joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4149b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ec4]
mov dword [ebp - 0x14], 0x8a5ac9e4
mov dword [ebp - 0x10], 0x46d216
mov dword [ebp - 0xc], 0x4ba392ca
mov dword [ebp - 8], 0x351034e5
push edi
test esi, esi
jne 0x414b55
mov esi, dword [0x517e74]
test esi, esi
jne 0x414a04
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x414ac3
cmp byte [ebp - 0x14], 0x30
je 0x414ac3
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x414ab9
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x414ab9
add eax, 0x18
je 0x414ab9
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x414ab9
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x414ab9
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x414ab9
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x414ab9
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x414ab9
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x414ab9
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414aa8
test dl, dl
je 0x414aa4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414aa8
add ecx, 2
add eax, 2
test dl, dl
jne 0x414a88
xor eax, eax
jmp 0x414aad
sbb eax, eax
or eax, 1
test eax, eax
je 0x414ad6
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x414a80
mov dword [0x517ec4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x414b45
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x414b45
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x414b37
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414b47
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414b47
add esi, ecx
mov dword [0x517ec4], esi
test esi, esi
je 0x414ac3
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x414b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fb4]
mov dword [ebp - 0x24], 0xe44ce496
mov dword [ebp - 0x20], 0x7d7bef28
mov dword [ebp - 0x1c], 0xdb6e9b
mov dword [ebp - 0x18], 0x5f849fd
mov dword [ebp - 0x14], 0x642794d2
mov dword [ebp - 0x10], 0x64f8d299
mov dword [ebp - 0xc], 0x1b2e7e04
mov word [ebp - 8], 0x6a85
push edi
test esi, esi
jne 0x414d30
mov esi, dword [0x517e70]
test esi, esi
jne 0x414bdf
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.0041fef0
test esi, esi
je 0x414c9e
cmp byte [ebp - 0x24], 0x30
je 0x414c9e
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x414c94
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x414c94
add eax, 0x18
je 0x414c94
add eax, 0x60
mov dword [ebp - 0x38], eax
je 0x414c94
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
add eax, esi
je 0x414c94
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x28], ecx
je 0x414c94
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x30], edx
je 0x414c94
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x414c94
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x2c], eax
je 0x414c94
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x24]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414c83
test dl, dl
je 0x414c7f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414c83
add ecx, 2
add eax, 2
test dl, dl
jne 0x414c63
xor eax, eax
jmp 0x414c88
sbb eax, eax
or eax, 1
test eax, eax
je 0x414cb1
mov ecx, dword [ebp - 0x28]
inc edi
cmp edi, ebx
jb 0x414c5b
mov dword [0x517fb4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x414d20
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x414d20
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x414d12
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414d22
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414d22
add esi, ecx
mov dword [0x517fb4], esi
test esi, esi
je 0x414c9e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x414d50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fb0]
mov dword [ebp - 0x24], 0xe44ce496
mov dword [ebp - 0x20], 0x7d7bef28
mov dword [ebp - 0x1c], 0xdb6e9b
mov dword [ebp - 0x18], 0x5f849fd
mov dword [ebp - 0x14], 0x642794d2
mov dword [ebp - 0x10], 0x64f8d299
mov dword [ebp - 0xc], 0x1b2ef604
mov word [ebp - 8], 0x6a85
push edi
test esi, esi
jne 0x414f10
mov esi, dword [0x517e70]
test esi, esi
jne 0x414dbf
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.0041fef0
test esi, esi
je 0x414e7e
cmp byte [ebp - 0x24], 0x30
je 0x414e7e
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x414e74
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x414e74
add eax, 0x18
je 0x414e74
add eax, 0x60
mov dword [ebp - 0x38], eax
je 0x414e74
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
add eax, esi
je 0x414e74
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x28], ecx
je 0x414e74
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x30], edx
je 0x414e74
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x414e74
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x2c], eax
je 0x414e74
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x24]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414e63
test dl, dl
je 0x414e5f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414e63
add ecx, 2
add eax, 2
test dl, dl
jne 0x414e43
xor eax, eax
jmp 0x414e68
sbb eax, eax
or eax, 1
test eax, eax
je 0x414e91
mov ecx, dword [ebp - 0x28]
inc edi
cmp edi, ebx
jb 0x414e3b
mov dword [0x517fb0], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x414f00
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x414f00
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x414ef2
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414f02
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x414f02
add esi, ecx
mov dword [0x517fb0], esi
test esi, esi
je 0x414e7e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x414f30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f60]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0xa9efb8
mov dword [ebp - 0x10], 0x4ba392e9
mov dword [ebp - 0xc], 0x108ae5
mov word [ebp - 8], 0x38ed
push edi
test esi, esi
jne 0x4150dd
mov esi, dword [0x517e74]
test esi, esi
jne 0x414f8a
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41504b
cmp byte [ebp - 0x18], 0x30
je 0x41504b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x415041
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x415041
add eax, 0x18
je 0x415041
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x415041
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x415041
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x415041
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x415041
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x415041
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x415041
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x415030
test dl, dl
je 0x41502c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x415030
add ecx, 2
add eax, 2
test dl, dl
jne 0x415010
xor eax, eax
jmp 0x415035
sbb eax, eax
or eax, 1
test eax, eax
je 0x41505e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x415006
mov dword [0x517f60], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4150cd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4150cd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4150bf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4150cf
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4150cf
add esi, ecx
mov dword [0x517f60], esi
test esi, esi
je 0x41504b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x4150f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f4c]
mov dword [ebp - 0x14], 0x8a5ac9e4
mov dword [ebp - 0x10], 0x461ab8
mov dword [ebp - 0xc], 0x4ba392e9
mov dword [ebp - 8], 0x1076e5
push edi
test esi, esi
jne 0x415295
mov esi, dword [0x517e74]
test esi, esi
jne 0x415144
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x415203
cmp byte [ebp - 0x14], 0x30
je 0x415203
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4151f9
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4151f9
add eax, 0x18
je 0x4151f9
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x4151f9
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x4151f9
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x4151f9
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x4151f9
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4151f9
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x4151f9
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4151e8
test dl, dl
je 0x4151e4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4151e8
add ecx, 2
add eax, 2
test dl, dl
jne 0x4151c8
xor eax, eax
jmp 0x4151ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x415216
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x4151c0
mov dword [0x517f4c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x415285
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x415285
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x415277
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x415287
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x415287
add esi, ecx
mov dword [0x517f4c], esi
test esi, esi
je 0x415203
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x4152b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x51805c]
mov dword [ebp - 0x20], 0xb243a61b
mov dword [ebp - 0x1c], 0x1b46d293
mov dword [ebp - 0x18], 0xe829cecf
mov dword [ebp - 0x14], 0xc39ca117
mov dword [ebp - 0x10], 0x5fdc6d7
mov dword [ebp - 0xc], 0x83623937
mov byte [ebp - 8], 0x88
push edi
test esi, esi
jne 0x41546d
mov esi, dword [0x517e7c]
test esi, esi
jne 0x415316
call fcn.00418540
mov esi, eax
mov dword [0x517e7c], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x4153db
cmp byte [ebp - 0x20], 0x30
je 0x4153db
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4153d1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4153d1
add eax, 0x18
je 0x4153d1
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x4153d1
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x4153d1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x4153d1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x4153d1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4153d1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x4153d1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4153c0
test dl, dl
je 0x4153bc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4153c0
add ecx, 2
add eax, 2
test dl, dl
jne 0x4153a0
xor eax, eax
jmp 0x4153c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4153ee
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x415392
mov dword [0x51805c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41545d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41545d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41544f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41545f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41545f
add esi, ecx
mov dword [0x51805c], esi
test esi, esi
je 0x4153db
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x415480
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fa4]
mov dword [ebp - 0x1c], 0x1b451bae
mov dword [ebp - 0x18], 0x1bb3008b
mov dword [ebp - 0x14], 0xdffd48cf
mov dword [ebp - 0x10], 0x64cd3192
mov dword [ebp - 0xc], 0xbebe94af
mov word [ebp - 8], 0x2599
mov byte [ebp - 6], 0x62
push edi
test esi, esi
jne 0x41563d
mov esi, dword [0x517e70]
test esi, esi
jne 0x4154e5
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x4155ab
cmp byte [ebp - 0x1c], 0x30
je 0x4155ab
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4155a1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4155a1
add eax, 0x18
je 0x4155a1
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x4155a1
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x4155a1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x4155a1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x4155a1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4155a1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x4155a1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x415590
test dl, dl
je 0x41558c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x415590
add ecx, 2
add eax, 2
test dl, dl
jne 0x415570
xor eax, eax
jmp 0x415595
sbb eax, eax
or eax, 1
test eax, eax
je 0x4155be
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x415565
mov dword [0x517fa4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41562d
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41562d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41561f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41562f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41562f
add esi, ecx
mov dword [0x517fa4], esi
test esi, esi
je 0x4155ab
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x415650
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fa0]
mov dword [ebp - 0x1c], 0xe444e39e
mov dword [ebp - 0x18], 0xd146d28b
mov dword [ebp - 0x14], 0x359c48cf
mov dword [ebp - 0x10], 0xfd9617
mov dword [ebp - 0xc], 0x9a29a051
mov word [ebp - 8], 0x25a1
push edi
test esi, esi
jne 0x415802
mov esi, dword [0x517e70]
test esi, esi
jne 0x4156b1
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x415770
cmp byte [ebp - 0x1c], 0x30
je 0x415770
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x415766
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x415766
add eax, 0x18
je 0x415766
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x415766
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x415766
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x415766
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x415766
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x415766
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x415766
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x415755
test dl, dl
je 0x415751
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x415755
add ecx, 2
add eax, 2
test dl, dl
jne 0x415735
xor eax, eax
jmp 0x41575a
sbb eax, eax
or eax, 1
test eax, eax
je 0x415783
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41572d
mov dword [0x517fa0], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4157f2
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4157f2
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4157e4
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4157f4
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4157f4
add esi, ecx
mov dword [0x517fa0], esi
test esi, esi
je 0x415770
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret