joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018d5
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416c26
jmp fcn.004019f4
push 0x416cb5
jmp fcn.004019f4
push 0x416cc5
jmp fcn.004019f4
push 0x416d0b
jmp fcn.004019f4
xor eax, eax
xor edx, edx
mov eax, dword [edi]
mov edx, dword [edi + 4]
cmp byte [edi + 0xd], 0
je 0x407b44
cmp edx, 0xffffffff
jne 0x407ac5
cmp eax, 0xffff8000
jb 0x407ac5
ret
test edx, edx
jne 0x407ac5
cmp eax, 0x10000
jae 0x407ac5
ret
mov eax, dword [edi]
mov edx, dword [edi + 4]
cmp byte [edi + 0xd], 0
je 0x407bb3
cmp edx, 0xffffffff
jne 0x407ac5
bt eax, 0x1f
jae 0x407ac5
ret
test edx, edx
jne 0x407ac5
ret
mov eax, dword [edi]
mov edx, dword [edi + 4]
cmp byte [edi + 0xd], 0
je 0x407c27
cmp edx, 0x80000000
jb 0x407ac5
ret
cmp byte [esi], 0x2e
je 0x4018d5
call fcn.00406bd8
mov eax, dword [edi + 0x10]
mov dword [0x417274], eax
mov al, byte [edi + 0xd]
mov byte [0x4172f2], al
mov al, byte [edi + 0xc]
mov byte [0x4172ee], al
cmp al, 6
je 0x407db7
cmp al, 5
je 0x407db7
ja 0x40198d
test al, 1
jne 0x40198d
or al, al
je 0x407e00
shl al, 5
jmp 0x407db9
mov al, 0x40
mov ah, byte [0x4172ea]
or byte [0x4172ea], al
shr al, 4
or ah, ah
je 0x407e00
cmp al, ah
je 0x407e00
cmp ax, 0x804
jne 0x4018a3
cmp byte [0x4172ee], 2
ja 0x407dea
mov byte [0x4172ee], 2
mov eax, dword [edi]
cdq
cmp edx, dword [edi + 4]
je 0x407e00
cmp dword [0x417228], 0
jne 0x407e00
call fcn.00407ac9
xor ebx, ebx
xor ecx, ecx
mov cl, byte [0x4172ee]
shl ecx, 0x10
mov ch, byte [0x4172ea]
cmp word [edi + 8], 0
je 0x407f2c
mov al, byte [edi + 8]
mov dl, byte [edi + 0xa]
call fcn.00407eb3
mov al, byte [edi + 9]
mov dl, byte [edi + 0xb]
call fcn.00407eb3
mov ax, bx
shr ah, 4
shr al, 4
or bh, bh
je 0x407e4d
or bl, bl
je 0x407e4d
cmp al, ah
jne 0x4018d5
or al, ah
mov ah, byte [0x4172ea]
and ah, 0xf
je 0x407e5e
cmp al, ah
jne 0x407e80
cmp al, 4
je 0x407ed1
cmp al, 8
je 0x407ed1
cmp al, 0xf
je 0x407e94
or cl, cl
je 0x407b2c
cmp cl, 1
je 0x407b2c
jmp 0x4018d5
cmp al, 0xf
jne 0x4018d5
mov al, bh
and al, 0xf
cmp al, ah
jne 0x4018d5
cmp bh, 0xf4
je 0x407b94
cmp bh, 0xf8
jne 0x4018d5
mov eax, dword [edi]
cdq
cmp edx, dword [edi + 4]
jne 0x407ac5
ret
or bh, bh
jne 0x407f65
cmp cl, 3
je 0x407f28
cmp cl, 5
je 0x407f28
cmp cl, 9
je 0x407f28
cmp cl, 2
jne 0x407fab
cmp bl, 0x45
jne 0x407f28
cmp byte [0x4172f8], 0x40
je 0x407f28
cmp byte [0x4172e4], 4
jne 0x407f28
cmp byte [0x4172ee], 0
jne 0x407fab
mov al, byte [edi]
cbw
cwde
cmp eax, dword [edi]
jne 0x407fab
cdq
cmp edx, dword [edi + 4]
jne 0x407f2c
mov bh, bl
dec cl
mov al, byte [0x4172ea]
and al, 0xf
cmp al, 2
je 0x407b2c
cmp al, 4
je 0x407b94
cmp al, 8
je 0x407c10
or al, al
jne 0x4018df
cmp byte [0x4172f8], 0x40
jne 0x407b94
jmp 0x407c10
cmp cl, 1
jne 0x407fab
cmp bl, 0x44
je 0x407f9b
cmp bl, 0x84
je 0x407f9b
cmp byte [0x4172f8], 0x40
je 0x407f9f
cmp bl, 0x45
jne 0x407f8d
cmp byte [0x4172e4], 3
je 0x407f9b
jmp 0x407f2c
cmp bh, 0x45
jne 0x407f2c
cmp byte [0x4172e4], 4
jne 0x407f2c
xchg bh, bl
jmp 0x407f2c
cmp bh, 0x45
je 0x407f9b
cmp bh, 0x85
je 0x407f9b
jmp 0x407f2c
test cl, 0xf0
jne 0x4018d5
mov al, cl
dec al
and al, cl
je 0x407f2c
jmp 0x4018d5
Function at 0x401ee8
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416b03
jmp fcn.00401542
mov edi, dword [0x417198]
call fcn.00401e21
mov esi, dword [0x417184]
call fcn.00401933
cmp edi, dword [0x41717c]
jae 0x4017ad
mov eax, edi
sub eax, ebx
dec eax
mov dword [ebx - 0x34], eax
mov eax, edi
sub eax, ebx
mov dword [ebx - 0x2c], eax
add eax, 0x40
mov dword [ebx - 0x20], eax
call fcn.00401e42
sub esi, dword [0x417170]
mov dword [ebx - 0x1c], esi
mov edx, dword [0x41718c]
call fcn.004013a4
jb 0x4017cb
mov edx, dword [0x417198]
mov ecx, dword [edx + 0x14]
add ecx, 0x40
call fcn.004013c3
jb 0x4017cb
mov edx, dword [0x417170]
mov ecx, esi
call fcn.004013c3
jb 0x4017cb
call fcn.004013f9
ret

