joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2001a6a5
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push esi
push edi
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push dword [ebp + 8]
mov esi, eax
call fcn.20004446
test esi, esi
pop ecx
je 0x2001a738
cmp esi, 0xffffffff
je 0x2001a738
test byte [ebp - 0x250], 0x10
jne 0x2001a70e
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x458]
push 0x200029c0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceW]
add edi, eax
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2001a6d7
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
leave
ret

Function at 0x2001a743
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp + 8]
add esp, 0xc
cmp word [ebx], 0x5c
mov dword [ebp - 4], 2
jne 0x2001a85b
push 0x2c
push ebx
mov dword [ebp + 8], edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, edi
je 0x2001a7b8
mov word [eax], di
add eax, 2
push eax
call fcn.2000c372
pop ecx
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
cmp eax, edi
je 0x2001a7b8
movzx eax, word [eax]
cmp ax, di
je 0x2001a7b8
movzx eax, ax
mov dword [ebp + 8], eax
push esi
lea eax, [ebp - 0x412]
push edi
inc ebx
push eax
inc ebx
mov word [ebp - 0x414], di
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x414], di
lea esi, [ebp - 0x414]
je 0x2001a8a2
mov ax, word [ebp + 8]
cmp word [esi], ax
jb 0x2001a849
push ebx
push esi
lea eax, [ebp - 0x20c]
push 0x200038e0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push eax
call fcn.2000448d
add esp, 0x14
test eax, eax
je 0x2001a849
push 0x200038d4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call fcn.2001a6a5
pop ecx
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], di
jne 0x2001a7f7
jmp 0x2001a8a2
push ebx
call fcn.2000448d
test eax, eax
pop ecx
je 0x2001a872
push 0x200038d4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call fcn.20004446
push ebx
call fcn.2000448d
test eax, eax
pop ecx
pop ecx
je 0x2001a8a2
lea eax, [ebp - 0x20c]
push eax
call fcn.2001a6a5
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2001a903
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb04
push ebx
push esi
push edi
push 0x2c
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x94]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.2000c4a6
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x4c]
call fcn.200042be
mov esi, 0x206
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4a2]
push ebx
push eax
mov word [ebp - 0x4a4], bx
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x29a]
push ebx
push eax
mov word [ebp - 0x29c], bx
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x2c
push dword [ebp - 0x54]
lea eax, [ebp - 0x4a4]
push eax
call esi
mov edi, dword [ebp - 0x50]
push edi
lea eax, [ebp - 0x29c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x2a
push ebx
push edi
call esi
test eax, eax
jne 0x2001a9ff
push 0x3f
push ebx
push edi
call esi
test eax, eax
jne 0x2001a9ff
lea eax, [ebp - 0x29c]
push eax
call fcn.20004465
test eax, eax
pop ecx
je 0x2001a9d4
cmp dword [ebp - 8], ebx
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4a4]
push eax
jne 0x2001a9ec
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
jmp 0x2001a9f4
cmp dword [ebp - 8], ebx
je 0x2001aaf1
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.2001a8aa
add esp, 0xc
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x2001aaf1
lea eax, [ebp - 0x29c]
push eax
call fcn.2000c426
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.2000c426
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x6f4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x2001aaf1
cmp eax, 0xffffffff
je 0x2001aaf1
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x200029c0
lea eax, [ebp - 0x6c8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xb04]
push edi
push eax
call esi
lea eax, [ebp - 0x6c8]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x8fc]
push edi
push eax
call esi
add esp, 0x20
test byte [ebp - 0x6f4], 0x10
je 0x2001aab0
cmp dword [ebp - 8], ebx
je 0x2001aad0
lea eax, [ebp - 0x6c8]
push eax
call fcn.20007e6f
test eax, eax
pop ecx
jne 0x2001aad0
push 1
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x8fc]
push eax
call fcn.2001a8aa
add esp, 0xc
jmp 0x2001aaca
cmp dword [ebp - 8], ebx
push ebx
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x8fc]
push eax
jne 0x2001aaa6
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
movzx eax, al
add dword [ebp - 4], eax
lea eax, [ebp - 0x6f4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x2001aa4c
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp dword [ebp - 4], ebx
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x2001ac01
Capabilities:
Change the wallpaper
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0x20003990
push 0x20003964
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 2
push esi
call fcn.2001aafe
pop ecx
pop ecx
push 3
push 0
push 0
push 0x14
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test esi, esi
pop esi
jne 0x2001ac4d
test eax, eax
jne 0x2001ac4d
inc eax
ret
xor eax, eax
ret

Function at 0x2001acad
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2a
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
jne 0x2001ace1
push 0x2c
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x2001ad8d
mov esi, eax
mov word [esi], bx
inc esi
inc esi
cmp byte [ebp + 0xc], bl
mov dword [ebp - 4], esi
je 0x2001ad48
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call sub.MSVCRT.dll_memset
push 0x20003a54
push 0x200034c8
lea eax, [ebp - 0x20c]
push 0x20002b80
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push esi
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x2001ad89
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
add eax, eax
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x20003a34
mov ebx, 0x200039d8
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push dword [ebp - 4]
call esi
add eax, eax
push eax
push dword [ebp - 4]
push 1
push 0x200039a4
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
xor eax, eax
jmp 0x2001ad90
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2001ae5e
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb0
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp + 0x70], esi
mov dword [ebp + 0x6c], esi
call fcn.2001adb1
sub eax, esi
je 0x2001af6b
dec eax
je 0x2001af6b
push 4
pop eax
mov dword [ebp + 0x64], eax
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x64]
push eax
mov ebx, 0x20003acc
push ebx
mov edi, 0x20003a60
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x2001af6b
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x6c]
jne 0x2001aecd
xor eax, eax
inc eax
jmp 0x2001af7e
push 4
lea eax, [ebp + 0x7c]
push eax
push 4
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x2001af6b
push 0x50
lea eax, [ebp - 0x3c]
push eax
push str._RamDrv_
call fcn.20007e9d
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jb 0x2001af6b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x14
pop ebx
push 1
call fcn.2001ae01
push 2
call fcn.2001ae01
lea eax, [ebp - 0x3c]
push eax
call fcn.20004a0d
add esp, 0xc
call esi
cmp eax, 3
je 0x2001af3a
inc dword [ebp + 0x70]
cmp dword [ebp + 0x70], ebx
jb 0x2001af11
cmp dword [ebp + 0x70], ebx
je 0x2001af6b
xor edi, edi
push 2
call fcn.2001ae01
push 1
call fcn.2001ae01
lea eax, [ebp - 0x3c]
push eax
call fcn.20004a0d
add esp, 0xc
call esi
cmp eax, 3
jne 0x2001af67
inc edi
cmp edi, ebx
jb 0x2001af41
cmp edi, ebx
jne 0x2001af8d
mov eax, dword [0x2002dba4]
cmp eax, 0xffffffff
je 0x2001af7c
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
call esi
cmp eax, 3
jne 0x2001af6b
lea eax, [ebp - 0x3c]
push eax
call fcn.20004a0d
test eax, eax
pop ecx
jne 0x2001af86
mov eax, dword [0x2002dba4]
cmp eax, 0xffffffff
je 0x2001aec5
push eax
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
jmp 0x2001aec5
Function at 0x2001afb5
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x534
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x2b6]
push ebx
push eax
mov word [ebp - 0x2b8], bx
call sub.MSVCRT.dll_memset
push 0x104
lea eax, [ebp - 0x2b8]
push eax
push dword [ebp + 0x7c]
call fcn.20007e9d
push 0x2c
push 5
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.2000c4a6
add esp, 0x28
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x30]
cmp edi, ebx
mov dword [ebp + 0x70], ebx
je 0x2001b06f
cmp word [edi], bx
je 0x2001b06f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, 0x20003af8
push ebx
push edi
call esi
test eax, eax
jne 0x2001b04e
push ebx
call fcn.20012d75
xor ebx, ebx
test eax, eax
pop ecx
je 0x2001b06f
mov dword [ebp + 0x70], 1
jmp 0x2001b06f
mov ebx, 0x200025d0
push ebx
push edi
call esi
test eax, eax
jne 0x2001b06d
push ebx
call fcn.20012d75
test eax, eax
pop ecx
je 0x2001b06d
mov dword [ebp + 0x70], 2
xor ebx, ebx
xor edi, edi
cmp dword [ebp + 0x70], ebx
jbe 0x2001b199
push 0x9e
lea eax, [ebp - 0x6e]
push ebx
push eax
mov word [ebp - 0x70], bx
call sub.MSVCRT.dll_memset
push 0x20
push 0x800
push 1
push dword [ebp + 0x34]
call fcn.20012e36
add esp, 0x1c
cmp dword [ebp + 0x70], 1
mov esi, eax
jne 0x2001b0d0
shl esi, 0x14
push esi
call fcn.2001ae5e
push 0x50
lea eax, [ebp - 0x70]
push eax
push str._RamDrv_
call fcn.20007e9d
lea eax, [ebp - 0x70]
push eax
call fcn.20004a0d
add esp, 0x14
jmp 0x2001b130
cmp dword [ebp + 0x70], 2
jne 0x2001b199
push dword [ebp + 0x3c]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push dword [ebp - 0x70]
call fcn.20004526
test eax, eax
pop ecx
je 0x2001b121
push dword [ebp - 0x70]
call fcn.20006460
cmp eax, ebx
jne 0x2001b121
call fcn.20006176
xor ecx, ecx
cmp ax, bx
setne cl
mov word [ebp - 0x70], ax
mov eax, ecx
cmp eax, ebx
je 0x2001b199
push dword [ebp + 0x40]
push dword [ebp + 0x38]
push esi
push dword [ebp - 0x70]
call fcn.2000669d
mov edi, eax
cmp edi, ebx
je 0x2001b199
cmp dword [ebp + 0x70], 2
jne 0x2001b149
push dword [ebp - 0x70]
call fcn.20006424
cmp eax, 0xffffffff
je 0x2001b199
push 0x206
lea eax, [ebp - 0x4be]
push ebx
push eax
mov word [ebp - 0x4c0], bx
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x70]
push eax
push 0x20003ae0
lea eax, [ebp - 0x4c0]
push 0x20002a5c
push eax
mov word [ebp - 0x6e], 0x3a
mov word [ebp - 0x6c], bx
call dword [sym.imp.USER32.dll_wsprintfW]
push ebx
push ebx
lea eax, [ebp - 0x4c0]
push ebx
push eax
call fcn.2000d5ac
add esp, 0x2c
xor eax, eax
cmp edi, ebx
pop edi
pop esi
sete al
pop ebx
add ebp, 0x74
leave
ret
Function at 0x2001b4bd
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5c
jne 0x2001b56c
and word [ebp - 0x208], 0
push esi
push 0x206
lea eax, [ebp - 0x206]
push 0
inc edi
push eax
inc edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x208], 0
lea esi, [ebp - 0x208]
je 0x2001b56b
mov ax, word [esi]
cmp ax, word [ebp + 0xc]
jb 0x2001b547
push edi
push esi
lea eax, [ebp - 0xa08]
push 0x20002b80
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xa08]
push eax
call fcn.20004465
add esp, 0x14
test eax, eax
jne 0x2001b55a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x2001b517
jmp 0x2001b56b
lea eax, [ebp - 0xa08]
push eax
add edi, 0xfffffffe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop esi
pop edi
leave
ret

Function at 0x2001b5b4
Capabilities:
Log keystrokes via polling
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xa8
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp word [ebp + 0x74], si
