rule dumpImportState
{
condition:
pe.dbg("imphash", pe.imphash()) and
pe.dbg("import_errors", pe.import_errors) and
pe.dbg("NumImports" , pe.number_of_imports-1) and
for all i in (0 .. pe.number_of_imports):(
pe.dbg( pe.dll_imports[i].funcCount, pe.dll_imports[i].name)
)
}