Function at 0x401f6e
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416a85
jmp fcn.00401542
push 0x416b5e
jmp fcn.004019f4
mov edi, 0x417301
xor al, al
stosb byte es:[edi], al
inc al
jne 0x401f75
mov esi, 0x417362
mov edi, 0x417342
mov ecx, 0x1a
rep movsb byte es:[edi], byte [esi]
mov edi, 0x417301
mov esi, 0x412a4f
movzx ecx, byte [esi - 1]
xor eax, eax
lodsb al, byte [esi]
mov byte [edi + eax], 0
loop 0x401f9b
mov edi, 0x4171dc
mov ax, 0x3001
stosw word es:[edi], ax
mov edi, dword [0x417170]
mov dword [0x417194], edi
mov esi, 0x412a46
call fcn.00401356
xor al, al
stosb byte es:[edi], al
mov dword [0x417170], edi
mov eax, dword [0x417178]
mov dword [0x417198], eax
mov eax, dword [0x41717c]
mov dword [0x4171f0], eax
xor eax, eax
mov dword [0x41719c], eax
mov dword [0x417230], eax
mov dword [0x4171fc], eax
mov dword [0x41722c], eax
mov byte [0x417300], al
mov byte [0x4172fc], al
mov esi, dword [0x417184]
mov edx, esi
call fcn.00401383
jb 0x4017c1
mov edi, dword [0x417170]
call fcn.0040203c
mov eax, dword [0x417228]
mov dword [0x4171b4], eax
cmp byte [0x4172fc], 0
jne 0x401849
mov dword [0x41719c], edi
ret

Function at 0x40203c
Capabilities:
Query environment variable
Terminate process

Disassembly:
push dword [0x417174]
push esi
mov al, 2
xor edx, edx
call fcn.00401401
push eax
xor al, al
xor edx, edx
call fcn.00401401
pop ecx
mov edx, dword [0x417174]
dec edx
mov byte [edx], 0x1a
sub edx, ecx
jb 0x4017ad
mov esi, edx
cmp edx, edi
jbe 0x4017ad
mov dword [0x417174], edx
call fcn.004013d9
call fcn.004013f9
pop edx
xor ecx, ecx
mov ebx, esi
inc ecx
mov dword [0x4171b4], edi
mov eax, edx
stosd dword es:[edi], eax
mov eax, ecx
stosd dword es:[edi], eax
mov eax, esi
sub eax, ebx
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
push ebx
push edx
call fcn.004020bf
call fcn.00402361
pop edx
pop ebx
cmp byte [esi - 1], 0
je 0x4020b7
cmp byte [esi - 1], 0x1a
jne 0x402088
pop dword [0x417174]
clc
ret
Function at 0x4020bf
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416a9b
jmp 0x4017e8
push 0x416d21
jmp fcn.004019f4
push 0x416d70
jmp fcn.004019f4
push ecx
test byte [0x4172fc], 0xf
je 0x4020cf
mov ax, 0x3b
stosw word es:[edi], ax
cmp edi, dword [0x417174]
jae 0x4017ad
lodsb al, byte [esi]
cmp al, 0x20
je 0x4020cf
cmp al, 9
je 0x4020cf
mov ah, al
mov ebx, 0x417301
xlatb
or al, al
je 0x402131
cmp ah, 0x27
je 0x40218b
cmp ah, 0x22
je 0x40218b
mov byte [edi], 0x1a
scasw ax, word es:[edi]
xchg ah, al
stosb byte es:[edi], al
mov ebx, 0x417301
xor ecx, ecx
lodsb al, byte [esi]
stosb byte es:[edi], al
xlatb
or al, al
loopne 0x402111
neg ecx
cmp ecx, 0xff
ja 0x401994
mov ebx, edi
sub ebx, ecx
mov byte [ebx - 2], cl
dec edi
mov ah, byte [esi - 1]
xchg ah, al
cmp al, 0x20
jb 0x40214c
je 0x4020cf
cmp al, 0x3b
je 0x4022e6
cmp al, 0x5c
je 0x4021ca
stosb byte es:[edi], al
jmp 0x4020cf
cmp al, 0x1a
je 0x4022ff
cmp al, 0xd
je 0x40217c
cmp al, 0xa
je 0x40216d
cmp al, 9
je 0x4020cf
or al, al
jne 0x402139
jmp 0x4022ff
lodsb al, byte [esi]
cmp al, 0xd
je 0x4022ff
dec esi
jmp 0x4022ff
lodsb al, byte [esi]
cmp al, 0xa
je 0x4022ff
dec esi
jmp 0x4022ff
mov al, 0x22
stosb byte es:[edi], al
scasd eax, dword es:[edi]
mov ebx, edi
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp al, 0xa
je 0x4019b0
cmp al, 0xd
je 0x4019b0
or al, al
je 0x4019b0
cmp al, 0x1a
je 0x4019b0
cmp al, ah
jne 0x402191
lodsb al, byte [esi]
cmp al, ah
je 0x402191
dec esi
dec edi
mov eax, edi
sub eax, ebx
mov dword [ebx - 4], eax
jmp 0x4020cf
mov byte [edi], 0
lodsb al, byte [esi]
cmp al, 0x20
je 0x402291
cmp al, 9
je 0x402291
cmp al, 0x1a
je 0x4017d5
or al, al
je 0x4017d5
cmp al, 0xa
je 0x4022d0
cmp al, 0xd
je 0x4022d8
cmp al, 0x3b
je 0x4022ba
mov al, 0x1a
stosb byte es:[edi], al
mov ecx, edi
mov ax, 0x5c01
stosw word es:[edi], ax
dec esi
lodsb al, byte [esi]
cmp al, 0x5c
jne 0x40221c
stosb byte es:[edi], al
inc byte [ecx]
jmp 0x402212
cmp al, 0x1a
je 0x4017d5
or al, al
je 0x4017d5
cmp al, 0xa
je 0x4019c5
cmp al, 0xd
je 0x4019c5
cmp al, 0x20
je 0x4019c5
cmp al, 9
je 0x4019c5
cmp al, 0x22
je 0x4019c5
cmp al, 0x27
je 0x4019c5
cmp al, 0x3b
je 0x4019c5
mov ah, al
mov ebx, 0x417301
xlatb
or al, al
je 0x402287
mov al, ah
stosb byte es:[edi], al
xlatb
or al, al
je 0x40212d
inc byte [ecx]
je 0x401994
lodsb al, byte [esi]
jmp 0x402272
mov al, ah
stosb byte es:[edi], al
inc byte [ecx]
jmp 0x4020cf
lodsb al, byte [esi]
cmp al, 0x20
je 0x402291
cmp al, 9
je 0x402291
cmp al, 0x1a
je 0x4017d5
or al, al
je 0x4017d5
cmp al, 0xa
je 0x4022d0
cmp al, 0xd
je 0x4022d8
cmp al, 0x3b
jne 0x4019c5
lodsb al, byte [esi]
cmp al, 0xa
je 0x4022d0
cmp al, 0xd
je 0x4022d8
or al, al
je 0x4022de
cmp al, 0x1a
jne 0x4022ba
jmp 0x4017d5
lodsb al, byte [esi]
cmp al, 0xd
je 0x4022de
dec esi
jmp 0x4022de
lodsb al, byte [esi]
cmp al, 0xa
je 0x4022de
dec esi
inc dword [esp]
jmp 0x4020cf
lodsb al, byte [esi]
cmp al, 0xa
je 0x40216d
cmp al, 0xd
je 0x40217c
or al, al
je 0x4022ff
cmp al, 0x1a
jne 0x4022e6
xor al, al
stosb byte es:[edi], al
pop ecx
ret
Function at 0x402642
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ebx, ebx
mov eax, 0x811c9dc5
mov ebp, 0x1000193
xor al, byte [esi + ebx]
mul ebp
inc bl
cmp bl, cl
jb 0x40264e
ret

Function at 0x40265a
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416d3c
jmp fcn.004019f4
push edi
push esi
cmp ch, 3
je 0x402676
push ecx
movzx ecx, cl
mov edi, 0x412a6a
call fcn.00402314
jae 0x4019a2
pop ecx
call fcn.00402642
mov ebp, eax
and ebp, 0x3ff
shr eax, 0xa
xor ebp, eax
shl ecx, 0x16
or ebp, ecx
mov ebx, 0x4171fc
mov ecx, 0x20
mov edx, dword [ebx]
or edx, edx
je 0x4026f5
xor eax, eax
rol ebp, 1
adc eax, 0
lea ebx, [edx + eax*4]
dec ecx
jne 0x402697
mov edx, dword [ebx]
or edx, edx
je 0x4026ce
shr ebp, 0x1e
cmp ebp, 3
je 0x4026ef
cmp dword [edx + 4], 0
jne 0x4026ce
mov edi, dword [edx]
or edi, edi
je 0x4026ef
cmp dword [edi + 4], 0
jne 0x4026ef
mov edx, edi
jmp 0x4026be
mov eax, edx
mov edx, dword [0x4171f0]
sub edx, 0x10
cmp edx, dword [0x417198]
jb 0x4017ad
mov dword [0x4171f0], edx
mov dword [edx], eax
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret
mov edx, dword [0x4171f0]
sub edx, 8
cmp edx, dword [0x417198]
jb 0x4017ad
mov dword [0x4171f0], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
shl ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
dec ecx
jne 0x4026f5
mov edx, dword [0x4171f0]
sub edx, 0x10
cmp edx, dword [0x417198]
jb 0x4017ad
mov dword [0x4171f0], edx
mov dword [edx], 0
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret

Function at 0x402869
Capabilities:
Query environment variable
Terminate process

Disassembly:
cmp byte [esi], 0x3c
jne 0x4028ca
mov ecx, 1
inc esi
lodsb al, byte [esi]
or al, al
je 0x40183f
cmp al, 0x1a
je 0x402890
cmp al, 0x22
je 0x402898
cmp al, 0x3e
je 0x40289d
cmp al, 0x3c
jne 0x402874
inc ecx
jmp 0x402874
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x402874
lodsd eax, dword [esi]
add esi, eax
jmp 0x402874
loop 0x402874
lodsb al, byte [esi]
or al, al
je 0x4028fd
cmp al, 0x2c
je 0x4028fd
cmp byte [0x4172fd], 0
je 0x40183f
cmp al, 0x7b
je 0x4028fd
or ebp, ebp
je 0x40183f
cmp al, 0x5d
je 0x4028fd
jmp 0x40183f
lodsb al, byte [esi]
or al, al
je 0x4028fd
cmp al, 0x2c
je 0x4028fd
cmp al, 0x22
je 0x4028f8
cmp al, 0x1a
je 0x4028f0
cmp byte [0x4172fd], 0
je 0x4028ca
cmp al, 0x7b
je 0x4028fd
or ebp, ebp
je 0x4028ca
cmp al, 0x5d
je 0x4028fd
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x4028ca
lodsd eax, dword [esi]
add esi, eax
jmp 0x4028ca
dec esi
ret

Function at 0x402a27
Capabilities:
Query environment variable
Terminate process

Disassembly:
lodsb al, byte [esi]
or al, al
je 0x40183f
cmp al, 0x2c
je 0x402a5a
cmp al, 0x22
je 0x402a55
cmp al, 0x1a
je 0x402a4d
cmp al, 0x3d
jne fcn.00402a27
mov al, byte [esi]
cmp al, 0x1a
je fcn.00402a27
cmp al, 0x22
je fcn.00402a27
inc esi
jmp fcn.00402a27
lodsb al, byte [esi]
movzx eax, al
add esi, eax
jmp fcn.00402a27
lodsd eax, dword [esi]
add esi, eax
jmp fcn.00402a27
ret
Function at 0x402b17
Capabilities:
Query environment variable
Terminate process

Disassembly:
lea eax, [edi + ecx]
cmp eax, dword [0x417174]
jae 0x4017ad
shr ecx, 1
jae 0x402b2b
movsb byte es:[edi], byte [esi]
shr ecx, 1
jae 0x402b31
movsw word es:[edi], word [esi]
rep movsd dword es:[edi], dword [esi]
ret
Function at 0x402b8e
Capabilities:
Query environment variable
Terminate process

Disassembly:
xor dl, dl
mov ebp, edi
mov edi, esi
lodsb al, byte [esi]
cmp al, 0x60
je 0x402c0b
cmp al, 0x23
je 0x402c88
cmp al, 0x1a
je 0x402bb9
cmp al, 0x3b
je 0x402bb6
cmp al, 0x22
je 0x402bce
xor dl, dl
or al, al
jne 0x402b92
mov edi, esi
ret
mov edi, ebp
ret
mov dl, 0x1a
mov ebx, esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x402bca
mov edi, esi
cmp byte [esi], 0x5c
je 0x402bd7
add esi, ecx
jmp 0x402b92
mov dl, 0x22
mov ebx, esi
lodsd eax, dword [esi]
add esi, eax
jmp 0x402b92
dec byte [edi - 1]
dec ecx
inc esi
cmp ecx, 1
rep movsb byte es:[edi], byte [esi]
jne 0x402d10
mov al, byte [esi - 1]
mov ecx, ebx
mov ebx, 0x417301
xlatb
mov ebx, ecx
or al, al
jne 0x402d10
sub edi, 3
mov al, byte [esi - 1]
stosb byte es:[edi], al
xor dl, dl
jmp 0x402d10
inc esi
mov edx, esi
mov al, byte [esi]
cmp al, 0x1a
jne 0x402c27
lodsw ax, word [esi]
movzx ecx, ah
lea ebx, [edi + 3]
jecxz 0x402c41
cmp byte [esi], 0x5c
jne 0x402c41
inc esi
dec ecx
dec ebx
jmp 0x402c41
cmp al, 0x22
je 0x402d10
cmp al, 0x60
je 0x402c0a
lea ebx, [edi + 5]
xor ecx, ecx
or al, al
je 0x402c41
cmp al, 0x23
je 0x402c41
inc ecx
sub ebx, edx
ja 0x402c5e
mov al, 0x22
mov dl, al
stosb byte es:[edi], al
mov ebx, edi
mov eax, ecx
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
cmp edi, esi
je 0x402b92
jmp 0x402d10
push ecx
mov edx, esi
lea esi, [ebp - 1]
add ebp, ebx
lea edi, [ebp - 1]
lea ecx, [esi + 1]
sub ecx, edx
std
rep movsb byte es:[edi], byte [esi]
cld
pop eax
sub edi, 3
mov dl, 0x22
mov byte [edi - 1], dl
mov ebx, edi
mov dword [edi], eax
lea esi, [edi + eax + 4]
jmp 0x402b92
cmp dl, 0x1a
je 0x402c9c
cmp dl, 0x22
je 0x402cce
cmp esi, edi
je 0x402b92
jmp 0x402d10
cmp byte [esi], 0x1a
jne 0x402c92
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x402cad
cmp byte [esi], 0x5c
je 0x402cb9
add byte [ebx], cl
jb 0x401994
rep movsb byte es:[edi], byte [esi]
jmp 0x402d10
inc esi
dec ecx
je 0x402cad
movzx eax, byte [esi]
cmp byte [eax + 0x417301], 0
jne 0x402cad
sub esi, 3
jmp 0x402c92
cmp byte [esi], 0x22
je 0x402d08
cmp byte [esi], 0x60
jne 0x402c92
inc esi
mov al, byte [esi]
cmp al, 0x60
je 0x402cd8
cmp al, 0x22
je 0x402d08
cmp al, 0x1a
jne 0x402cfb
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x402cf5
cmp byte [esi], 0x5c
jne 0x402cf5
inc esi
dec ecx
add dword [ebx], ecx
rep movsb byte es:[edi], byte [esi]
jmp 0x402d10
or al, al
je 0x402d10
cmp al, 0x23
je 0x402d10
inc dword [ebx]
movsb byte es:[edi], byte [esi]
jmp 0x402d10
inc esi
lodsd eax, dword [esi]
mov ecx, eax
add dword [ebx], eax
rep movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
cmp al, 0x60
je 0x402c0b
cmp al, 0x23
je 0x402c88
stosb byte es:[edi], al
cmp al, 0x1a
je 0x402d39
cmp al, 0x3b
je 0x402bb6
cmp al, 0x22
je 0x402d51
xor dl, dl
or al, al
jne 0x402d10
ret
mov dl, 0x1a
mov ebx, edi
lodsb al, byte [esi]
stosb byte es:[edi], al
movzx ecx, al
jecxz 0x402d4d
cmp byte [esi], 0x5c
je 0x402bd7
rep movsb byte es:[edi], byte [esi]
jmp 0x402d10
mov dl, 0x22
mov ebx, edi
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x402d10
Function at 0x402ded
Capabilities:
Query environment variable
Terminate process

Disassembly:
lodsb al, byte [esi]
movzx ecx, al
mov eax, dword [0x417220]
call fcn.00403829
add esi, ecx
xchg ebx, esi
mov dword [edx + 0xc], esi
mov byte [0x4172fd], 0
call fcn.00402869
call fcn.00402e2b
xchg ebx, esi
cmp byte [esi], 0x3d
je 0x402e47
cmp byte [esi], 0x2a
jne 0x402e2a
cmp dword [edx + 8], 0
je 0x40183f
inc esi
ret
inc esi
push esi
or byte [0x4172fd], 0xff
call fcn.00402869
pop eax
cmp dword [edx + 8], 0
jne 0x402e2a
mov dword [edx + 0xc], eax
call fcn.00402e2b
jmp 0x402e2a

Function at 0x402fb3
Capabilities:
Query environment variable
Terminate process

Disassembly:
push edi
call fcn.004048e7
mov al, 0x29
stosb byte es:[edi], al
push esi
mov esi, dword [esp + 4]
mov dword [0x417228], 0
mov byte [0x4172e9], 0
call fcn.00406bd8
cmp dword [0x417228], 0
je 0x402fe6
jmp dword [0x41722c]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cdq
cmp edx, ecx
jne 0x4018e9
cmp dl, byte [edi + 0xd]
jne 0x4018e9
pop esi
pop edi
ret
Function at 0x403829
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebx
push ebp
call fcn.00403802
jb 0x403859
mov eax, dword [ebx]
mov edx, dword [0x417198]
add edx, 0x10
cmp edx, dword [0x4171f0]
ja 0x4017ad
xchg dword [0x417198], edx
mov dword [ebx], edx
mov dword [edx], eax
mov dword [edx + 4], esi
pop ebp
pop ebx
ret
mov edx, dword [0x417198]
add edx, 0x10
cmp edx, dword [0x4171f0]
ja 0x4017ad
xchg dword [0x417198], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
shr ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
or ebp, ebp
jne 0x403859
add ebx, 8
xor eax, eax
jmp 0x403834
Function at 0x403f4f
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov dword [0x4172c4], 0
Function at 0x404979
Capabilities:
Query environment variable
Terminate process

Disassembly:
lea eax, [edi - 0x10]
mov edx, dword [0x417174]
cmp dword [0x41719c], 0
je 0x404991
mov edx, dword [0x4171f0]
cmp eax, edx
jae 0x4017ad
mov eax, esp
sub eax, 0x100
jb 0x4017b7
cmp eax, dword [0x417180]
jb 0x4017b7
cmp byte [esi], 0x28
je 0x4049f6
inc edi
call fcn.00404a9d
jb 0x404a12
or ebp, ebp
je 0x4049c8
mov byte [edi - 1], 0xf
ret
cmp dword [edi + 4], 0
jne 0x4049e1
cmp word [edi + 2], 0
jne 0x4049e9
cmp byte [edi + 1], 0
jne 0x4049ef
mov byte [edi - 1], 1
inc edi
ret
mov byte [edi - 1], 8
add edi, 8
ret
mov byte [edi - 1], 4
scasd eax, dword es:[edi]
ret
mov byte [edi - 1], 2
scasw ax, word es:[edi]
ret
inc esi
push dword [0x41723c]
call fcn.004048e7
pop dword [0x41723c]
lodsb al, byte [esi]
cmp al, 0x29
jne 0x4018cb
ret
cmp dword [0x41719c], 0
je 0x404a5f
push edi
mov edi, 0x412b7b
call fcn.0040449f
or al, al
jne 0x404a58
mov edi, 0x412b2c
call fcn.0040449f
pop edi
or al, al
jne 0x404a51
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x4018df
lodsb al, byte [esi]
movzx ecx, al
call fcn.00404607
mov byte [edi - 1], 0x11
stosd dword es:[edi], eax
ret
mov eax, 0xf
jmp 0x404a4b
pop edi
mov byte [edi - 1], 0x10
stosb byte es:[edi], al
ret
dec edi
cmp dword [0x4171fc], 0
je 0x4018df
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x4018df
lodsb al, byte [esi]
mov cl, al
mov ch, 2
call fcn.004025c3
jb 0x4018df
push esi
mov esi, dword [edx + 8]
push dword [0x41723c]
call fcn.004048e7
pop dword [0x41723c]
pop esi
ret
Function at 0x404f78
Capabilities:
Query environment variable
Terminate process

Disassembly:
or ecx, ecx
je 0x405100
mov eax, dword [edi + 0xc]
mul ecx
mov dword [edi + 0xc], eax
mov ebx, edx
mov eax, dword [edi]
mul ecx
add eax, ebx
adc edx, 0
mov dword [edi], eax
mov ebx, edx
mov eax, dword [edi + 4]
mul ecx
add eax, ebx
adc edx, 0
mov dword [edi + 4], eax
or edx, edx
je 0x404fd1
mov eax, dword [edi]
shrd dword [edi + 0xc], eax, 1
mov eax, dword [edi + 4]
shrd dword [edi], eax, 1
shrd eax, edx, 1
mov dword [edi + 4], eax
shr edx, 1
inc dword [edi + 8]
cmp dword [edi + 8], 0x8000
jge 0x4018e9
jmp 0x404fa4
ret
Function at 0x4053e7
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416ab2
jmp 0x4017e8
cmp byte [0x417300], 0
jne 0x401808
cmp dword [0x41718c], 0
je fcn.00401542
call fcn.00401ee8
jmp fcn.00401542
xor eax, eax
mov dword [0x417290], eax
mov word [0x417192], ax
mov dword [0x417280], eax
mov dword [0x41728c], eax
mov dword [0x4172b4], eax
mov eax, dword [0x4171f0]
mov dword [0x417230], eax
mov eax, dword [0x417178]
mov dword [0x417198], eax
mov eax, dword [0x41717c]
mov dword [0x417234], eax
mov esi, dword [0x41719c]
mov edi, dword [0x4171a0]
xor eax, eax
mov dword [0x417268], eax
mov dword [0x41726c], eax
mov dword [0x417200], edi
mov dword [0x417204], eax
mov dword [0x417210], edi
mov dword [0x417208], eax
mov dword [0x41720c], eax
mov dword [0x417228], eax
mov dword [0x41721c], eax
mov dword [0x41727c], eax
mov dword [0x417288], eax
mov dword [0x417218], eax
mov dword [0x4172d4], eax
mov byte [0x4172f5], al
mov byte [0x4172f6], al
mov byte [0x4172fa], al
mov byte [0x4172fb], al
mov byte [0x4172f7], al
mov byte [0x4172f9], al
mov byte [0x417300], al
mov byte [0x4172f8], 0x10
call fcn.004055e7
jae 0x40549c
mov eax, dword [0x41717c]
cmp eax, dword [0x417234]
je 0x4054c0
sub eax, 0x20
mov eax, dword [eax + 4]
mov dword [0x4171b4], eax
jmp 0x4019b7
call fcn.00408af8
mov eax, dword [0x4171f0]
cmp eax, dword [0x417174]
jae 0x405582
test byte [eax + 8], 8
je 0x405504
mov cx, word [0x417192]
cmp cx, word [eax + 0x12]
jne 0x405504
test byte [eax + 8], 1
je 0x405504
sub cx, word [eax + 0x10]
cmp cx, 1
jne 0x405504
and byte [eax + 8], 0xfe
or byte [0x4172f5], 0xff
test byte [eax + 8], 0x10
je 0x40553c
mov cx, word [0x417192]
and byte [eax + 8], 0xef
test byte [eax + 8], 0x20
jne 0x405529
cmp cx, word [eax + 0x12]
jne 0x40553c
test byte [eax + 8], 8
je 0x40553c
jmp 0x405535
test byte [eax + 8], 8
je 0x405535
cmp cx, word [eax + 0x12]
je 0x40553c
or byte [0x4172f5], 0xff
test byte [eax + 8], 0x40
je 0x40557a
and byte [eax + 8], 0xbf
test byte [eax + 8], 4
jne 0x405573
mov cx, word [0x417192]
test byte [eax + 8], 0x80
jne 0x405567
cmp cx, word [eax + 0x10]
jne 0x40557a
test byte [eax + 8], 1
je 0x40557a
jmp 0x405573
test byte [eax + 8], 1
je 0x405573
cmp cx, word [eax + 0x10]
je 0x40557a
or byte [0x4172f5], 0xff
add eax, 0x20
jmp 0x4054ca
cmp byte [0x4172f5], 0
jne 0x4055c7
mov eax, dword [0x417228]
or eax, eax
je 0x4055e6
mov dword [0x4171b4], eax
cmp dword [0x41722c], 0x4018f3
jne 0x4055b4
mov eax, dword [0x417224]
or eax, eax
je 0x4055b4
test byte [eax + 8], 1
jne 0x4055c7
call 0x4055b9
mov eax, dword [0x41722c]
sub eax, 0x4055b9
add dword [esp], eax
ret
inc word [0x417192]
mov ax, word [0x417192]
cmp ax, word [0x417190]
je 0x4017dc
jmp 0x405403
ret