push edi
je 0x2001b5e6
movzx eax, word [ebp + 0x74]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x2001b6a0
movzx esi, word [ebp + 0x74]
jmp 0x2001b622
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
push 8
pop edi
movzx eax, di
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x2001b60b
inc edi
cmp di, 0xff
jb 0x2001b5f2
jmp 0x2001b60e
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x7c], esi
jne 0x2001b617
test ebx, ebx
je 0x2001b5e6
test ebx, ebx
je 0x2001b6a0
movzx esi, di
xor edi, edi
cmp si, di
je 0x2001b6a0
push 0x9e
lea eax, [ebp - 0x3a]
push edi
push eax
mov word [ebp - 0x3c], di
call sub.MSVCRT.dll_memset
mov word [ebp + 0x64], di
xor eax, eax
lea edi, [ebp + 0x66]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x78]
add esp, 0xc
test eax, eax
je 0x2001b65b
cmp word [eax], 0
je 0x2001b65b
push eax
jmp 0x2001b660
push 0x20003b24
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esi - 0x60]
cmp ax, 9
ja 0x2001b679
add esi, 0xffd0
cmp si, 0x40
jbe 0x2001b685
cmp si, 0x5b
jb 0x2001b68e
lea eax, [esi - 0x30]
cmp ax, 9
ja 0x2001b692
mov word [ebp + 0x64], si
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
movzx eax, si
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x2001bcb5
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0xa0
cmp dword [ebp + 8], eax
je 0x2001bccb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [0x2002dd74], eax
lea eax, [ebp - 0xa0]
push 0x20002b9c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
push 0x20003b48
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
leave
ret

Function at 0x2001becb
Capabilities:
Set current directory

Disassembly:
mov eax, dword [esp + 4]
movzx ecx, word [eax]
test cx, cx
je 0x2001befc
cmp cx, 0x40
jne 0x2001bee3
add eax, 2
push eax
jmp 0x2001bf01
cmp cx, 0x23
jne 0x2001bef4
add eax, 2
push eax
call fcn.20013c88
pop ecx
ret
push eax
call fcn.2000c2f8
pop ecx
ret
push 0x2002e1b0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x2001bf0d
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push edi
push pe_nt_image_headers32
push dword [ebp + 8]
call esi
xor ebx, ebx
cmp eax, ebx
je 0x2001c055
mov word [eax], bx
inc eax
inc eax
push 0x23
push eax
mov dword [ebp - 8], eax
call esi
mov edi, eax
cmp edi, ebx
je 0x2001c055
mov word [edi], bx
inc edi
push 0x2a
inc edi
push edi
mov dword [ebp - 4], ebx
call esi
cmp eax, ebx
je 0x2001bf62
add eax, 2
push eax
call fcn.200042be
pop ecx
mov dword [ebp - 4], eax
push 6
pop ebx
push 2
push 0x20003b84
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x2001bfa4
push 0x24
push edi
call esi
mov esi, eax
test esi, esi
je 0x2001bfa4
inc esi
inc esi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
test esi, esi
je 0x2001bf9c
cmp word [esi], 0x4e
jne 0x2001bf9c
mov al, 1
jmp 0x2001bf9e
xor al, al
movzx ebx, al
add ebx, 6
push dword [ebp + 8]
call fcn.2000c479
cmp dword [ebp - 0xc], 0
pop ecx
mov edx, eax
je 0x2001c039
and word [ebp - 0x2c], 0
mov esi, 0x20003b78
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp ebx, 6
setne al
push ebx
push dword [ebp - 4]
shl eax, 8
or eax, 0x24
push eax
push dword [ebp - 8]
push edx
push dword [0x2002dd6c]
call fcn.2000f82c
add esp, 0x18
cmp eax, 6
jne 0x2001c01b
push 4
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x2001c029
lea eax, [ebp - 0x46]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x2001c051
push ebx
push dword [ebp - 4]
push pe_nt_image_headers32
push dword [ebp - 8]
push edx
push dword [0x2002dd6c]
call fcn.2000f82c
add esp, 0x18
xor eax, eax
jmp 0x2001c058
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2001c19a
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x328
push ebx
push esi
push edi
push 0x2c
push 5
push dword [ebp + 0x7c]
lea eax, [ebp - 0xac]
push eax
call fcn.2000c4a6
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x38]
xor eax, eax
cmp word [esi], 0x2a
push 0x206
sete al
xor ebx, ebx
push ebx
mov word [ebp - 0x2b4], bx
mov edi, eax
lea eax, [ebp - 0x2b2]
push eax
call sub.MSVCRT.dll_memset
add esp, 0x1c
cmp edi, ebx
je 0x2001c21f
inc esi
inc esi
push esi
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0x44]
call fcn.200042be
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.2001c07e
jmp 0x2001c280
xor eax, eax
cmp word [esi], 0x26
sete al
mov edi, eax
cmp edi, ebx
je 0x2001c230
inc esi
inc esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2b4]
push eax
call esi
push 0x9e
lea eax, [ebp - 0x6a]
push ebx
push eax
mov word [ebp - 0x6c], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0x40], ebx
je 0x2001c266
push dword [ebp + 0x40]
lea eax, [ebp - 0x6c]
push eax
call esi
jmp 0x2001c26c
mov word [ebp - 0x6c], 0x2a
push edi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x3c]
lea eax, [ebp - 0x2b4]
push eax
call fcn.2001c0d6
add esp, 0x10
cmp dword [ebp + 0x34], ebx
pop edi
pop esi
pop ebx
je 0x2001c295
push eax
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
add ebp, 0x74
leave
ret
Function at 0x2001c29c
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
mov eax, 0x1ca0
call fcn.200256d0
push ebx
push esi
push edi
push 0x2c
xor ebx, ebx
push ebx
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov edi, eax
cmp edi, ebx
je 0x2001c2c7
mov word [edi], bx
inc edi
inc edi
push 0x3ff
lea eax, [ebp - 0x42b]
push ebx
push eax
mov byte [ebp - 0x42c], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x7c]
lea eax, [ebp - 0x42c]
push eax
call fcn.2000429f
push 0x7ff
lea eax, [ebp - 0xc2b]
push ebx
push eax
mov byte [ebp - 0xc2c], bl
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x18
lea eax, [ebp - 0x42c]
push eax
call esi
lea ecx, [ebp - 0xc2c]
push ecx
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.2000ef70
add esp, 0xc
test eax, eax
je 0x2001c404
push 0xffe
lea eax, [ebp - 0x1c2a]
push ebx
push eax
mov word [ebp - 0x1c2c], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc2c]
push eax
call esi
push eax
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0x1c2c]
push eax
call fcn.20004282
add esp, 0xc
cmp edi, ebx
je 0x2001c399
lea eax, [ebp - 0x1c2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x2001c407
push 0x9e
lea eax, [ebp - 0x2a]
push ebx
push eax
mov word [ebp - 0x2c], bx
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x1c2c]
push eax
call fcn.2000c288
add esp, 0x10
mov esi, eax
cmp esi, ebx
push 0x50
lea eax, [ebp - 0x2c]
push eax
je 0x2001c3ce
push 0x2727
jmp 0x2001c3d3
push 0x2730
push dword [0x2003f03c]
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c2c]
push eax
push dword [0x2002dd6c]
call fcn.2000f82c
xor eax, eax
add esp, 0x18
cmp esi, ebx
sete al
jmp 0x2001c407
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x2001c61a
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
mov eax, dword [ebp + 0x7c]
sub esp, 0xa0
test eax, eax
push ebx
je 0x2001c68a
cmp word [eax], 0
je 0x2001c68a
push 0x3d
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebx, eax
test ebx, ebx
je 0x2001c68a
push esi
push edi
mov esi, 0x20002418
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
push 0x9a
lea eax, [ebp - 0x26]
push 0
push eax
movsw word es:[edi], word [esi]
call sub.MSVCRT.dll_memset
and word [ebx], 0
mov ax, word [ebx + 2]
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2c]
push eax
call fcn.20004e0e
add esp, 0x10
pop edi
xor ecx, ecx
pop esi
cmp dword [ecx*8 + 0x20002348], eax
je 0x2001c693
inc ecx
cmp ecx, 0xc
jl 0x2001c67b
xor eax, eax
inc eax
pop ebx
add ebp, 0x74
leave
ret
push dword [ecx*8 + 0x2000234c]
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x2001c68d