joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cf8d0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10155368]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x100cfa0e
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100cfa04
cmp dword [ebp - 0x20], 0x10
jb 0x100cf9e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100cf9e8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100cf9e8
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100cf978
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
push edx
push 0
mov eax, dword [0x101cba6c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100cf976
jmp 0x100cfa04
jmp 0x100cf9c8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100cf9c8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x101cba6c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100cf9b2
jmp 0x100cfa04
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x20], 0x1c
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100cf912
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d1418
mov esp, ebp
pop ebp
ret
Function at 0x100cfb40
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100cf8d0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100cfbdd
mov dword [ebp - 4], 0
jmp 0x100cfb89
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100cfbdd
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100cfbdb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100cff10
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100cfb80
mov esp, ebp
pop ebp
ret

Function at 0x100d0090
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100d0104
mov dword [ebp - 4], 0
jmp 0x100d00b0
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100d00f0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100d00ee
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100d00a7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x101cba6c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esp, ebp
pop ebp
ret
Function at 0x100d0210
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101d79a8]
mov dword [ebp - 4], eax
jmp 0x100d0228
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100d023e
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100d023c
mov eax, dword [ebp - 4]
jmp 0x100d02b9
jmp 0x100d0220
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100d02b6
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100d0278
mov edx, dword [ebp - 4]
mov eax, dword [0x101d79a8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x101d79a8], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100d07c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100d0809
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100d0809
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100d0809
xor eax, eax
jmp 0x100d084a
mov dword [ebp - 4], 1
jmp 0x100d081b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100d0845
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100d0843
xor eax, eax
jmp 0x100d084a
jmp 0x100d0812
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100d7c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x100d7c65
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x100d7ccb
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x100d7cc4
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x100d7c97
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x100d7c86
jmp 0x100d7cc4
test edx, edx
jne 0x100d7ca0
mov dword [ebx + 0x54], ecx
jmp 0x100d7ca3
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100d7cb0
push esi
call eax
add esp, 4
push esi
call fcn.100d81c0
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x100d7c70
lea eax, [edi + 0x6c]
test eax, eax
je 0x100d7d4e
test ebp, ebp
je 0x100d7d4e
mov ebx, dword [eax]
test ebx, ebx
je 0x100d7d41
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x100d7cf7
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x100d7d0b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100d7d1c
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x100d7ce0
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x100d7d62
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.100d7bc0
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x100d7d7d
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x100d7daf
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x100d7d9b
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x100d7daf
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x100d7dd6
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x1011e770
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
xorps xmm0, xmm0
push ebx
push ebp
mov ebp, dword [esp + 0x20]
lea ebx, [ebp + 0x318]
movups xmmword [ebx], xmm0
push esi
movq qword [ebx + 0x10], xmm0
movzx ecx, word [ebp + 0x98]
mov eax, dword [ebp + 0x9c]
shl ecx, 4
add ecx, eax
push edi
cmp eax, ecx
jae 0x1011e95d
cmp dword [eax], 0x42444620
jne 0x1011e7b5
mov esi, dword [eax + 0xc]
test esi, esi
jne 0x1011e7c9
add eax, 0x10
cmp eax, ecx
jb 0x1011e7a6
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0x14
ret
push dword [eax + 8]
mov edi, dword [esp + 0x30]
push edi
call fcn.100d7010
add esp, 8
test eax, eax
jne 0x1011e95d
cmp esi, 8
jb 0x1011e95d
push ebx
push esi
push edi
call fcn.100d6720
add esp, 0xc
mov dword [esp + 0x20], eax
test eax, eax
jne 0x1011e95d
mov eax, dword [ebx]
lea ecx, [eax + esi]
mov dword [ebp + 0x31c], ecx
mov ecx, eax
movzx edi, byte [ecx + 2]
movzx eax, byte [ecx + 3]
movzx edx, byte [ecx + 5]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 4]
shl eax, 8
or edx, eax
movzx eax, byte [ecx + 6]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 7]
movzx ecx, byte [ecx + 1]
shl edx, 8
or edx, eax
mov eax, dword [ebx]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
cmp ecx, 1
jne 0x1011e945
cmp edx, 8
jb 0x1011e945
lea eax, [edx - 8]
shr eax, 2
cmp eax, edi
jb 0x1011e945
lea eax, [edx + 1]
cmp eax, esi
ja 0x1011e945
mov eax, dword [ebx]
sub esi, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [ebp + 0x328], edi
mov dword [ebp + 0x324], esi
lea ecx, [eax + edx]
mov dword [ebp + 0x320], ecx
lea edx, [eax + 8]
lea eax, [edx + edi*4]
mov dword [esp + 0x10], eax
cmp edi, 2
jb 0x1011e901
lea esi, [edi - 2]
xor ebx, ebx
shr esi, 1
inc esi
xor ebp, ebp
movzx ecx, byte [edx + 2]
sub edi, 2
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
movzx ecx, byte [edx + 6]
lea ebx, [ebx + eax*2]
shl ecx, 8
movzx eax, byte [edx + 7]
add edx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea ebp, [ebp + eax*2]
sub esi, 1
jne 0x1011e8b5
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov esi, dword [ebp + 0x320]
lea ebx, [ebp + 0x318]
jmp 0x1011e903
mov esi, ecx
test edi, edi
je 0x1011e920
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
mov edx, dword [esp + 0x10]
shl ecx, 8
or ecx, eax
lea eax, [ecx + ecx*4]
lea edx, [edx + eax*2]
jmp 0x1011e924
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
add eax, edx
cmp eax, esi
ja 0x1011e945
mov eax, dword [esp + 0x20]
pop edi
pop esi
mov byte [ebp + 0x32c], 1
pop ebp
pop ebx
add esp, 0x14
ret
push ebx
push dword [esp + 0x30]
call fcn.100d6fd0
xorps xmm0, xmm0
add esp, 8
movups xmmword [ebx], xmm0
movq qword [ebx + 0x10], xmm0
mov eax, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x900
push ebx
push esi
push edi
push 0x27
call fcn.00401f84
mov esi, dword [ebp + 8]
push dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push dword [esi]
push eax
lea eax, [ebp - 0x900]
push eax
call edi
and dword [ebp + 8], 0
add esp, 0x14
cmp dword [esi + 0x10], 0
jbe 0x401070
lea ebx, [esi + 0x14]
push dword [ebx]
lea eax, [ebp - 0x100]
push str._t0x_p_n
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x900]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add ebx, 4
cmp eax, dword [esi + 0x10]
jb 0x40103b
lea eax, [ebp - 0x900]
push eax
call fcn.00407cba
pop ecx
call fcn.00403e38
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4014f2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.00408d36
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401310
push 0x5c
mov ecx, edi
call fcn.00401410
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x401283
push edi
push edi
mov dword [0x418740], esi
mov dword [0x418748], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x418788], 2
mov dword [0x418744], eax
je 0x40154f
call fcn.00407e7d
push 0xffffffffffffffff
push dword [0x418744]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x418748]
cmp eax, edi
mov dword [0x4187fc], edi
je 0x40159e
cmp eax, 1
je 0x401592
cmp eax, 2
je 0x40158e
cmp eax, 3
je 0x40158a
cmp eax, 0x67
jle 0x401585
cmp eax, 0x6a
jle 0x401602
push eax
push 0x14
jmp 0x4015d5
push 0x12
jmp 0x401594
push 0x13
jmp 0x401594
push 0x11
push edi
call fcn.00407d88
pop ecx
pop ecx
jmp 0x401602
cmp dword [0x418804], edi
jne 0x401602
lea eax, [ebp + 8]
push eax
push dword [0x418744]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x4015c5
cmp ecx, edi
jne 0x4015c5
xor eax, eax
jmp 0x401607
mov eax, 0x80070000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x4015d8
push ecx
push 0x21
push edi
jmp 0x4015fa
and ecx, 0xffff
cmp ecx, 0xe
jne 0x4015ec
cmp dword [0x41878c], 0xffffffff
je 0x401602
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.00407d88
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x40196d
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4019ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x401998
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4019ae
test al, 0x10
jne 0x4019ae
push esi
jmp 0x40198e
xor eax, eax
inc eax
pop esi
ret
Function at 0x401bc6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov ebx, eax
movzx eax, word [0x41874c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x401c0a
push 0x409
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
je 0x401c30
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x401c1b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esi], eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401c30
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x401caa
cmp dword [0x41875c], 0
jne 0x401ca8
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.SetProcessPreferredUILanguages
mov ebx, str.kernel32
push ebx
mov dword [0x41875c], 1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0
mov dword [ebp - 4], eax
movzx eax, word [0x41874c]
push 0x409
push 0
push eax
lea eax, [ebp - 0x44]
push str._04X_c_04X_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp dword [ebp - 4], 0
jne 0x401c9d
push str.SetThreadPreferredUILanguages
push ebx
call esi
push eax
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x401ca8
push 0
lea eax, [ebp - 0x44]
push eax
push 4
call dword [ebp - 4]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f84
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp dword [0x418058], ebx
je 0x401fb7
mov eax, 0x418058
mov ecx, dword [ebp + 8]
cmp dword [eax], ecx
je 0x401fb7
inc esi
mov eax, esi
shl eax, 4
lea eax, [eax + 0x418058]
cmp dword [eax], ebx
jne 0x401fa0
shl esi, 4
cmp dword [esi + 0x418058], ebx
jne 0x401fcc
mov eax, 0x41439c
jmp 0x40213e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x68]
push str.7zSfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x68]
push eax
call ebx
mov dword [ebp - 4], eax
call edi
test eax, eax
jne 0x40207c
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
add eax, 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, dword [ebp - 4]
inc ecx
push ecx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x68]
push eax
call ebx
cmp eax, dword [ebp - 4]
ja 0x402073
call edi
test eax, eax
jne 0x402073
mov eax, dword [esi + 0x418064]
test eax, eax
je 0x402068
mov edi, dword [ebp - 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402065
push dword [esi + 0x418064]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov dword [esi + 0x418064], edi
jmp 0x40207b
push edi
jmp 0x402076
mov eax, dword [ebp - 8]
mov dword [esi + 0x418064], eax
jmp 0x40207c
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x418064]
test eax, eax
jne 0x40213d
mov ebx, dword [esi + 0x41805c]
lea edi, [esi + 0x418060]
cmp dword [edi], eax
je 0x4020b2
call fcn.00401f2e
cmp eax, dword [0x4150a4]
jne 0x4020b2
mov ebx, dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [0x418054], 0xffffffff
pop ecx
mov dword [esi + 0x418064], eax
jne 0x40211d
and dword [0x418054], 0
push 0x1f
lea eax, [ebp - 0xa8]
push eax
movzx eax, word [0x41874c]
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x40211d
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.MSVCRT.dll__wtol]
pop ecx
mov dword [0x418054], eax
lea eax, [edi + 1]
push eax
push dword [esi + 0x418064]
push edi
push ebx
push 0
push dword [0x418054]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esi + 0x418064]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402236
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x402293
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
pop ebx
leave
ret

Function at 0x4024a1
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [ebp + 8], 0
jne 0x4024b1
xor eax, eax
leave
ret
test byte [0x41878c], 2
mov dword [ebp - 0x40], 0x40
jne 0x402506
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x402506
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, eax
ja 0x402506
jb 0x4024e2
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp + 8]
jae 0x402506
push 0x2b
call fcn.00401f84
push eax
call fcn.00407d29
cmp eax, 1
pop ecx
pop ecx
je 0x4024ff
or dword [0x41878c], 0xffffffff
jmp 0x4024ad
or dword [0x41878c], 2
xor eax, eax
inc eax
leave
ret

Function at 0x40280e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.004013f8
cmp dword [ebp - 4], 1
jg 0x40282c
push 1
lea ecx, [ebp - 0xc]
call fcn.00401112
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 1
push dword [ebp - 0xc]
push eax
call esi
test eax, eax
jne 0x402850
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x402887
push ebx
mov ebx, dword [edi]
inc eax
push eax
push eax
lea ecx, [ebp - 0xc]
call fcn.0040257c
push eax
push ebx
call esi
mov esi, dword [ebp - 0xc]
push esi
call fcn.004010fe
and word [esi + eax*2], 0
pop ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, edi
call fcn.00401349
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
pop edi
pop esi
leave
ret