joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403300
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40338b
cmp ax, 9
je 0x403378
cmp ax, 0x20
je 0x403378
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x4033e0
cmp ax, 0x22
je 0x4033f0
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40338b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403330
test edi, 1
jne 0x403330
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x403378
cmp ax, 0x20
je 0x403378
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x403408
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x40334b
and dword [ebp - 0x54], 1
jne 0x403344
xor edi, 1
jmp 0x40334b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x4033a4

Function at 0x403420
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check for time delay via gettickcount
Query environment variable
Terminate process

Disassembly:
mov dword [0x4170ae], 0xfffffff5
mov esi, 0x4017e3
call fcn.00401410
call fcn.004010fd
jb 0x4010ec
call fcn.004012a1
mov esi, 0x4018ee
call fcn.00401410
mov eax, dword [0x416b38]
sub eax, dword [0x416b34]
add eax, dword [0x416b40]
sub eax, dword [0x416b3c]
shr eax, 0xa
call fcn.00401469
mov esi, 0x4018f2
call fcn.00401410
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4170b6], eax
call fcn.00401fdf
call fcn.00403932
call fcn.004052fb
call fcn.004081a6
call fcn.004014a5
movzx eax, word [0x416b56]
inc eax
call fcn.00401469
mov esi, 0x401907
call fcn.00401410
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4170b6]
xor edx, edx
mov ebx, 0x64
div ebx
or eax, eax
je 0x4010d1
xor edx, edx
mov ebx, 0xa
div ebx
push edx
call fcn.00401469
mov dl, 0x2e
call fcn.0040143d
pop eax
call fcn.00401469
mov esi, 0x401911
call fcn.00401410
mov eax, dword [0x416b70]
call fcn.00401469
mov esi, 0x40191c
call fcn.00401410
xor al, al
jmp fcn.00401335
mov esi, 0x401803
call fcn.00401410
mov al, 1
jmp fcn.00401335

Function at 0x4012a1
Capabilities:
Get memory capacity
Query environment variable
Terminate process

Disassembly:
xor eax, eax
mov dword [0x416b34], eax
mov eax, esp
and eax, 0xfffff000
add eax, 0xffff1000
mov dword [0x416b44], eax
mov eax, dword [0x4170b2]
shl eax, 0xa
jne 0x4012dc
push 0x4190ba
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
mov eax, dword [0x4190ce]
shr eax, 2
add eax, dword [0x4190c6]
mov edx, eax
shr edx, 2
mov ecx, eax
sub ecx, edx
mov dword [0x416b38], ecx
mov dword [0x416b40], edx
push 4
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
or eax, eax
je 0x401321
mov dword [0x416b34], eax
add eax, dword [0x416b38]
mov dword [0x416b38], eax
mov dword [0x416b3c], eax
add dword [0x416b40], eax
ret
mov eax, dword [0x416b40]
shl eax, 1
cmp eax, 0x4000
jb 0x401926
jmp 0x4012dc

Function at 0x401356
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov ecx, dword [0x416b38]
sub ecx, edi
cmp ecx, 0x4000
jbe 0x40136b
mov ecx, 0x4000
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
add edi, eax
cmp edi, dword [0x416b38]
jae 0x401926
ret

Function at 0x401410
Capabilities:
Write file on windows

Disassembly:
push dword [0x4170ae]
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor al, al
repne scasb al, byte es:[edi]
neg ecx
sub ecx, 2
push 0
push 0x40179b
push ecx
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret

Function at 0x4014a5
Capabilities:
Write file on windows

Disassembly:
mov dword [0x40179f], 0
call fcn.00405c4e
cmp dword [0x40179f], 1
jb 0x4014fb
je 0x4014d1
mov ax, word [0x4017a3]
cmp ax, 0xa0d
je 0x4014fb
cmp ax, 0xd0a
je 0x4014fb
mov word [0x4190ba], 0xa0d
push dword [0x4170ae]
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push 0
push 0x40179b
push 2
push 0x4190ba
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret
Function at 0x4014fc
Capabilities:
Write file on windows

Disassembly:
add dword [0x40179f], ecx
cmp ecx, 1
ja 0x401518
jb 0x401541
mov al, byte [0x4017a4]
mov ah, byte [esi]
mov word [0x4017a3], ax
jmp 0x401523
mov ax, word [esi + ecx - 2]
mov word [0x4017a3], ax
push ecx
push dword [0x4170ae]
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
pop ecx
push 0
push 0x40179b
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret
Function at 0x401a2c
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x41690d
jmp fcn.00401b2c
push 0x41699c
jmp fcn.00401b2c
push 0x4169ac
jmp fcn.00401b2c
push 0x4169f2
jmp fcn.00401b2c
ret
xor eax, eax
xor edx, edx
cmp dword [0x416bec], 0
jne 0x4078e5
mov ecx, dword [0x416b78]
mov dword [0x416bec], ecx
mov dword [0x416bf0], 0x401a40
ret
mov eax, dword [edi]
mov edx, dword [edi + 4]
or edx, edx
je 0x407977
cmp edx, 0xffffffff
jne 0x4078e6
cmp eax, 0xffff8000
jb 0x4078e6
ret
cmp eax, 0x10000
jae 0x4078e6
ret
mov eax, dword [edi]
mov edx, dword [edi + 4]
or edx, edx
je 0x4079e5
cmp edx, 0xffffffff
jne 0x4078e6
bt eax, 0x1f
jae 0x4078e6
ret
mov eax, dword [edi]
mov edx, dword [edi + 4]
ret
cmp byte [esi], 0x2e
je 0x401a2c
call fcn.00406ad2
mov eax, dword [edi + 0x10]
mov dword [0x416c38], eax
mov al, byte [edi + 0xc]
mov byte [0x416ca1], al
cmp al, 6
je 0x407bd1
cmp al, 5
je 0x407bd1
ja 0x401acc
test al, 1
jne 0x401acc
or al, al
je 0x407c2b
shl al, 5
jmp 0x407bd3
mov al, 0x40
mov ah, byte [0x416c9e]
or byte [0x416c9e], al
shr al, 4
or ah, ah
je 0x407c2b
cmp al, ah
je 0x407c2b
cmp ax, 0x804
jne 0x4019fa
cmp byte [0x416ca1], 2
ja 0x407c04
mov byte [0x416ca1], 2
mov eax, dword [edi]
cdq
cmp edx, dword [edi + 4]
je 0x407c2b
cmp dword [0x416bec], 0
jne 0x407c2b
mov ecx, dword [0x416b78]
mov dword [0x416bec], ecx
mov dword [0x416bf0], 0x401a40
xor ebx, ebx
xor ecx, ecx
mov cl, byte [0x416ca1]
shl ecx, 0x10
mov ch, byte [0x416c9e]
cmp word [edi + 8], 0
je 0x407d64
mov al, byte [edi + 8]
mov dl, byte [edi + 0xa]
call fcn.00407cde
mov al, byte [edi + 9]
mov dl, byte [edi + 0xb]
call fcn.00407cde
mov ax, bx
shr ah, 4
shr al, 4
or bh, bh
je 0x407c78
or bl, bl
je 0x407c78
cmp al, ah
jne 0x401a2c
or al, ah
mov ah, byte [0x416c9e]
and ah, 0xf
je 0x407c89
cmp al, ah
jne 0x407cab
cmp al, 4
je 0x407cfc
cmp al, 8
je 0x407cfc
cmp al, 0xf
je 0x407cbf
or cl, cl
je 0x407959
cmp cl, 1
je 0x407959
jmp 0x401a2c
cmp al, 0xf
jne 0x401a2c
mov al, bh
and al, 0xf
cmp al, ah
jne 0x401a2c
cmp bh, 0xf4
je 0x4079c9
cmp bh, 0xf8
jne 0x401a2c
mov eax, dword [edi]
cdq
cmp edx, dword [edi + 4]
jne 0x4078e6
ret
or bh, bh
jne 0x407d43
cmp cl, 3
je 0x407d60
cmp cl, 5
je 0x407d60
cmp cl, 9
je 0x407d60
cmp cl, 2
jne 0x407d43
cmp bl, 0x45
jne 0x407d60
cmp byte [0x416ca9], 0x40
je 0x407d60
cmp byte [0x416c98], 4
jne 0x407d60
cmp byte [0x416ca1], 0
jne 0x407d43
mov al, byte [edi]
cbw
cwde
cmp eax, dword [edi]
jne 0x407d43
cdq
cmp edx, dword [edi + 4]
je 0x407d60
or cl, cl
je 0x407d64
cmp cl, 1
je 0x407d64
cmp cl, 2
je 0x407d64
cmp cl, 4
je 0x407d64
cmp cl, 8
je 0x407d64
jmp 0x401a2c
mov bh, bl
dec cl
mov al, byte [0x416c9e]
and al, 0xf
cmp al, 2
je 0x407959
cmp al, 4
je 0x4079c9
cmp al, 8
je 0x407a81
or al, al
jne 0x401a36
cmp byte [0x416ca9], 0x40
jne 0x4079c9
jmp 0x407a81
Function at 0x401f65
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x4167ea
jmp fcn.00401542
mov edi, dword [0x416b5c]
call fcn.00401e9e
mov esi, dword [0x416b48]
call fcn.00401a79
cmp edi, dword [0x416b40]
jae 0x401926
mov eax, edi
sub eax, ebx
dec eax
mov dword [ebx - 0x2c], eax
mov eax, edi
sub eax, ebx
mov dword [ebx - 0x24], eax
add eax, 0x38
mov dword [ebx - 0x18], eax
call fcn.00401ebf
sub esi, dword [0x416b34]
mov dword [ebx - 0x14], esi
mov edx, dword [0x416b50]
call fcn.004013a4
jb 0x401944
mov edx, dword [0x416b5c]
mov ecx, dword [edx + 0x14]
add ecx, 0x38
call fcn.004013c3
mov edx, dword [0x416b34]
mov ecx, esi
call fcn.004013c3
call fcn.004013f9
ret

Function at 0x401fdf
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x41676c
jmp fcn.00401542
push 0x416845
jmp fcn.00401b2c
mov edi, 0x416cae
xor al, al
stosb byte es:[edi], al
inc al
jne 0x401fe6
mov esi, 0x416d0f
mov edi, 0x416cef
mov ecx, 0x1a
rep movsb byte es:[edi], byte [esi]
mov edi, 0x416cae
mov esi, 0x4127e3
movzx ecx, byte [esi - 1]
xor eax, eax
lodsb al, byte [esi]
mov byte [edi + eax], 0
loop 0x40200c
mov edi, 0x416ba0
mov ax, 0x3001
stosw word es:[edi], ax
mov edi, dword [0x416b34]
mov dword [0x416b58], edi
mov esi, 0x4127da
call fcn.00401356
xor al, al
stosb byte es:[edi], al
mov dword [0x416b34], edi
mov eax, dword [0x416b3c]
mov dword [0x416b5c], eax
mov eax, dword [0x416b40]
mov dword [0x416bb4], eax
xor eax, eax
mov dword [0x416b60], eax
mov dword [0x416bf4], eax
mov dword [0x416bc0], eax
mov byte [0x416cab], al
mov esi, dword [0x416b48]
mov edx, esi
call fcn.00401383
jb 0x40193a
mov edi, dword [0x416b34]
call fcn.004020a3
mov eax, dword [0x416bec]
mov dword [0x416b78], eax
cmp byte [0x416cab], 0
jne 0x4019a0
mov dword [0x416b60], edi
ret

Function at 0x4020a3
Capabilities:
Query environment variable
Terminate process

Disassembly:
push dword [0x416b38]
push esi
mov al, 2
xor edx, edx
call fcn.00401401
push eax
xor al, al
xor edx, edx
call fcn.00401401
pop ecx
mov edx, dword [0x416b38]
dec edx
mov byte [edx], 0x1a
sub edx, ecx
jb 0x401926
mov esi, edx
cmp edx, edi
jbe 0x401926
mov dword [0x416b38], edx
call fcn.004013d9
call fcn.004013f9
pop edx
xor ecx, ecx
mov ebx, esi
inc ecx
mov dword [0x416b78], edi
mov eax, edx
stosd dword es:[edi], eax
mov eax, ecx
stosd dword es:[edi], eax
mov eax, esi
sub eax, ebx
stosd dword es:[edi], eax
xor eax, eax
stosd dword es:[edi], eax
push ebx
push edx
call fcn.00402120
call fcn.004023aa
pop edx
pop ebx
cmp byte [esi - 1], 0x1a
jne 0x4020ef
pop dword [0x416b38]
clc
ret
Function at 0x402120
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416782
jmp 0x401961
cmp dword [0x416b50], 0
je fcn.00401542
call fcn.00401f65
jmp fcn.00401542
push 0x416a08
jmp fcn.00401b2c
push 0x416a57
jmp fcn.00401b2c
push 0x416a96
jmp fcn.00401b2c
push ecx
test byte [0x416cab], 0xf
je 0x402130
mov ax, 0x3b
stosw word es:[edi], ax
cmp edi, dword [0x416b38]
jae 0x401926
lodsb al, byte [esi]
cmp al, 0x20
je 0x402130
cmp al, 9
je 0x402130
mov ah, al
mov ebx, 0x416cae
xlatb
or al, al
je 0x402192
cmp ah, 0x27
je 0x4021ec
cmp ah, 0x22
je 0x4021ec
mov byte [edi], 0x1a
scasw ax, word es:[edi]
xchg ah, al
stosb byte es:[edi], al
mov ebx, 0x416cae
xor ecx, ecx
lodsb al, byte [esi]
stosb byte es:[edi], al
xlatb
or al, al
loopne 0x402172
neg ecx
cmp ecx, 0xff
ja 0x401ad3
mov ebx, edi
sub ebx, ecx
mov byte [ebx - 2], cl
dec edi
mov ah, byte [esi - 1]
xchg ah, al
cmp al, 0x20
jb 0x4021ad
je 0x402130
cmp al, 0x3b
je 0x40232f
cmp al, 0x5c
je 0x40222b
stosb byte es:[edi], al
jmp 0x402130
cmp al, 0x1a
je 0x402348
cmp al, 0xd
je 0x4021dd
cmp al, 0xa
je 0x4021ce
cmp al, 9
je 0x402130
or al, al
jne 0x40219a
jmp 0x402348
lodsb al, byte [esi]
cmp al, 0xd
je 0x402348
dec esi
jmp 0x402348
lodsb al, byte [esi]
cmp al, 0xa
je 0x402348
dec esi
jmp 0x402348
mov al, 0x22
stosb byte es:[edi], al
scasd eax, dword es:[edi]
mov ebx, edi
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp al, 0xa
je 0x401aef
cmp al, 0xd
je 0x401aef
or al, al
je 0x401aef
cmp al, 0x1a
je 0x401aef
cmp al, ah
jne 0x4021f2
lodsb al, byte [esi]
cmp al, ah
je 0x4021f2
dec esi
dec edi
mov eax, edi
sub eax, ebx
mov dword [ebx - 4], eax
jmp 0x402130
mov byte [edi], 0
lodsb al, byte [esi]
cmp al, 0x20
je 0x4022e2
cmp al, 9
je 0x4022e2
cmp al, 0x1a
je 0x40194e
cmp al, 0xa
je 0x402319
cmp al, 0xd
je 0x402321
cmp al, 0x3b
je 0x402303
mov al, 0x1a
stosb byte es:[edi], al
mov ecx, edi
mov ax, 0x5c01
stosw word es:[edi], ax
dec esi
lodsb al, byte [esi]
cmp al, 0x5c
jne 0x402275
stosb byte es:[edi], al
inc byte [ecx]
jmp 0x40226b
cmp al, 0x1a
je 0x40194e
cmp al, 0xa
je 0x401b04
cmp al, 0xd
je 0x401b04
cmp al, 0x20
je 0x401b04
cmp al, 9
je 0x401b04
cmp al, 0x22
je 0x401b04
cmp al, 0x27
je 0x401b04
cmp al, 0x3b
je 0x401b04
mov ah, al
mov ebx, 0x416cae
xlatb
or al, al
je 0x4022d8
mov al, ah
stosb byte es:[edi], al
xlatb
or al, al
je 0x40218e
inc byte [ecx]
je 0x401ad3
lodsb al, byte [esi]
jmp 0x4022c3
mov al, ah
stosb byte es:[edi], al
inc byte [ecx]
jmp 0x402130
lodsb al, byte [esi]
cmp al, 0x20
je 0x4022e2
cmp al, 9
je 0x4022e2
cmp al, 0x1a
je 0x40194e
cmp al, 0xa
je 0x402319
cmp al, 0xd
je 0x402321
cmp al, 0x3b
jne 0x401b04
lodsb al, byte [esi]
cmp al, 0xa
je 0x402319
cmp al, 0xd
je 0x402321
or al, al
je 0x402327
cmp al, 0x1a
jne 0x402303
jmp 0x40194e
lodsb al, byte [esi]
cmp al, 0xd
je 0x402327
dec esi
jmp 0x402327
lodsb al, byte [esi]
cmp al, 0xa
je 0x402327
dec esi
inc dword [esp]
jmp 0x402130
lodsb al, byte [esi]
cmp al, 0xa
je 0x4021ce
cmp al, 0xd
je 0x4021dd
or al, al
je 0x402348
cmp al, 0x1a
jne 0x40232f
xor al, al
stosb byte es:[edi], al
pop ecx
ret
Function at 0x40268b
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ebx, ebx
mov eax, 0x811c9dc5
mov ebp, 0x1000193
xor al, byte [esi + ebx]
mul ebp
inc bl
cmp bl, cl
jb 0x402697
ret

Function at 0x4026a3
Capabilities:
Query environment variable
Terminate process

Disassembly:
push 0x416a23
jmp fcn.00401b2c
push edi
push esi
cmp ch, 3
je 0x4026bf
push ecx
movzx ecx, cl
mov edi, 0x4127fe
call fcn.0040235d
jae 0x401ae1
pop ecx
call fcn.0040268b
mov ebp, eax
and ebp, 0x3ff
shr eax, 0xa
xor ebp, eax
shl ecx, 0x16
or ebp, ecx
mov ebx, 0x416bc0
mov ecx, 0x20
mov edx, dword [ebx]
or edx, edx
je 0x40273e
xor eax, eax
rol ebp, 1
adc eax, 0
lea ebx, [edx + eax*4]
dec ecx
jne 0x4026e0
mov edx, dword [ebx]
or edx, edx
je 0x402717
shr ebp, 0x1e
cmp ebp, 3
je 0x402738
cmp dword [edx + 4], 0
jne 0x402717
mov edi, dword [edx]
or edi, edi
je 0x402738
cmp dword [edi + 4], 0
jne 0x402738
mov edx, edi
jmp 0x402707
mov eax, edx
mov edx, dword [0x416bb4]
sub edx, 0x10
cmp edx, dword [0x416b5c]
jb 0x401926
mov dword [0x416bb4], edx
mov dword [edx], eax
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret
mov edx, dword [0x416bb4]
sub edx, 8
cmp edx, dword [0x416b5c]
jb 0x401926
mov dword [0x416bb4], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
shl ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
dec ecx
jne 0x40273e
mov edx, dword [0x416bb4]
sub edx, 0x10
cmp edx, dword [0x416b5c]
jb 0x401926
mov dword [0x416bb4], edx
mov dword [edx], 0
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret

Function at 0x4029bf
Capabilities:
Query environment variable
Terminate process

Disassembly:
lodsb al, byte [esi]
or al, al
je 0x401996
cmp al, 0x2c
je 0x4029f2
cmp al, 0x22
je 0x4029ed
cmp al, 0x1a
je 0x4029e5
cmp al, 0x3d
jne fcn.004029bf
mov al, byte [esi]
cmp al, 0x1a
je fcn.004029bf
cmp al, 0x22
je fcn.004029bf
inc esi
jmp fcn.004029bf
lodsb al, byte [esi]
movzx eax, al
add esi, eax
jmp fcn.004029bf
lodsd eax, dword [esi]
add esi, eax
jmp fcn.004029bf
ret

Function at 0x402aaf
Capabilities:
Query environment variable
Terminate process

Disassembly:
lea eax, [edi + ecx]
cmp eax, dword [0x416b38]
jae 0x401926
shr ecx, 1
jae 0x402ac3
movsb byte es:[edi], byte [esi]
shr ecx, 1
jae 0x402ac9
movsw word es:[edi], word [esi]
rep movsd dword es:[edi], dword [esi]
ret
Function at 0x402b26
Capabilities:
Query environment variable
Terminate process

Disassembly:
xor dl, dl
mov ebp, edi
mov edi, esi
lodsb al, byte [esi]
cmp al, 0x60
je 0x402ba3
cmp al, 0x23
je 0x402c20
cmp al, 0x1a
je 0x402b51
cmp al, 0x3b
je 0x402b4e
cmp al, 0x22
je 0x402b66
xor dl, dl
or al, al
jne 0x402b2a
mov edi, esi
ret
mov edi, ebp
ret
mov dl, 0x1a
mov ebx, esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x402b62
mov edi, esi
cmp byte [esi], 0x5c
je 0x402b6f
add esi, ecx
jmp 0x402b2a
mov dl, 0x22
mov ebx, esi
lodsd eax, dword [esi]
add esi, eax
jmp 0x402b2a
dec byte [edi - 1]
dec ecx
inc esi
cmp ecx, 1
rep movsb byte es:[edi], byte [esi]
jne 0x402ca8
mov al, byte [esi - 1]
mov ecx, ebx
mov ebx, 0x416cae
xlatb
mov ebx, ecx
or al, al
jne 0x402ca8
sub edi, 3
mov al, byte [esi - 1]
stosb byte es:[edi], al
xor dl, dl
jmp 0x402ca8
inc esi
mov edx, esi
mov al, byte [esi]
cmp al, 0x1a
jne 0x402bbf
lodsw ax, word [esi]
movzx ecx, ah
lea ebx, [edi + 3]
jecxz 0x402bd9
cmp byte [esi], 0x5c
jne 0x402bd9
inc esi
dec ecx
dec ebx
jmp 0x402bd9
cmp al, 0x22
je 0x402ca8
cmp al, 0x60
je 0x402ba2
lea ebx, [edi + 5]
xor ecx, ecx
or al, al
je 0x402bd9
cmp al, 0x23
je 0x402bd9
inc ecx
sub ebx, edx
ja 0x402bf6
mov al, 0x22
mov dl, al
stosb byte es:[edi], al
mov ebx, edi
mov eax, ecx
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
cmp edi, esi
je 0x402b2a
jmp 0x402ca8
push ecx
mov edx, esi
lea esi, [ebp - 1]
add ebp, ebx
lea edi, [ebp - 1]
lea ecx, [esi + 1]
sub ecx, edx
std
rep movsb byte es:[edi], byte [esi]
cld
pop eax
sub edi, 3
mov dl, 0x22
mov byte [edi - 1], dl
mov ebx, edi
mov dword [edi], eax
lea esi, [edi + eax + 4]
jmp 0x402b2a
cmp dl, 0x1a
je 0x402c34
cmp dl, 0x22
je 0x402c66
cmp esi, edi
je 0x402b2a
jmp 0x402ca8
cmp byte [esi], 0x1a
jne 0x402c2a
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x402c45
cmp byte [esi], 0x5c
je 0x402c51
add byte [ebx], cl
jb 0x401ad3
rep movsb byte es:[edi], byte [esi]
jmp 0x402ca8
inc esi
dec ecx
je 0x402c45
movzx eax, byte [esi]
cmp byte [eax + 0x416cae], 0
jne 0x402c45
sub esi, 3
jmp 0x402c2a
cmp byte [esi], 0x22
je 0x402ca0
cmp byte [esi], 0x60
jne 0x402c2a
inc esi
mov al, byte [esi]
cmp al, 0x60
je 0x402c70
cmp al, 0x22
je 0x402ca0
cmp al, 0x1a
jne 0x402c93
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x402c8d
cmp byte [esi], 0x5c
jne 0x402c8d
inc esi
dec ecx
add dword [ebx], ecx
rep movsb byte es:[edi], byte [esi]
jmp 0x402ca8
or al, al
je 0x402ca8
cmp al, 0x23
je 0x402ca8
inc dword [ebx]
movsb byte es:[edi], byte [esi]
jmp 0x402ca8
inc esi
lodsd eax, dword [esi]
mov ecx, eax
add dword [ebx], eax
rep movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
cmp al, 0x60
je 0x402ba3
cmp al, 0x23
je 0x402c20
stosb byte es:[edi], al
cmp al, 0x1a
je 0x402cd1
cmp al, 0x3b
je 0x402b4e
cmp al, 0x22
je 0x402ce9
xor dl, dl
or al, al
jne 0x402ca8
ret
mov dl, 0x1a
mov ebx, edi
lodsb al, byte [esi]
stosb byte es:[edi], al
movzx ecx, al
jecxz 0x402ce5
cmp byte [esi], 0x5c
je 0x402b6f
rep movsb byte es:[edi], byte [esi]
jmp 0x402ca8
mov dl, 0x22
mov ebx, edi
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x402ca8
Function at 0x402d83
Capabilities:
Query environment variable
Terminate process

Disassembly:
lodsb al, byte [esi]
movzx ecx, al
mov eax, dword [0x416be4]
call fcn.004037a5
add esi, ecx
xchg ebx, esi
mov dword [edx + 0xc], esi
cmp byte [esi], 0x3c
jne 0x402def
inc esi
mov dword [edx + 0xc], esi
mov ecx, 1
lodsb al, byte [esi]
or al, al
je 0x401996
cmp al, 0x1a
je 0x402dc2
cmp al, 0x22
je 0x402dca
cmp al, 0x3e
je 0x402dcf
cmp al, 0x3c
jne 0x402da6
inc ecx
jmp 0x402da6
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x402da6
lodsd eax, dword [esi]
add esi, eax
jmp 0x402da6
loop 0x402da6
mov al, byte [esi]
or al, al
je 0x402ddf
cmp al, 0x2c
jne 0x401996
mov eax, esi
sub eax, dword [edx + 0xc]
dec eax
or eax, 0x80000000
mov dword [edx + 8], eax
jmp 0x402e16
lodsb al, byte [esi]
or al, al
je 0x402e0d
cmp al, 0x2c
je 0x402e0d
cmp al, 0x22
je 0x402e08
cmp al, 0x1a
jne 0x402def
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x402def
lodsd eax, dword [esi]
add esi, eax
jmp 0x402def
dec esi
mov eax, esi
sub eax, dword [edx + 0xc]
mov dword [edx + 8], eax
xchg ebx, esi
cmp byte [esi], 0x2a
jne 0x402e28
cmp dword [edx + 8], 0
je 0x401996
inc esi
ret

Function at 0x402f76
Capabilities:
Query environment variable
Terminate process

Disassembly:
push edi
call fcn.00404805
mov al, 0x29
stosb byte es:[edi], al
push esi
mov esi, dword [esp + 4]
mov byte [0x416c9d], 8
call fcn.00406ad2
mov eax, dword [edi]
mov ecx, dword [edi + 4]
pop esi
pop edi
cdq
cmp edx, ecx
jne 0x401a40
ret
Function at 0x4037a5
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebx
push ebp
call fcn.0040377e
jb 0x4037d5
mov eax, dword [ebx]
mov edx, dword [0x416b5c]
add edx, 0x10
cmp edx, dword [0x416bb4]
ja 0x401926
xchg dword [0x416b5c], edx
mov dword [ebx], edx
mov dword [edx], eax
mov dword [edx + 4], esi
pop ebp
pop ebx
ret
mov edx, dword [0x416b5c]
add edx, 0x10
cmp edx, dword [0x416bb4]
ja 0x401926
xchg dword [0x416b5c], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
shr ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
or ebp, ebp
jne 0x4037d5
add ebx, 8
xor eax, eax
jmp 0x4037b0
Function at 0x403e9a
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov dword [0x416c78], 0
Function at 0x404893
Capabilities:
Query environment variable
Terminate process

Disassembly:
lea eax, [edi - 0x10]
mov edx, dword [0x416b38]
cmp dword [0x416b60], 0
je 0x4048ab
mov edx, dword [0x416bb4]
cmp eax, edx
jae 0x401926
mov eax, esp
sub eax, 0x100
jb 0x401930
cmp eax, dword [0x416b44]
jb 0x401930
cmp byte [esi], 0x28
je 0x404910
inc edi
call fcn.004049b7
jb 0x40492c
or ebp, ebp
je 0x4048e2
mov byte [edi - 1], 0xf
ret
cmp dword [edi + 4], 0
jne 0x4048fb
cmp word [edi + 2], 0
jne 0x404903
cmp byte [edi + 1], 0
jne 0x404909
mov byte [edi - 1], 1
inc edi
ret
mov byte [edi - 1], 8
add edi, 8
ret
mov byte [edi - 1], 4
scasd eax, dword es:[edi]
ret
mov byte [edi - 1], 2
scasw ax, word es:[edi]
ret
inc esi
push dword [0x416c00]
call fcn.00404805
pop dword [0x416c00]
lodsb al, byte [esi]
cmp al, 0x29
jne 0x401a22
ret
cmp dword [0x416b60], 0
je 0x404979
push edi
mov edi, 0x412903
call fcn.004043da
or al, al
jne 0x404972
mov edi, 0x4128c0
call fcn.004043da
pop edi
or al, al
jne 0x40496b
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x401a36
lodsb al, byte [esi]
movzx ecx, al
call fcn.00404542
mov byte [edi - 1], 0x11
stosd dword es:[edi], eax
ret
mov eax, 0xf
jmp 0x404965
pop edi
mov byte [edi - 1], 0x10
stosb byte es:[edi], al
ret
dec edi
cmp dword [0x416bc0], 0
je 0x401a36
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x401a36
lodsb al, byte [esi]
mov cl, al
mov ch, 2
call fcn.0040260c
jb 0x401a36
push esi
mov esi, dword [edx + 8]
push dword [0x416c00]
call fcn.00404805
pop dword [0x416c00]
pop esi
ret