joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41918c
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push 0x431e30
jmp fcn.004188fd
push 0x431e7f
jmp fcn.004188fd
push 0x431ebe
jmp fcn.004188fd
push ecx
test byte [0x432195], 0xf
je 0x41919c
mov ax, 0x3b
stosw word es:[edi], ax
cmp edi, dword [0x432004]
jae 0x4186d8
lodsb al, byte [esi]
cmp al, 0x20
je 0x41919c
cmp al, 9
je 0x41919c
mov ah, al
mov ebx, 0x43219b
xlatb
or al, al
je 0x4191fe
cmp ah, 0x27
je 0x419254
cmp ah, 0x22
je 0x419254
mov byte [edi], 0x1a
scasw ax, word es:[edi]
xchg ah, al
stosb byte es:[edi], al
mov ebx, 0x43219b
xor ecx, ecx
lodsb al, byte [esi]
stosb byte es:[edi], al
xlatb
or al, al
loopne 0x4191de
neg ecx
cmp ecx, 0xff
ja 0x41889d
mov ebx, edi
sub ebx, ecx
mov byte [ebx - 2], cl
dec edi
mov ah, byte [esi - 1]
xchg ah, al
cmp al, 0x20
jb 0x419215
je 0x41919c
cmp al, 0x3b
je 0x4193a3
cmp al, 0x5c
je 0x419283
stosb byte es:[edi], al
jmp 0x41919c
cmp al, 0x1a
je 0x4193bc
cmp al, 0xd
je 0x419245
cmp al, 0xa
je 0x419236
cmp al, 9
je 0x41919c
or al, al
jne 0x419206
jmp 0x4193bc
lodsb al, byte [esi]
cmp al, 0xd
je 0x4193bc
dec esi
jmp 0x4193bc
lodsb al, byte [esi]
cmp al, 0xa
je 0x4193bc
dec esi
jmp 0x4193bc
mov al, 0x22
stosb byte es:[edi], al
scasd eax, dword es:[edi]
mov ebx, edi
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp al, 0xa
je 0x4192db
cmp al, 0xd
je 0x4192db
or al, al
je 0x4192db
cmp al, 0x1a
je 0x4192db
cmp al, ah
jne 0x41925a
lodsb al, byte [esi]
cmp al, ah
je 0x41925a
dec esi
dec edi
mov eax, edi
sub eax, ebx
mov dword [ebx - 4], eax
jmp 0x41919c
mov byte [edi], 0
lodsb al, byte [esi]
cmp al, 0x20
je 0x419359
cmp al, 9
je 0x419359
cmp al, 0x1a
je 0x4193bc
or al, al
je 0x4193bc
cmp al, 0xa
je 0x41938d
cmp al, 0xd
je 0x419395
cmp al, 0x3b
je 0x41937a
mov al, 0x1a
stosb byte es:[edi], al
mov ecx, edi
mov ax, 0x5c01
stosw word es:[edi], ax
dec esi
lodsb al, byte [esi]
cmp al, 0x5c
jne 0x4192e4
stosb byte es:[edi], al
inc byte [ecx]
je 0x41889d
jmp 0x4192cb
mov byte [ebx - 5], 0
jmp 0x4188b9
cmp al, 0x1a
je 0x4188ce
or al, al
je 0x4188ce
cmp al, 0xa
je 0x4188ce
cmp al, 0xd
je 0x4188ce
cmp al, 0x20
je 0x4188ce
cmp al, 9
je 0x4188ce
cmp al, 0x22
je 0x4188ce
cmp al, 0x27
je 0x4188ce
cmp al, 0x3b
je 0x4188ce
mov ah, al
mov ebx, 0x43219b
xlatb
or al, al
je 0x41934f
mov al, ah
stosb byte es:[edi], al
xlatb
or al, al
je 0x4191fa
inc byte [ecx]
je 0x41889d
lodsb al, byte [esi]
jmp 0x41933a
mov al, ah
stosb byte es:[edi], al
inc byte [ecx]
jmp 0x41919c
lodsb al, byte [esi]
cmp al, 0x20
je 0x419359
cmp al, 9
je 0x419359
cmp al, 0x1a
je 0x4193bc
or al, al
je 0x4193bc
cmp al, 0xa
je 0x41938d
cmp al, 0xd
je 0x419395
cmp al, 0x3b
jne 0x4188ce
lodsb al, byte [esi]
cmp al, 0xa
je 0x41938d
cmp al, 0xd
je 0x419395
or al, al
je 0x41939b
cmp al, 0x1a
jne 0x41937a
jmp 0x4193bc
lodsb al, byte [esi]
cmp al, 0xd
je 0x41939b
dec esi
jmp 0x41939b
lodsb al, byte [esi]
cmp al, 0xa
je 0x41939b
dec esi
inc dword [esp]
jmp 0x41919c
lodsb al, byte [esi]
cmp al, 0xa
je 0x419236
cmp al, 0xd
je 0x419245
or al, al
je 0x4193bc
cmp al, 0x1a
jne 0x4193a3
xor al, al
stosb byte es:[edi], al
pop ecx
ret
Function at 0x419757
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ebx, ebx
mov eax, 0x811c9dc5
mov ebp, 0x1000193
xor al, byte [esi + ebx]
mul ebp
inc bl
cmp bl, cl
jb 0x419763
ret

Function at 0x41976f
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push edi
push esi
xor eax, eax
or cl, cl
je 0x419796
cmp ch, 3
je 0x419791
push ecx
movzx ecx, cl
mov edi, 0x42c302
call fcn.004193d1
jae 0x4188ab
pop ecx
call fcn.00419757
mov ebp, eax
and ebp, 0x3ff
shr eax, 0xa
xor ebp, eax
shl ecx, 0x16
or ebp, ecx
mov ebx, 0x432094
mov ecx, 0x20
mov edx, dword [ebx]
or edx, edx
je 0x419810
xor eax, eax
rol ebp, 1
adc eax, 0
lea ebx, [edx + eax*4]
dec ecx
jne 0x4197b2
mov edx, dword [ebx]
or edx, edx
je 0x4197e9
shr ebp, 0x1e
cmp ebp, 3
je 0x41980a
cmp dword [edx + 4], 0
jne 0x4197e9
mov edi, dword [edx]
or edi, edi
je 0x41980a
cmp dword [edi + 4], 0
jne 0x41980a
mov edx, edi
jmp 0x4197d9
mov eax, edx
mov edx, dword [0x432088]
sub edx, 0x10
cmp edx, dword [0x43202c]
jb 0x4186d8
mov dword [0x432088], edx
mov dword [edx], eax
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret
mov edx, dword [0x432088]
sub edx, 8
cmp edx, dword [0x43202c]
jb 0x4186d8
mov dword [0x432088], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
shl ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
dec ecx
jne 0x419810
mov edx, dword [0x432088]
sub edx, 0x10
cmp edx, dword [0x43202c]
jb 0x4186d8
mov dword [0x432088], edx
mov dword [edx], 0
mov dword [ebx], edx
pop esi
pop edi
mov dword [edx + 4], esi
ret

Function at 0x41998c
Capabilities:
Query environment variable
Read .ini file

Disassembly:
cmp byte [esi], 0x3c
jne 0x4199f1
mov ecx, 1
inc esi
lodsb al, byte [esi]
or al, al
je 0x418748
cmp al, 0x1a
je 0x4199b3
cmp al, 0x22
je 0x4199bb
cmp al, 0x3e
je 0x4199c0
cmp al, 0x3c
jne 0x419997
inc ecx
jmp 0x419997
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x419997
lodsd eax, dword [esi]
add esi, eax
jmp 0x419997
loop 0x419997
lodsb al, byte [esi]
or al, al
je 0x419a28
cmp al, 0x2c
je 0x419a28
cmp byte [0x432196], 0
je 0x418748
cmp al, 0x7b
je 0x419a28
cmp al, 0x26
je 0x419a28
or ebp, ebp
je 0x418748
cmp al, 0x5d
je 0x419a28
jmp 0x418748
lodsb al, byte [esi]
or al, al
je 0x419a28
cmp al, 0x2c
je 0x419a28
cmp al, 0x22
je 0x419a23
cmp al, 0x1a
je 0x419a1b
cmp byte [0x432196], 0
je 0x4199f1
cmp al, 0x7b
je 0x419a28
cmp al, 0x26
je 0x419a28
or ebp, ebp
je 0x4199f1
cmp al, 0x5d
je 0x419a28
movzx eax, byte [esi]
inc esi
add esi, eax
jmp 0x4199f1
lodsd eax, dword [esi]
add esi, eax
jmp 0x4199f1
dec esi
ret

Function at 0x419b9a
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lodsb al, byte [esi]
or al, al
je 0x418748
cmp al, 0x2c
je 0x419bcd
cmp al, 0x22
je 0x419bc8
cmp al, 0x1a
je 0x419bc0
cmp al, 0x3d
jne fcn.00419b9a
mov al, byte [esi]
cmp al, 0x1a
je fcn.00419b9a
cmp al, 0x22
je fcn.00419b9a
inc esi
jmp fcn.00419b9a
lodsb al, byte [esi]
movzx eax, al
add esi, eax
jmp fcn.00419b9a
lodsd eax, dword [esi]
add esi, eax
jmp fcn.00419b9a
ret
Function at 0x419c96
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lea eax, [edi + ecx]
cmp eax, dword [0x432004]
jae 0x4186d8
shr ecx, 1
jae 0x419caa
movsb byte es:[edi], byte [esi]
shr ecx, 1
jae 0x419cb0
movsw word es:[edi], word [esi]
rep movsd dword es:[edi], dword [esi]
ret
Function at 0x419d8c
Capabilities:
Query environment variable
Read .ini file

Disassembly:
xor dl, dl
mov ebp, edi
mov edi, esi
lodsb al, byte [esi]
cmp al, 0x60
je 0x419e09
cmp al, 0x23
je 0x419e86
cmp al, 0x1a
je 0x419db7
cmp al, 0x3b
je 0x419db4
cmp al, 0x22
je 0x419dcc
xor dl, dl
or al, al
jne 0x419d90
mov edi, esi
ret
mov edi, ebp
ret
mov dl, 0x1a
mov ebx, esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x419dc8
mov edi, esi
cmp byte [esi], 0x5c
je 0x419dd5
add esi, ecx
jmp 0x419d90
mov dl, 0x22
mov ebx, esi
lodsd eax, dword [esi]
add esi, eax
jmp 0x419d90
dec byte [edi - 1]
dec ecx
inc esi
cmp ecx, 1
rep movsb byte es:[edi], byte [esi]
jne 0x419f0e
mov al, byte [esi - 1]
mov ecx, ebx
mov ebx, 0x43219b
xlatb
mov ebx, ecx
or al, al
jne 0x419f0e
sub edi, 3
mov al, byte [esi - 1]
stosb byte es:[edi], al
xor dl, dl
jmp 0x419f0e
inc esi
mov edx, esi
mov al, byte [esi]
cmp al, 0x1a
jne 0x419e25
lodsw ax, word [esi]
movzx ecx, ah
lea ebx, [edi + 3]
jecxz 0x419e3f
cmp byte [esi], 0x5c
jne 0x419e3f
inc esi
dec ecx
dec ebx
jmp 0x419e3f
cmp al, 0x22
je 0x419f0e
cmp al, 0x60
je 0x419e08
lea ebx, [edi + 5]
xor ecx, ecx
or al, al
je 0x419e3f
cmp al, 0x23
je 0x419e3f
inc ecx
sub ebx, edx
ja 0x419e5c
mov al, 0x22
mov dl, al
stosb byte es:[edi], al
mov ebx, edi
mov eax, ecx
stosd dword es:[edi], eax
rep movsb byte es:[edi], byte [esi]
cmp edi, esi
je 0x419d90
jmp 0x419f0e
push ecx
mov edx, esi
lea esi, [ebp - 1]
add ebp, ebx
lea edi, [ebp - 1]
lea ecx, [esi + 1]
sub ecx, edx
std
rep movsb byte es:[edi], byte [esi]
cld
pop eax
sub edi, 3
mov dl, 0x22
mov byte [edi - 1], dl
mov ebx, edi
mov dword [edi], eax
lea esi, [edi + eax + 4]
jmp 0x419d90
cmp dl, 0x1a
je 0x419e9a
cmp dl, 0x22
je 0x419ecc
cmp esi, edi
je 0x419d90
jmp 0x419f0e
cmp byte [esi], 0x1a
jne 0x419e90
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x419eab
cmp byte [esi], 0x5c
je 0x419eb7
add byte [ebx], cl
jb 0x41889d
rep movsb byte es:[edi], byte [esi]
jmp 0x419f0e
inc esi
dec ecx
je 0x419eab
movzx eax, byte [esi]
cmp byte [eax + 0x43219b], 0
jne 0x419eab
sub esi, 3
jmp 0x419e90
cmp byte [esi], 0x22
je 0x419f06
cmp byte [esi], 0x60
jne 0x419e90
inc esi
mov al, byte [esi]
cmp al, 0x60
je 0x419ed6
cmp al, 0x22
je 0x419f06
cmp al, 0x1a
jne 0x419ef9
inc esi
lodsb al, byte [esi]
movzx ecx, al
jecxz 0x419ef3
cmp byte [esi], 0x5c
jne 0x419ef3
inc esi
dec ecx
add dword [ebx], ecx
rep movsb byte es:[edi], byte [esi]
jmp 0x419f0e
or al, al
je 0x419f0e
cmp al, 0x23
je 0x419f0e
inc dword [ebx]
movsb byte es:[edi], byte [esi]
jmp 0x419f0e
inc esi
lodsd eax, dword [esi]
mov ecx, eax
add dword [ebx], eax
rep movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
cmp al, 0x60
je 0x419e09
cmp al, 0x23
je 0x419e86
stosb byte es:[edi], al
cmp al, 0x1a
je 0x419f37
cmp al, 0x3b
je 0x419db4
cmp al, 0x22
je 0x419f4f
xor dl, dl
or al, al
jne 0x419f0e
ret
mov dl, 0x1a
mov ebx, edi
lodsb al, byte [esi]
stosb byte es:[edi], al
movzx ecx, al
jecxz 0x419f4b
cmp byte [esi], 0x5c
je 0x419dd5
rep movsb byte es:[edi], byte [esi]
jmp 0x419f0e
mov dl, 0x22
mov ebx, edi
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x419f0e
Function at 0x419ff3
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lodsb al, byte [esi]
movzx ecx, al
mov eax, dword [0x4320a8]
call fcn.0041ab4c
add esi, ecx
xor eax, eax
mov dword [0x432070], eax
cmp byte [esi], 0x2a
je 0x41a02e
cmp byte [esi], 0x3a
je 0x41a019
cmp byte [esi], 0x3d
jne 0x41a036
inc esi
mov dword [0x432070], esi
or byte [0x432196], 0xff
call fcn.0041998c
jmp 0x41a036
inc esi
or dword [0x432070], 0xffffffff
xchg ebx, esi
mov dword [edx + 0xc], esi
mov byte [0x432196], 0
cmp byte [ebx], 0x26
je 0x41a053
call fcn.0041998c
call fcn.0041a086
jmp 0x41a063
call fcn.0041a8eb
dec esi
mov eax, dword [edx + 0xc]
mov ecx, esi
sub ecx, eax
mov dword [edx + 8], ecx
xchg ebx, esi
cmp dword [edx + 8], 0
jne 0x41a085
mov eax, dword [0x432070]
or eax, eax
je 0x41a085
cmp eax, 0xffffffff
je 0x418748
mov dword [edx + 0xc], eax
call fcn.0041a086
ret

Function at 0x41a1ef
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push edi
call fcn.0041bc68
mov al, 0x29
stosb byte es:[edi], al
push esi
mov esi, dword [esp + 4]
mov dword [0x4320b0], 0
mov byte [0x432180], 0
call fcn.0041e324
cmp dword [0x4320b0], 0
je 0x41a222
jmp dword [0x4320b4]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
cdq
cmp edx, ecx
jne 0x4187f2
cmp dl, byte [edi + 0xd]
jne 0x4187f2
pop esi
pop edi
ret
Function at 0x41ab4c
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push ebx
push ebp
call fcn.0041ab25
jb 0x41ab7c
mov eax, dword [ebx]
mov edx, dword [0x43202c]
add edx, 0x10
cmp edx, dword [0x432088]
ja 0x4186d8
xchg dword [0x43202c], edx
mov dword [ebx], edx
mov dword [edx], eax
mov dword [edx + 4], esi
pop ebp
pop ebx
ret
mov edx, dword [0x43202c]
add edx, 0x10
cmp edx, dword [0x432088]
ja 0x4186d8
xchg dword [0x43202c], edx
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
shr ebp, 1
adc eax, 0
mov dword [ebx], edx
lea ebx, [edx + eax*4]
or ebp, ebp
jne 0x41ab7c
add ebx, 8
xor eax, eax
jmp 0x41ab57
Function at 0x41b238
Capabilities:
Parse credit card information
Query environment variable
Read .ini file

Disassembly:
mov dword [0x432158], 0
Function at 0x41bcfa
Capabilities:
Query environment variable
Read .ini file

Disassembly:
lea eax, [edi + 0x20]
mov edx, dword [0x432004]
cmp dword [0x432030], 0
je 0x41bd12
mov edx, dword [0x432088]
cmp eax, edx
jae 0x4186d8
mov eax, esp
sub eax, dword [0x432010]
cmp eax, 0x100
jb 0x4186e2
cmp byte [esi], 0x28
je 0x41bd71
inc edi
call fcn.0041be69
jb 0x41bd8d
or ebp, ebp
je 0x41bd43
mov byte [edi - 1], 0xf
ret
cmp dword [edi + 4], 0
jne 0x41bd5c
cmp word [edi + 2], 0
jne 0x41bd64
cmp byte [edi + 1], 0
jne 0x41bd6a
mov byte [edi - 1], 1
inc edi
ret
mov byte [edi - 1], 8
add edi, 8
ret
mov byte [edi - 1], 4
scasd eax, dword es:[edi]
ret
mov byte [edi - 1], 2
scasw ax, word es:[edi]
ret
inc esi
push dword [0x4320c4]
call fcn.0041bc68
pop dword [0x4320c4]
lodsb al, byte [esi]
cmp al, 0x29
je 0x41bd8c
dec esi
mov al, 0x21
stosb byte es:[edi], al
ret
mov eax, dword [0x432030]
test eax, eax
je 0x41be1c
cmp eax, 0xffffffff
je 0x4187e8
push edi
push esi
lodsw ax, word [esi]
cmp al, 0x1a
jne 0x41bde5
movzx ecx, ah
call fcn.0041b85f
jb 0x41bde5
cmp al, 0x10
jne 0x41bde5
mov al, ah
shr ah, 4
cmp ah, 4
je 0x41be14
and ah, 0xfe
cmp ah, 8
je 0x41be14
cmp ah, 0xc
jae 0x41be14
cmp ah, 6
je 0x41be14
cmp al, 0x23
je 0x41be14
cmp al, 0x25
je 0x41be14
cmp al, 0x26
je 0x41be14
cmp al, 0x27
je 0x41be14
pop esi
mov edi, 0x42c3ef
call fcn.0041b7f9
pop edi
or al, al
jne 0x41be0d
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x4187e8
lodsb al, byte [esi]
movzx ecx, al
call fcn.0041b970
mov byte [edi - 1], 0x11
stosd dword es:[edi], eax
ret
mov eax, 0xf
jmp 0x41be07
pop edx
pop edi
mov byte [edi - 1], 0x10
stosb byte es:[edi], al
ret
dec edi
lodsb al, byte [esi]
cmp al, 0x1a
jne 0x4187e8
lodsb al, byte [esi]
mov cl, al
mov ch, 2
call fcn.0041969a
jb 0x4187e8
test edx, edx
je 0x41be51
push esi
mov esi, dword [edx + 8]
push dword [0x4320c4]
call fcn.0041bc68
pop dword [0x4320c4]
pop esi
ret
cmp eax, 0x419d4d
jne 0x4187e8
call fcn.00419d76
mov al, 4
stosb byte es:[edi], al
mov eax, dword [ebx + 4]
stosd dword es:[edi], eax
ret
Function at 0x41c365
Capabilities:
Query environment variable
Read .ini file

Disassembly:
or ecx, ecx
je 0x41c4ed
mov eax, dword [edi + 0xc]
mul ecx
mov dword [edi + 0xc], eax
mov ebx, edx
mov eax, dword [edi]
mul ecx
add eax, ebx
adc edx, 0
mov dword [edi], eax
mov ebx, edx
mov eax, dword [edi + 4]
mul ecx
add eax, ebx
adc edx, 0
mov dword [edi + 4], eax
or edx, edx
je 0x41c3be
mov eax, dword [edi]
shrd dword [edi + 0xc], eax, 1
mov eax, dword [edi + 4]
shrd dword [edi], eax, 1
shrd eax, edx, 1
mov dword [edi + 4], eax
shr edx, 1
inc dword [edi + 8]
cmp dword [edi + 8], 0x8000
jge 0x4187f2
jmp 0x41c391
ret

Function at 0x41c7d4
Capabilities:
Query environment variable
Read .ini file

Disassembly:
push 0x431bc1
jmp 0x418713
xor eax, eax
mov dword [0x43211c], eax
mov word [0x432026], ax
mov dword [0x43210c], eax
mov dword [0x432118], eax
mov dword [0x432144], eax
mov eax, dword [0x432088]
mov dword [0x4320b8], eax
mov eax, dword [0x432008]
mov dword [0x43202c], eax
mov eax, dword [0x43200c]
mov dword [0x4320bc], eax
mov esi, dword [0x432030]
mov edi, dword [0x432034]
xor eax, eax
mov dword [0x4320f0], eax
mov dword [0x4320f4], eax
mov dword [0x432098], eax
mov dword [0x4320b0], eax
mov dword [0x4320a4], eax
mov dword [0x432108], eax
mov dword [0x432114], eax
mov dword [0x4320a0], eax
mov dword [0x432168], eax
mov byte [0x432190], al
mov byte [0x432191], al
mov byte [0x432193], al
mov byte [0x432194], al
mov byte [0x432192], 0x10
call fcn.0041c9d0
call fcn.0041ca15
jae 0x41c869
mov eax, dword [0x43200c]
cmp eax, dword [0x4320bc]
je 0x41c88d
sub eax, 0x18
mov eax, dword [eax + 4]
mov dword [0x432048], eax
jmp 0x4188c0
call fcn.0042026f
mov eax, dword [0x432088]
cmp eax, dword [0x432004]
jae 0x41c94f
test byte [eax + 8], 8
je 0x41c8d1
mov cx, word [0x432026]
cmp cx, word [eax + 0x12]
jne 0x41c8d1
test byte [eax + 8], 1
je 0x41c8d1
sub cx, word [eax + 0x10]
cmp cx, 1
jne 0x41c8d1
and byte [eax + 8], 0xfe
or byte [0x432190], 0xff
test byte [eax + 8], 0x10
je 0x41c909
mov cx, word [0x432026]
and byte [eax + 8], 0xef
test byte [eax + 8], 0x20
jne 0x41c8f6
cmp cx, word [eax + 0x12]
jne 0x41c909
test byte [eax + 8], 8
je 0x41c909
jmp 0x41c902
test byte [eax + 8], 8
je 0x41c902
cmp cx, word [eax + 0x12]
je 0x41c909
or byte [0x432190], 0xff
test byte [eax + 8], 0x40
je 0x41c947
and byte [eax + 8], 0xbf
test byte [eax + 8], 4
jne 0x41c940
mov cx, word [0x432026]
test byte [eax + 8], 0x80
jne 0x41c934
cmp cx, word [eax + 0x10]
jne 0x41c947
test byte [eax + 8], 1
je 0x41c947
jmp 0x41c940
test byte [eax + 8], 1
je 0x41c940
cmp cx, word [eax + 0x10]
je 0x41c947
or byte [0x432190], 0xff
add eax, 0x20
jmp 0x41c897
cmp byte [0x432190], 0
jne 0x41c994
mov eax, dword [0x4320b0]
or eax, eax
je 0x41c9b3
mov dword [0x432048], eax
cmp dword [0x4320b4], 0x4187fc
jne 0x41c981
mov eax, dword [0x4320ac]
or eax, eax
je 0x41c981
test byte [eax + 8], 1
jne 0x41c994
call 0x41c986
mov eax, dword [0x4320b4]
sub eax, 0x41c986
add dword [esp], eax
ret
inc word [0x432026]
mov ax, word [0x432026]
cmp ax, word [0x432024]
je 0x418700
jmp 0x41c7f0
ret
Function at 0x41c9d0
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov ebx, dword [0x4320b8]
mov dword [ebx - 4], 0x10
mov dword [ebx - 8], 0x24
sub ebx, 0x2c
cmp ebx, edi
jbe 0x4186d8
mov dword [0x4320b8], ebx
mov dword [0x432098], ebx
xor eax, eax
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], eax
ret
Function at 0x41caf3
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov eax, edi
xor edx, edx
xor cl, cl
mov ebp, dword [0x432098]
sub eax, dword ds:[ebp]
sbb edx, dword ds:[ebp + 4]
sbb cl, byte ds:[ebp + 8]
jp 0x41cb12
call fcn.0041f137
mov byte [0x43218c], cl
test byte ds:[ebp + 0xa], 1
jne 0x41cb53
or byte [ebx + 9], 1
xchg dword [ebx], eax
xchg dword [ebx + 4], edx
mov ch, byte [ebx + 9]
shr ch, 1
and ch, 1
neg ch
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
sbb ch, cl
mov dword [0x4320f0], eax
mov dword [0x4320f4], edx
mov byte [0x432193], ch
or al, ch
or eax, edx
setne ah
jmp 0x41cb69
and byte [ebx + 9], 0xfe
cmp eax, dword [ebx]
mov dword [ebx], eax
setne ah
cmp edx, dword [ebx + 4]
mov dword [ebx + 4], edx
setne al
or ah, al
mov ebp, dword [0x432098]
mov ch, byte ds:[ebp + 9]
mov cl, byte [0x432182]
mov edx, dword ds:[ebp + 0x14]
mov ebp, dword ds:[ebp + 0x10]

Function at 0x41d20a
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov eax, dword [0x4320b8]
or eax, eax
je 0x41d23f
mov esi, dword [0x432088]
cmp esi, eax
je 0x41d23f
sub esi, 8
mov eax, dword [esi + 4]
mov ecx, dword [esi]
sub esi, ecx
cmp eax, 0x10
je 0x41d240
test eax, eax
jne 0x41d237
push esi
call fcn.004183bb
pop esi
cmp esi, dword [0x4320b8]
jne 0x41d21d
ret
mov ecx, dword [esi + 0x20]
jecxz 0x41d237
push esi
mov edi, dword [0x43202c]
mov esi, dword [0x43201c]
test esi, esi
je 0x41d2d0
xor ebx, ebx
lodsb al, byte [esi]
cmp edi, dword [0x4320bc]
jae 0x4186d8
stosb byte es:[edi], al
test al, al
je 0x41d27e
cmp al, 0x2f
je 0x41d27a
cmp al, 0x5c
je 0x41d27a
cmp al, 0x2e
jne 0x41d258
mov ebx, edi
jmp 0x41d258
xor ebx, ebx
jmp 0x41d258
test ebx, ebx
jne 0x41d288
mov byte [edi - 1], 0x2e
mov ebx, edi
mov edi, ebx
add ebx, ecx
inc ebx
cmp ebx, dword [0x4320bc]
jae 0x4186d8
mov esi, dword [esp]
mov esi, dword [esi + 0x18]
sub esi, ecx
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
mov edx, dword [0x43202c]
call fcn.00418317
jb 0x4186f6
mov esi, dword [esp]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
call fcn.00418346
jb 0x4186f6
call fcn.0041837c
pop esi
jmp 0x41d237
Function at 0x41e769
Capabilities:
Query environment variable
Read .ini file

Disassembly:
or al, al
je 0x41e7b4
cmp byte [esi + 8], al
jne 0x41e782
add byte [esi + 0xa], cl
jo 0x4187f2
jne 0x41e7b4
mov byte [esi + 8], 0
ret
cmp byte [esi + 9], al
jne 0x41e797
add byte [esi + 0xb], cl
jo 0x4187f2
jne 0x41e7b4
mov byte [esi + 9], 0
ret
cmp byte [esi + 8], 0
jne 0x41e7a4
mov byte [esi + 8], al
mov byte [esi + 0xa], cl
ret
cmp byte [esi + 9], 0
jne 0x4187d4
mov byte [esi + 9], al
mov byte [esi + 0xb], cl
ret

Function at 0x41e834
Capabilities:
Query environment variable
Read .ini file

Disassembly:
or al, al
je 0x41e7b4
neg cl
jo 0x4187f2
jmp 0x41e76d

Function at 0x41e9a4
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov al, byte [edi]
cbw
cwde
cdq
cmp edx, dword [edi + 4]
jne 0x4187f2
cmp eax, dword [edi]
jne 0x4187f2
ret

Function at 0x41ed7a
Capabilities:
Query environment variable
Read .ini file

Disassembly:
xor ebx, ebx
cmp dword [edi], 0
jne 0x41ed99
cmp dword [edi + 4], 0
jne 0x41ed99
cmp byte [0x432190], 0
je 0x4187f2
jmp 0x41ee60
cmp byte [esi + 0xd], 0
je 0x41edbf
mov eax, dword [esi]
mov edx, dword [esi + 4]
not eax
not edx
add eax, 1
adc edx, 0
mov dword [esi], eax
mov dword [esi + 4], edx
or eax, edx
je 0x4187f2
xor bx, 0xffff
cmp byte [edi + 0xd], 0
je 0x41ede4
mov eax, dword [edi]
mov edx, dword [edi + 4]
not eax
not edx
add eax, 1
adc edx, 0
mov dword [edi], eax
mov dword [edi + 4], edx
or eax, edx
je 0x4187f2
xor bl, 0xff
cmp dword [edi + 4], 0
jne 0x41ee02
mov ecx, dword [edi]
mov eax, dword [esi + 4]
xor edx, edx
div ecx
mov dword [esi + 4], eax
mov eax, dword [esi]
div ecx
mov dword [esi], eax
mov eax, edx
xor edx, edx
jmp 0x41ee60
push ebx
mov eax, dword [esi + 4]
xor edx, edx
div dword [edi + 4]
mov ebx, dword [esi]
mov dword [esi], eax
and dword [esi + 4], 0
mov ecx, edx
mul dword [edi]
cmp ecx, edx
ja 0x41ee2a
jb 0x41ee35
cmp ebx, eax
jae 0x41ee2a
dec dword [esi]
sub eax, dword [edi]
sbb edx, dword [edi + 4]
jae 0x41ee17
sub ebx, eax
sbb ecx, edx
mov edx, ecx
mov eax, ebx
pop ebx
jmp 0x41ee60
push eax
push edx
mov eax, edx
sub eax, ecx
xor edx, edx
div dword [edi + 4]
shr eax, 1
je 0x41ee5c
sub dword [esi], eax
push eax
mul dword [edi + 4]
sub dword [esp + 4], eax
pop eax
mul dword [edi]
sub dword [esp + 4], eax
sbb dword [esp], edx
pop edx
pop eax
jmp 0x41ee17
pop edx
pop eax
jmp 0x41ee21
or bh, bh
je 0x41ee76
not eax
not edx
add eax, 1
adc edx, 0
mov ecx, eax
or ecx, edx
jne 0x41ee76
not bh
or bl, bl
je 0x41ee8f
not dword [esi]
not dword [esi + 4]
add dword [esi], 1
adc dword [esi + 4], 0
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x41ee8f
not bl
mov byte [esi + 0xd], bl
ret

Function at 0x41ee93
Capabilities:
Query environment variable
Read .ini file

Disassembly:
cmp dword [0x432020], 0
je 0x41eeca
cmp byte [0x432190], 0
jne 0x41eeca
mov eax, dword [0x4320b8]
mov dword [eax - 4], 2
mov dword [eax - 8], 4
sub eax, 0xc
cmp eax, edi
jbe 0x4186d8
mov dword [0x4320b8], eax
mov dword [eax], ebx
ret
Function at 0x41f2db
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov byte [0x43216c], 0
lodsb al, byte [esi]
call fcn.00428b70
cmp al, 0x28
jne 0x4187e8
mov al, byte [0x43216c]
cmp al, 1
je 0x41f376
cmp al, 2
je 0x41f36a
cmp al, 4
je 0x41f361
cmp al, 6
je 0x41f357
cmp al, 8
je 0x41f34a
or al, al
jne 0x4187e8
mov byte [0x432180], al
call fcn.0041f321
mov eax, dword [edi]
mov edx, dword [edi + 4]
ret
call fcn.0041f261
mov byte [0x432189], 0
ret
call fcn.0041f220
movzx edx, dx
jmp 0x41f34f
call fcn.0041f1c6
xor edx, edx
jmp 0x41f34f
call fcn.0041f17e
xor edx, edx
movzx eax, ax
jmp 0x41f34f
call fcn.0041f0f3
xor edx, edx
movzx eax, al
jmp 0x41f34f

Function at 0x41f321
Capabilities:
Query environment variable
Read .ini file

Disassembly:
call fcn.0041e324
cmp word [edi + 8], 0
jne 0x4187e8
mov eax, dword [edi + 0x10]
mov dword [0x4320f8], eax
mov al, byte [edi + 0xd]
mov byte [0x432189], al
mov al, byte [edi + 0xc]
mov byte [0x432188], al
ret