joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b010
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f9c]
mov dword [ebp - 0x1c], 0xe444e39e
mov dword [ebp - 0x18], 0x5468c5e
mov dword [ebp - 0x14], 0x3d1d6ecf
mov dword [ebp - 0x10], 0xe88096e5
mov dword [ebp - 0xc], 0x3b2994b6
mov word [ebp - 8], 0x250e
push edi
test esi, esi
jne 0x41b1c2
mov esi, dword [0x517e70]
test esi, esi
jne 0x41b071
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041fef0
test esi, esi
je 0x41b130
cmp byte [ebp - 0x1c], 0x30
je 0x41b130
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41b126
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41b126
add eax, 0x18
je 0x41b126
add eax, 0x60
mov dword [ebp - 0x30], eax
je 0x41b126
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
add eax, esi
je 0x41b126
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x20], ecx
je 0x41b126
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x28], edx
je 0x41b126
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41b126
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x24], eax
je 0x41b126
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x1c]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41b115
test dl, dl
je 0x41b111
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41b115
add ecx, 2
add eax, 2
test dl, dl
jne 0x41b0f5
xor eax, eax
jmp 0x41b11a
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b143
mov ecx, dword [ebp - 0x20]
inc edi
cmp edi, ebx
jb 0x41b0ed
mov dword [0x517f9c], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41b1b2
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41b1b2
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41b1a4
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b1b4
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b1b4
add esi, ecx
mov dword [0x517f9c], esi
test esi, esi
je 0x41b130
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41b240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f64]
mov dword [ebp - 0x14], 0x1b5d1ba6
mov dword [ebp - 0x10], 0x27ef0b
mov dword [ebp - 0xc], 0x4ba36ef7
mov word [ebp - 8], 0x7219
mov byte [ebp - 6], 0x10
push edi
test esi, esi
jne 0x41b3ed
mov esi, dword [0x517e74]
test esi, esi
jne 0x41b297
call fcn.0041bb20
mov esi, eax
mov dword [0x517e74], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x41b35b
cmp byte [ebp - 0x14], 0x30
je 0x41b35b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41b351
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41b351
add eax, 0x18
je 0x41b351
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x41b351
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x41b351
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x41b351
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x41b351
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41b351
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x41b351
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41b340
test dl, dl
je 0x41b33c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41b340
add ecx, 2
add eax, 2
test dl, dl
jne 0x41b320
xor eax, eax
jmp 0x41b345
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b36e
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x41b313
mov dword [0x517f64], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41b3dd
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41b3dd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41b3cf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b3df
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b3df
add esi, ecx
mov dword [0x517f64], esi
test esi, esi
je 0x41b35b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41b400
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ff8]
mov dword [ebp - 0x18], 0x1b591ba2
mov dword [ebp - 0x14], 0xdf468293
mov dword [ebp - 0x10], 0x7c9c6e17
mov dword [ebp - 0xc], 0x7c8649fd
mov word [ebp - 8], 0x94e9
mov byte [ebp - 6], 0x7b
push edi
test esi, esi
jne 0x41b5af
mov esi, dword [0x517e9c]
test esi, esi
jne 0x41b45e
call fcn.004195b0
mov esi, eax
mov dword [0x517e9c], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41b51d
cmp byte [ebp - 0x18], 0x30
je 0x41b51d
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41b513
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41b513
add eax, 0x18
je 0x41b513
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41b513
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41b513
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41b513
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41b513
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41b513
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41b513
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41b502
test dl, dl
je 0x41b4fe
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41b502
add ecx, 2
add eax, 2
test dl, dl
jne 0x41b4e2
xor eax, eax
jmp 0x41b507
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b530
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41b4da
mov dword [0x517ff8], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41b59f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41b59f
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41b591
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b5a1
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b5a1
add esi, ecx
mov dword [0x517ff8], esi
test esi, esi
je 0x41b51d
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41b5d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517ff4]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0x5f8ef6f
mov dword [ebp - 0x10], 0xd1292917
mov dword [ebp - 0xc], 0x83c39ac3
mov word [ebp - 8], 0x66e9
push edi
test esi, esi
jne 0x41b77d
mov esi, dword [0x517e9c]
test esi, esi
jne 0x41b62a
call fcn.004195b0
mov esi, eax
mov dword [0x517e9c], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41b6eb
cmp byte [ebp - 0x18], 0x30
je 0x41b6eb
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41b6e1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41b6e1
add eax, 0x18
je 0x41b6e1
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41b6e1
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41b6e1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41b6e1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41b6e1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41b6e1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41b6e1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41b6d0
test dl, dl
je 0x41b6cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41b6d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x41b6b0
xor eax, eax
jmp 0x41b6d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b6fe
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41b6a6
mov dword [0x517ff4], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41b76d
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41b76d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41b75f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b76f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b76f
add esi, ecx
mov dword [0x517ff4], esi
test esi, esi
je 0x41b6eb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41b790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518000]
mov dword [ebp - 0x20], 0xb243a61b
mov dword [ebp - 0x1c], 0xe465434
mov dword [ebp - 0x18], 0x5fd6e17
mov dword [ebp - 0x14], 0xdfdb76ba
mov dword [ebp - 0x10], 0x46be4bd7
mov dword [ebp - 0xc], 0xec307fc
mov byte [ebp - 8], 0x6f
push edi
test esi, esi
jne 0x41b94d
mov esi, dword [0x517e70]
test esi, esi
jne 0x41b7f6
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0041fef0
test esi, esi
je 0x41b8bb
cmp byte [ebp - 0x20], 0x30
je 0x41b8bb
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41b8b1
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41b8b1
add eax, 0x18
je 0x41b8b1
add eax, 0x60
mov dword [ebp - 0x34], eax
je 0x41b8b1
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
add eax, esi
je 0x41b8b1
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x24], ecx
je 0x41b8b1
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x2c], edx
je 0x41b8b1
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41b8b1
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x28], eax
je 0x41b8b1
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x20]
add eax, esi
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41b8a0
test dl, dl
je 0x41b89c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41b8a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x41b880
xor eax, eax
jmp 0x41b8a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x41b8ce
mov ecx, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jb 0x41b872
mov dword [0x518000], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41b93d
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41b93d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41b92f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b93f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41b93f
add esi, ecx
mov dword [0x518000], esi
test esi, esi
je 0x41b8bb
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41b960
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x517f30]
mov dword [ebp - 0x18], 0x9646c4e4
mov dword [ebp - 0x14], 0x23fd2d28
mov dword [ebp - 0x10], 0x1bfb72ca
mov dword [ebp - 0xc], 0xccfd6a9d
mov dword [ebp - 8], 0xfabe276c
push edi
test esi, esi
jne 0x41bb0d
mov esi, dword [0x517e70]
test esi, esi
jne 0x41b9bb
call fcn.00418770
mov esi, eax
mov dword [0x517e70], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41ba7b
cmp byte [ebp - 0x18], 0x30
je 0x41ba7b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41ba71
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41ba71
add eax, 0x18
je 0x41ba71
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41ba71
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41ba71
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41ba71
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41ba71
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41ba71
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41ba71
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41ba60
test dl, dl
je 0x41ba5c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41ba60
add ecx, 2
add eax, 2
test dl, dl
jne 0x41ba40
xor eax, eax
jmp 0x41ba65
sbb eax, eax
or eax, 1
test eax, eax
je 0x41ba8e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41ba37
mov dword [0x517f30], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41bafd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41bafd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41baef
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41baff
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41baff
add esi, ecx
mov dword [0x517f30], esi
test esi, esi
je 0x41ba7b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41bb80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518080]
mov dword [ebp - 0x14], 0x1b5d1ba6
mov dword [ebp - 0x10], 0x59cefb8
mov dword [ebp - 0xc], 0xdbfd9cff
mov word [ebp - 8], 0xb3e5
mov byte [ebp - 6], 0x80
push edi
test esi, esi
jne 0x41bd2d
mov esi, dword [0x517eb0]
test esi, esi
jne 0x41bbd7
call fcn.0041aa00
mov esi, eax
mov dword [0x517eb0], esi
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041fef0
test esi, esi
je 0x41bc9b
cmp byte [ebp - 0x14], 0x30
je 0x41bc9b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41bc91
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41bc91
add eax, 0x18
je 0x41bc91
add eax, 0x60
mov dword [ebp - 0x28], eax
je 0x41bc91
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
add eax, esi
je 0x41bc91
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x18], ecx
je 0x41bc91
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x20], edx
je 0x41bc91
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41bc91
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x1c], eax
je 0x41bc91
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x14]
add eax, esi
nop dword [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41bc80
test dl, dl
je 0x41bc7c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41bc80
add ecx, 2
add eax, 2
test dl, dl
jne 0x41bc60
xor eax, eax
jmp 0x41bc85
sbb eax, eax
or eax, 1
test eax, eax
je 0x41bcae
mov ecx, dword [ebp - 0x18]
inc edi
cmp edi, ebx
jb 0x41bc53
mov dword [0x518080], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41bd1d
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41bd1d
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41bd0f
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41bd1f
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41bd1f
add esi, ecx
mov dword [0x518080], esi
test esi, esi
je 0x41bc9b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret
Function at 0x41bd40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x457664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x518084]
mov dword [ebp - 0x18], 0xe458e3e3
mov dword [ebp - 0x14], 0x3b2befb8
mov dword [ebp - 0x10], 0xedb9cff
mov dword [ebp - 0xc], 0x239c0219
mov word [ebp - 8], 0x4528
push edi
test esi, esi
jne 0x41beed
mov esi, dword [0x517eb0]
test esi, esi
jne 0x41bd9a
call fcn.0041aa00
mov esi, eax
mov dword [0x517eb0], esi
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0041fef0
test esi, esi
je 0x41be5b
cmp byte [ebp - 0x18], 0x30
je 0x41be5b
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x41be51
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x41be51
add eax, 0x18
je 0x41be51
add eax, 0x60
mov dword [ebp - 0x2c], eax
je 0x41be51
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
add eax, esi
je 0x41be51
mov ecx, dword [eax + 0x20]
add ecx, esi
mov dword [ebp - 0x1c], ecx
je 0x41be51
mov edx, dword [eax + 0x1c]
add edx, esi
mov dword [ebp - 0x24], edx
je 0x41be51
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x41be51
mov eax, dword [eax + 0x24]
mov edi, 0
add eax, esi
mov dword [ebp - 0x20], eax
je 0x41be51
mov eax, dword [ecx + edi*4]
lea ecx, [ebp - 0x18]
add eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x41be40
test dl, dl
je 0x41be3c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x41be40
add ecx, 2
add eax, 2
test dl, dl
jne 0x41be20
xor eax, eax
jmp 0x41be45
sbb eax, eax
or eax, 1
test eax, eax
je 0x41be6e
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, ebx
jb 0x41be16
mov dword [0x518084], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441849
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
mov ecx, dword [ecx + eax*4]
cmp ecx, edx
jb 0x41bedd
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
add eax, edx
cmp ecx, eax
jae 0x41bedd
lea eax, [ecx + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov edi, eax
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 0xc
mov esi, eax
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
test ecx, ecx
je 0x41becf
lea eax, [esi + 1]
push eax
push ecx
call fcn.004131f0
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41bedf
push edi
xor esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x41bedf
add esi, ecx
mov dword [0x518084], esi
test esi, esi
je 0x41be5b
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441849
mov esp, ebp
pop ebp
ret