joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d223
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x40
push dword [ebp + 8]
call esi
test eax, eax
mov dword [ebp - 8], eax
je 0x40d389
and word [eax], 0
push ebx
push edi
push 2
pop ebx
add dword [ebp - 8], ebx
push 0x23
push dword [ebp - 8]
call esi
mov edi, eax
test edi, edi
je 0x40d387
and word [edi], 0
and dword [ebp - 0x10], 0
push 0x2a
add edi, ebx
push edi
call esi
test eax, eax
je 0x40d282
add eax, ebx
push eax
call fcn.00402b60
pop ecx
mov dword [ebp - 0x10], eax
push ebx
push 0x40265c
push edi
mov dword [ebp - 0xc], 6
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
mov dword [ebp - 4], eax
je 0x40d2c5
push 0x24
push edi
call esi
mov esi, eax
test esi, esi
je 0x40d2c5
add esi, ebx
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
test esi, esi
je 0x40d2c0
cmp word [esi], 0x4e
jne 0x40d2c0
xor eax, eax
inc eax
jmp 0x40d2c2
xor eax, eax
add dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.0040446a
cmp dword [ebp - 0x10], 0
pop ecx
mov ebx, eax
je 0x40d2ed
lea eax, [ebp - 0x10]
push eax
push 0x40d12e
call fcn.00402d1d
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x40d36e
and word [ebp - 0x30], 0
mov esi, 0x402650
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x2e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp dword [ebp - 0xc], 6
setne al
shl eax, 8
or eax, 0x24
push eax
push dword [ebp - 8]
push ebx
push dword [0x4152c8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40d350
push 4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x40d35e
lea eax, [ebp - 0x4a]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x40d380
push 0x40
push dword [ebp - 8]
push ebx
push dword [0x4152c8]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 4], 1
pop edi
pop ebx
xor eax, eax
cmp dword [ebp - 4], eax
pop esi
sete al
leave
ret
Function at 0x40d517
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x328
push ebx
push esi
push edi
push dword [ebp + 0x7c]
lea eax, [ebp - 0xac]
push eax
call fcn.00404497
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x38]
xor ebx, ebx
cmp word [esi], 0x2a
push 0x206
sete bl
xor edi, edi
lea eax, [ebp - 0x2b2]
push edi
push eax
mov word [ebp - 0x2b4], di
call sub.MSVCRT.dll_memset
add esp, 0x14
cmp ebx, edi
je 0x40d591
inc esi
inc esi
push esi
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0x3c]
lea eax, [ebp - 0x2b4]
push edi
push eax
call fcn.0040d3b7
add esp, 0xc
jmp 0x40d5f3
xor ebx, ebx
cmp word [esi], 0x26
sete bl
cmp ebx, edi
je 0x40d5a0
inc esi
inc esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2b4]
push eax
call esi
push 0x9e
lea eax, [ebp - 0x6a]
push edi
push eax
mov word [ebp - 0x6c], di
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0x40], edi
je 0x40d5d6
push dword [ebp + 0x40]
lea eax, [ebp - 0x6c]
push eax
call esi
jmp 0x40d5dc
mov word [ebp - 0x6c], 0x2a
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x3c]
lea eax, [ebp - 0x2b4]
push eax
call fcn.0040d41a
add esp, 0x10
cmp dword [ebp + 0x34], edi
pop edi
pop esi
pop ebx
je 0x40d605
push eax
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
add ebp, 0x74
leave
ret
Function at 0x40dd4d
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb4
mov eax, dword [ebp + 0x7c]
xor ecx, ecx
cmp word [eax], 0x23
push ebx
sete cl
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push edi
push 0x3d
mov dword [ebp + 0x70], ecx
movzx ecx, cl
lea edi, [eax + ecx*2]
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x40def5
and word [ebx], 0
inc ebx
push edi
inc ebx
call fcn.004043d0
pop ecx
mov dword [ebp + 0x7c], eax
lea eax, [ebx + 2]
push 0x2b
push eax
call esi
mov edi, eax
test edi, edi
jne 0x40ddd1
push 0x2d
lea eax, [ebx + 2]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x40ddd1
push 0x2a
lea eax, [ebx + 2]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x40ddd1
push 0x2f
lea eax, [ebx + 2]
push eax
call esi
mov edi, eax
test edi, edi
je 0x40def5
movzx esi, word [edi]
and word [edi], 0
push ebx
call fcn.004043d0
add edi, 2
push edi
mov ebx, eax
call fcn.004043d0
pop ecx
xor edi, edi
cmp dword [ebp + 0x70], edi
pop ecx
mov dword [ebp + 0x68], eax
push ebx
je 0x40de7c
call fcn.00402b60
push dword [ebp + 0x68]
mov edi, eax
call fcn.00402b60
pop ecx
xor ebx, ebx
cmp si, 0x2b
pop ecx
mov ecx, eax
jne 0x40de1a
lea ebx, [ecx + edi]
jmp 0x40de40
cmp si, 0x2d
jne 0x40de26
sub edi, ecx
mov ebx, edi
jmp 0x40de40
cmp si, 0x2a
jne 0x40de33
imul ecx, edi
mov ebx, ecx
jmp 0x40de40
cmp si, 0x2f
jne 0x40de40
mov eax, edi
cdq
idiv ecx
mov ebx, eax
and word [ebp - 0x40], 0
push 0x9e
lea eax, [ebp - 0x3e]
push 0
push eax
call sub.MSVCRT.dll_memset
push ebx
lea eax, [ebp - 0x40]
push 0x401848
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40def8
call fcn.004047f1
fstp qword [ebp + 0x60]
push dword [ebp + 0x68]
call fcn.004047f1
fldz
cmp si, 0x2b
fstp qword [ebp + 0x6c]
pop ecx
pop ecx
jne 0x40de9e
fadd qword [ebp + 0x60]
jmp 0x40deb2
cmp si, 0x2d
jne 0x40dea9
fsubr qword [ebp + 0x60]
jmp 0x40deb2
cmp si, 0x2a
jne 0x40deb7
fmul qword [ebp + 0x60]
fstp qword [ebp + 0x6c]
jmp 0x40dec4
cmp si, 0x2f
jne 0x40dec2
fdivr qword [ebp + 0x60]
jmp 0x40deb2
fstp st(0)
push 0x9e
lea eax, [ebp - 0x3e]
push edi
push eax
mov word [ebp - 0x40], di
call sub.MSVCRT.dll_memset
fld qword [ebp + 0x6c]
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
push 4
push ecx
push ecx
fstp qword [esp]
call fcn.00404824
add esp, 0x10
jmp 0x40de68
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x40df00
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push dword [ebp + 8]
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e005
push 0x3d
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x40e005
push edi
mov word [esi], bx
push 0x5c
inc esi
push ebx
inc esi
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
je 0x40df52
mov word [eax], bx
jmp 0x40df66
push esi
call edi
cmp eax, 1
jbe 0x40df66
cmp word [esi + 2], 0x3a
je 0x40df66
mov esi, 0x401a34
push esi
call fcn.004043d0
mov esi, eax
mov dword [esp], 0x40e
lea eax, [ebp - 0x40e]
push ebx
push eax
mov word [ebp - 0x410], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
call edi
cmp eax, 1
jbe 0x40df9b
cmp word [esi + 2], 0x3a
jne 0x40dfa3
push esi
call edi
cmp eax, 2
jae 0x40dfd2
push esi
call fcn.004043ee
test eax, eax
pop ecx
lea eax, [ebp - 0x410]
je 0x40dfcb
push esi
push 0x4152e0
push 0x401a18
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x40dfe0
push 0x4152e0
jmp 0x40dfd9
push esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x410]
push eax
call fcn.00404444
pop ecx
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop edi
jmp 0x40e010
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret

Function at 0x40e014
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x2b8
push esi
lea eax, [ebp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
and word [ebp - 0x3c], 0
push 0x9e
lea eax, [ebp - 0x3a]
push 0
push eax
call sub.MSVCRT.dll_memset
movzx eax, word [ebp + 0x70]
push eax
movzx eax, word [ebp + 0x6e]
push eax
movzx eax, word [ebp + 0x6c]
push eax
movzx eax, word [ebp + 0x68]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
movzx eax, word [ebp + 0x6a]
push eax
movzx eax, word [ebp + 0x66]
push eax
movzx eax, word [ebp + 0x64]
push eax
lea eax, [ebp - 0x3c]
push 0x40275c
push eax
call esi
and word [ebp - 0x244], 0
push 0x206
lea eax, [ebp - 0x242]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x3c
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
lea eax, [ebp - 0x244]
je 0x40e0b0
push dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x40e0ba
push 0x40274c
push eax
call esi
pop ecx
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop esi
add ebp, 0x74
leave
ret
Function at 0x40e0d6
Capabilities:
Get disk information
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x4b0
push ebx
push dword [ebp + 0x7c]
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e219
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3d
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
xor ebx, ebx
cmp eax, ebx
je 0x40e219
push esi
mov word [eax], bx
add eax, 2
push edi
push eax
call fcn.004043d0
mov esi, eax
push esi
call fcn.004043ee
test eax, eax
pop ecx
pop ecx
je 0x40e184
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jbe 0x40e156
cmp word [esi + 2], 0x3a
jne 0x40e156
push esi
call edi
cmp eax, 2
jbe 0x40e206
mov word [esi + 4], bx
jmp 0x40e206
push 0x9e
lea eax, [ebp - 0x2a]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov ax, word [0x4152e0]
mov word [ebp - 0x2c], ax
mov ax, word [0x4152e2]
add esp, 0xc
mov word [ebp - 0x2a], ax
lea esi, [ebp - 0x2c]
jmp 0x40e206
push 0x206
lea eax, [ebp - 0x232]
push ebx
push eax
mov word [ebp - 0x234], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x43c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x43c], bx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebp - 0x43c]
je 0x40e1eb
push esi
call edi
mov word [esi + eax*2 - 2], 0x7c
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push esi
call edi
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x40e1c7
lea eax, [ebp - 0x234]
push eax
call edi
cmp eax, ebx
jbe 0x40e200
mov word [ebp + eax*2 - 0x236], bx
lea esi, [ebp - 0x234]
push esi
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
jmp 0x40e21c
xor eax, eax
inc eax
pop ebx
add ebp, 0x74
leave
ret

Function at 0x40e222
Capabilities:
Set environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebx
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e292
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3d
push ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x40e292
and word [eax], 0
add eax, 2
push esi
push eax
call fcn.004043d0
mov esi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
pop ecx
push 0x5c
push 0
push eax
call esi
test eax, eax
je 0x40e275
and word [eax], 0
add eax, 2
push eax
call fcn.004043d0
pop ecx
push 0x2e
push 0
push eax
call esi
test eax, eax
pop esi
je 0x40e283
inc eax
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop ebx
ret
xor eax, eax
inc eax
pop ebx
ret
Function at 0x40e297
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xb0
push ebx
push esi
push edi
push dword [ebp + 0x7c]
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e3bb
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [ebp + 0x7c]
call esi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x40e3bb
mov word [edi], bx
inc edi
push 0x2c
inc edi
push edi
call esi
cmp eax, ebx
je 0x40e3bb
mov word [eax], bx
add eax, 2
push eax
call fcn.004043d0
pop ecx
push 0x2c
push eax
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x70], 1
call esi
cmp eax, ebx
je 0x40e327
mov word [eax], bx
add eax, 2
push eax
call fcn.004043d0
push eax
call fcn.00402b60
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0x70], eax
jge 0x40e327
mov dword [ebp + 0x70], ebx
push edi
call fcn.004043d0
mov esi, dword [sym.imp.USER32.dll_CharUpperW]
pop ecx
push eax
call esi
push eax
mov dword [ebp + 0x64], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 0x6c], ebx
jle 0x40e372
push dword [ebp + 0x68]
call esi
xor edx, edx
xor ecx, ecx
cmp edi, ebx
jle 0x40e372
movzx eax, word [eax]
mov esi, dword [ebp + 0x64]
cmp word [esi + ecx*2], ax
jne 0x40e3b4
inc edx
cmp dword [ebp + 0x70], ebx
jle 0x40e3ae
cmp edx, dword [ebp + 0x70]
jne 0x40e3b4
inc ecx
mov dword [ebp + 0x6c], ecx
push 0x9e
lea eax, [ebp - 0x3a]
push ebx
push eax
mov word [ebp - 0x3c], bx
call sub.MSVCRT.dll_memset
push dword [ebp + 0x6c]
lea eax, [ebp - 0x3c]
push 0x401848
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40e3be
lea esi, [ecx + 1]
mov dword [ebp + 0x6c], esi
inc ecx
cmp ecx, edi
jl 0x40e35a
jmp 0x40e372
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x40e3c6
Capabilities:
Set environment variable

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e44c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [esp + 0x10]
call ebx
mov esi, eax
test esi, esi
je 0x40e44c
and word [esi], 0
push edi
inc esi
push 0x2c
inc esi
push esi
xor edi, edi
call ebx
test eax, eax
je 0x40e41a
and word [eax], di
add eax, 2
push eax
call fcn.004043d0
push eax
call fcn.00402b60
pop ecx
pop ecx
mov edi, eax
push esi
call fcn.004043d0
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, edi
jl 0x40e432
test edi, edi
jne 0x40e434
mov edi, eax
and word [esi + edi*2], 0
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop edi
jmp 0x40e44f
xor eax, eax
inc eax
pop esi
pop ebx
ret
Function at 0x40e452
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e529
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
je 0x40e529
and word [ebx], 0
inc ebx
push 0x2c
inc ebx
push ebx
call esi
mov edi, eax
test edi, edi
je 0x40e529
and word [edi], 0
inc edi
push 0x2c
inc edi
push edi
mov dword [ebp - 4], 1
call esi
test eax, eax
je 0x40e4cc
and word [eax], 0
add eax, 2
push eax
call fcn.004043d0
push eax
call fcn.00402b60
pop ecx
pop ecx
mov dword [ebp - 4], eax
push edi
call fcn.004043d0
push eax
call fcn.00402b60
push ebx
mov esi, eax
call fcn.004043d0
add esp, 0xc
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, 1
jge 0x40e4f4
xor esi, esi
inc esi
cmp esi, eax
jle 0x40e4fb
lea esi, [eax + 1]
cmp dword [ebp - 4], eax
jg 0x40e506
cmp dword [ebp - 4], 0
jne 0x40e509
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, esi
and word [edi + eax*2 - 2], 0
lea eax, [edi + esi*2 - 2]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40e52c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e531
Capabilities:
Set environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebx
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e59b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3d
push ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x40e59b
and word [eax], 0
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x5c
push 0
add eax, 2
push eax
call edi
mov esi, eax
test esi, esi
je 0x40e583
push 0x2e
inc esi
push 0
inc esi
push esi
call edi
test eax, eax
je 0x40e583
and word [eax], 0
push esi
call fcn.004043d0
pop ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret
xor eax, eax
inc eax
pop ebx
ret
Function at 0x40e5a0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00412b10
push esi
push edi
push dword [ebp + 8]
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e6d9
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
je 0x40e6d9
and word [edi], 0
inc edi
push 0x2c
inc edi
push edi
call esi
test eax, eax
je 0x40e6d9
and word [eax], 0
add eax, 2
push ebx
push eax
call fcn.004043d0
pop ecx
mov ebx, eax
push 0x2c
push ebx
mov dword [ebp - 4], 1
call esi
test eax, eax
je 0x40e633
and word [eax], 0
add eax, 2
push eax
call fcn.004043d0
push eax
call fcn.00402b60
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jge 0x40e633
and dword [ebp - 4], 0
push edi
call fcn.004043d0
mov esi, dword [sym.imp.USER32.dll_CharUpperW]
pop ecx
push eax
call esi
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [ebp - 8], 0
mov edi, eax
test edi, edi
jle 0x40e680
push ebx
call esi
lea ecx, [edi - 1]
xor edx, edx
cmp ecx, 0xffffffff
jle 0x40e680
movzx eax, word [eax]
mov esi, dword [ebp - 0xc]
cmp word [esi + ecx*2], ax
jne 0x40e6d1
inc edx
cmp dword [ebp - 4], 0
jle 0x40e6cb
cmp edx, dword [ebp - 4]
jne 0x40e6d1
inc ecx
mov dword [ebp - 8], ecx
and word [ebp - 0x100c], 0
push 0xffe
lea eax, [ebp - 0x100a]
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp - 8]
lea eax, [ebp - 0x100c]
push 0x401848
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop ebx
jmp 0x40e6dc
lea esi, [ecx + 1]
mov dword [ebp - 8], esi
dec ecx
cmp ecx, 0xffffffff
jg 0x40e667
jmp 0x40e680
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x40e6e0
Capabilities:
Set environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e761
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push ebp
call ebx
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x40e761
mov word [esi], di
inc esi
push 0x2c
inc esi
push esi
call ebx
test eax, eax
je 0x40e732
and word [eax], di
add eax, 2
push eax
call fcn.004043d0
push eax
call fcn.00402b60
pop ecx
pop ecx
mov edi, eax
push esi
call fcn.004043d0
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp edi, 1
jge 0x40e749
mov edi, eax
sub eax, edi
jns 0x40e74f
xor eax, eax
lea eax, [esi + eax*2]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x40e764
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40e769
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa0
push dword [ebp + 0x7c]
call fcn.004043ee
test eax, eax
pop ecx
je 0x40e7ed
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x3d
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x40e7ed
and word [eax], 0
add eax, 2
push edi
push eax
call fcn.004043d0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
and word [ebp - 0x2c], 0
push 0x9e
mov edi, eax
lea eax, [ebp - 0x2a]
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x2c]
push 0x401848
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop edi
jmp 0x40e7f0
xor eax, eax
inc eax
add ebp, 0x74
leave
ret

Function at 0x40e81c
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x4152cc], eax
call fcn.0040e806
mov edi, 0x206
push edi
mov dword [0x415078], eax
lea eax, [ebp - 0x616]
push ebx
push eax
mov word [ebp - 0x618], bx
call sub.MSVCRT.dll_memset
push 1
lea eax, [ebp - 0x618]
push ebx
push eax
call fcn.00405318
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, 0x104
push esi
push 0x415588
push ebx
mov dword [0x4152d4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4152e0
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4152e0
call fcn.00404444
push edi
lea eax, [ebp - 0x206]
push ebx
push eax
mov word [ebp - 0x208], bx
call sub.MSVCRT.dll_memset
add esp, 0x10
push esi
lea eax, [ebp - 0x208]
push eax
push 0x402600
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x40e920
push edi
lea eax, [ebp - 0x40e]
push ebx
push eax
mov word [ebp - 0x410], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00405202
add esp, 0xc
jmp 0x40e932
push 0x4152e0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x208]
push eax
push 0x402600
call esi
lea eax, [ebp - 0x208]
push eax
push 0x4025f0
mov word [ebp - 0x204], bx
call esi
push 0xc
push 0x4014c0
push 0x415790
call fcn.004048b7
push 0x3b8
push ebx
push 0x4157b0
call sub.MSVCRT.dll_memset
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret