joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f68]
mov dword [ebp - 0x1c], 0xb6475a1b
mov dword [ebp - 0x18], 0x5bbeef04
mov dword [ebp - 0x14], 0x55135cf
mov dword [ebp - 0x10], 0x64279817
mov dword [ebp - 0xc], 0x9a9ca051
mov byte [ebp - 8], 0xa7
push edi
test esi, esi
jne 0x417110
mov esi, dword [0x517e7c]
test esi, esi
jne 0x416fbf
call fcn.00418540
mov esi, eax
mov dword [0x517e7c], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41707e
cmp byte [ebp - 0x1c], 0x30
je 0x41707e
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417074
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x417074
add eax, 0x18
je 0x417074
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x417074
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x417074
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x417074
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x417074
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x417074
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x417074
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417063
test dl, dl
je 0x41705f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417063
add ecx, 2
add eax, 2
test dl, dl
jne 0x417043
xor eax, eax
jmp 0x417068
sbb eax, eax
or eax, 1
test eax, eax
je 0x417091
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41703b
mov dword [0x517f68], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x417100
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x417100
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4170f2
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417102
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417102
add esi, ecx
mov dword [0x517f68], esi
test esi, esi
je 0x41707e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x417130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518090]
mov dword [ebp - 0x2c], 0x1b751bbe
mov dword [ebp - 0x28], 0x8329efb5
mov dword [ebp - 0x24], 0x3d8048cf
mov dword [ebp - 0x20], 0xdddb94c3
mov dword [ebp - 0x1c], 0x7cfd3951
mov dword [ebp - 0x18], 0x6410397c
mov dword [ebp - 0x14], 0x7c833eec
mov dword [ebp - 0x10], 0x468182be
mov dword [ebp - 0xc], 0x972268e1
mov word [ebp - 8], 0x2bf5
mov byte [ebp - 6], 0x20
push edi
test esi, esi
jne 0x417302
mov esi, dword [0x517e70]
test esi, esi
jne 0x4171b1
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0041fef0
test esi, esi
je 0x417270
cmp byte [ebp - 0x2c], 0x30
je 0x417270
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417266
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x417266
add eax, 0x18
je 0x417266
add eax, 0x60
mov dword [ebp - 0x40], eax
je 0x417266
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
add eax, esi
je 0x417266
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x30], ecx
je 0x417266
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x38], edx
je 0x417266
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x417266
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x34], eax
je 0x417266
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x2c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417255
test dl, dl
je 0x417251
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417255
add ecx, 2
add eax, 2
test dl, dl
jne 0x417235
xor eax, eax
jmp 0x41725a
sbb eax, eax
or eax, 1
test eax, eax
je 0x417283
mov ecx, dword [ebp - 0x30]
inc edi
cmp edi, ebx
jb 0x41722d
mov dword [0x518090], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4172f2
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4172f2
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4172e4
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4172f4
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4172f4
add esi, ecx
mov dword [0x518090], esi
test esi, esi
je 0x417270
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x417320
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f98]
mov dword [ebp - 0x20], 0xb243a61b
mov dword [ebp - 0x1c], 0x6446276b
mov dword [ebp - 0x18], 0xdd8e96cf
mov dword [ebp - 0x14], 0x62fd31ba
mov dword [ebp - 0x10], 0xa3be40b6
mov dword [ebp - 0xc], 0xd662c2ea
mov byte [ebp - 8], 0x88
push edi
test esi, esi
jne 0x4174dd
mov esi, dword [0x517e70]
test esi, esi
jne 0x417386
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x41744b
cmp byte [ebp - 0x20], 0x30
je 0x41744b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417441
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x417441
add eax, 0x18
je 0x417441
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x417441
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x417441
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x417441
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x417441
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x417441
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x417441
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417430
test dl, dl
je 0x41742c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417430
add ecx, 2
add eax, 2
test dl, dl
jne 0x417410
xor eax, eax
jmp 0x417435
sbb eax, eax
or eax, 1
test eax, eax
je 0x41745e
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x417402
mov dword [0x517f98], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4174cd
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4174cd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4174bf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4174cf
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4174cf
add esi, ecx
mov dword [0x517f98], esi
test esi, esi
je 0x41744b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x4174f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fc4]
mov dword [ebp - 0x1c], 0xb6475a1b
mov dword [ebp - 0x18], 0x6486ef6b
mov dword [ebp - 0x14], 0xdd6f29cf
mov dword [ebp - 0x10], 0x83fd9880
mov dword [ebp - 0xc], 0x9a9c4051
mov byte [ebp - 8], 0xfc
push edi
test esi, esi
jne 0x4176a0
mov esi, dword [0x517e74]
test esi, esi
jne 0x41754f
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41760e
cmp byte [ebp - 0x1c], 0x30
je 0x41760e
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417604
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x417604
add eax, 0x18
je 0x417604
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x417604
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x417604
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x417604
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x417604
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x417604
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x417604
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4175f3
test dl, dl
je 0x4175ef
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4175f3
add ecx, 2
add eax, 2
test dl, dl
jne 0x4175d3
xor eax, eax
jmp 0x4175f8
sbb eax, eax
or eax, 1
test eax, eax
je 0x417621
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x4175cb
mov dword [0x517fc4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x417690
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x417690
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x417682
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417692
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417692
add esi, ecx
mov dword [0x517fc4], esi
test esi, esi
je 0x41760e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x4176c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fb8]
mov dword [ebp - 0x20], 0x1b411baa
mov dword [ebp - 0x1c], 0x527ef5e
mov dword [ebp - 0x18], 0x23f835cf
mov dword [ebp - 0x14], 0xa3564919
mov dword [ebp - 0x10], 0x64274003
mov dword [ebp - 0xc], 0x46f807bd
mov word [ebp - 8], 0x2788
mov byte [ebp - 6], 0xdc
push edi
test esi, esi
jne 0x41787d
mov esi, dword [0x517e70]
test esi, esi
jne 0x41772c
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x4177eb
cmp byte [ebp - 0x20], 0x30
je 0x4177eb
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4177e1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4177e1
add eax, 0x18
je 0x4177e1
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x4177e1
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x4177e1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x4177e1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x4177e1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4177e1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x4177e1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4177d0
test dl, dl
je 0x4177cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4177d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4177b0
xor eax, eax
jmp 0x4177d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4177fe
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x4177a8
mov dword [0x517fb8], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41786d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41786d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41785f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41786f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41786f
add esi, ecx
mov dword [0x517fb8], esi
test esi, esi
je 0x4177eb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x417890
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f8c]
mov dword [ebp - 0x1c], 0x8242f7e4
mov dword [ebp - 0x18], 0x527ef5e
mov dword [ebp - 0x14], 0xdff835cf
mov dword [ebp - 0x10], 0xa3f89819
mov dword [ebp - 0xc], 0x5127b6
mov dword [ebp - 8], 0x23622599
push edi
test esi, esi
jne 0x417a43
mov esi, dword [0x517e78]
test esi, esi
jne 0x4178f2
call fcn.004133b0
mov esi, eax
mov dword [0x517e78], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x4179b1
cmp byte [ebp - 0x1c], 0x30
je 0x4179b1
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4179a7
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4179a7
add eax, 0x18
je 0x4179a7
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x4179a7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x4179a7
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x4179a7
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x4179a7
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4179a7
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x4179a7
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417996
test dl, dl
je 0x417992
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417996
add ecx, 2
add eax, 2
test dl, dl
jne 0x417976
xor eax, eax
jmp 0x41799b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4179c4
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41796e
mov dword [0x517f8c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x417a33
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x417a33
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x417a25
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417a35
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417a35
add esi, ecx
mov dword [0x517f8c], esi
test esi, esi
je 0x4179b1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x417a60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fd4]
mov dword [ebp - 0x18], 0x1b591ba2
mov dword [ebp - 0x14], 0xd1461aaa
mov dword [ebp - 0x10], 0x83be30cf
mov dword [ebp - 0xc], 0x5ac18be
mov word [ebp - 8], 0x4048
mov byte [ebp - 6], 0x9c
push edi
test esi, esi
jne 0x417c0f
mov esi, dword [0x517e90]
test esi, esi
jne 0x417abe
call fcn.0041ac30
mov esi, eax
mov dword [0x517e90], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x417b7d
cmp byte [ebp - 0x18], 0x30
je 0x417b7d
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417b73
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x417b73
add eax, 0x18
je 0x417b73
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x417b73
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x417b73
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x417b73
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x417b73
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x417b73
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x417b73
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417b62
test dl, dl
je 0x417b5e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417b62
add ecx, 2
add eax, 2
test dl, dl
jne 0x417b42
xor eax, eax
jmp 0x417b67
sbb eax, eax
or eax, 1
test eax, eax
je 0x417b90
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x417b3a
mov dword [0x517fd4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x417bff
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x417bff
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x417bf1
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417c01
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417c01
add esi, ecx
mov dword [0x517fd4], esi
test esi, esi
je 0x417b7d
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x417c30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fc8]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0x83a9ef9c
mov dword [ebp - 0x10], 0x5f892cf
mov dword [ebp - 0xc], 0x64db8a17
mov word [ebp - 8], 0x3848
push edi
test esi, esi
jne 0x417ddd
mov esi, dword [0x517e70]
test esi, esi
jne 0x417c8a
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x417d4b
cmp byte [ebp - 0x18], 0x30
je 0x417d4b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417d41
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x417d41
add eax, 0x18
je 0x417d41
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x417d41
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x417d41
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x417d41
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x417d41
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x417d41
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x417d41
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417d30
test dl, dl
je 0x417d2c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417d30
add ecx, 2
add eax, 2
test dl, dl
jne 0x417d10
xor eax, eax
jmp 0x417d35
sbb eax, eax
or eax, 1
test eax, eax
je 0x417d5e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x417d06
mov dword [0x517fc8], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x417dcd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x417dcd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x417dbf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417dcf
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417dcf
add esi, ecx
mov dword [0x517fc8], esi
test esi, esi
je 0x417d4b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret