joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ab6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ebx, ebx
mov eax, 0x811c9dc5
mov ebp, 0x1000193
xor al, byte [esi + ebx]
mul ebp
inc bl
cmp bl, cl
jb 0x417ac2
ret

Function at 0x417ace
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push edi
push esi
xor eax, eax
or cl, cl
je 0x417af5
cmp ch, 3
je 0x417af0
push ecx
movzx ecx, cl
mov edi, 0x42a661
call fcn.00417730
jae 0x416c0a
pop ecx
call fcn.00417ab6
mov ebp, eax
and ebp, 0x3ff
shr eax, 0xa
xor ebp, eax
shl ecx, 0x16
or ebp, ecx
mov ebx, 0x431094
mov ecx, 0x20
mov edx, dword [ebx]
or edx, edx
je 0x417b6f
xor eax, eax
rol ebp, 1
adc eax, 0
lea ebx, [edx + eax*4]
dec ecx
jne 0x417b11
mov edx, dword [ebx]
or edx, edx
je 0x417b48
shr ebp, 0x1e
cmp ebp, 3
je 0x417b69
cmp dword [edx + 4], 0
jne 0x417b48
mov edi, dword [edx]
or edi, edi
je 0x417b69
cmp dword [edi + 4], 0
jne 0x417b69
mov edx, edi
jmp 0x417b38
mov eax, edx
mov edx, dword [0x431088]
sub edx, 0x10
cmp edx, dword [0x43102c]
jb 0x416a37
mov dword [0x431088], edx
mov dword [edx], eax
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret
mov edx, dword [0x431088]
sub edx, 8
cmp edx, dword [0x43102c]
jb 0x416a37
mov dword [0x431088], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
shl ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
dec ecx
jne 0x417b6f
mov edx, dword [0x431088]
sub edx, 0x10
cmp edx, dword [0x43102c]
jb 0x416a37
mov dword [0x431088], edx
mov dword [edx], 0
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret

Function at 0x417ceb
Capabilities:
Query environment variable
Read .ini file

Disassembly:
cmp byte [esi], 0x3c
jne 0x417d50
mov ecx, 1
inc esi
lodsb al, byte [esi]
or al, al
je 0x416aa7
cmp al, 0x1a
je 0x417d12
cmp al, 0x22
je 0x417d1a
cmp al, 0x3e
je 0x417d1f
cmp al, 0x3c
jne 0x417cf6
inc ecx
jmp 0x417cf6
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x417cf6
lodsd eax, dword [esi]
add esi, eax
jmp 0x417cf6
loop 0x417cf6
lodsb al, byte [esi]
or al, al
je 0x417d87
cmp al, 0x2c
je 0x417d87
cmp byte [0x431196], 0
je 0x416aa7
cmp al, 0x7b
je 0x417d87
cmp al, 0x26
je 0x417d87
or ebp, ebp
je 0x416aa7
cmp al, 0x5d
je 0x417d87
jmp 0x416aa7
lodsb al, byte [esi]
or al, al
je 0x417d87
cmp al, 0x2c
je 0x417d87
cmp al, 0x22
je 0x417d82
cmp al, 0x1a
je 0x417d7a
cmp byte [0x431196], 0
je 0x417d50
cmp al, 0x7b
je 0x417d87
cmp al, 0x26
je 0x417d87
or ebp, ebp
je 0x417d50
cmp al, 0x5d
je 0x417d87
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x417d50
lodsd eax, dword [esi]
add esi, eax
jmp 0x417d50
dec esi
ret

Function at 0x417ef9
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lodsb al, byte [esi]
or al, al
je 0x416aa7
cmp al, 0x2c
je 0x417f2c
cmp al, 0x22
je 0x417f27
cmp al, 0x1a
je 0x417f1f
cmp al, 0x3d
jne fcn.00417ef9
mov al, byte [esi]
cmp al, 0x1a
je fcn.00417ef9
cmp al, 0x22
je fcn.00417ef9
inc esi
jmp fcn.00417ef9
lodsb al, byte [esi]
movzx eax, al
add esi, eax
jmp fcn.00417ef9
lodsd eax, dword [esi]
add esi, eax
jmp fcn.00417ef9
ret
Function at 0x417ff5
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lea eax, [edi + ecx]
cmp eax, dword [0x431004]
jae 0x416a37
shr ecx, 1
jae 0x418009
movsb byte es:[edi], byte [esi]
shr ecx, 1
jae 0x41800f
movsw word es:[edi], word [esi]
rep movsd dword es:[edi], dword [esi]
ret
Function at 0x4180eb
Capabilities:
Query environment variable
Read .ini file

Disassembly:
xor dl, dl
mov ebp, edi
mov edi, esi
lodsb al, byte [esi]
cmp al, 0x60
je 0x418168
cmp al, 0x23
je 0x4181e5
cmp al, 0x1a
je 0x418116
cmp al, 0x3b
je 0x418113
cmp al, 0x22
je 0x41812b
xor dl, dl
or al, al
jne 0x4180ef
mov edi, esi
ret
mov edi, ebp
ret
mov dl, 0x1a
mov ebx, esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x418127
mov edi, esi
cmp byte [esi], 0x5c
je 0x418134
add esi, ecx
jmp 0x4180ef
mov dl, 0x22
mov ebx, esi
lodsd eax, dword [esi]
add esi, eax
jmp 0x4180ef
dec byte [edi - 1]
dec ecx
inc esi
cmp ecx, 1
rep movsb byte es:[edi], byte [esi]
jne 0x41826d
mov al, byte [esi - 1]
mov ecx, ebx
mov ebx, 0x43119b
xlatb
mov ebx, ecx
or al, al
jne 0x41826d
sub edi, 3
mov al, byte [esi - 1]
stosb byte es:[edi], al
xor dl, dl
jmp 0x41826d
inc esi
mov edx, esi
mov al, byte [esi]
cmp al, 0x1a
jne 0x418184
lodsw ax, word [esi]
movzx ecx, ah
lea ebx, [edi + 3]
jecxz 0x41819e
cmp byte [esi], 0x5c
jne 0x41819e
inc esi
dec ecx
dec ebx
jmp 0x41819e
cmp al, 0x22
je 0x41826d
cmp al, 0x60
je 0x418167
lea ebx, [edi + 5]
xor ecx, ecx
or al, al
je 0x41819e
cmp al, 0x23
je 0x41819e
inc ecx
sub ebx, edx
ja 0x4181bb
mov al, 0x22
mov dl, al
stosb byte es:[edi], al
mov ebx, edi
mov eax, ecx
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
cmp edi, esi
je 0x4180ef
jmp 0x41826d
push ecx
mov edx, esi
lea esi, [ebp - 1]
add ebp, ebx
lea edi, [ebp - 1]
lea ecx, [esi + 1]
sub ecx, edx
std
rep movsb byte es:[edi], byte [esi]
cld
pop eax
sub edi, 3
mov dl, 0x22
mov byte [edi - 1], dl
mov ebx, edi
mov dword [edi], eax
lea esi, [edi + eax + 4]
jmp 0x4180ef
cmp dl, 0x1a
je 0x4181f9
cmp dl, 0x22
je 0x41822b
cmp esi, edi
je 0x4180ef
jmp 0x41826d
cmp byte [esi], 0x1a
jne 0x4181ef
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x41820a
cmp byte [esi], 0x5c
je 0x418216
add byte [ebx], cl
jb 0x416bfc
rep movsb byte es:[edi], byte [esi]
jmp 0x41826d
inc esi
dec ecx
je 0x41820a
movzx eax, byte [esi]
cmp byte [eax + 0x43119b], 0
jne 0x41820a
sub esi, 3
jmp 0x4181ef
cmp byte [esi], 0x22
je 0x418265
cmp byte [esi], 0x60
jne 0x4181ef
inc esi
mov al, byte [esi]
cmp al, 0x60
je 0x418235
cmp al, 0x22
je 0x418265
cmp al, 0x1a
jne 0x418258
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x418252
cmp byte [esi], 0x5c
jne 0x418252
inc esi
dec ecx
add dword [ebx], ecx
rep movsb byte es:[edi], byte [esi]
jmp 0x41826d
or al, al
je 0x41826d
cmp al, 0x23
je 0x41826d
inc dword [ebx]
movsb byte es:[edi], byte [esi]
jmp 0x41826d
inc esi
lodsd eax, dword [esi]
mov ecx, eax
add dword [ebx], eax
rep movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
cmp al, 0x60
je 0x418168
cmp al, 0x23
je 0x4181e5
stosb byte es:[edi], al
cmp al, 0x1a
je 0x418296
cmp al, 0x3b
je 0x418113
cmp al, 0x22
je 0x4182ae
xor dl, dl
or al, al
jne 0x41826d
ret
mov dl, 0x1a
mov ebx, edi
lodsb al, byte [esi]
stosb byte es:[edi], al
movzx ecx, al
jecxz 0x4182aa
cmp byte [esi], 0x5c
je 0x418134
rep movsb byte es:[edi], byte [esi]
jmp 0x41826d
mov dl, 0x22
mov ebx, edi
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x41826d
Function at 0x418352
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lodsb al, byte [esi]
movzx ecx, al
mov eax, dword [0x4310a8]
call fcn.00418eab
add esi, ecx
xor eax, eax
mov dword [0x431070], eax
cmp byte [esi], 0x2a
je 0x41838d
cmp byte [esi], 0x3a
je 0x418378
cmp byte [esi], 0x3d
jne 0x418395
inc esi
mov dword [0x431070], esi
or byte [0x431196], 0xff
call fcn.00417ceb
jmp 0x418395
inc esi
or dword [0x431070], 0xffffffff
xchg ebx, esi
mov dword [edx + 0xc], esi
mov byte [0x431196], 0
cmp byte [ebx], 0x26
je 0x4183b2
call fcn.00417ceb
call fcn.004183e5
jmp 0x4183c2
call fcn.00418c4a
dec esi
mov eax, dword [edx + 0xc]
mov ecx, esi
sub ecx, eax
mov dword [edx + 8], ecx
xchg ebx, esi
cmp dword [edx + 8], 0
jne 0x4183e4
mov eax, dword [0x431070]
or eax, eax
je 0x4183e4
cmp eax, 0xffffffff
je 0x416aa7
mov dword [edx + 0xc], eax
call fcn.004183e5
ret

Function at 0x41854e
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push edi
call fcn.00419fc7
mov al, 0x29
stosb byte es:[edi], al
push esi
mov esi, dword [esp + 4]
mov dword [0x4310b0], 0
mov byte [0x431180], 0
call fcn.0041c683
cmp dword [0x4310b0], 0
je 0x418581
jmp dword [0x4310b4]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cdq
cmp edx, ecx
jne 0x416b51
cmp dl, byte [edi + 0xd]
jne 0x416b51
pop esi
pop edi
ret
Function at 0x418eab
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebx
push ebp
call fcn.00418e84
jb 0x418edb
mov eax, dword [ebx]
mov edx, dword [0x43102c]
add edx, 0x10
cmp edx, dword [0x431088]
ja 0x416a37
xchg dword [0x43102c], edx
mov dword [ebx], edx
mov dword [edx], eax
mov dword [edx + 4], esi
pop ebp
pop ebx
ret
mov edx, dword [0x43102c]
add edx, 0x10
cmp edx, dword [0x431088]
ja 0x416a37
xchg dword [0x43102c], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
shr ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
or ebp, ebp
jne 0x418edb
add ebx, 8
xor eax, eax
jmp 0x418eb6
Function at 0x419597
Capabilities:
Parse credit card information
Query environment variable
Read .ini file

Disassembly:
mov dword [0x431158], 0
Function at 0x41a059
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lea eax, [edi + 0x20]
mov edx, dword [0x431004]
cmp dword [0x431030], 0
je 0x41a071
mov edx, dword [0x431088]
cmp eax, edx
jae 0x416a37
mov eax, esp
sub eax, dword [0x431010]
cmp eax, 0x100
jb 0x416a41
cmp byte [esi], 0x28
je 0x41a0d0
inc edi
call fcn.0041a1c8
jb 0x41a0ec
or ebp, ebp
je 0x41a0a2
mov byte [edi - 1], 0xf
ret
cmp dword [edi + 4], 0
jne 0x41a0bb
cmp word [edi + 2], 0
jne 0x41a0c3
cmp byte [edi + 1], 0
jne 0x41a0c9
mov byte [edi - 1], 1
inc edi
ret
mov byte [edi - 1], 8
add edi, 8
ret
mov byte [edi - 1], 4
scasd eax, dword es:[edi]
ret
mov byte [edi - 1], 2
scasw ax, word es:[edi]
ret
inc esi
push dword [0x4310c4]
call fcn.00419fc7
pop dword [0x4310c4]
lodsb al, byte [esi]
cmp al, 0x29
je 0x41a0eb
dec esi
mov al, 0x21
stosb byte es:[edi], al
ret
mov eax, dword [0x431030]
test eax, eax
je 0x41a17b
cmp eax, 0xffffffff
je 0x416b47
push edi
push esi
lodsw ax, word [esi]
cmp al, 0x1a
jne 0x41a144
movzx ecx, ah
call fcn.00419bbe
jb 0x41a144
cmp al, 0x10
jne 0x41a144
mov al, ah
shr ah, 4
cmp ah, 4
je 0x41a173
and ah, 0xfe
cmp ah, 8
je 0x41a173
cmp ah, 0xc
jae 0x41a173
cmp ah, 6
je 0x41a173
cmp al, 0x23
je 0x41a173
cmp al, 0x25
je 0x41a173
cmp al, 0x26
je 0x41a173
cmp al, 0x27
je 0x41a173
pop esi
mov edi, 0x42a74e
call fcn.00419b58
pop edi
or al, al
jne 0x41a16c
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x416b47
lodsb al, byte [esi]
movzx ecx, al
call fcn.00419ccf
mov byte [edi - 1], 0x11
stosd dword es:[edi], eax
ret
mov eax, 0xf
jmp 0x41a166
pop edx
pop edi
mov byte [edi - 1], 0x10
stosb byte es:[edi], al
ret
dec edi
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x416b47
lodsb al, byte [esi]
mov cl, al
mov ch, 2
call fcn.004179f9
jb 0x416b47
test edx, edx
je 0x41a1b0
push esi
mov esi, dword [edx + 8]
push dword [0x4310c4]
call fcn.00419fc7
pop dword [0x4310c4]
pop esi
ret
cmp eax, 0x4180ac
jne 0x416b47
call fcn.004180d5
mov al, 4
stosb byte es:[edi], al
mov eax, dword [ebx + 4]
stosd dword es:[edi], eax
ret
Function at 0x41a6c4
Capabilities:
Query environment variable
Read .ini file

Disassembly:
or ecx, ecx
je 0x41a84c
mov eax, dword [edi + 0xc]
mul ecx
mov dword [edi + 0xc], eax
mov ebx, edx
mov eax, dword [edi]
mul ecx
add eax, ebx
adc edx, 0
mov dword [edi], eax
mov ebx, edx
mov eax, dword [edi + 4]
mul ecx
add eax, ebx
adc edx, 0
mov dword [edi + 4], eax
or edx, edx
je 0x41a71d
mov eax, dword [edi]
shrd dword [edi + 0xc], eax, 1
mov eax, dword [edi + 4]
shrd dword [edi], eax, 1
shrd eax, edx, 1
mov dword [edi + 4], eax
shr edx, 1
inc dword [edi + 8]
cmp dword [edi + 8], 0x8000
jge 0x416b51
jmp 0x41a6f0
ret

Function at 0x41ab33
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push 0x42ff20
jmp 0x416a72
xor eax, eax
mov dword [0x43111c], eax
mov word [0x431026], ax
mov dword [0x43110c], eax
mov dword [0x431118], eax
mov dword [0x431144], eax
mov eax, dword [0x431088]
mov dword [0x4310b8], eax
mov eax, dword [0x431008]
mov dword [0x43102c], eax
mov eax, dword [0x43100c]
mov dword [0x4310bc], eax
mov esi, dword [0x431030]
mov edi, dword [0x431034]
xor eax, eax
mov dword [0x4310f0], eax
mov dword [0x4310f4], eax
mov dword [0x431098], eax
mov dword [0x4310b0], eax
mov dword [0x4310a4], eax
mov dword [0x431108], eax
mov dword [0x431114], eax
mov dword [0x4310a0], eax
mov dword [0x431168], eax
mov byte [0x431190], al
mov byte [0x431191], al
mov byte [0x431193], al
mov byte [0x431194], al
mov byte [0x431192], 0x10
call fcn.0041ad2f
call fcn.0041ad74
jae 0x41abc8
mov eax, dword [0x43100c]
cmp eax, dword [0x4310bc]
je 0x41abec
sub eax, 0x18
mov eax, dword [eax + 4]
mov dword [0x431048], eax
jmp 0x416c1f
call fcn.0041e5ce
mov eax, dword [0x431088]
cmp eax, dword [0x431004]
jae 0x41acae
test byte [eax + 8], 8
je 0x41ac30
mov cx, word [0x431026]
cmp cx, word [eax + 0x12]
jne 0x41ac30
test byte [eax + 8], 1
je 0x41ac30
sub cx, word [eax + 0x10]
cmp cx, 1
jne 0x41ac30
and byte [eax + 8], 0xfe
or byte [0x431190], 0xff
test byte [eax + 8], 0x10
je 0x41ac68
mov cx, word [0x431026]
and byte [eax + 8], 0xef
test byte [eax + 8], 0x20
jne 0x41ac55
cmp cx, word [eax + 0x12]
jne 0x41ac68
test byte [eax + 8], 8
je 0x41ac68
jmp 0x41ac61
test byte [eax + 8], 8
je 0x41ac61
cmp cx, word [eax + 0x12]
je 0x41ac68
or byte [0x431190], 0xff
test byte [eax + 8], 0x40
je 0x41aca6
and byte [eax + 8], 0xbf
test byte [eax + 8], 4
jne 0x41ac9f
mov cx, word [0x431026]
test byte [eax + 8], 0x80
jne 0x41ac93
cmp cx, word [eax + 0x10]
jne 0x41aca6
test byte [eax + 8], 1
je 0x41aca6
jmp 0x41ac9f
test byte [eax + 8], 1
je 0x41ac9f
cmp cx, word [eax + 0x10]
je 0x41aca6
or byte [0x431190], 0xff
add eax, 0x20
jmp 0x41abf6
cmp byte [0x431190], 0
jne 0x41acf3
mov eax, dword [0x4310b0]
or eax, eax
je 0x41ad12
mov dword [0x431048], eax
cmp dword [0x4310b4], 0x416b5b
jne 0x41ace0
mov eax, dword [0x4310ac]
or eax, eax
je 0x41ace0
test byte [eax + 8], 1
jne 0x41acf3
call 0x41ace5
mov eax, dword [0x4310b4]
sub eax, 0x41ace5
add dword [esp], eax
ret
inc word [0x431026]
mov ax, word [0x431026]
cmp ax, word [0x431024]
je 0x416a5f
jmp 0x41ab4f
ret
Function at 0x41ad2f
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov ebx, dword [0x4310b8]
mov dword [ebx - 4], 0x10
mov dword [ebx - 8], 0x24
sub ebx, 0x2c
cmp ebx, edi
jbe 0x416a37
mov dword [0x4310b8], ebx
mov dword [0x431098], ebx
xor eax, eax
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
ret
Function at 0x41ae52
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov eax, edi
xor edx, edx
xor cl, cl
mov ebp, dword [0x431098]
sub eax, dword ds:[ebp]
sbb edx, dword ds:[ebp + 4]
sbb cl, byte ds:[ebp + 8]
jp 0x41ae71
call fcn.0041d496
mov byte [0x43118c], cl
test byte ds:[ebp + 0xa], 1
jne 0x41aeb2
or byte [ebx + 9], 1
xchg dword [ebx], eax
xchg dword [ebx + 4], edx
mov ch, byte [ebx + 9]
shr ch, 1
and ch, 1
neg ch
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
sbb ch, cl
mov dword [0x4310f0], eax
mov dword [0x4310f4], edx
mov byte [0x431193], ch
or al, ch
or eax, edx
setne ah
jmp 0x41aec8
and byte [ebx + 9], 0xfe
cmp eax, dword [ebx]
mov dword [ebx], eax
setne ah
cmp edx, dword [ebx + 4]
mov dword [ebx + 4], edx
setne al
or ah, al
mov ebp, dword [0x431098]
mov ch, byte ds:[ebp + 9]
mov cl, byte [0x431182]
mov edx, dword ds:[ebp + 0x14]
mov ebp, dword ds:[ebp + 0x10]

Function at 0x41b569
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov eax, dword [0x4310b8]
or eax, eax
je 0x41b59e
mov esi, dword [0x431088]
cmp esi, eax
je 0x41b59e
sub esi, 8
mov eax, dword [esi + 4]
mov ecx, dword [esi]
sub esi, ecx
cmp eax, 0x10
je 0x41b59f
test eax, eax
jne 0x41b596
push esi
call fcn.0041671a
pop esi
cmp esi, dword [0x4310b8]
jne 0x41b57c
ret
mov ecx, dword [esi + 0x20]
jecxz 0x41b596
push esi
mov edi, dword [0x43102c]
mov esi, dword [0x43101c]
test esi, esi
je 0x41b62f
xor ebx, ebx
lodsb al, byte [esi]
cmp edi, dword [0x4310bc]
jae 0x416a37
stosb byte es:[edi], al
test al, al
je 0x41b5dd
cmp al, 0x2f
je 0x41b5d9
cmp al, 0x5c
je 0x41b5d9
cmp al, 0x2e
jne 0x41b5b7
mov ebx, edi
jmp 0x41b5b7
xor ebx, ebx
jmp 0x41b5b7
test ebx, ebx
jne 0x41b5e7
mov byte [edi - 1], 0x2e
mov ebx, edi
mov edi, ebx
add ebx, ecx
inc ebx
cmp ebx, dword [0x4310bc]
jae 0x416a37
mov esi, dword [esp]
mov esi, dword [esi + 0x18]
sub esi, ecx
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
mov edx, dword [0x43102c]
call fcn.00416676
jb 0x416a55
mov esi, dword [esp]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
call fcn.004166a5
jb 0x416a55
call fcn.004166db
pop esi
jmp 0x41b596
Function at 0x41cac8
Capabilities:
Query environment variable
Read .ini file

Disassembly:
or al, al
je 0x41cb13
cmp byte [esi + 8], al
jne 0x41cae1
add byte [esi + 0xa], cl
jo 0x416b51
jne 0x41cb13
mov byte [esi + 8], 0
ret
cmp byte [esi + 9], al
jne 0x41caf6
add byte [esi + 0xb], cl
jo 0x416b51
jne 0x41cb13
mov byte [esi + 9], 0
ret
cmp byte [esi + 8], 0
jne 0x41cb03
mov byte [esi + 8], al
mov byte [esi + 0xa], cl
ret
cmp byte [esi + 9], 0
jne 0x416b33
mov byte [esi + 9], al
mov byte [esi + 0xb], cl
ret

Function at 0x41cb93
Capabilities:
Query environment variable
Read .ini file

Disassembly:
or al, al
je 0x41cb13
neg cl
jo 0x416b51
jmp 0x41cacc

Function at 0x41cd03
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov al, byte [edi]
cbw
cwde
cdq
cmp edx, dword [edi + 4]
jne 0x416b51
cmp eax, dword [edi]
jne 0x416b51
ret

Function at 0x41d0d9
Capabilities:
Query environment variable
Read .ini file

Disassembly:
xor ebx, ebx
cmp dword [edi], 0
jne 0x41d0f8
cmp dword [edi + 4], 0
jne 0x41d0f8
cmp byte [0x431190], 0
je 0x416b51
jmp 0x41d1bf
cmp byte [esi + 0xd], 0
je 0x41d11e
mov eax, dword [esi]
mov edx, dword [esi + 4]
not eax
not edx
add eax, 1
adc edx, 0
mov dword [esi], eax
mov dword [esi + 4], edx
or eax, edx
je 0x416b51
xor bx, 0xffff
cmp byte [edi + 0xd], 0
je 0x41d143
mov eax, dword [edi]
mov edx, dword [edi + 4]
not eax
not edx
add eax, 1
adc edx, 0
mov dword [edi], eax
mov dword [edi + 4], edx
or eax, edx
je 0x416b51
xor bl, 0xff
cmp dword [edi + 4], 0
jne 0x41d161
mov ecx, dword [edi]
mov eax, dword [esi + 4]
xor edx, edx
div ecx
mov dword [esi + 4], eax
mov eax, dword [esi]
div ecx
mov dword [esi], eax
mov eax, edx
xor edx, edx
jmp 0x41d1bf
push ebx
mov eax, dword [esi + 4]
xor edx, edx
div dword [edi + 4]
mov ebx, dword [esi]
mov dword [esi], eax
and dword [esi + 4], 0
mov ecx, edx
mul dword [edi]
cmp ecx, edx
ja 0x41d189
jb 0x41d194
cmp ebx, eax
jae 0x41d189
dec dword [esi]
sub eax, dword [edi]
sbb edx, dword [edi + 4]
jae 0x41d176
sub ebx, eax
sbb ecx, edx
mov edx, ecx
mov eax, ebx
pop ebx
jmp 0x41d1bf
push eax
push edx
mov eax, edx
sub eax, ecx
xor edx, edx
div dword [edi + 4]
shr eax, 1
je 0x41d1bb
sub dword [esi], eax
push eax
mul dword [edi + 4]
sub dword [esp + 4], eax
pop eax
mul dword [edi]
sub dword [esp + 4], eax
sbb dword [esp], edx
pop edx
pop eax
jmp 0x41d176
pop edx
pop eax
jmp 0x41d180
or bh, bh
je 0x41d1d5
not eax
not edx
add eax, 1
adc edx, 0
mov ecx, eax
or ecx, edx
jne 0x41d1d5
not bh
or bl, bl
je 0x41d1ee
not dword [esi]
not dword [esi + 4]
add dword [esi], 1
adc dword [esi + 4], 0
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x41d1ee
not bl
mov byte [esi + 0xd], bl
ret

Function at 0x41d1f2
Capabilities:
Query environment variable
Read .ini file

Disassembly:
cmp dword [0x431020], 0
je 0x41d229
cmp byte [0x431190], 0
jne 0x41d229
mov eax, dword [0x4310b8]
mov dword [eax - 4], 2
mov dword [eax - 8], 4
sub eax, 0xc
cmp eax, edi
jbe 0x416a37
mov dword [0x4310b8], eax
mov dword [eax], ebx
ret
Function at 0x41d63a
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov byte [0x43116c], 0
lodsb al, byte [esi]
call fcn.00426ecf
cmp al, 0x28
jne 0x416b47
mov al, byte [0x43116c]
cmp al, 1
je 0x41d6d5
cmp al, 2
je 0x41d6c9
cmp al, 4
je 0x41d6c0
cmp al, 6
je 0x41d6b6
cmp al, 8
je 0x41d6a9
or al, al
jne 0x416b47
mov byte [0x431180], al
call fcn.0041d680
mov eax, dword [edi]
mov edx, dword [edi + 4]
ret
call fcn.0041d5c0
mov byte [0x431189], 0
ret
call fcn.0041d57f
movzx edx, dx
jmp 0x41d6ae
call fcn.0041d525
xor edx, edx
jmp 0x41d6ae
call fcn.0041d4dd
xor edx, edx
movzx eax, ax
jmp 0x41d6ae
call fcn.0041d452
xor edx, edx
movzx eax, al
jmp 0x41d6ae

Function at 0x41d680
Capabilities:
Query environment variable
Read .ini file

Disassembly:
call fcn.0041c683
cmp word [edi + 8], 0
jne 0x416b47
mov eax, dword [edi + 0x10]
mov dword [0x4310f8], eax
mov al, byte [edi + 0xd]
mov byte [0x431189], al
mov al, byte [edi + 0xc]
mov byte [0x431188], al
ret
Function at 0x41e25b
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov eax, dword [0x431040]
mov dword [0x431044], eax
mov edx, dword [0x431034]
mov ecx, dword [0x431038]
add dword [0x431040], ecx
lea eax, [edx + ecx]
call fcn.004166a5
jb 0x416a55
ret

Function at 0x41e5ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [0x431191]
cmp al, 3
je 0x41fca4
cmp al, 4
je 0x42006f
cmp al, 5
je 0x4207f8
ret
call fcn.0041f10f
mov edx, dword [0x431034]
mov dword [edx + 0x50], eax
call fcn.00416949
mov edx, dword [0x431034]
mov dword [edx + 8], eax
mov eax, dword [0x431118]
mov word [edx + 6], ax
imul eax, eax, 0x28
movzx ecx, word [edx + 0x14]
lea eax, [eax + ecx + 0x18]
add eax, dword [0x43111c]
mov ecx, dword [edx + 0x3c]
dec ecx
add eax, ecx
not ecx
and eax, ecx
cmp eax, dword [edx + 0x54]
je 0x41fcf0
or byte [0x431190], 0xff
xor ecx, ecx
add edx, 0x78
test dword [0x431108], 4
je 0x41fd04
add edx, 0x10
mov eax, dword [edx + ecx*8]
or eax, eax
je 0x41fd22
cmp dword [edx + ecx*8 + 4], 0xffffffff
jne 0x41fd22
mov ebx, dword [edx + ecx*8]
mov eax, dword [ebx + 0xc]
mov dword [edx + ecx*8], eax
mov eax, dword [ebx + 8]
mov dword [edx + ecx*8 + 4], eax
inc cl
cmp cl, 0x10
jb 0x41fd04
cmp dword [edx + 0x28], 0
jne 0x41fd50
mov eax, dword [0x431114]
shl eax, 2
sub dword [0x43102c], eax
btr dword [0x43110c], 0
jae 0x41fd72
or byte [0x431190], 0xff
jmp 0x41fd72
push edi
mov edi, dword [0x431148]
call fcn.0041f611
pop edi
add dword [0x431144], eax
cmp eax, dword [0x43114c]
je 0x41fd72
or byte [0x431190], 0xff
mov ebx, dword [0x431034]
sub ebx, dword [0x43111c]
mov ecx, edi
sub ecx, ebx
mov ebp, ecx
shr ecx, 1
xor eax, eax
cdq
mov dx, word [ebx]
add eax, edx
mov dx, ax
shr eax, 0x10
add eax, edx
add ebx, 2
loop 0x41fd89
add eax, ebp
mov ebx, dword [0x431034]
mov dword [ebx + 0x58], eax
ret
call fcn.0041ff66
cmp byte [0x431190], 0
je 0x420087
mov eax, dword [0x431110]
mov dword [0x43102c], eax
ret
bt dword [0x431108], 0
jb 0x42149a
call fcn.0041ff66
cmp byte [0x431190], 0
je 0x42081e
mov eax, dword [0x431110]
mov dword [0x43102c], eax
ret
test dword [0x431108], 8
jne 0x4214d6
call fcn.004211fe
mov edx, dword [0x431034]
mov eax, dword [0x431118]
mov byte [edx + 0x1c], 0x34
mov word [edx + 0x2c], ax
shl eax, 5
add eax, edx
add eax, 0x34
cmp eax, dword [0x431110]
je 0x4214d5
or byte [0x431190], 0xff
ret
call fcn.004213e5
mov edx, dword [0x431034]
mov eax, dword [0x431118]
mov byte [edx + 0x20], 0x40
mov word [edx + 0x38], ax
imul eax, eax, 0x38
add eax, edx
add eax, 0x40
cmp eax, dword [0x431110]
je 0x421505
or byte [0x431190], 0xff
ret