joyce8/EMBER2024-capa huggingface dataset:
Function at 0x558290
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
mov esi, edx
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov edi, dword [esp + 0x20]
mov ebx, ecx
jne 0x5582bc
mov edi, str.Missing_IHDR_before_pHYs
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x5582e5
mov ecx, str.Invalid_pHYs_after_IDAT
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
test edi, edi
je 0x558314
test byte [edi + 8], 0x80
je 0x558314
mov ecx, str.Duplicate_pHYs_chunk
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
cmp ebx, 9
je 0x55833e
mov ecx, str.Incorrect_pHYs_chunk_length
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
mov ebx, 9
lea eax, [esp + 0xc]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
jne 0x5583b7
test edi, edi
je 0x5583b7
movzx eax, byte [esp + 0xc]
movzx ecx, byte [esp + 0xd]
movzx edx, byte [esp + 0xe]
shl eax, 8
add eax, ecx
movzx ecx, byte [esp + 0xf]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x10]
shl eax, 8
add eax, ecx
movzx ecx, byte [esp + 0x12]
shl edx, 8
mov dword [edi + 0x74], eax
movzx eax, byte [esp + 0x11]
add edx, eax
movzx eax, byte [esp + 0x13]
shl edx, 8
add edx, ecx
mov cl, byte [esp + 0x14]
shl edx, 8
add edx, eax
or dword [edi + 8], 0x80
mov dword [edi + 0x78], edx
mov byte [edi + 0x7c], cl
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
Function at 0x5583d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push esi
mov esi, edx
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov edi, dword [esp + 0x20]
mov ebx, ecx
jne 0x5583fc
mov edi, str.Missing_IHDR_before_oFFs
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x558425
mov ecx, str.Invalid_oFFs_after_IDAT
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
test edi, edi
je 0x558457
test dword [edi + 8], 0x100
je 0x558457
mov ecx, str.Duplicate_oFFs_chunk
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
cmp ebx, 9
je 0x558481
mov ecx, str.Incorrect_oFFs_chunk_length
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
mov ebx, 9
lea eax, [esp + 0xc]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
jne 0x558525
mov al, byte [esp + 0xc]
movzx ecx, al
shl ecx, 8
test al, al
jns 0x5584cb
movzx eax, byte [esp + 0xd]
movzx edx, byte [esp + 0xe]
add ecx, eax
movzx eax, byte [esp + 0xf]
shl ecx, 8
add ecx, edx
shl ecx, 8
add ecx, eax
jmp 0x5584e6
movzx edx, byte [esp + 0xd]
movzx eax, byte [esp + 0xe]
add ecx, edx
movzx edx, byte [esp + 0xf]
shl ecx, 8
add ecx, eax
shl ecx, 8
add ecx, edx
mov al, byte [esp + 0x10]
movzx edx, byte [esp + 0x11]
test al, al
movzx eax, al
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x12]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x13]
shl eax, 8
add eax, edx
test edi, edi
je 0x558525
or dword [edi + 8], 0x100
mov dword [edi + 0x6c], eax
mov al, byte [esp + 0x14]
mov dword [edi + 0x68], ecx
mov byte [edi + 0x70], al
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
Function at 0x558920
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
test al, 1
jne 0x55893c
mov edi, str.Missing_IHDR_before_sCAL
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x558958
mov ecx, str.Invalid_sCAL_after_IDAT
call fcn.0054c4a0
mov eax, edi
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00556840
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x558981
test dword [eax + 8], 0x4000
je 0x558981
mov ecx, str.Duplicate_sCAL_chunk
call fcn.0054c4a0
mov eax, edi
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00556840
lea ecx, [edi + 1]
call fcn.005600d0
test eax, eax
mov dword [esi + 0x2a8], eax
jne 0x5589ab
mov ecx, str.Out_of_memory_while_processing_sCAL_chunk
call fcn.0054c4a0
mov eax, edi
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00556840
push ebx
mov ebx, edi
call fcn.005567d0
mov eax, dword [esi + 0x2a8]
mov byte [edi + eax], 0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
je 0x5589e8
mov edx, dword [esi + 0x2a8]
mov ecx, esi
call fcn.005600a0
pop ebx
pop edi
mov dword [esi + 0x2a8], 0
pop esi
add esp, 0x10
ret
push ebp
mov ebp, dword [esi + 0x2a8]
mov al, byte [ebp]
cmp al, 1
mov byte [esp + 0x13], al
je 0x558a08
cmp al, 2
je 0x558a08
mov ecx, str.Invalid_sCAL_ignored:_invalid_unit
jmp 0x558a97
xor eax, eax
cmp byte [ebp + 1], 0x2d
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [ebp + 1]
mov dword [esp + 0x1c], eax
je 0x558a92
lea ecx, [esp + 0x18]
push ecx
push ebp
lea edx, [esp + 0x1c]
call fcn.0054ba50
add esp, 8
test eax, eax
je 0x558a92
mov eax, dword [esp + 0x14]
cmp eax, edi
jae 0x558a92
mov dl, byte [eax + ebp]
add eax, 1
test dl, dl
mov dword [esp + 0x14], eax
jne 0x558a92
cmp byte [eax + ebp], 0x2d
lea ebx, [eax + ebp]
je 0x558a8b
lea eax, [esp + 0x18]
push eax
push ebp
lea edx, [esp + 0x1c]
call fcn.0054ba50
add esp, 8
test eax, eax
je 0x558a8b
cmp dword [esp + 0x14], edi
jne 0x558a8b
mov ecx, dword [esp + 0x1c]
movsx edx, byte [esp + 0x13]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
push esi
call fcn.0054d030
add esp, 0x10
jmp 0x558a9c
mov ecx, str.Invalid_sCAL_chunk_ignored:_bad_height_format
jmp 0x558a97
mov ecx, str.Invalid_sCAL_chunk_ignored:_bad_width_format
call fcn.0054c4a0
mov edx, dword [esi + 0x2a8]
mov ecx, esi
call fcn.005600a0
pop ebp
pop ebx
pop edi
mov dword [esi + 0x2a8], 0
pop esi
add esp, 0x10
ret
Function at 0x558ac0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov esi, edx
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov edi, dword [esp + 0x24]
mov ebx, ecx
jne 0x558aec
mov edi, str.Out_of_place_tIME_chunk
mov eax, esi
jmp fcn.0054c480
test edi, edi
je 0x558b1e
test dword [edi + 8], 0x200
je 0x558b1e
mov ecx, str.Duplicate_tIME_chunk
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
test al, 4
je 0x558b28
or eax, 8
mov dword [esi + 0x6c], eax
cmp ebx, 7
je 0x558b52
mov ecx, str.Incorrect_tIME_chunk_length
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
mov ebx, 7
lea eax, [esp + 0x14]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
jne 0x558bd3
movzx eax, byte [esp + 0x1a]
mov dl, byte [esp + 0x18]
movzx ecx, byte [esp + 0x19]
mov byte [esp + 0x12], al
movzx eax, byte [esp + 0x17]
mov byte [esp + 0x10], dl
movzx dx, byte [esp + 0x14]
mov byte [esp + 0xf], al
movzx ax, byte [esp + 0x15]
mov byte [esp + 0x11], cl
movzx ecx, byte [esp + 0x16]
shl dx, 8
add dx, ax
test edi, edi
mov byte [esp + 0xe], cl
mov word [esp + 0xc], dx
je 0x558bd3
test dword [esi + 0x6c], 0x200
jne 0x558bd3
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
or dword [edi + 8], 0x200
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], edx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
Function at 0x558bf0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 0x260]
test eax, eax
je 0x558c38
cmp eax, 1
jne 0x558c12
mov eax, edi
pop edi
pop esi
add esp, 4
jmp fcn.00556840
add eax, 0xffffffff
cmp eax, 1
mov dword [esi + 0x260], eax
jne 0x558c38
mov ecx, str.No_space_in_chunk_cache_for_tEXt
call fcn.0054c4a0
mov eax, edi
pop edi
mov ecx, esi
pop esi
add esp, 4
jmp fcn.00556840
mov eax, dword [esi + 0x6c]
test al, 1
jne 0x558c4b
mov edi, str.Missing_IHDR_before_tEXt
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x558c55
or eax, 8
mov dword [esi + 0x6c], eax
mov ecx, dword [esi + 0x2a8]
test ecx, ecx
je 0x558c7a
mov eax, dword [esi + 0x240]
test eax, eax
push ecx
je 0x558c72
push esi
call eax
add esp, 8
jmp 0x558c7a
call fcn.005d27e0
add esp, 4
lea ecx, [edi + 1]
call fcn.005600d0
test eax, eax
mov dword [esi + 0x2a8], eax
jne 0x558c9a
mov ecx, str.No_memory_to_process_text_chunk
call fcn.0054c4a0
pop edi
pop esi
pop ecx
ret
push ebx
mov ebx, edi
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
je 0x558ccb
mov edx, dword [esi + 0x2a8]
mov ecx, esi
call fcn.005600a0
pop ebx
pop edi
mov dword [esi + 0x2a8], 0
pop esi
pop ecx
ret
mov ebx, dword [esi + 0x2a8]
lea eax, [ebx + edi]
mov byte [eax], 0
cmp byte [ebx], 0
push ebp
mov ebp, ebx
je 0x558ce9
nop
add ebp, 1
cmp byte [ebp], 0
jne 0x558ce0
cmp ebp, eax
je 0x558cf0
add ebp, 1
mov eax, dword [esi + 0x70]
mov dword [esp + 0x10], eax
or eax, 0x100000
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x23c]
test eax, eax
push 0x1c
je 0x558d13
push esi
call eax
add esp, 8
jmp 0x558d1b
call fcn.005d3435
add esp, 4
mov edi, eax
xor eax, eax
cmp edi, eax
jne 0x558d38
test dword [esi + 0x70], 0x100000
jne 0x558d38
mov edi, str.Out_of_Memory
mov eax, esi
jmp fcn.0054c480
cmp edi, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x70], ecx
jne 0x558d90
mov ecx, str.Not_enough_memory_to_process_text_chunk
call fcn.0054c4a0
mov ecx, dword [esi + 0x2a8]
test ecx, ecx
je 0x558d80
mov eax, dword [esi + 0x240]
test eax, eax
push ecx
je 0x558d78
push esi
call eax
add esp, 8
pop ebp
pop ebx
pop edi
mov dword [esi + 0x2a8], 0
pop esi
pop ecx
ret
call fcn.005d27e0
add esp, 4
pop ebp
pop ebx
pop edi
mov dword [esi + 0x2a8], 0
pop esi
pop ecx
ret
push ebp
mov dword [edi], 0xffffffff
mov dword [edi + 4], ebx
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x18]
push edi
push edx
push esi
mov dword [edi + 0xc], eax
call fcn.0054d350
mov ebx, eax
mov eax, dword [esi + 0x2a8]
add esp, 0xc
test eax, eax
je 0x558de5
mov ecx, dword [esi + 0x240]
test ecx, ecx
push eax
je 0x558ddd
push esi
call ecx
add esp, 8
jmp 0x558de5
call fcn.005d27e0
add esp, 4
mov eax, dword [esi + 0x240]
test eax, eax
mov dword [esi + 0x2a8], 0
push edi
je 0x558e02
push esi
call eax
add esp, 8
jmp 0x558e0a
call fcn.005d27e0
add esp, 4
test ebx, ebx
je 0x558e18
mov ecx, str.Insufficient_memory_to_process_text_chunk
call fcn.0054c4a0
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x559400
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, edx
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov edi, ecx
jne 0x55942c
mov edi, str.Missing_IHDR_before_acTL
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x559455
mov ecx, str.Invalid_acTL_after_IDAT_skipped
call fcn.0054c4a0
mov eax, edi
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
test eax, 0x4000
je 0x559481
mov ecx, str.Duplicate_acTL_skipped
call fcn.0054c4a0
mov eax, edi
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
cmp edi, 8
je 0x5594ab
mov ecx, str.acTL_with_invalid_length_skipped
call fcn.0054c4a0
mov eax, edi
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
push ebx
mov ebx, 8
lea eax, [esp + 0x10]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
push esi
lea ecx, [esp + 0x14]
call fcn.005565d0
push esi
lea ecx, [esp + 0x1c]
mov edi, eax
call fcn.005565d0
mov edx, eax
push esi
mov ecx, edi
mov eax, ebp
call fcn.0054d860
add esp, 0xc
test eax, eax
pop ebx
je 0x5594f4
or dword [esi + 0x6c], 0x4000
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
Function at 0x559510
Capabilities:
Terminate process

Disassembly:
sub esp, 0x28
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x38]
mov ebx, ecx
mov esi, edx
push ebx
mov eax, esi
call fcn.005596f0
mov eax, dword [esi + 0x6c]
add esp, 4
test al, 1
jne 0x559547
mov edi, str.Missing_IHDR_before_fcTL
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x559571
mov ecx, str.Invalid_fcTL_after_IDAT_skipped
call fcn.0054c4a0
lea eax, [ebx - 4]
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret
test eax, 0x8000
je 0x55959e
mov ecx, str.Duplicate_fcTL_within_one_frame_skipped
call fcn.0054c4a0
lea eax, [ebx - 4]
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret
cmp ebx, 0x1a
je 0x5595c9
mov ecx, str.fcTL_with_invalid_length_skipped
call fcn.0054c4a0
lea eax, [ebx - 4]
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret
push ebp
mov ebx, 0x16
lea eax, [esp + 0x18]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
push esi
lea ecx, [esp + 0x1c]
call fcn.005565d0
push esi
lea ecx, [esp + 0x24]
mov ebx, eax
call fcn.005565d0
push esi
lea ecx, [esp + 0x2c]
mov ebp, eax
call fcn.005565d0
push esi
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], eax
call fcn.005565d0
movzx ecx, byte [esp + 0x38]
movzx edx, byte [esp + 0x39]
shl cx, 8
add cx, dx
movzx edx, byte [esp + 0x3a]
movzx ecx, cx
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x3b]
shl dx, 8
add dx, cx
mov ecx, dword [esi + 0x278]
add esp, 0x10
test ecx, ecx
movzx edx, dx
jne 0x559660
cmp dword [esp + 0x10], ecx
jne 0x559654
test eax, eax
je 0x559660
mov edi, str.fcTL_for_the_first_frame_must_have_zero_offset
mov eax, esi
jmp fcn.0054c480
test edi, edi
je 0x5596a6
test ecx, ecx
jne 0x55967d
cmp ebx, dword [edi]
jne 0x559671
cmp ebp, dword [edi + 4]
je 0x55967d
mov edi, str.size_in_first_frames_fcTL_must_match_the_size_in_IHDR
mov eax, esi
jmp fcn.0054c480
mov ecx, dword [esp + 0x2d]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
mov al, byte [esp + 0x40]
push ebp
push ebx
push esi
call fcn.0054d8e0
add esp, 0x20
mov eax, edi
mov ecx, esi
call fcn.0055aa80
or dword [esi + 0x6c], 0x8000
mov ecx, dword [esp + 0x34]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret

Function at 0x5596c0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, eax
call fcn.005596f0
add esp, 4
mov ecx, str.ignoring_fdAT_chunk
call fcn.0054c4a0
mov ecx, esi
lea eax, [edi - 4]
pop esi
jmp fcn.00556840
Function at 0x5596f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, 4
cmp dword [esp + 0xc], ebx
push edi
mov esi, eax
jae 0x55970a
mov edi, str.invalid_fcTL_or_fdAT_chunk_found
jmp fcn.0054c480
lea eax, [esp + 0x10]
call fcn.005567d0
mov ecx, dword [esp + 0x10]
movzx edx, byte [esp + 0x12]
movzx eax, cl
shl eax, 8
movzx ecx, ch
add eax, ecx
movzx ecx, byte [esp + 0x13]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
cmp eax, 0x7fffffff
jbe 0x559749
mov edi, str.PNG_unsigned_integer_out_of_range
mov eax, esi
jmp fcn.0054c480
mov ecx, dword [esi + 0x26c]
cmp eax, ecx
je 0x55975f
mov edi, str.fcTL_or_fdAT_chunk_with_out_of_order_sequence_number_found
mov eax, esi
jmp fcn.0054c480
add ecx, 1
pop edi
mov dword [esi + 0x26c], ecx
pop esi
pop ebx
ret
Function at 0x559a10
Capabilities:
Terminate process

Disassembly:
mov al, byte [ecx]
cmp al, 0x41
jb 0x559a5b
cmp al, 0x7a
ja 0x559a5b
cmp al, 0x5a
jbe 0x559a22
cmp al, 0x61
jb 0x559a5b
mov al, byte [ecx + 1]
cmp al, 0x41
jb 0x559a5b
cmp al, 0x7a
ja 0x559a5b
cmp al, 0x5a
jbe 0x559a35
cmp al, 0x61
jb 0x559a5b
mov al, byte [ecx + 2]
cmp al, 0x41
jb 0x559a5b
cmp al, 0x7a
ja 0x559a5b
cmp al, 0x5a
jbe 0x559a48
cmp al, 0x61
jb 0x559a5b
mov al, byte [ecx + 3]
cmp al, 0x41
jb 0x559a5b
cmp al, 0x7a
ja 0x559a5b
cmp al, 0x5a
jbe 0x559a65
cmp al, 0x61
jae 0x559a65
mov edx, str.invalid_chunk_type
jmp fcn.0054c5d0
ret

Function at 0x55a1e0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
cmp eax, 4
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
ja case.default.0x55a1f4
jmp dword [eax*4 + 0x55a370]
movzx eax, byte [edx + 0xb]
mov esi, dword [edx + 4]
add eax, 7
sar eax, 3
add ecx, eax
cmp eax, esi
jae case.0x55a1f4.0
mov edx, ecx
sub edx, eax
sub esi, eax
mov al, byte [edx]
add byte [ecx], al
add ecx, 1
add edx, 1
sub esi, 1
jne 0x55a214
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, dword [edx + 4]
xor eax, eax
test edi, edi
jbe case.0x55a1f4.0
mov dl, byte [eax + esi]
add byte [ecx], dl
add eax, 1
add ecx, 1
cmp eax, edi
jb 0x55a234
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
movzx eax, byte [edx + 0xb]
mov edx, dword [edx + 4]
add eax, 7
sar eax, 3
sub edx, eax
test eax, eax
mov edi, ecx
jbe 0x55a273
mov ebp, eax
mov al, byte [esi]
shr al, 1
add byte [ecx], al
add esi, 1
add ecx, 1
sub ebp, 1
jne 0x55a262
test edx, edx
jbe case.0x55a1f4.0
mov ebx, edx
lea esp, [esp]
movzx edx, byte [esi]
movzx eax, byte [edi]
add eax, edx
cdq
sub eax, edx
sar eax, 1
add byte [ecx], al
add edi, 1
add esi, 1
add ecx, 1
sub ebx, 1
jne 0x55a280
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
movzx eax, byte [edx + 0xb]
mov edx, dword [edx + 4]
add eax, 7
sar eax, 3
sub edx, eax
test eax, eax
mov ebx, ecx
mov dword [esp + 0x10], ecx
mov edi, esi
mov ebp, esi
jbe 0x55a2d7
mov esi, eax
mov al, byte [edi]
add byte [ebx], al
add edi, 1
add ebx, 1
sub esi, 1
jne 0x55a2c4
mov dword [esp + 0x10], ebx
test edx, edx
jbe case.0x55a1f4.0
mov dword [esp + 0x18], edx
jmp 0x55a2ed
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
movzx ebx, byte [ecx]
movzx esi, byte [edi]
movzx edx, byte [ebp]
add ecx, 1
mov dword [esp + 0x1c], ecx
mov eax, esi
mov ecx, ebx
add ebp, 1
sub eax, edx
add edi, 1
sub ecx, edx
test eax, eax
mov dword [esp + 0x20], ebp
jge 0x55a31e
mov ebp, eax
neg ebp
mov dword [esp + 0x14], ebp
jmp 0x55a322
mov dword [esp + 0x14], eax
test ecx, ecx
mov ebp, ecx
jge 0x55a32a
neg ebp
add eax, ecx
jns 0x55a330
neg eax
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
jg 0x55a340
cmp ecx, eax
jg 0x55a340
mov edx, ebx
jmp 0x55a346
cmp ebp, eax
jg 0x55a346
mov edx, esi
mov eax, dword [esp + 0x10]
add byte [eax], dl
add eax, 1
sub dword [esp + 0x18], 1
mov dword [esp + 0x10], eax
jne 0x55a2e5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
mov edi, str.Ignoring_bad_adaptive_filter_type
jmp fcn.0054c480
Function at 0x560000
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, eax
je 0x560059
test edi, edi
je 0x560059
mov eax, dword [esi + 0x23c]
test eax, eax
push edi
je 0x560021
push esi
call eax
add esp, 8
jmp 0x560029
call fcn.005d3435
add esp, 4
test eax, eax
jne 0x560042
test dword [esi + 0x70], 0x100000
jne 0x560042
mov edi, str.Out_of_Memory
mov eax, esi
jmp fcn.0054c480
test eax, eax
mov esi, eax
je 0x560054
push edi
push 0
push eax
call fcn.005da970
add esp, 0xc
pop edi
mov eax, esi
pop esi
ret
xor esi, esi
pop edi
mov eax, esi
pop esi
ret

Function at 0x560060
Capabilities:
Terminate process

Disassembly:
test esi, esi
je 0x56009d
test ecx, ecx
je 0x56009d
mov eax, dword [esi + 0x23c]
test eax, eax
push ecx
je 0x56007b
push esi
call eax
add esp, 8
jmp 0x560083
call fcn.005d3435
add esp, 4
test eax, eax
jne 0x56009f
test dword [esi + 0x70], 0x100000
jne 0x56009f
push edi
mov edi, str.Out_of_Memory
mov eax, esi
jmp fcn.0054c480
xor eax, eax
ret

Function at 0x5600d0
Capabilities:
Terminate process

Disassembly:
test esi, esi
jne 0x5600d7
xor eax, eax
ret
push edi
mov edi, dword [esi + 0x70]
mov eax, edi
or eax, 0x100000
test ecx, ecx
mov dword [esi + 0x70], eax
je 0x56011d
mov eax, dword [esi + 0x23c]
test eax, eax
push ecx
je 0x5600fc
push esi
call eax
add esp, 8
jmp 0x560104
call fcn.005d3435
add esp, 4
test eax, eax
jne 0x56011f
test dword [esi + 0x70], 0x100000
jne 0x56011f
mov edi, str.Out_of_Memory
mov eax, esi
jmp fcn.0054c480
xor eax, eax
mov dword [esi + 0x70], edi
pop edi
ret

Function at 0x560130
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 8], eax
mov al, 0xa
mov byte [esp + 5], al
mov byte [esp + 7], al
mov eax, dword [esi + 0x50]
test eax, eax
mov byte [esp], 0x89
mov byte [esp + 1], 0x50
mov byte [esp + 2], 0x4e
mov byte [esp + 3], 0x47
mov byte [esp + 4], 0xd
mov byte [esp + 6], 0x1a
mov dword [esi + 0x2ac], 0x12
je 0x5601af
movzx ecx, byte [esi + 0x12c]
mov edx, 8
sub edx, ecx
push edx
lea ecx, [esp + ecx + 4]
push ecx
push esi
call eax
add esp, 0xc
cmp byte [esi + 0x12c], 3
jae 0x5601a0
or dword [esi + 0x6c], 0x1000
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
push edi
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480

Function at 0x5601c0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
mov edi, eax
je 0x56020a
push edi
call fcn.00560210
add esp, 4
test ebx, ebx
je 0x5601f5
test edi, edi
jbe 0x5601f5
mov eax, dword [esi + 0x50]
test eax, eax
je 0x5601fe
push edi
push ebx
push esi
call eax
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0054afb0
pop edi
mov eax, esi
pop esi
jmp fcn.00560320
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
pop edi
pop esi
ret
Function at 0x560210
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 8], eax
test esi, esi
mov eax, dword [esp + 0x10]
push edi
mov edi, ecx
je 0x5602bf
mov ecx, eax
shr ecx, 0x18
mov edx, eax
shr edx, 0x10
mov byte [esp + 4], cl
mov ecx, eax
mov byte [esp + 7], al
mov eax, dword [esi + 0x50]
mov dword [esi + 0x2ac], 0x22
mov byte [esp + 5], dl
mov edx, dword [edi]
shr ecx, 8
test eax, eax
mov byte [esp + 6], cl
mov dword [esp + 8], edx
je 0x5602cf
push 8
lea ecx, [esp + 8]
push ecx
push esi
call eax
mov edx, dword [edi]
add esp, 0xc
test dl, 0x20
mov dword [esi + 0x11c], edx
mov dword [esi + 0x110], 0
je 0x560298
mov eax, dword [esi + 0x70]
and eax, 0x300
cmp eax, 0x300
jne 0x5602a1
jmp 0x5602b5
test dword [esi + 0x70], 0x800
jne 0x5602b5
mov edx, 4
mov ecx, edi
xor eax, eax
call fcn.00566310
mov dword [esi + 0x110], eax
mov dword [esi + 0x2ac], 0x42
mov ecx, dword [esp + 0xc]
pop edi
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480

Function at 0x5602e0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, eax
je 0x56030a
test ebx, ebx
je 0x56030a
test edi, edi
jbe 0x56030a
mov eax, dword [esi + 0x50]
test eax, eax
je 0x56030d
push edi
push ebx
push esi
call eax
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0054afb0
pop edi
pop esi
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480

Function at 0x560320
Capabilities:
Terminate process

Disassembly:
push ecx
test eax, eax
je 0x560367
mov ecx, dword [eax + 0x110]
mov edx, ecx
shr edx, 0x18
mov byte [esp], dl
mov edx, ecx
shr edx, 0x10
mov byte [esp + 1], dl
mov edx, ecx
mov byte [esp + 3], cl
mov ecx, dword [eax + 0x50]
shr edx, 8
test ecx, ecx
mov dword [eax + 0x2ac], 0x82
mov byte [esp + 2], dl
je 0x560369
push 4
lea edx, [esp + 4]
push edx
push eax
call ecx
add esp, 0xc
pop ecx
ret
push edi
mov edi, str.Call_to_NULL_write_function
jmp fcn.0054c480