joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40505c]
test esi, esi
jle 0x401df0
mov eax, dword [0x405060]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401d04
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401d87
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401cf0
mov dword [esp], ebx
call fcn.00402650
mov edi, eax
test eax, eax
je 0x401e17
mov eax, dword [0x405060]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402790
mov edx, dword [0x405060]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401df7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401d80
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401d90
add dword [0x40505c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x405060]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401d80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401c70
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401d0e
mov eax, dword [0x405060]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401c70
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401c70
lea esi, [esi]
nop

Function at 0x4022d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405070]
sub esp, 4
test ebx, ebx
je 0x402325
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40231e
test esi, esi
je 0x40231e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402300
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402650
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402675
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402680
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402675
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4026c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4026be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4026ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4026b0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x402950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [esp + 0x150]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x402ad8
cmp byte [ebx], 0
je 0x402aa0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x402ae8
test al, 0x10
je 0x402aa0
lea esi, [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov dword [esp + 0x1c], eax
mov ebp, eax
lea eax, [eax + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x402afa
lea edx, [eax + 0x22c]
lea eax, [ebp + 1]
cmp eax, 4
jb 0x402a78
mov ecx, dword [esp + eax + 0x28]
mov edi, edx
mov dword [edx + eax - 4], ecx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x22c], 0
je 0x402a20
movzx ecx, byte [ebx + ebp + 0x22b]
cmp cl, 0x5c
je 0x402a20
cmp cl, 0x2f
jne 0x402ac0
lea esi, [esi]
mov eax, dword [esp + 0x1c]
mov ecx, 0x2a
mov word [edx + eax], cx
lea edx, [ebx + 0x120]
mov ecx, 0x41
xor eax, eax
mov dword [ebx + 0x224], 0xffffffff
mov edi, edx
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov dword [ebx + 0x11c], 0
rep stosd dword es:[edi], eax
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x4029fb
movzx ecx, byte [esp + 0x2c]
mov byte [edx], cl
test al, 2
je 0x4029fb
movzx ecx, word [esp + eax + 0x2a]
mov word [edx + eax - 2], cx
jmp 0x4029fb
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 0x14
add esp, 0x13c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x5c
mov dword [esp + 0x1c], eax
mov word [edx + ebp], si
jmp 0x402a20
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
jmp 0x402a66
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x402a66
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
jmp 0x402a66
Function at 0x190025ca
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
lea ecx, [ebp - 0xc]
call fcn.19011396
lea ecx, [ebp - 0x18]
call fcn.19011396
push 0x3c
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.190158f0
mov ebx, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, 0x740
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x38], 0xa
test bl, 1
je 0x19002622
mov ecx, 0x8740
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x50], ecx
test bl, 2
mov eax, str.runas
cmove eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
and ebx, 0x10000
jne 0x19002642
or ecx, 0x100
mov dword [ebp - 0x50], ecx
mov eax, dword [0x1902fe6c]
push 5
push eax
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 0x4c]
call dword [sym.imp.USER32.dll_BringWindowToTop]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.19004cc7
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.190114c8
cmp dword [ebp - 8], esi
je 0x190026aa
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x190026ad
test ebx, ebx
jne 0x190026a1
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
inc esi
push dword [ebp - 0x18]
call fcn.19019869
push dword [ebp - 0xc]
call fcn.19019869
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x19002921
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.19003264
xor edi, edi
mov dword [0x1902fe5c], esi
lea eax, [ebp - 4]
mov dword [0x1902fe64], edi
push eax
push edi
push esi
push 0x19002cf9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, eax
mov dword [0x1902fe60], edx
test edx, edx
je 0x19002981
cmp dword [0x1902fe98], 2
je 0x19002972
call fcn.1900827c
mov edx, dword [0x1902fe60]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x1902fe60]
mov eax, dword [0x1902fe64]
mov dword [0x1902fffc], edi
test eax, eax
je 0x190029c3
cmp eax, 1
je 0x190029b7
cmp eax, 2
je 0x190029b3
cmp eax, 3
je 0x190029af
cmp eax, 0x67
jle 0x190029a9
cmp eax, 0x6b
jle 0x19002a27
push eax
push 0x14
push edi
jmp 0x19002a1f
push 0x12
jmp 0x190029b9
push 0x13
jmp 0x190029b9
push 0x11
push edi
call fcn.190099a4
pop ecx
pop ecx
jmp 0x19002a27
mov ecx, edi
mov dword [ebp + 8], ecx
cmp dword [0x19030000], ecx
jne 0x19002a27
test edx, edx
je 0x190029ee
lea eax, [ebp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x190029ee
test ecx, ecx
jne 0x190029ee
xor eax, eax
jmp 0x19002a2c
mov edx, 0x80070000
mov eax, ecx
and eax, edx
cmp eax, edx
je 0x19002a00
push ecx
push 0x21
jmp 0x190029ac
movzx eax, cx
cmp eax, 0xe
jne 0x19002a11
cmp dword [0x1902fe9c], 0xffffffff
je 0x19002a27
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.190099a4
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 4
Function at 0x19003790
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], eax
mov edi, eax
call fcn.1901135f
xor esi, esi
lea ecx, [ebp - 0x18]
push esi
call fcn.19004058
push 0x2f
mov ebx, eax
mov eax, dword [ebp + 8]
pop ecx
push 0x5c
pop edx
movzx eax, word [eax + edi*2 - 2]
cmp ax, dx
je 0x190037d6
cmp ax, cx
jne 0x1900380a
xor eax, eax
mov word [ebx + edi*2 - 2], ax
dec edi
mov dword [ebp - 4], edi
jmp 0x1900380a
test edi, edi
jle 0x19003802
push 0x2f
pop ecx
push 0x5c
pop edx
movzx eax, word [ebx + edi*2]
cmp ax, cx
je 0x19003800
cmp ax, dx
je 0x19003800
dec edi
test edi, edi
jg 0x190037ed
test edi, edi
je 0x1900385f
xor eax, eax
mov word [ebx + edi*2], ax
push ebx
call fcn.190057b4
pop ecx
test eax, eax
je 0x190037e3
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1900383e
lea eax, [ebp - 0xc]
push eax
push ebx
call fcn.190043c0
pop ecx
pop ecx
test eax, eax
jne 0x190038e3
push ebx
call fcn.190057b4
pop ecx
test eax, eax
jne 0x190038d9
push ebx
push 0xc
push 1
call fcn.190099a4
add esp, 0xc
jmp 0x190038e3
cmp dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
jne 0x19003880
mov ax, word [ecx]
or ax, 0x20
sub ax, 0x61
cmp ax, 0x19
ja 0x19003880
cmp word [ecx + 2], 0x3a
je 0x190038e0
push ecx
jmp 0x1900384e
sub eax, edi
lea esi, [ebx + edi*2]
inc eax
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + edi*2]
push eax
push esi
call fcn.19015a50
xor ecx, ecx
lea eax, [edi + 1]
add esp, 0xc
cmp word [esi], cx
cmove eax, edi
mov edi, eax
jmp 0x190038bd
movzx eax, cx
push 0x5c
pop ecx
cmp ax, cx
je 0x190038c8
push 0x2f
pop ecx
cmp ax, cx
je 0x190038c8
inc edi
movzx eax, word [ebx + edi*2]
mov ecx, eax
test ax, ax
jne 0x190038a9
xor eax, eax
push ebx
mov word [ebx + edi*2], ax
call fcn.190057b4
pop ecx
test eax, eax
je 0x190038f3
mov eax, dword [ebp - 4]
cmp edi, eax
jl 0x19003883
xor esi, esi
inc esi
push dword [ebp - 0x18]
call fcn.19019869
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
push ebx
push 0xc
push 1
call fcn.190099a4
add esp, 0xc
xor esi, esi
jmp 0x190038e3
Function at 0x19003c09
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.19011396
push 2
mov ecx, edi
call fcn.19004058
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
xor ebx, ebx
mov eax, dword [edi]
xor ecx, ecx
mov dword [edi + 4], ebx
mov word [eax], cx
test esi, esi
je 0x19003c60
inc esi
mov ecx, edi
push esi
call fcn.19004058
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [edi]
push esi
call fcn.19004e7c
pop ecx
xor ecx, ecx
mov dword [edi + 4], eax
mov word [esi + eax*2], cx
mov esi, dword [edi + 4]
mov dword [ebp + 8], esi
lea eax, [esi + 0xf]
push eax
mov ecx, edi
call fcn.19004058
push ebx
push dword [ebp + 0xc]
lea eax, [eax + esi*2]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [edi]
push esi
call fcn.19004e7c
add esp, 0x10
mov dword [edi + 4], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x19003caf
mov esi, dword [ebp + 8]
inc ebx
lea eax, [esi + 0xf]
cmp ebx, 0xfff
jl 0x19003c69
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x19003cb6
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.1901135f
push 0x19025b98
lea ecx, [ebp - 0xc]
call fcn.1901168c
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
je 0x19003d92
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.190114c8
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.190018ff
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0xc]
call fcn.1901168c
test byte [ebp - 0x25c], 0x10
je 0x19003d5a
push 0x19025ba0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x19003d75
push 0x19025ba4
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x19003d75
push dword [ebp - 0xc]
call fcn.19003cb6
pop ecx
jmp 0x19003d71
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x19003dbc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x19003dbc
lea eax, [ebp - 0x25c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x19003cf6
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [0x1902fed8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x19003dbc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x19003dbc
xor esi, esi
inc esi
push dword [ebp - 0xc]
call fcn.19019869
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x19003dcb
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
cmp dword [0x19030010], 0
jne 0x19003e2b
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x19003e2b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x250], 0x10
jne 0x19003e20
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x19003e1c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
leave
ret
xor eax, eax
leave
ret
push dword [ebp + 8]
call fcn.19003cb6
pop ecx
leave
ret
xor eax, eax
inc eax
leave
ret
Function at 0x19004207
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1902f0c0]
sub esp, 0xa0
push esi
push edi
xor edi, edi
mov esi, edi
jmp 0x1900422e
cmp eax, dword [ebp + 8]
je 0x19004232
inc esi
mov eax, esi
shl eax, 4
mov eax, dword [eax + 0x1902f0c0]
test eax, eax
jne 0x1900421d
shl esi, 4
cmp dword [esi + 0x1902f0c0], edi
jne 0x19004247
mov eax, 0x190259f8
jmp 0x190043bc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x60]
push str.SfxString_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x60]
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
mov dword [ebp - 4], edi
call ebx
push 2
pop edx
test eax, eax
jne 0x190042f1
xor ecx, ecx
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.19019860
pop ecx
mov ecx, dword [ebp - 4]
mov edi, eax
inc ecx
lea eax, [ebp - 0x60]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, dword [ebp - 4]
ja 0x190042ea
call ebx
test eax, eax
jne 0x190042ea
mov eax, dword [esi + 0x1902f0cc]
test eax, eax
je 0x190042e2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x190042ea
push 2
pop eax
push eax
push dword [esi + 0x1902f0cc]
call fcn.19019852
pop ecx
mov dword [esi + 0x1902f0cc], edi
jmp 0x190042f0
mov dword [esi + 0x1902f0cc], edi
jmp 0x190042f1
push edi
call fcn.19019869
pop ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x1902f0cc]
test eax, eax
jne 0x190043bb
mov ebx, dword [esi + 0x1902f0c4]
cmp dword [esi + 0x1902f0c8], eax
je 0x19004329
call fcn.190047b3
cmp eax, dword [0x19025da0]
jne 0x19004329
mov ebx, dword [esi + 0x1902f0c8]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
push 2
pop edx
lea edi, [eax + 1]
lea eax, [edi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.19019860
pop ecx
mov ecx, dword [0x1902f0bc]
mov dword [esi + 0x1902f0cc], eax
cmp ecx, 0xffffffff
jne 0x190043a0
and dword [0x1902f0bc], 0
lea eax, [ebp - 0xa0]
push 0x1f
push eax
movzx eax, word [0x1902fe68]
push 0x1004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x1900439a
lea eax, [ebp - 0xa0]
push eax
call fcn.1901b050
pop ecx
mov ecx, eax
mov dword [0x1902f0bc], ecx
jmp 0x190043a0
mov ecx, dword [0x1902f0bc]
lea eax, [edi + 1]
push eax
push dword [esi + 0x1902f0cc]
push edi
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esi + 0x1902f0cc]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x190047b3
Capabilities:
Identify system language via api

Disassembly:
mov dx, word [0x1902fe68]
test dx, dx
jne 0x1900481d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov cx, ax
mov word [0x1902fe68], ax
mov edx, 0x3ff
and cx, dx
