static int check_fnstenv_instr(uint8_t* buf, int buf_len, int offset)
{
        uint8_t *buf_cpy = buf + offset;
        int rv, i;

        /*
         * This array is the fnstenv [esp - 12] instruction in Metasploit.
         */
        static const uint8_t fnstenv_instr[] = { 0xd9, 0x74, 0x24, 0xf4 };
        static const int N = sizeof(fnstenv_instr);

        if (buf_len - offset >= N) {
                for (i = 0; i < N && buf_cpy[i] == fnstenv_instr[i]; i++)
                        continue;

                if (i == N) {
                        rv = 1;
                        goto out;
                }
        }