joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518064]
mov dword [ebp - 0x18], 0xaa5b5e1b
mov dword [ebp - 0x14], 0x64292973
mov dword [ebp - 0x10], 0x78fd31b2
mov dword [ebp - 0xc], 0xd123f7c6
mov byte [ebp - 8], 0x1e
push edi
test esi, esi
jne 0x41c0ad
mov esi, dword [0x517e9c]
test esi, esi
jne 0x41bf58
call fcn.004195b0
mov esi, eax
mov dword [0x517e9c], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41c01b
cmp byte [ebp - 0x18], 0x30
je 0x41c01b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41c011
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41c011
add eax, 0x18
je 0x41c011
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41c011
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41c011
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41c011
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41c011
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41c011
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41c011
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41c000
test dl, dl
je 0x41bffc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41c000
add ecx, 2
add eax, 2
test dl, dl
jne 0x41bfe0
xor eax, eax
jmp 0x41c005
sbb eax, eax
or eax, 1
test eax, eax
je 0x41c02e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41bfd4
mov dword [0x518064], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41c09d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41c09d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41c08f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c09f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c09f
add esi, ecx
mov dword [0x518064], esi
test esi, esi
je 0x41c01b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41c0c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518044]
mov dword [ebp - 0x14], 0x1b5d1ba6
mov dword [ebp - 0x10], 0x78cdef8b
mov dword [ebp - 0xc], 0x7ce348f1
mov word [ebp - 8], 0x205
mov byte [ebp - 6], 0xf8
push edi
test esi, esi
jne 0x41c26d
mov esi, dword [0x517ea8]
test esi, esi
jne 0x41c117
call fcn.0041ddf0
mov esi, eax
mov dword [0x517ea8], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x41c1db
cmp byte [ebp - 0x14], 0x30
je 0x41c1db
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41c1d1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41c1d1
add eax, 0x18
je 0x41c1d1
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x41c1d1
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x41c1d1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x41c1d1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x41c1d1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41c1d1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x41c1d1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41c1c0
test dl, dl
je 0x41c1bc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41c1c0
add ecx, 2
add eax, 2
test dl, dl
jne 0x41c1a0
xor eax, eax
jmp 0x41c1c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x41c1ee
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x41c193
mov dword [0x518044], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41c25d
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41c25d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41c24f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c25f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c25f
add esi, ecx
mov dword [0x518044], esi
test esi, esi
je 0x41c1db
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41c280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518040]
mov dword [ebp - 0x18], 0x9646c4e4
mov dword [ebp - 0x14], 0xd6298eca
mov dword [ebp - 0x10], 0x59c9cf1
mov dword [ebp - 0xc], 0x64809845
mov dword [ebp - 8], 0x4b3b386c
push edi
test esi, esi
jne 0x41c42d
mov esi, dword [0x517ea8]
test esi, esi
jne 0x41c2db
call fcn.0041ddf0
mov esi, eax
mov dword [0x517ea8], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41c39b
cmp byte [ebp - 0x18], 0x30
je 0x41c39b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41c391
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41c391
add eax, 0x18
je 0x41c391
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41c391
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41c391
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41c391
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41c391
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41c391
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41c391
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41c380
test dl, dl
je 0x41c37c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41c380
add ecx, 2
add eax, 2
test dl, dl
jne 0x41c360
xor eax, eax
jmp 0x41c385
sbb eax, eax
or eax, 1
test eax, eax
je 0x41c3ae
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41c357
mov dword [0x518040], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41c41d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41c41d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41c40f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c41f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c41f
add esi, ecx
mov dword [0x518040], esi
test esi, esi
je 0x41c39b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41c440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x51803c]
mov dword [ebp - 0x14], 0x1b5d1ba6
mov dword [ebp - 0x10], 0xd1cdef6b
mov dword [ebp - 0xc], 0x64e335f1
mov word [ebp - 8], 0x205
mov byte [ebp - 6], 0x9c
push edi
test esi, esi
jne 0x41c5ed
mov esi, dword [0x517ea8]
test esi, esi
jne 0x41c497
call fcn.0041ddf0
mov esi, eax
mov dword [0x517ea8], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x41c55b
cmp byte [ebp - 0x14], 0x30
je 0x41c55b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41c551
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41c551
add eax, 0x18
je 0x41c551
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x41c551
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x41c551
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x41c551
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x41c551
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41c551
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x41c551
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41c540
test dl, dl
je 0x41c53c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41c540
add ecx, 2
add eax, 2
test dl, dl
jne 0x41c520
xor eax, eax
jmp 0x41c545
sbb eax, eax
or eax, 1
test eax, eax
je 0x41c56e
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x41c513
mov dword [0x51803c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41c5dd
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41c5dd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41c5cf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c5df
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c5df
add esi, ecx
mov dword [0x51803c], esi
test esi, esi
je 0x41c55b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41c660
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x51802c]
mov dword [ebp - 0x1c], 0x1b451bae
mov dword [ebp - 0x18], 0x1bfd2d3d
mov dword [ebp - 0x14], 0x64274de9
mov dword [ebp - 0x10], 0x7c2324c3
mov dword [ebp - 0xc], 0xbe9cc63a
mov word [ebp - 8], 0x41a7
mov byte [ebp - 6], 0xb3
push edi
test esi, esi
jne 0x41c81d
mov esi, dword [0x517e80]
test esi, esi
jne 0x41c6c5
call fcn.0041c600
mov esi, eax
mov dword [0x517e80], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41c78b
cmp byte [ebp - 0x1c], 0x30
je 0x41c78b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41c781
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41c781
add eax, 0x18
je 0x41c781
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x41c781
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x41c781
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x41c781
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x41c781
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41c781
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x41c781
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41c770
test dl, dl
je 0x41c76c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41c770
add ecx, 2
add eax, 2
test dl, dl
jne 0x41c750
xor eax, eax
jmp 0x41c775
sbb eax, eax
or eax, 1
test eax, eax
je 0x41c79e
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41c745
mov dword [0x51802c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41c80d
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41c80d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41c7ff
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c80f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c80f
add esi, ecx
mov dword [0x51802c], esi
test esi, esi
je 0x41c78b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41c830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518008]
mov dword [ebp - 0x18], 0x1b591ba2
mov dword [ebp - 0x14], 0x1b46353d
mov dword [ebp - 0x10], 0x64f848e9
mov dword [ebp - 0xc], 0x64233719
mov word [ebp - 8], 0x4599
mov byte [ebp - 6], 0xf8
push edi
test esi, esi
jne 0x41c9df
mov esi, dword [0x517e80]
test esi, esi
jne 0x41c88e
call fcn.0041c600
mov esi, eax
mov dword [0x517e80], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41c94d
cmp byte [ebp - 0x18], 0x30
je 0x41c94d
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41c943
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41c943
add eax, 0x18
je 0x41c943
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41c943
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41c943
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41c943
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41c943
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41c943
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41c943
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41c932
test dl, dl
je 0x41c92e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41c932
add ecx, 2
add eax, 2
test dl, dl
jne 0x41c912
xor eax, eax
jmp 0x41c937
sbb eax, eax
or eax, 1
test eax, eax
je 0x41c960
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41c90a
mov dword [0x518008], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41c9cf
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41c9cf
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41c9c1
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c9d1
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41c9d1
add esi, ecx
mov dword [0x518008], esi
test esi, esi
je 0x41c94d
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41ca00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518028]
mov dword [ebp - 0x30], 0xe470e4a9
mov dword [ebp - 0x2c], 0x1bfdef3d
mov dword [ebp - 0x28], 0x649c29e9
mov dword [ebp - 0x24], 0xdb62ac17
mov dword [ebp - 0x20], 0xdfc7e683
mov dword [ebp - 0x1c], 0xdddb230e
mov dword [ebp - 0x18], 0xdfff6237
mov dword [ebp - 0x14], 0x5826acd
mov dword [ebp - 0x10], 0xd105b054
mov dword [ebp - 0xc], 0xff60f5
mov word [ebp - 8], 0x2ec6
push edi
test esi, esi
jne 0x41cbd5
mov esi, dword [0x517e80]
test esi, esi
jne 0x41ca84
call fcn.0041c600
mov esi, eax
mov dword [0x517e80], esi
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.0041fef0
test esi, esi
je 0x41cb43
cmp byte [ebp - 0x30], 0x30
je 0x41cb43
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41cb39
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41cb39
add eax, 0x18
je 0x41cb39
add eax, 0x60
mov dword [ebp - 0x44], eax
je 0x41cb39
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
add eax, esi
je 0x41cb39
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x34], ecx
je 0x41cb39
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x3c], edx
je 0x41cb39
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41cb39
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x38], eax
je 0x41cb39
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x30]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41cb28
test dl, dl
je 0x41cb24
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41cb28
add ecx, 2
add eax, 2
test dl, dl
jne 0x41cb08
xor eax, eax
jmp 0x41cb2d
sbb eax, eax
or eax, 1
test eax, eax
je 0x41cb56
mov ecx, dword [ebp - 0x34]
inc edi
cmp edi, ebx
jb 0x41cb00
mov dword [0x518028], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41cbc5
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41cbc5
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41cbb7
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41cbc7
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41cbc7
add esi, ecx
mov dword [0x518028], esi
test esi, esi
je 0x41cb43
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41cbf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518018]
mov dword [ebp - 0x20], 0xe440e48a
mov dword [ebp - 0x1c], 0x1b84803d
mov dword [ebp - 0x18], 0x649c9ce9
mov dword [ebp - 0x14], 0xd162961b
mov dword [ebp - 0x10], 0xfafda0ed
mov dword [ebp - 0xc], 0xdf46258e
mov word [ebp - 8], 0xf6ec
push edi
test esi, esi
jne 0x41cdad
mov esi, dword [0x517e80]
test esi, esi
jne 0x41cc58
call fcn.0041c600
mov esi, eax
mov dword [0x517e80], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x41cd1b
cmp byte [ebp - 0x20], 0x30
je 0x41cd1b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41cd11
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41cd11
add eax, 0x18
je 0x41cd11
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x41cd11
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x41cd11
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x41cd11
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x41cd11
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41cd11
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x41cd11
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41cd00
test dl, dl
je 0x41ccfc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41cd00
add ecx, 2
add eax, 2
test dl, dl
jne 0x41cce0
xor eax, eax
jmp 0x41cd05
sbb eax, eax
or eax, 1
test eax, eax
je 0x41cd2e
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x41ccd4
mov dword [0x518018], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41cd9d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41cd9d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41cd8f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41cd9f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41cd9f
add esi, ecx
mov dword [0x518018], esi
test esi, esi
je 0x41cd1b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret