joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417df0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518060]
mov dword [ebp - 0x20], 0xe440e48a
mov dword [ebp - 0x1c], 0x353b519c
mov dword [ebp - 0x18], 0xdf5b6ecf
mov dword [ebp - 0x14], 0x62be9680
mov dword [ebp - 0x10], 0xdffd45aa
mov dword [ebp - 0xc], 0x64463d0e
mov word [ebp - 8], 0x2788
push edi
test esi, esi
jne 0x417fad
mov esi, dword [0x517e70]
test esi, esi
jne 0x417e58
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x417f1b
cmp byte [ebp - 0x20], 0x30
je 0x417f1b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x417f11
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x417f11
add eax, 0x18
je 0x417f11
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x417f11
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x417f11
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x417f11
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x417f11
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x417f11
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x417f11
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x417f00
test dl, dl
je 0x417efc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x417f00
add ecx, 2
add eax, 2
test dl, dl
jne 0x417ee0
xor eax, eax
jmp 0x417f05
sbb eax, eax
or eax, 1
test eax, eax
je 0x417f2e
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x417ed4
mov dword [0x518060], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x417f9d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x417f9d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x417f8f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417f9f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x417f9f
add esi, ecx
mov dword [0x518060], esi
test esi, esi
je 0x417f1b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x417fc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ed4]
mov dword [ebp - 0x18], 0x1b591ba2
mov dword [ebp - 0x14], 0xe846921b
mov dword [ebp - 0x10], 0x23f61ccf
mov dword [ebp - 0xc], 0x272d9d
mov word [ebp - 8], 0x4048
mov byte [ebp - 6], 0x9c
push edi
test esi, esi
jne 0x41816f
mov esi, dword [0x517e74]
test esi, esi
jne 0x41801e
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x4180dd
cmp byte [ebp - 0x18], 0x30
je 0x4180dd
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4180d3
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4180d3
add eax, 0x18
je 0x4180d3
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x4180d3
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x4180d3
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x4180d3
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x4180d3
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4180d3
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x4180d3
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4180c2
test dl, dl
je 0x4180be
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4180c2
add ecx, 2
add eax, 2
test dl, dl
jne 0x4180a2
xor eax, eax
jmp 0x4180c7
sbb eax, eax
or eax, 1
test eax, eax
je 0x4180f0
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41809a
mov dword [0x517ed4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41815f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41815f
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x418151
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418161
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418161
add esi, ecx
mov dword [0x517ed4], esi
test esi, esi
je 0x4180dd
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x418190
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ebc]
mov dword [ebp - 0x24], 0xbe4fa21b
mov dword [ebp - 0x20], 0xe810f21b
mov dword [ebp - 0x1c], 0x23f6cecf
mov dword [ebp - 0x18], 0xe8274c19
mov dword [ebp - 0x14], 0x7e297837
mov dword [ebp - 0x10], 0xd17b1aa7
mov dword [ebp - 0xc], 0x64fa03ec
mov byte [ebp - 8], 0x62
push edi
test esi, esi
jne 0x41834e
mov esi, dword [0x517e74]
test esi, esi
jne 0x4181fd
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call fcn.0041fef0
test esi, esi
je 0x4182bc
cmp byte [ebp - 0x24], 0x30
je 0x4182bc
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4182b2
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4182b2
add eax, 0x18
je 0x4182b2
add eax, 0x60
mov dword [ebp - 0x38], eax
je 0x4182b2
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
add eax, esi
je 0x4182b2
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x28], ecx
je 0x4182b2
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x30], edx
je 0x4182b2
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4182b2
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x2c], eax
je 0x4182b2
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x24]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4182a1
test dl, dl
je 0x41829d
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4182a1
add ecx, 2
add eax, 2
test dl, dl
jne 0x418281
xor eax, eax
jmp 0x4182a6
sbb eax, eax
or eax, 1
test eax, eax
je 0x4182cf
mov ecx, dword [ebp - 0x28]
inc edi
cmp edi, ebx
jb 0x418279
mov dword [0x517ebc], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41833e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41833e
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x418330
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418340
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418340
add esi, ecx
mov dword [0x517ebc], esi
test esi, esi
je 0x4182bc
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x418370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518094]
mov dword [ebp - 0x20], 0xb243a61b
mov dword [ebp - 0x1c], 0x974600f7
mov dword [ebp - 0x18], 0x7827ceb6
mov dword [ebp - 0x14], 0xddfd72be
mov dword [ebp - 0x10], 0x7dbe94b6
mov dword [ebp - 0xc], 0x35623dbb
mov byte [ebp - 8], 0x33
push edi
test esi, esi
jne 0x41852d
mov esi, dword [0x517e70]
test esi, esi
jne 0x4183d6
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x41849b
cmp byte [ebp - 0x20], 0x30
je 0x41849b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x418491
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x418491
add eax, 0x18
je 0x418491
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x418491
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x418491
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x418491
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x418491
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x418491
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x418491
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x418480
test dl, dl
je 0x41847c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x418480
add ecx, 2
add eax, 2
test dl, dl
jne 0x418460
xor eax, eax
jmp 0x418485
sbb eax, eax
or eax, 1
test eax, eax
je 0x4184ae
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x418452
mov dword [0x518094], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41851d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41851d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41850f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41851f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41851f
add esi, ecx
mov dword [0x518094], esi
test esi, esi
je 0x41849b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x4185a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f04]
mov dword [ebp - 0x18], 0x1b591ba2
mov dword [ebp - 0x14], 0xa646d28f
mov dword [ebp - 0x10], 0x5b274849
mov dword [ebp - 0xc], 0xcf1dca17
mov word [ebp - 8], 0x3b71
mov byte [ebp - 6], 0xb3
push edi
test esi, esi
jne 0x41874f
mov esi, dword [0x517e70]
test esi, esi
jne 0x4185fe
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x4186bd
cmp byte [ebp - 0x18], 0x30
je 0x4186bd
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4186b3
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4186b3
add eax, 0x18
je 0x4186b3
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x4186b3
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x4186b3
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x4186b3
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x4186b3
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4186b3
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x4186b3
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4186a2
test dl, dl
je 0x41869e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4186a2
add ecx, 2
add eax, 2
test dl, dl
jne 0x418682
xor eax, eax
jmp 0x4186a7
sbb eax, eax
or eax, 1
test eax, eax
je 0x4186d0
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41867a
mov dword [0x517f04], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41873f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41873f
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x418731
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418741
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418741
add esi, ecx
mov dword [0x517f04], esi
test esi, esi
je 0x4186bd
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x418c00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f90]
mov dword [ebp - 0x1c], 0xe444e39e
mov dword [ebp - 0x18], 0xc3461af9
mov dword [ebp - 0x14], 0x35276e15
mov dword [ebp - 0x10], 0x7e862dc6
mov dword [ebp - 0xc], 0xd6e3703a
mov word [ebp - 8], 0x9ee4
push edi
test esi, esi
jne 0x418db2
mov esi, dword [0x517e78]
test esi, esi
jne 0x418c61
call fcn.004133b0
mov esi, eax
mov dword [0x517e78], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x418d20
cmp byte [ebp - 0x1c], 0x30
je 0x418d20
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x418d16
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x418d16
add eax, 0x18
je 0x418d16
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x418d16
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x418d16
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x418d16
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x418d16
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x418d16
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x418d16
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x418d05
test dl, dl
je 0x418d01
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x418d05
add ecx, 2
add eax, 2
test dl, dl
jne 0x418ce5
xor eax, eax
jmp 0x418d0a
sbb eax, eax
or eax, 1
test eax, eax
je 0x418d33
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x418cdd
mov dword [0x517f90], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x418da2
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x418da2
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x418d94
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418da4
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418da4
add esi, ecx
mov dword [0x517f90], esi
test esi, esi
je 0x418d20
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x418dd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f2c]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0x5b84ef9c
mov dword [ebp - 0x10], 0x23c72fb2
mov dword [ebp - 0xc], 0x1bfb4cc3
mov word [ebp - 8], 0x6645
push edi
test esi, esi
jne 0x418f7d
mov esi, dword [0x517e70]
test esi, esi
jne 0x418e2a
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x418eeb
cmp byte [ebp - 0x18], 0x30
je 0x418eeb
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x418ee1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x418ee1
add eax, 0x18
je 0x418ee1
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x418ee1
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x418ee1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x418ee1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x418ee1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x418ee1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x418ee1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x418ed0
test dl, dl
je 0x418ecc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x418ed0
add ecx, 2
add eax, 2
test dl, dl
jne 0x418eb0
xor eax, eax
jmp 0x418ed5
sbb eax, eax
or eax, 1
test eax, eax
je 0x418efe
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x418ea6
mov dword [0x517f2c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x418f6d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x418f6d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x418f5f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418f6f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x418f6f
add esi, ecx
mov dword [0x517f2c], esi
test esi, esi
je 0x418eeb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x418f90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518034]
mov dword [ebp - 0x1c], 0xb6475a1b
mov dword [ebp - 0x18], 0x30fdef93
mov dword [ebp - 0x14], 0x1b9a9ccf
mov dword [ebp - 0x10], 0x23cd76a4
mov dword [ebp - 0xc], 0x549c40d7
mov byte [ebp - 8], 0xe
push edi
test esi, esi
jne 0x419140
mov esi, dword [0x517e94]
test esi, esi
jne 0x418fef
call fcn.004194f0
mov esi, eax
mov dword [0x517e94], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x4190ae
cmp byte [ebp - 0x1c], 0x30
je 0x4190ae
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4190a4
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4190a4
add eax, 0x18
je 0x4190a4
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x4190a4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x4190a4
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x4190a4
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x4190a4
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4190a4
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x4190a4
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419093
test dl, dl
je 0x41908f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419093
add ecx, 2
add eax, 2
test dl, dl
jne 0x419073
xor eax, eax
jmp 0x419098
sbb eax, eax
or eax, 1
test eax, eax
je 0x4190c1
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41906b
mov dword [0x518034], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x419130
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x419130
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x419122
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419132
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419132
add esi, ecx
mov dword [0x518034], esi
test esi, esi
je 0x4190ae
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret