joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413740
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518068]
mov dword [ebp - 0x14], 0x8a5ac9e4
mov dword [ebp - 0x10], 0x784654d3
mov dword [ebp - 0xc], 0x584a5b6
mov dword [ebp - 8], 0xdff892ab
push edi
test esi, esi
jne 0x4138e5
mov esi, dword [0x517e70]
test esi, esi
jne 0x413794
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x413853
cmp byte [ebp - 0x14], 0x30
je 0x413853
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x413849
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x413849
add eax, 0x18
je 0x413849
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x413849
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x413849
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x413849
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x413849
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x413849
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x413849
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413838
test dl, dl
je 0x413834
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413838
add ecx, 2
add eax, 2
test dl, dl
jne 0x413818
xor eax, eax
jmp 0x41383d
sbb eax, eax
or eax, 1
test eax, eax
je 0x413866
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x413810
mov dword [0x518068], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4138d5
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4138d5
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4138c7
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4138d7
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4138d7
add esi, ecx
mov dword [0x518068], esi
test esi, esi
je 0x413853
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x413900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fec]
mov dword [ebp - 0x1c], 0xb6475a1b
mov dword [ebp - 0x18], 0x6486ef81
mov dword [ebp - 0x14], 0x5f82915
mov dword [ebp - 0x10], 0x78fd3165
mov dword [ebp - 0xc], 0xdb23c6d7
mov byte [ebp - 8], 0xdf
push edi
test esi, esi
jne 0x413ab0
mov esi, dword [0x517e98]
test esi, esi
jne 0x41395f
call fcn.00419550
mov esi, eax
mov dword [0x517e98], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x413a1e
cmp byte [ebp - 0x1c], 0x30
je 0x413a1e
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x413a14
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x413a14
add eax, 0x18
je 0x413a14
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x413a14
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x413a14
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x413a14
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x413a14
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x413a14
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x413a14
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413a03
test dl, dl
je 0x4139ff
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413a03
add ecx, 2
add eax, 2
test dl, dl
jne 0x4139e3
xor eax, eax
jmp 0x413a08
sbb eax, eax
or eax, 1
test eax, eax
je 0x413a31
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x4139db
mov dword [0x517fec], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x413aa0
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x413aa0
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x413a92
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413aa2
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413aa2
add esi, ecx
mov dword [0x517fec], esi
test esi, esi
je 0x413a1e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x413ad0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fe0]
mov dword [ebp - 0x18], 0x1b591ba2
mov dword [ebp - 0x14], 0x23460050
mov dword [ebp - 0x10], 0x23db4815
mov dword [ebp - 0xc], 0x648034ba
mov word [ebp - 8], 0x2e09
mov byte [ebp - 6], 0x5b
push edi
test esi, esi
jne 0x413c7f
mov esi, dword [0x517e98]
test esi, esi
jne 0x413b2e
call fcn.00419550
mov esi, eax
mov dword [0x517e98], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x413bed
cmp byte [ebp - 0x18], 0x30
je 0x413bed
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x413be3
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x413be3
add eax, 0x18
je 0x413be3
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x413be3
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x413be3
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x413be3
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x413be3
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x413be3
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x413be3
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413bd2
test dl, dl
je 0x413bce
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413bd2
add ecx, 2
add eax, 2
test dl, dl
jne 0x413bb2
xor eax, eax
jmp 0x413bd7
sbb eax, eax
or eax, 1
test eax, eax
je 0x413c00
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x413baa
mov dword [0x517fe0], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x413c6f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x413c6f
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x413c61
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413c71
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413c71
add esi, ecx
mov dword [0x517fe0], esi
test esi, esi
je 0x413bed
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x413ca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fe8]
mov dword [ebp - 0x20], 0xb243a61b
mov dword [ebp - 0x1c], 0x23468c50
mov dword [ebp - 0x18], 0x23db6e15
mov dword [ebp - 0x14], 0x58072b8
mov dword [ebp - 0x10], 0x64842ee7
mov dword [ebp - 0xc], 0xd12325da
mov byte [ebp - 8], 0x4f
push edi
test esi, esi
jne 0x413e5d
mov esi, dword [0x517e98]
test esi, esi
jne 0x413d06
call fcn.00419550
mov esi, eax
mov dword [0x517e98], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x413dcb
cmp byte [ebp - 0x20], 0x30
je 0x413dcb
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x413dc1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x413dc1
add eax, 0x18
je 0x413dc1
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x413dc1
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x413dc1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x413dc1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x413dc1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x413dc1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x413dc1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413db0
test dl, dl
je 0x413dac
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413db0
add ecx, 2
add eax, 2
test dl, dl
jne 0x413d90
xor eax, eax
jmp 0x413db5
sbb eax, eax
or eax, 1
test eax, eax
je 0x413dde
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x413d82
mov dword [0x517fe8], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x413e4d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x413e4d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x413e3f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413e4f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x413e4f
add esi, ecx
mov dword [0x517fe8], esi
test esi, esi
je 0x413dcb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x413e70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ff0]
mov dword [ebp - 0x1c], 0xe444e39e
mov dword [ebp - 0x18], 0xd1463555
mov dword [ebp - 0x14], 0x6425e415
mov dword [ebp - 0x10], 0x512731ba
mov dword [ebp - 0xc], 0xdb1d75d7
mov word [ebp - 8], 0x7adf
push edi
test esi, esi
jne 0x414022
mov esi, dword [0x517e98]
test esi, esi
jne 0x413ed1
call fcn.00419550
mov esi, eax
mov dword [0x517e98], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x413f90
cmp byte [ebp - 0x1c], 0x30
je 0x413f90
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x413f86
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x413f86
add eax, 0x18
je 0x413f86
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x413f86
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x413f86
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x413f86
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x413f86
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x413f86
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x413f86
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x413f75
test dl, dl
je 0x413f71
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x413f75
add ecx, 2
add eax, 2
test dl, dl
jne 0x413f55
xor eax, eax
jmp 0x413f7a
sbb eax, eax
or eax, 1
test eax, eax
je 0x413fa3
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x413f4d
mov dword [0x517ff0], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x414012
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x414012
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x414004
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414014
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414014
add esi, ecx
mov dword [0x517ff0], esi
test esi, esi
je 0x413f90
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x414040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fe4]
mov dword [ebp - 0x18], 0x1b591ba2
mov dword [ebp - 0x14], 0x23465450
mov dword [ebp - 0x10], 0x23806e15
mov dword [ebp - 0xc], 0x9c22e5
mov word [ebp - 8], 0x3909
mov byte [ebp - 6], 2
push edi
test esi, esi
jne 0x4141ef
mov esi, dword [0x517e98]
test esi, esi
jne 0x41409e
call fcn.00419550
mov esi, eax
mov dword [0x517e98], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41415d
cmp byte [ebp - 0x18], 0x30
je 0x41415d
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x414153
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x414153
add eax, 0x18
je 0x414153
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x414153
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x414153
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x414153
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x414153
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x414153
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x414153
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414142
test dl, dl
je 0x41413e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414142
add ecx, 2
add eax, 2
test dl, dl
jne 0x414122
xor eax, eax
jmp 0x414147
sbb eax, eax
or eax, 1
test eax, eax
je 0x414170
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41411a
mov dword [0x517fe4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4141df
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4141df
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4141d1
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4141e1
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4141e1
add esi, ecx
mov dword [0x517fe4], esi
test esi, esi
je 0x41415d
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x414270
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fd0]
mov dword [ebp - 0x1c], 0xb6475a1b
mov dword [ebp - 0x18], 0x7625ef28
mov dword [ebp - 0x14], 0x64fd291b
mov dword [ebp - 0x10], 0x5db9617
mov dword [ebp - 0xc], 0xdbfd3b11
mov byte [ebp - 8], 0xe
push edi
test esi, esi
jne 0x414420
mov esi, dword [0x517e70]
test esi, esi
jne 0x4142cf
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41438e
cmp byte [ebp - 0x1c], 0x30
je 0x41438e
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x414384
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x414384
add eax, 0x18
je 0x414384
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x414384
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x414384
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x414384
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x414384
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x414384
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x414384
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414373
test dl, dl
je 0x41436f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414373
add ecx, 2
add eax, 2
test dl, dl
jne 0x414353
xor eax, eax
jmp 0x414378
sbb eax, eax
or eax, 1
test eax, eax
je 0x4143a1
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41434b
mov dword [0x517fd0], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x414410
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x414410
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x414402
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414412
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414412
add esi, ecx
mov dword [0x517fd0], esi
test esi, esi
je 0x41438e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x414440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f28]
mov dword [ebp - 0x1c], 0x1b451bae
mov dword [ebp - 0x18], 0x3f3b8228
mov dword [ebp - 0x14], 0x64fd6e1b
mov dword [ebp - 0x10], 0x7cdb52be
mov dword [ebp - 0xc], 0xbefdd2d2
mov word [ebp - 8], 0x44c4
mov byte [ebp - 6], 0x23
push edi
test esi, esi
jne 0x4145fd
mov esi, dword [0x517e70]
test esi, esi
jne 0x4144a5
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41456b
cmp byte [ebp - 0x1c], 0x30
je 0x41456b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x414561
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x414561
add eax, 0x18
je 0x414561
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x414561
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x414561
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x414561
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x414561
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x414561
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x414561
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414550
test dl, dl
je 0x41454c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414550
add ecx, 2
add eax, 2
test dl, dl
jne 0x414530
xor eax, eax
jmp 0x414555
sbb eax, eax
or eax, 1
test eax, eax
je 0x41457e
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x414525
mov dword [0x517f28], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4145ed
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4145ed
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4145df
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4145ef
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4145ef
add esi, ecx
mov dword [0x517f28], esi
test esi, esi
je 0x41456b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret