mov eax, dword [esi + 0x14]
mov byte [esi + 0x1d], 1
and dword [eax], 0
jmp 0x1014dc74
push dword [esi + 0x14]
mov ecx, 0x1066855c
call fcn.101538cf
and dword [esi + 0x14], 0
mov byte [esi + 0x1d], 0
jmp 0x1014dc8c
push 4
mov ecx, 0x1066855c
call fcn.10153889
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1014dc17
mov dword [ebp - 0x218], 0x8007000e
jmp 0x1014dc98
mov byte [esi + 0x1d], 1
and dword [eax], ebx
lea eax, [ebp - 0x214]
push 0x100
push eax
push 4
push dword [esi + 4]
call edi
test eax, eax
je 0x1014dc74
and dword [ebp - 0x21c], ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.1014fd5d
test eax, eax
je 0x1014dc68
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call fcn.101528be
mov ecx, dword [esi + 0x14]
mov dword [ecx], eax
cmp dword [ebp - 0x218], 0x8007000e
je 0x1014dc98
cmp dword [esi + 8], 0xc00
je 0x1014dc81
or dword [esi + 0x20], 2
and dword [ebp - 0x218], 0
test ebx, ebx
je 0x1014dc98
lea eax, [ebp - 0x234]
push eax
call fcn.1014c06f
pop edi
mov esi, dword [ebp - 0x218]
lea ecx, [ebp - 0x240]
call fcn.102f3376
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4
Function at 0x1015056c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10668540], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x10150595
mov esi, 0x8ff000ff
jmp 0x101505e8
test ebx, ebx
je 0x101505e3
xor esi, esi
cmp dword [0x10668490], esi
jne 0x101505aa
call fcn.1014f083
mov esi, eax
test esi, esi
js 0x101505e8
push edi
call fcn.1014b486
mov edi, eax
test edi, edi
je 0x101505e3
test byte [edi + 0x20], 4
jne 0x101505d6
push edi
call fcn.1014d260
mov esi, eax
test esi, esi
jns 0x101505d6
cmp esi, 0x8007000e
je 0x101505e8
xor esi, esi
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x101505fd
sub eax, 1
je 0x10150611
mov esi, 0x80004005
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10150611
cmp byte [edi + 0x1e], 0
jbe 0x10150611
movzx eax, byte [eax]
mov dword [ebx], eax
jmp 0x101505e8
push 3
lea eax, [ebp - 0xc]
push eax
push 0x1009
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x101505e3
lea eax, [ebp - 0xc]
push eax
call fcn.102a1fb2
pop ecx
push ebx
push eax
call fcn.1015063e
mov esi, eax
jmp 0x101505e8
Function at 0x10151dc9
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x168], edx
xor esi, esi
lea edx, [ebp - 0x164]
mov dword [ebp - 0x174], eax
push edx
push ecx
push eax
push 0x55
lea eax, [ebp - 0xb0]
mov dword [ebp - 0x170], ecx
push eax
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x16c], esi
call fcn.1014c2ea
mov edi, eax
xor eax, eax
mov word [ebp - 0x15c], ax
test edi, edi
je 0x10151ece
lea ebx, [edi + edi]
push 0x2d
pop eax
cmp ax, word [ebp + ebx - 0xb0]
jne 0x10151ea4
cmp ebx, 0xaa
jae 0x10151f5d
push dword [ebp + 0x1c]
xor eax, eax
push dword [ebp - 0x168]
mov word [ebp + ebx - 0xb0], ax
lea eax, [ebp - 0x16c]
push eax
push 0x55
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.10151d5c
mov esi, eax
test esi, esi
jne 0x10151eb0
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 2
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, eax
test esi, esi
jne 0x10151eb0
sub ebx, 2
sub edi, 1
jne 0x10151e38
test esi, esi
je 0x10151ec8
push 0xffffffffffffffff
push 0x103992a8
lea eax, [ebp - 0x15c]
push 0x55
push eax
call fcn.102a1f8c
add esp, 0x10
mov ebx, dword [ebp - 0x160]
mov edi, dword [ebp - 0x174]
lea eax, [ebp - 0x164]
push eax
push dword [ebp - 0x170]
lea eax, [ebp - 0xb0]
push edi
push 0x55
push eax
call fcn.1014c2ea
lea eax, [ebp - 0xb0]
push eax
call fcn.10152ddb
push 0xffffffffffffffff
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x15c]
push 0x55
push eax
call fcn.102a1f8c
add esp, 0x10
test esi, esi
je 0x10151f32
push 0xffffffffffffffff
push 0x103549d0
lea eax, [ebp - 0x15c]
push 0x55
push eax
call fcn.102a1f8c
add esp, 0x10
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x15c]
push eax
push edi
push dword [ebp + 0x10]
push ebx
call fcn.1014c2ea
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 0x18
call fcn.10279be9
int3

Function at 0x1015be41
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x1015bea1
test eax, eax
je 0x1015bea1
push edi
push edi
push edi
push 2
push edi
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, 0xffffffff
je 0x1015bea1
test eax, eax
je 0x1015bea1
push edi
push edi
push edi
push 4
push eax
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi + 0x18], edi
inc eax
mov dword [esi + 0x14], edi
jmp 0x1015bea3
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x1015bea9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push esi
mov esi, ecx
cmp dword [ebp + 8], eax
je 0x1015bef1
push 0xea
push 1
push dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x1015bed6
xor eax, eax
jmp 0x1015bef1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1015bed2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 0xc], eax
xor eax, eax
inc eax
pop esi
pop ebp
ret 4

Function at 0x1015d736
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x1015d745
or eax, 0xffffffff
jmp 0x1015d782
movzx eax, word [edx]
mov ecx, 0x1505
push esi
xor esi, esi
jmp 0x1015d75f
imul ecx, ecx, 0x21
movzx eax, ax
xor ecx, eax
inc esi
movzx eax, word [edx + esi*2]
test ax, ax
jne 0x1015d752
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
pop ebp
ret 4
Function at 0x10164689
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0xb8], 0xffffffff
or dword [ebp - 0xbc], 0xffffffff
and dword [ebp - 0xb4], 0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc0], eax
test esi, esi
je 0x1016482f
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jle 0x1016482f
lea ecx, [ebp - 0xb8]
push ecx
push eax
call fcn.10150693
mov dword [ebp - 0xb4], eax
test eax, eax
js 0x101646fa
push dword [ebp - 0xb8]
call fcn.10164648
mov dword [ebp - 0xbc], eax
push edi
call fcn.101643cb
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc4], eax
xor eax, eax
mov word [esi], ax
cmp edi, 2
jne 0x10164733
cmp dword [ebp - 0xb4], eax
jl 0x10164733
push ebx
push esi
push 1
push eax
push dword [ebp - 0xb8]
call fcn.101645b5
test eax, eax
jne 0x10164826
push ebx
push esi
push edi
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x10164826
push dword [ebp - 0xc0]
push edi
call fcn.10164563
test eax, eax
jle 0x10164821
cmp dword [ebp - 0xbc], 0xffffffff
je 0x101647b7
push 0xaa
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.1027bff1
add esp, 0xc
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x55
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xbc]
call fcn.1014b275
cmp dword [ebp - 0xb4], 0
jl 0x101647b7
push ebx
push esi
push edi
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x10164826
push dword [ebp - 0xc0]
push edi
call fcn.10164563
cmp eax, 1
jle 0x10164821
cmp dword [ebp - 0xc4], 0xffffffff
je 0x10164821
push 0xaa
lea eax, [ebp - 0xb0]
push 0
push eax
call fcn.1027bff1
add esp, 0xc
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x55
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xc4]
call fcn.1014b275
cmp dword [ebp - 0xb4], 0
jl 0x10164821
push ebx
push esi
push edi
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x10164826
xor eax, eax
mov word [esi], ax
push esi
call fcn.10113ed3
pop edi
jmp 0x10164831
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10167183
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e0
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 0x3b4], eax
mov edx, edi
mov dword [ebp - 0x3b8], ecx
mov dword [ebp - 0x3a8], edi
mov dword [ebp - 0x3b0], edi
mov dword [ebp - 0x3ac], edx
cmp dword [ebp + 0x10], edx
je 0x101671ee
lea ecx, [ebp - 0x3ac]
push ecx
push edi
push edi
push dword [ebp + 0x10]
push dword [eax + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
js 0x1016732c
mov edx, dword [ebp - 0x3ac]
xor eax, eax
lea edi, [ebp - 0x3d8]
cmp dword [ebx + 0x14], 8
push 8
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x3b4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3d8], eax
jb 0x10167214
mov eax, dword [ebx]
jmp 0x10167216
mov eax, ebx
cmp dword [esi + 0x10], 0
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3d4], edx
je 0x10167249
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x3c4], 0x1016707f
jb 0x10167243
mov esi, dword [esi]
mov dword [ebp - 0x3c0], esi
lea eax, [ebp - 0x3d8]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
test esi, esi
jne 0x10167272
push 2
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x3a8]
push eax
push 0x1039731c
push esi
call dword [sym.imp.SHELL32.dll_SHBindToParent]
test eax, eax
js 0x1016730a
mov eax, dword [ebp - 0x3a8]
lea edx, [ebp - 0x4e0]
push edx
push 0x8000
push dword [ebp - 0x3b0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x3a8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x104
lea eax, [ebp - 0x224]
push eax
push esi
lea eax, [ebp - 0x4e0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRetToBufW]
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10006939
mov ecx, dword [ebp - 0x3b8]
push eax
call fcn.10006b39
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.10007cb3
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
inc eax
jmp 0x1016725f
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push ebx
push str.Failed_to_get_open_directory_name.__Title:__s
call fcn.10132f42
push eax
push 0xf
lea ecx, [ebp - 0x3a4]
call fcn.10166fee
jmp 0x10167340
push ebx
push str.Failed_to_get_location_for_root_of_browse_dialog.__Title:__s
push eax
push 0x17
lea ecx, [ebp - 0x3a4]
call fcn.10119458
push 0x1060513c
lea eax, [ebp - 0x3a4]
push eax
call fcn.1027a8f4
int3
Function at 0x10167370
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10167434
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x108]
mov edi, 0x104
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], edi
push eax
push ebx
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10167423
cmp dword [ebp - 0x110], 2
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
jne 0x10167414
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb ebx, ebx
inc ebx
jmp 0x10167423
push eax
push edi
push esi
call fcn.100e0324
xor ebx, ebx
test eax, eax
setns bl
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
jmp 0x10167436
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4
Function at 0x101688d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
and dword [ebp - 4], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 4]
push edi
push str.file
call ebx
test eax, eax
jne 0x101689e8
lea eax, [esi + 0x20c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov dword [ebp + 8], eax
call esi
mov ebx, dword [ebp + 0xc]
lea edi, [eax + 3]
test ebx, ebx
je 0x10168923
push ebx
call esi
inc edi
add edi, eax
push edi
lea eax, [ebp - 4]
push eax
call fcn.10168a50
mov esi, eax
test esi, esi
js 0x10168a0c
push dword [ebp + 8]
push 0x103ab454
push 0xffffffffffffffff
push edi
push dword [ebp - 4]
call fcn.100555a2
add esp, 0x14
test eax, eax
jns 0x1016895b
mov esi, 0x8007007a
jmp 0x10168a0c
test ebx, ebx
je 0x1016898b
push 0xffffffffffffffff
push 0x10337178
push edi
push dword [ebp - 4]
call fcn.102a1f8c
add esp, 0x10
cmp eax, 0x50
je 0x10168951
push 0xffffffffffffffff
push ebx
push edi
push dword [ebp - 4]
call fcn.102a1f8c
add esp, 0x10
cmp eax, 0x50
je 0x10168951
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.1027bff1
add esp, 0xc
mov dword [ebp - 0x58], esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x101689d2
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
mov esi, ebx
jmp 0x10168a0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x10168a0c
push edi
push 0x103ab460
call ebx
test eax, eax
jne 0x10168a07
push dword [ebp + 0xc]
lea eax, [esi + 0x20c]
push eax
call fcn.10168bb2
mov esi, eax
jmp 0x10168a0c
mov esi, 0x81000004
cmp dword [ebp - 4], 0
je 0x10168a1a
push dword [ebp - 4]
call fcn.10168a99
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10168d0c
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x10168d65
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x10168d61
jbe 0x10168d79
cmp eax, 3
jbe 0x10168d51
cmp eax, 4
je 0x10168d61
jbe 0x10168d79
cmp eax, 6
ja 0x10168d5c
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10168d27
cmp eax, 7
jne 0x10168d79
mov dword [edi], eax
jmp 0x10168d79
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
Function at 0x10169800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
xor esi, esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x214]
push eax
push 1
push esi
push str.SOFTWAREMicrosoftMOTIFFlexUIAutomation
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x214], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1016984a
xor eax, eax
jmp 0x101698d1
cmp byte [ebp + 8], 0
je 0x10169861
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x101698d1
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x208
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], esi
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push str.FlexUIDataSourceProxyPath
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x214]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10169843
cmp dword [ebp - 0x218], 1
je 0x101698bf
push 0x1a06cf
call fcn.10153dc1
jmp 0x10169843
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
call fcn.102d74e4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4

Function at 0x101739f0
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x10658524]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x10173a01
ret
mov eax, dword [eax + 0xc]
ret