cmp cx, 9
je 0x190047e0
movzx eax, ax
ret
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, 0x409
cmp ax, cx
jne 0x19004816
push esi
mov esi, dword [0x19025da0]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx edx, word [0x1902fe68]
cmp eax, esi
movzx ecx, si
cmove edx, ecx
mov word [0x1902fe68], dx
pop esi
jmp 0x1900481d
mov dx, word [0x1902fe68]
movzx eax, dx
ret

Function at 0x19004beb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [0x1902fe68]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceExA]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x19004c2f
push 0x409
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call ebx
mov esi, eax
test esi, esi
je 0x19004c55
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x19004c40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x19004c55
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x19004cc2
cmp dword [0x1902fe74], 0
jne 0x19004cc0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessPreferredUILanguages
push dword [0x1902feb8]
mov dword [0x1902fe74], 1
call edi
movzx ecx, word [0x1902fe68]
xor ebx, ebx
push ebx
push 0x409
push ebx
push ecx
mov esi, eax
lea eax, [ebp - 0x40]
push str._04X_c_04X_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test esi, esi
jne 0x19004cb7
push str.SetThreadPreferredUILanguages
push dword [0x1902feb8]
call edi
mov esi, eax
test esi, esi
je 0x19004cc0
push ebx
lea eax, [ebp - 0x40]
push eax
push 4
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x19004d94
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp + 8]
mov edi, eax
call fcn.19011396
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
push esi
call fcn.19004058
lea eax, [edi + 1]
mov edi, dword [ebp + 8]
push eax
push esi
mov ecx, edi
call fcn.19004058
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [edi]
push esi
call fcn.19004e7c
pop ecx
mov dword [edi + 4], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x190057b4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x190057f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x190057e1
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x190057f9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x190057f6
test al, 0x10
jne 0x190057f6
push esi
jmp 0x190057d7
xor eax, eax
inc eax
pop esi
pop ebp
ret
Function at 0x19005a4b
Capabilities:
Create process on windows
Get disk information
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x30
push ebx
push edi
push 0x3a
pop edx
cmp word [eax + 2], dx
jne 0x19005bcd
movzx ecx, word [eax + 4]
push esi
push 0x5c
pop esi
cmp cx, si
je 0x19005a79
cmp ecx, 0x2f
jne 0x19005bcc
mov ax, word [eax]
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], dx
mov word [ebp - 8], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x19005bc9
lea eax, [ebp - 0x24]
push str.7ZSfx_03x.cmd
push eax
call fcn.19003c09
pop ecx
pop ecx
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x19005bc0
lea ecx, [ebp - 0x18]
call fcn.19011396
push str.:Repeat_r_n
lea ecx, [ebp - 0x18]
call fcn.190114c8
mov ebx, str.del__
lea ecx, [ebp - 0x18]
push ebx
call fcn.1901168c
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.1901164e
mov esi, 0x19026c8c
lea ecx, [ebp - 0x18]
push esi
call fcn.1901168c
push str.if_exist__
lea ecx, [ebp - 0x18]
call fcn.1901168c
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.1901164e
push str.__goto_Repeat_r_n
lea ecx, [ebp - 0x18]
call fcn.1901168c
push ebx
lea ecx, [ebp - 0x18]
call fcn.1901168c
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.1901164e
push esi
lea ecx, [ebp - 0x18]
call fcn.1901168c
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push 1
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.19005844
add esp, 0xc
lea ecx, [ebp - 4]
xor ebx, ebx
push ebx
push ecx
push esi
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x30]
mov esi, eax
call fcn.19019869
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x19005bd8
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jne 0x19005bd8
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push dword [ebp - 0x24]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x18]
call fcn.19019869
pop ecx
push dword [ebp - 0x24]
call fcn.19019869
pop ecx
mov eax, dword [ebp + 8]
pop esi
push eax
call fcn.19019869
pop ecx
pop edi
pop ebx
leave
ret
push dword [ebp - 0x24]
call fcn.19003dcb
push dword [ebp - 0x18]
call fcn.19019869
push dword [ebp - 0x24]
call fcn.19019869
add esp, 0xc
jmp 0x19005bc9