joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517fdc]
mov dword [ebp - 0x20], 0xe440e48a
mov dword [ebp - 0x1c], 0x31f88eca
mov dword [ebp - 0x18], 0x5f829cf
mov dword [ebp - 0x14], 0x272b17
mov dword [ebp - 0x10], 0x23dbe694
mov dword [ebp - 0xc], 0x78462500
mov word [ebp - 8], 0xe988
push edi
test esi, esi
jne 0x41931d
mov esi, dword [0x517e94]
test esi, esi
jne 0x4191c8
call fcn.004194f0
mov esi, eax
mov dword [0x517e94], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x41928b
cmp byte [ebp - 0x20], 0x30
je 0x41928b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x419281
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x419281
add eax, 0x18
je 0x419281
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x419281
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x419281
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x419281
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x419281
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x419281
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x419281
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419270
test dl, dl
je 0x41926c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419270
add ecx, 2
add eax, 2
test dl, dl
jne 0x419250
xor eax, eax
jmp 0x419275
sbb eax, eax
or eax, 1
test eax, eax
je 0x41929e
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x419244
mov dword [0x517fdc], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41930d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41930d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4192ff
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41930f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41930f
add esi, ecx
mov dword [0x517fdc], esi
test esi, esi
je 0x41928b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x419330
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518030]
mov dword [ebp - 0x18], 0x9646c4e4
mov dword [ebp - 0x14], 0x6427331b
mov dword [ebp - 0x10], 0xa9fdeecf
mov dword [ebp - 0xc], 0x8380495c
mov dword [ebp - 8], 0x549c216c
push edi
test esi, esi
jne 0x4194dd
mov esi, dword [0x517e94]
test esi, esi
jne 0x41938b
call fcn.004194f0
mov esi, eax
mov dword [0x517e94], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41944b
cmp byte [ebp - 0x18], 0x30
je 0x41944b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x419441
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x419441
add eax, 0x18
je 0x419441
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x419441
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x419441
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x419441
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x419441
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x419441
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x419441
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419430
test dl, dl
je 0x41942c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419430
add ecx, 2
add eax, 2
test dl, dl
jne 0x419410
xor eax, eax
jmp 0x419435
sbb eax, eax
or eax, 1
test eax, eax
je 0x41945e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x419407
mov dword [0x518030], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4194cd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4194cd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x4194bf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4194cf
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4194cf
add esi, ecx
mov dword [0x518030], esi
test esi, esi
je 0x41944b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x419610
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517eb8]
mov dword [ebp - 0x14], 0x8a5ac9e4
mov dword [ebp - 0x10], 0xdf46d250
mov dword [ebp - 0xc], 0xe57b48d1
mov dword [ebp - 8], 0x5864a17
push edi
test esi, esi
jne 0x4197b5
mov esi, dword [0x517e70]
test esi, esi
jne 0x419664
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x419723
cmp byte [ebp - 0x14], 0x30
je 0x419723
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x419719
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x419719
add eax, 0x18
je 0x419719
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x419719
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x419719
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x419719
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x419719
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x419719
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x419719
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419708
test dl, dl
je 0x419704
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419708
add ecx, 2
add eax, 2
test dl, dl
jne 0x4196e8
xor eax, eax
jmp 0x41970d
sbb eax, eax
or eax, 1
test eax, eax
je 0x419736
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x4196e0
mov dword [0x517eb8], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x4197a5
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x4197a5
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x419797
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4197a7
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x4197a7
add esi, ecx
mov dword [0x517eb8], esi
test esi, esi
je 0x419723
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x4197d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f08]
mov dword [ebp - 0x1c], 0xb6475a1b
mov dword [ebp - 0x18], 0xdffdef50
mov dword [ebp - 0x14], 0xe57b43d1
mov dword [ebp - 0x10], 0xd18696c3
mov dword [ebp - 0xc], 0x3fdc6d2
mov byte [ebp - 8], 0x76
push edi
test esi, esi
jne 0x419980
mov esi, dword [0x517e78]
test esi, esi
jne 0x41982f
call fcn.004133b0
mov esi, eax
mov dword [0x517e78], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x4198ee
cmp byte [ebp - 0x1c], 0x30
je 0x4198ee
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x4198e4
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x4198e4
add eax, 0x18
je 0x4198e4
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x4198e4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x4198e4
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x4198e4
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x4198e4
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4198e4
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x4198e4
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4198d3
test dl, dl
je 0x4198cf
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4198d3
add ecx, 2
add eax, 2
test dl, dl
jne 0x4198b3
xor eax, eax
jmp 0x4198d8
sbb eax, eax
or eax, 1
test eax, eax
je 0x419901
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x4198ab
mov dword [0x517f08], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x419970
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x419970
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x419962
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419972
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419972
add esi, ecx
mov dword [0x517f08], esi
test esi, esi
je 0x4198ee
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x419a00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517eec]
mov dword [ebp - 0x14], 0x8a5ac9e4
mov dword [ebp - 0x10], 0x83468c8b
mov dword [ebp - 0xc], 0x7cfd83cf
mov dword [ebp - 8], 0xd3fd5319
push edi
test esi, esi
jne 0x419ba5
mov esi, dword [0x517e78]
test esi, esi
jne 0x419a54
call fcn.004133b0
mov esi, eax
mov dword [0x517e78], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x419b13
cmp byte [ebp - 0x14], 0x30
je 0x419b13
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x419b09
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x419b09
add eax, 0x18
je 0x419b09
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x419b09
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x419b09
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x419b09
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x419b09
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x419b09
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x419b09
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419af8
test dl, dl
je 0x419af4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419af8
add ecx, 2
add eax, 2
test dl, dl
jne 0x419ad8
xor eax, eax
jmp 0x419afd
sbb eax, eax
or eax, 1
test eax, eax
je 0x419b26
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x419ad0
mov dword [0x517eec], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x419b95
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x419b95
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x419b87
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419b97
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419b97
add esi, ecx
mov dword [0x517eec], esi
test esi, esi
je 0x419b13
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x419bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ee8]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0x46a9ef2d
mov dword [ebp - 0x10], 0x2548cf
mov dword [ebp - 0xc], 0xd33602f3
mov word [ebp - 8], 0x38c8
push edi
test esi, esi
jne 0x419d6d
mov esi, dword [0x517e78]
test esi, esi
jne 0x419c1a
call fcn.004133b0
mov esi, eax
mov dword [0x517e78], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x419cdb
cmp byte [ebp - 0x18], 0x30
je 0x419cdb
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x419cd1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x419cd1
add eax, 0x18
je 0x419cd1
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x419cd1
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x419cd1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x419cd1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x419cd1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x419cd1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x419cd1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419cc0
test dl, dl
je 0x419cbc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419cc0
add ecx, 2
add eax, 2
test dl, dl
jne 0x419ca0
xor eax, eax
jmp 0x419cc5
sbb eax, eax
or eax, 1
test eax, eax
je 0x419cee
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x419c96
mov dword [0x517ee8], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x419d5d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x419d5d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x419d4f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419d5f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419d5f
add esi, ecx
mov dword [0x517ee8], esi
test esi, esi
je 0x419cdb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x419d80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f00]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0xa9ef53
mov dword [ebp - 0x10], 0x1b2548cf
mov dword [ebp - 0xc], 0xd33602c3
mov word [ebp - 8], 0x38c8
push edi
test esi, esi
jne 0x419f2d
mov esi, dword [0x517e78]
test esi, esi
jne 0x419dda
call fcn.004133b0
mov esi, eax
mov dword [0x517e78], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x419e9b
cmp byte [ebp - 0x18], 0x30
je 0x419e9b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x419e91
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x419e91
add eax, 0x18
je 0x419e91
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x419e91
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x419e91
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x419e91
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x419e91
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x419e91
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x419e91
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419e80
test dl, dl
je 0x419e7c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419e80
add ecx, 2
add eax, 2
test dl, dl
jne 0x419e60
xor eax, eax
jmp 0x419e85
sbb eax, eax
or eax, 1
test eax, eax
je 0x419eae
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x419e56
mov dword [0x517f00], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x419f1d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x419f1d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x419f0f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419f1f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x419f1f
add esi, ecx
mov dword [0x517f00], esi
test esi, esi
je 0x419e9b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x419f40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ee4]
mov dword [ebp - 0x1c], 0xb6475a1b
mov dword [ebp - 0x18], 0xd1a9effd
mov dword [ebp - 0x14], 0x358078cf
mov dword [ebp - 0x10], 0x5254c0a
mov dword [ebp - 0xc], 0x1a2b3999
mov byte [ebp - 8], 0xa2
push edi
test esi, esi
jne 0x41a0f0
mov esi, dword [0x517e78]
test esi, esi
jne 0x419f9f
call fcn.004133b0
mov esi, eax
mov dword [0x517e78], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41a05e
cmp byte [ebp - 0x1c], 0x30
je 0x41a05e
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41a054
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41a054
add eax, 0x18
je 0x41a054
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x41a054
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x41a054
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x41a054
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x41a054
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41a054
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x41a054
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41a043
test dl, dl
je 0x41a03f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41a043
add ecx, 2
add eax, 2
test dl, dl
jne 0x41a023
xor eax, eax
jmp 0x41a048
sbb eax, eax
or eax, 1
test eax, eax
je 0x41a071
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41a01b
mov dword [0x517ee4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41a0e0
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41a0e0
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41a0d2
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41a0e2
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41a0e2
add esi, ecx
mov dword [0x517ee4], esi
test esi, esi
je 0x41a05e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret