joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41741e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
push esi
push edi
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
xor edi, edi
inc edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
push dword [ebp + 8]
mov esi, eax
call fcn.00403cb6
test esi, esi
pop ecx
je 0x4174b1
cmp esi, 0xffffffff
je 0x4174b1
test byte [ebp - 0x250], 0x10
jne 0x417487
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x458]
push 0x4025f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceW]
add edi, eax
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x417450
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
leave
ret

Function at 0x4174bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x20a]
push ebx
push eax
mov word [ebp - 0x20c], bx
call sub.MSVCRT.dll_memset
mov edi, dword [ebp + 8]
add esp, 0xc
cmp word [edi], 0x5c
mov dword [ebp - 4], 2
jne 0x4175b1
push 0x2c
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x417526
mov word [esi], bx
inc esi
inc esi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [esi]
cmp ax, bx
je 0x417526
movzx eax, ax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x414]
push eax
inc edi
push 0x104
inc edi
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
cmp word [ebp - 0x414], bx
lea esi, [ebp - 0x414]
je 0x4175f8
mov ax, word [ebp + 8]
cmp word [esi], ax
jb 0x41759f
push edi
push esi
lea eax, [ebp - 0x20c]
push 0x4033e0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push eax
call fcn.00403cfd
add esp, 0x14
test eax, eax
je 0x41759f
push 0x4033d4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041741e
pop ecx
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x41754d
jmp 0x4175f8
push edi
call fcn.00403cfd
test eax, eax
pop ecx
je 0x4175c8
push 0x4033d4
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push edi
call fcn.00403cb6
push edi
call fcn.00403cfd
test eax, eax
pop ecx
pop ecx
je 0x4175f8
lea eax, [ebp - 0x20c]
push eax
call fcn.0041741e
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417703
Capabilities:
Change the wallpaper
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0x403424
push 0x4033f8
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 2
push esi
call fcn.00417600
pop ecx
pop ecx
push 3
push 0
push 0
push 0x14
mov esi, eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test esi, esi
pop esi
jne 0x41774f
test eax, eax
jne 0x41774f
inc eax
ret
xor eax, eax
ret

Function at 0x4177af
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2a
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
jne 0x4177dd
push 0x2c
push edi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x417842
and word [esi], 0
and word [ebp - 0x208], 0
push 0x206
lea eax, [ebp - 0x206]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x403438
push 0x402828
lea eax, [ebp - 0x208]
push 0x4028b8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
push edi
push 1
add esi, 2
push esi
lea eax, [ebp - 0x208]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
jmp 0x417845
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x417ba4
Capabilities:
Log keystrokes via polling
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xa8
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp word [ebp + 0x74], si
push edi
je 0x417bd6
movzx eax, word [ebp + 0x74]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x417c90
movzx esi, word [ebp + 0x74]
jmp 0x417c12
push 0x14
call dword [sym.imp.KERNEL32.DLL_Sleep]
nop
push 8
pop edi
movzx eax, di
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x417bfb
inc edi
cmp di, 0xff
jb 0x417be2
jmp 0x417bfe
xor ebx, ebx
inc ebx
cmp dword [ebp + 0x7c], esi
jne 0x417c07
test ebx, ebx
je 0x417bd6
test ebx, ebx
je 0x417c90
movzx esi, di
xor edi, edi
cmp si, di
je 0x417c90
push 0x9e
lea eax, [ebp - 0x3a]
push edi
push eax
mov word [ebp - 0x3c], di
call sub.MSVCRT.dll_memset
mov word [ebp + 0x64], di
xor eax, eax
lea edi, [ebp + 0x66]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x78]
add esp, 0xc
test eax, eax
je 0x417c4b
cmp word [eax], 0
je 0x417c4b
push eax
jmp 0x417c50
push 0x403470
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [esi - 0x60]
cmp ax, 9
ja 0x417c69
add esi, 0xffd0
cmp si, 0x40
jbe 0x417c75
cmp si, 0x5b
jb 0x417c7e
lea eax, [esi - 0x30]
cmp ax, 9
ja 0x417c82
mov word [ebp + 0x64], si
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
pop edi
movzx eax, si
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x4182b0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea eax, [ebp - 0xa0]
push 0x4025ac
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
push 0x403494
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
leave
ret

Function at 0x4182e9
Capabilities:
Set current directory

Disassembly:
mov eax, dword [esp + 4]
movzx ecx, word [eax]
test cx, cx
je 0x41831a
cmp cx, 0x40
jne 0x418301
add eax, 2
push eax
jmp 0x41831f
cmp cx, 0x23
jne 0x418312
add eax, 2
push eax
call fcn.00410fe8
pop ecx
ret
push eax
call fcn.0040ba1d
pop ecx
ret
push 0x423450
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x418590
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push edi
push 0x40
push dword [ebp + 8]
call esi
xor ebx, ebx
cmp eax, ebx
je 0x4186d8
mov word [eax], bx
inc eax
inc eax
push 0x23
push eax
mov dword [ebp - 8], eax
call esi
mov edi, eax
cmp edi, ebx
je 0x4186d8
mov word [edi], bx
inc edi
push 0x2a
inc edi
push edi
mov dword [ebp - 4], ebx
call esi
cmp eax, ebx
je 0x4185e5
add eax, 2
push eax
call fcn.00403b00
pop ecx
mov dword [ebp - 4], eax
push 6
pop ebx
push 2
push 0x4034bc
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x418627
push 0x24
push edi
call esi
mov esi, eax
test esi, esi
je 0x418627
inc esi
inc esi
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
test esi, esi
je 0x41861f
cmp word [esi], 0x4e
jne 0x41861f
mov al, 1
jmp 0x418621
xor al, al
movzx ebx, al
add ebx, 6
push dword [ebp + 8]
call fcn.0040acf3
cmp dword [ebp - 0xc], 0
pop ecx
mov edx, eax
je 0x4186bc
and word [ebp - 0x2c], 0
mov esi, 0x4034b0
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
cmp ebx, 6
setne al
push ebx
push dword [ebp - 4]
shl eax, 8
or eax, 0x24
push eax
push dword [ebp - 8]
push edx
push dword [0x423434]
call fcn.00418510
add esp, 0x18
cmp eax, 6
jne 0x41869e
push 4
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x4186ac
lea eax, [ebp - 0x46]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
jmp 0x4186d4
push ebx
push dword [ebp - 4]
push 0x40
push dword [ebp - 8]
push edx
push dword [0x423434]
call fcn.00418510
add esp, 0x18
xor eax, eax
jmp 0x4186db
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418856
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
mov eax, 0x1ca0
call fcn.00420160
push ebx
push esi
push edi
push 0x2c
xor ebx, ebx
push ebx
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov edi, eax
cmp edi, ebx
je 0x418881
mov word [edi], bx
inc edi
inc edi
push 0x3ff
lea eax, [ebp - 0x42b]
push ebx
push eax
mov byte [ebp - 0x42c], bl
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
push dword [ebp + 0x7c]
lea eax, [ebp - 0x42c]
push eax
call fcn.00403ae1
push 0x7ff
lea eax, [ebp - 0xc2b]
push ebx
push eax
mov byte [ebp - 0xc2c], bl
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
add esp, 0x18
lea eax, [ebp - 0x42c]
push eax
call esi
lea ecx, [ebp - 0xc2c]
push ecx
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00411b0e
add esp, 0xc
test eax, eax
je 0x4189ba
push 0xffe
lea eax, [ebp - 0x1c2a]
push ebx
push eax
mov word [ebp - 0x1c2c], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc2c]
push eax
call esi
push eax
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0x1c2c]
push eax
call fcn.00403ac4
add esp, 0xc
cmp edi, ebx
je 0x418953
lea eax, [ebp - 0x1c2c]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x4189bd
push 0x9e
lea eax, [ebp - 0x2a]
push ebx
push eax
mov word [ebp - 0x2c], bx
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x1c2c]
push eax
call fcn.0040ab36
add esp, 0x10
mov esi, eax
cmp esi, ebx
push 0x50
lea eax, [ebp - 0x2c]
push eax
je 0x418988
push 0x2721
jmp 0x41898d
push 0x271d
push dword [0x423438]
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c2c]
push eax
push dword [0x423434]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
cmp esi, ebx
sete al
jmp 0x4189bd
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x4189c5
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x328
push ebx
push esi
push edi
push 0x2c
push 5
push dword [ebp + 0x7c]
lea eax, [ebp - 0xac]
push eax
call fcn.0040ad20
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x38]
xor eax, eax
cmp word [esi], 0x2a
push 0x206
sete al
xor ebx, ebx
push ebx
mov word [ebp - 0x2b4], bx
mov edi, eax
lea eax, [ebp - 0x2b2]
push eax
call sub.MSVCRT.dll_memset
add esp, 0x1c
cmp edi, ebx
je 0x418a4a
inc esi
inc esi
push esi
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push dword [ebp + 0x44]
call fcn.00403b00
push dword [ebp + 0x3c]
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.00418701
jmp 0x418aab
xor eax, eax
cmp word [esi], 0x26
sete al
mov edi, eax
cmp edi, ebx
je 0x418a5b
inc esi
inc esi
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x2b4]
push eax
call esi
push 0x9e
lea eax, [ebp - 0x6a]
push ebx
push eax
mov word [ebp - 0x6c], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0x40], ebx
je 0x418a91
push dword [ebp + 0x40]
lea eax, [ebp - 0x6c]
push eax
call esi
jmp 0x418a97
mov word [ebp - 0x6c], 0x2a
push edi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x3c]
lea eax, [ebp - 0x2b4]
push eax
call fcn.00418759
add esp, 0x10
cmp dword [ebp + 0x34], ebx
pop edi
pop esi
pop ebx
je 0x418ac0
push eax
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
xor eax, eax
add ebp, 0x74
leave
ret
Function at 0x41923e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x410
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
je 0x419342
cmp word [eax], bx
je 0x419342
push 0x3d
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x419342
push edi
mov word [esi], bx
push 0x5c
inc esi
push ebx
inc esi
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
je 0x419291
mov word [eax], bx
jmp 0x4192a5
push esi
call edi
cmp eax, 1
jbe 0x4192a5
cmp word [esi + 2], 0x3a
je 0x4192a5
mov esi, 0x402620
push esi
call fcn.0040ac04
mov esi, eax
mov dword [esp], 0x40e
lea eax, [ebp - 0x40e]
push ebx
push eax
mov word [ebp - 0x410], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
call edi
cmp eax, 1
jbe 0x4192da
cmp word [esi + 2], 0x3a
jne 0x4192e2
push esi
call edi
cmp eax, 2
jae 0x41930f
cmp esi, ebx
je 0x419308
cmp word [esi], bx
je 0x419308
push esi
push 0x423450
lea eax, [ebp - 0x410]
push 0x4025f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x41931d
push 0x423450
jmp 0x419310
push esi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x410]
push eax
call fcn.0040acda
pop ecx
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop edi
jmp 0x41934d
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret

Function at 0x419351
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x2b8
push esi
push edi
lea eax, [ebp + 0x64]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
xor edi, edi
push 0x9e
lea eax, [ebp - 0x3a]
push edi
push eax
mov word [ebp - 0x3c], di
call sub.MSVCRT.dll_memset
movzx eax, word [ebp + 0x70]
push eax
movzx eax, word [ebp + 0x6e]
push eax
movzx eax, word [ebp + 0x6c]
push eax
movzx eax, word [ebp + 0x68]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
movzx eax, word [ebp + 0x6a]
push eax
movzx eax, word [ebp + 0x66]
push eax
movzx eax, word [ebp + 0x64]
push eax
lea eax, [ebp - 0x3c]
push 0x4035bc
push eax
call esi
push 0x206
lea eax, [ebp - 0x242]
push edi
push eax
mov word [ebp - 0x244], di
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 0x7c]
add esp, 0x3c
cmp eax, edi
je 0x4193e9
cmp word [eax], di
je 0x4193e9
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
jmp 0x4193f9
lea eax, [ebp - 0x244]
push 0x4035ac
push eax
call esi
pop ecx
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add ebp, 0x74
leave
ret
Function at 0x419416
Capabilities:
Get disk information
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x4b0
push ebx
push esi
mov esi, dword [ebp + 0x7c]
xor ebx, ebx
cmp esi, ebx
je 0x419557
cmp word [esi], bx
je 0x419557
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0x3d
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x419557
mov word [eax], bx
add eax, 2
push edi
push eax
call fcn.0040ac04
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4194c3
cmp word [esi], bx
je 0x4194c3
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push esi
call edi
cmp eax, 1
jbe 0x419495
cmp word [esi + 2], 0x3a
jne 0x419495
push esi
call edi
cmp eax, 2
jbe 0x419545
mov word [esi + 4], bx
jmp 0x419545
push 0x9e
lea eax, [ebp - 0x2a]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov ax, word [0x423450]
mov word [ebp - 0x2c], ax
mov ax, word [0x423452]
add esp, 0xc
mov word [ebp - 0x2a], ax
lea esi, [ebp - 0x2c]
jmp 0x419545
push 0x206
lea eax, [ebp - 0x232]
push ebx
push eax
mov word [ebp - 0x234], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x43c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
cmp word [ebp - 0x43c], bx
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea esi, [ebp - 0x43c]
je 0x41952a
push esi
call edi
mov word [esi + eax*2 - 2], 0x7c
push esi
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push esi
call edi
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x419506
lea eax, [ebp - 0x234]
push eax
call edi
cmp eax, ebx
jbe 0x41953f
mov word [ebp + eax*2 - 0x236], bx
lea esi, [ebp - 0x234]
push esi
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
pop edi
jmp 0x41955a
xor eax, eax
inc eax
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x419561
Capabilities:
Set environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
xor edi, edi
cmp ebx, edi
je 0x4195ce
cmp word [ebx], di
je 0x4195ce
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0x3d
push ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, edi
je 0x4195ce
mov word [eax], di
add eax, 2
push esi
push eax
call fcn.0040ac04
mov esi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
pop ecx
push 0x5c
push edi
push eax
call esi
cmp eax, edi
je 0x4195b2
mov word [eax], di
add eax, 2
push eax
call fcn.0040ac04
pop ecx
push 0x2e
push edi
push eax
call esi
cmp eax, edi
pop esi
je 0x4195bf
inc eax
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x4195d1
xor eax, eax
inc eax
pop edi
pop ebx
ret
Function at 0x4195d4
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa0
push ebx
push esi
mov esi, dword [ebp + 0x7c]
test esi, esi
push edi
je 0x4196b7
cmp word [esi], 0
je 0x4196b7
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0x3d
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
call esi
mov ebx, eax
test ebx, ebx
je 0x4196b7
and word [ebx], 0
inc ebx
push 0x2c
inc ebx
push ebx
call esi
mov edi, eax
test edi, edi
je 0x4196b7
and word [edi], 0
inc edi
push 0x2c
inc edi
push edi
call esi
mov esi, eax
test esi, esi
je 0x4196b7
and word [esi], 0
push ebx
call fcn.00403b00
add esi, 2
push esi
mov ebx, eax
call fcn.0040ac04
push edi
mov esi, eax
call fcn.0040ac04
add esp, 0xc
test ebx, ebx
push eax
push esi
je 0x419668
call dword [sym.imp.SHLWAPI.dll_StrStrW]
jmp 0x41966e
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
xor edi, edi
test eax, eax
je 0x41967b
sub eax, esi
sar eax, 1
inc eax
mov edi, eax
and word [ebp - 0x2c], 0
push 0x9e
lea eax, [ebp - 0x2a]
push 0
push eax
call sub.MSVCRT.dll_memset
push edi
lea eax, [ebp - 0x2c]
push 0x4025ac
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x4196ba
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x4196c2
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa8
push ebx
push esi
mov esi, dword [ebp + 0x7c]
test esi, esi
push edi
je 0x4197df
cmp word [esi], 0
je 0x4197df
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0x3d
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
call esi
mov edi, eax
test edi, edi
je 0x4197df
and word [edi], 0
inc edi
push 0x2c
inc edi
push edi
call esi
mov ebx, eax
test ebx, ebx
je 0x4197df
and word [ebx], 0
and dword [ebp + 0x70], 0
inc ebx
push 0x2c
inc ebx
push ebx
call esi
test eax, eax
je 0x419794
and word [eax], 0
add eax, 2
push eax
call fcn.0040ac04
push ebx
mov esi, eax
call fcn.0040ac04
push eax
call fcn.00403b00
add esp, 0xc
test eax, eax
mov dword [ebp + 0x6c], eax
jge 0x419753
and dword [ebp + 0x6c], 0
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
test esi, esi
jle 0x419794
movzx eax, word [edi]
push eax
call fcn.00403ab0
pop ecx
xor edx, edx
xor ecx, ecx
test esi, esi
mov word [edi], ax
jle 0x419794
cmp word [ebx + ecx*2], ax
jne 0x4197d8
inc edx
cmp dword [ebp + 0x6c], 0
jle 0x4197d2
cmp edx, dword [ebp + 0x6c]
jne 0x4197d8
inc ecx
mov dword [ebp + 0x70], ecx
and word [ebp - 0x34], 0
push 0x9e
lea eax, [ebp - 0x32]
push 0
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 0x70]
lea eax, [ebp - 0x34]
push 0x4025ac
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x4197e2
lea edi, [ecx + 1]
mov dword [ebp + 0x70], edi
inc ecx
cmp ecx, esi
jl 0x41977e
jmp 0x419794
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x4197ea
Capabilities:
Set environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
xor ebp, ebp
cmp ebx, ebp
push esi
push edi
je 0x41986a
cmp word [ebx], bp
je 0x41986a
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x3d
push ebx
call edi
mov esi, eax
cmp esi, ebp
je 0x41986a
mov word [esi], bp
inc esi
push 0x2c
inc esi
push esi
call edi
cmp eax, ebp
je 0x419867
mov word [eax], bp
add eax, 2
push eax
call fcn.0040ac04
push esi
mov edi, eax
call fcn.0040ac04
push eax
call fcn.00403b00
add esp, 0xc
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp eax, esi
jl 0x419852
cmp esi, ebp
jne 0x419854
mov esi, eax
mov word [edi + esi*2], bp
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x41986d
push ebp
jmp 0x419859
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x419872
Capabilities:
Set environment variable

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
xor ebp, ebp
cmp esi, ebp
push edi
je 0x41994b
cmp word [esi], bp
je 0x41994b
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0x3d
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
call esi
mov ebx, eax
cmp ebx, ebp
je 0x41994b
mov word [ebx], bp
inc ebx
push 0x2c
inc ebx
push ebx
call esi
mov edi, eax
cmp edi, ebp
je 0x419948
mov word [edi], bp
inc edi
push 0x2c
inc edi
push edi
call esi
mov esi, eax
cmp esi, ebp
je 0x419948
push edi
mov word [esi], bp
call fcn.0040ac04
push eax
call fcn.00403b00
push ebx
mov ebp, eax
call fcn.0040ac04
push eax
call fcn.00403b00
add esi, 2
push esi
mov edi, eax
call fcn.0040ac04
add esp, 0x14
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
cmp edi, 1
jge 0x41990a
xor edi, edi
inc edi
cmp edi, eax
jle 0x419910
mov edi, eax
cmp ebp, eax
jg 0x419919
cmp ebp, 1
jge 0x41991b
mov ebp, eax
lea ecx, [edi + ebp - 1]
cmp ecx, eax
lea edx, [esi + edi*2 - 2]
jle 0x41992b
mov ecx, eax
jmp 0x419931
test ecx, ecx
jge 0x419931
xor ecx, ecx
and word [esi + ecx*2], 0
push edx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
inc eax
jmp 0x41994e
push ebp
jmp 0x419937
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x419953
Capabilities:
Set environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
cmp ebp, ebx
je 0x4199bb
cmp word [ebp], bx
je 0x4199bb
push 0x57
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0x3d
push ebp
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x4199bb
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x5c
mov word [eax], bx
push ebx
add eax, 2
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x4199a3
push 0x2e
inc esi
push ebx
inc esi
push esi
call edi
cmp eax, ebx
je 0x4199a3
mov word [eax], bx
push esi
call fcn.0040ac04
pop ecx
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
jmp 0x4199be
xor eax, eax
inc eax
pop ebp
pop ebx
ret