joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5606d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, dword [ebp]
test edi, edi
mov esi, eax
je 0x56071b
test esi, esi
mov ebp, dword [ebp + 4]
je 0x560809
test ebp, ebp
jbe 0x560809
mov eax, dword [esi + 0x50]
test eax, eax
je 0x56070f
push ebp
push edi
push esi
call eax
add esp, 0xc
mov edx, ebp
mov ecx, edi
call fcn.0054afb0
pop edi
pop esi
pop ebp
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
xor eax, eax
cmp dword [ebp + 8], eax
push ebx
mov dword [esp + 0x14], eax
jle 0x56078c
mov ecx, dword [ebp + 0x10]
mov edi, dword [ecx + eax*4]
test edi, edi
mov ebx, dword [esi + 0xb4]
je 0x560753
test ebx, ebx
jbe 0x560753
mov eax, dword [esi + 0x50]
test eax, eax
je 0x56070f
push ebx
push edi
push esi
call eax
add esp, 0xc
mov edx, ebx
mov ecx, edi
call fcn.0054afb0
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [edx + eax*4]
test eax, eax
je 0x56077c
mov ecx, dword [esi + 0x240]
test ecx, ecx
push eax
je 0x560774
push esi
call ecx
add esp, 8
jmp 0x56077c
call fcn.005d27e0
add esp, 4
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
jl 0x560727
cmp dword [ebp + 0xc], 0
je 0x5607b8
test esi, esi
mov ebp, dword [ebp + 0x10]
je 0x5607b8
test ebp, ebp
je 0x5607b8
mov eax, dword [esi + 0x240]
test eax, eax
push ebp
je 0x5607b0
push esi
call eax
add esp, 8
jmp 0x5607b8
call fcn.005d27e0
add esp, 4
mov ecx, dword [esi + 0x88]
mov eax, dword [esi + 0xb4]
cmp ecx, eax
jae 0x5607f6
mov edi, dword [esi + 0xb0]
sub eax, ecx
test edi, edi
mov ebx, eax
je 0x5607f6
test ebx, ebx
jbe 0x5607f6
mov eax, dword [esi + 0x50]
test eax, eax
je 0x56070f
push ebx
push edi
push esi
call eax
add esp, 0xc
mov edx, ebx
mov ecx, edi
call fcn.0054afb0
lea eax, [esi + 0x78]
call fcn.005643f0
mov dword [esi + 0xa4], 0
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x560c50
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
test byte [esi + 0x230], 1
push edi
mov edi, edx
mov byte [esp + 0xc], 0x50
mov byte [esp + 0xd], 0x4c
mov byte [esp + 0xe], 0x54
mov byte [esp + 0xf], 0x45
mov byte [esp + 0x10], 0
jne 0x560c8a
test ebx, ebx
je 0x560c92
cmp ebx, 0x100
jbe 0x560cc2
cmp byte [esi + 0x126], 3
jne 0x560ca7
mov edi, str.Invalid_number_of_colors_in_palette
mov eax, esi
jmp fcn.0054c480
mov ecx, str.Invalid_number_of_colors_in_palette
call fcn.0054c4a0
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
test byte [esi + 0x126], 2
jne 0x560ce6
mov ecx, str.Ignoring_request_to_write_a_PLTE_chunk_in_grayscale_PNG
call fcn.0054c4a0
pop edi
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
lea eax, [ebx + ebx*2]
push ebp
push eax
lea ecx, [esp + 0x14]
mov word [esi + 0x118], bx
call fcn.00560210
add esp, 4
xor ebp, ebp
test ebx, ebx
jbe 0x560d47
add edi, 2
mov al, byte [edi]
mov cl, byte [edi - 2]
mov dl, byte [edi - 1]
mov byte [esp + 0xe], al
mov eax, dword [esi + 0x50]
test eax, eax
mov byte [esp + 0xc], cl
mov byte [esp + 0xd], dl
je 0x560d64
push 3
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
mov edx, 3
lea ecx, [esp + 0xc]
call fcn.0054afb0
add ebp, 1
add edi, 3
cmp ebp, ebx
jb 0x560d07
mov eax, esi
call fcn.00560320
or dword [esi + 0x6c], 2
mov ecx, dword [esp + 0x18]
pop ebp
pop edi
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
Function at 0x560d70
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
test byte [esi + 0x6c], 4
mov cl, 0x41
mov al, 0x54
push edi
mov byte [esp + 0x10], 0x49
mov byte [esp + 0x11], 0x44
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], al
mov byte [esp + 0x14], 0
mov byte [esp + 0x18], 0x66
mov byte [esp + 0x19], 0x64
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], 0
jne 0x560e90
cmp byte [esi + 0x254], 0
jne 0x560e90
movzx ebx, byte [ebp]
mov eax, ebx
and al, 0xf
cmp al, 8
jne 0x560eb3
mov ecx, ebx
and ecx, 0xf0
cmp ecx, 0x70
ja 0x560eb3
mov edi, dword [esp + 0x2c]
cmp edi, 2
jb 0x560e94
mov edx, dword [esi + 0xd0]
cmp edx, 0x4000
jae 0x560e94
mov ecx, dword [esi + 0xcc]
cmp ecx, 0x4000
jae 0x560e94
movzx edi, byte [esi + 0x127]
movzx eax, byte [esi + 0x12a]
imul eax, edi
imul eax, ecx
add eax, 0xf
shr eax, 3
imul eax, edx
mov edx, ebx
shr edx, 4
lea ecx, [edx + 7]
mov edi, 1
shl edi, cl
cmp eax, edi
ja 0x560e61
nop
cmp edi, 0x100
jb 0x560e61
shr edi, 1
sub edx, 1
cmp eax, edi
jbe 0x560e50
shl edx, 4
or edx, 8
mov eax, edx
cmp ebx, eax
je 0x560e90
movzx ecx, byte [ebp + 1]
mov byte [ebp], al
and ecx, 0xe0
shl eax, 8
add eax, ecx
xor edx, edx
mov edi, 0x1f
div edi
sub cl, dl
add cl, 0x1f
mov byte [ebp + 1], cl
mov edi, dword [esp + 0x2c]
cmp dword [esi + 0x288], 0
jne 0x560ebf
push esi
mov eax, edi
mov ebx, ebp
lea ecx, [esp + 0x14]
call fcn.005601c0
add esp, 4
jmp 0x560f44
mov edi, str.Invalid_zlib_compression_method_or_flags_in_IDAT
mov eax, esi
jmp fcn.0054c480
lea edx, [edi + 4]
push edx
lea ecx, [esp + 0x1c]
call fcn.00560210
mov eax, dword [esi + 0x26c]
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x14], cl
mov edx, eax
mov ecx, eax
mov byte [esp + 0x17], al
mov eax, dword [esi + 0x50]
shr edx, 0x10
shr ecx, 8
add esp, 4
test eax, eax
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], cl
je 0x560f5b
push 4
lea edx, [esp + 0x14]
push edx
push esi
call eax
add esp, 0xc
mov edx, 4
lea ecx, [esp + 0x10]
call fcn.0054afb0
test ebp, ebp
je 0x560f36
test edi, edi
jbe 0x560f36
mov eax, dword [esi + 0x50]
test eax, eax
je 0x560f5b
push edi
push ebp
push esi
call eax
add esp, 0xc
mov edx, edi
mov ecx, ebp
call fcn.0054afb0
mov eax, esi
call fcn.00560320
add dword [esi + 0x26c], 1
or dword [esi + 0x6c], 4
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
Function at 0x560fd0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
mov cl, 0x41
mov byte [esp + 9], cl
mov byte [esp + 0xb], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 4], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
test esi, esi
mov byte [esp + 8], 0x67
mov byte [esp + 0xa], 0x4d
mov byte [esp + 0xc], 0
mov byte [esp + 5], dl
mov byte [esp + 6], cl
mov byte [esp + 7], al
je 0x561058
push 4
lea ecx, [esp + 0xc]
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x561068
push 4
lea edx, [esp + 8]
push edx
push esi
call eax
add esp, 0xc
mov edx, 4
lea ecx, [esp + 4]
call fcn.0054afb0
mov eax, esi
call fcn.00560320
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
push edi
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480

Function at 0x561080
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0xc], eax
cmp ebx, 4
push esi
mov esi, ecx
mov byte [esp + 8], 0x73
mov byte [esp + 9], 0x52
mov byte [esp + 0xa], 0x47
mov byte [esp + 0xb], 0x42
mov byte [esp + 0xc], 0
jl 0x5610b9
mov ecx, str.Invalid_sRGB_rendering_intent_specified
call fcn.0054c4a0
test esi, esi
mov byte [esp + 7], bl
je 0x5610f8
push 1
lea ecx, [esp + 0xc]
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x561108
push 1
lea ecx, [esp + 0xb]
push ecx
push esi
call eax
add esp, 0xc
mov edx, 1
lea ecx, [esp + 7]
call fcn.0054afb0
mov eax, esi
call fcn.00560320
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
push edi
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
Function at 0x561620
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
push ebx
push esi
push eax
mov eax, dword [esp + 0x48]
mov ebx, ecx
mov ecx, dword [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x48]
mov esi, edx
mov edx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
mov eax, esi
mov byte [esp + 0x24], 0x63
mov byte [esp + 0x25], 0x48
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], 0x4d
mov byte [esp + 0x28], 0
call fcn.0054b700
add esp, 0x1c
test eax, eax
je 0x5617d1
mov eax, dword [esp + 0x38]
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x10], cl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x11], dl
mov ecx, eax
shr ecx, 8
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x3c]
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x14], dl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x15], cl
mov edx, eax
shr edx, 8
mov byte [esp + 0x16], dl
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x40]
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x18], cl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x19], dl
mov ecx, eax
shr ecx, 8
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x44]
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x1c], dl
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x20], dl
mov ecx, ebx
shr ecx, 8
mov byte [esp + 0x1e], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x21], cl
mov edx, eax
shr edx, 8
mov byte [esp + 0x23], al
mov eax, dword [esp + 0x48]
mov byte [esp + 0x22], dl
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x24], cl
mov edx, eax
shr edx, 0x10
mov byte [esp + 0x25], dl
mov ecx, eax
shr ecx, 8
mov byte [esp + 0x27], al
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x26], cl
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x28], dl
mov ecx, eax
shr ecx, 0x10
mov edx, eax
mov byte [esp + 0x2b], al
mov eax, dword [esp + 0x50]
mov byte [esp + 0x29], cl
shr edx, 8
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x2a], dl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x2c], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
test esi, esi
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], al
je 0x5617d1
push 0x20
lea ecx, [esp + 0xc]
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x5617e2
push 0x20
lea edx, [esp + 0x14]
push edx
push esi
call eax
add esp, 0xc
mov edx, 0x20
lea ecx, [esp + 0x10]
call fcn.0054afb0
mov eax, esi
call fcn.00560320
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x2c
ret
push edi
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
Function at 0x5617f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x10], eax
cmp edx, 3
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
mov byte [esp + 0x10], 0x74
mov byte [esp + 0x11], 0x52
mov byte [esp + 0x12], 0x4e
mov byte [esp + 0x13], 0x53
mov byte [esp + 0x14], 0
jne 0x561872
test eax, eax
jle 0x561857
movzx ecx, word [esi + 0x118]
cmp eax, ecx
jg 0x561857
push esi
lea ecx, [esp + 0x14]
call fcn.005601c0
add esp, 4
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
mov ecx, str.Invalid_number_of_transparent_colors_specified
call fcn.0054c4a0
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
test edx, edx
push edi
jne 0x5618d8
movzx eax, word [ecx + 8]
mov cl, byte [esi + 0x127]
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x561896
mov ecx, str.Ignoring_attempt_to_write_tRNS_chunk_out_of_range_for_bit_depth
jmp 0x561978
mov ecx, eax
shr ecx, 8
mov byte [esp + 0xc], cl
push 2
lea ecx, [esp + 0x18]
mov byte [esp + 0x11], al
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x5618cc
push 2
lea edx, [esp + 0x10]
push edx
push esi
call eax
mov edx, 2
jmp 0x56194e
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
cmp edx, 2
jne 0x561973
movzx eax, word [ecx + 2]
mov edx, eax
mov byte [esp + 0xd], al
movzx eax, word [ecx + 4]
movzx ecx, word [ecx + 6]
mov ebx, eax
mov byte [esp + 0xf], al
mov eax, ecx
shr edx, 8
shr ebx, 8
shr eax, 8
cmp byte [esi + 0x127], 8
mov byte [esp + 0xc], dl
mov byte [esp + 0xe], bl
mov byte [esp + 0x10], al
mov byte [esp + 0x11], cl
jne 0x56192a
or al, bl
or al, dl
je 0x56192a
mov ecx, str.Ignoring_attempt_to_write_16_bit_tRNS_chunk_when_bit_depth_is_8
jmp 0x561978
push 6
lea ecx, [esp + 0x18]
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x5618cc
push 6
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
mov edx, 6
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.0054afb0
mov eax, esi
call fcn.00560320
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
mov ecx, str.Cant_write_tRNS_with_an_alpha_channel
call fcn.0054c4a0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
Function at 0x561990
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x10], eax
cmp ecx, 3
mov eax, dword [esp + 0x18]
push esi
push edi
mov esi, edx
mov byte [esp + 0x10], 0x62
mov byte [esp + 0x11], 0x4b
mov byte [esp + 0x12], 0x47
mov byte [esp + 0x13], 0x44
mov byte [esp + 0x14], 0
jne 0x561a53
movzx ecx, word [esi + 0x118]
test cx, cx
jne 0x5619dd
test byte [esi + 0x230], 1
jne 0x561a01
movzx dx, byte [eax]
cmp dx, cx
jb 0x561a01
mov ecx, str.Invalid_background_palette_index
call fcn.0054c4a0
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
mov al, byte [eax]
push 1
lea ecx, [esp + 0x14]
mov byte [esp + 0xc], al
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x561b54
push 1
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
add esp, 0xc
mov edx, 1
lea ecx, [esp + 8]
call fcn.0054afb0
mov eax, esi
call fcn.00560320
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
test cl, 2
je 0x561aeb
movzx edx, word [eax + 2]
push ebx
movzx ebx, word [eax + 4]
mov ecx, edx
mov byte [esp + 0xd], dl
mov edx, ebx
mov byte [esp + 0xf], bl
movzx ebx, word [eax + 6]
mov eax, ebx
shr ecx, 8
shr edx, 8
shr eax, 8
cmp byte [esi + 0x127], 8
mov byte [esp + 0x11], bl
mov byte [esp + 0xc], cl
mov byte [esp + 0xe], dl
mov byte [esp + 0x10], al
pop ebx
jne 0x561abb
or al, dl
or al, cl
je 0x561abb
mov ecx, str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
call fcn.0054c4a0
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
push 6
lea ecx, [esp + 0x14]
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x561b54
push 6
lea edx, [esp + 0xc]
push edx
push esi
call eax
add esp, 0xc
mov edx, 6
jmp 0x561a32
mov cl, byte [esi + 0x127]
movzx eax, word [eax + 8]
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x561b1b
mov ecx, str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
call fcn.0054c4a0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
mov ecx, eax
shr ecx, 8
mov byte [esp + 8], cl
push 2
lea ecx, [esp + 0x14]
mov byte [esp + 0xd], al
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x561b54
push 2
lea edx, [esp + 0xc]
push edx
push esi
call eax
add esp, 0xc
mov edx, 2
jmp 0x561a32
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
Function at 0x561b60
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0xc], eax
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, ecx
movzx eax, word [esi + 0x118]
cmp ebx, eax
mov byte [esp + 0xc], 0x68
mov byte [esp + 0xd], 0x49
mov byte [esp + 0xe], 0x53
mov byte [esp + 0xf], 0x54
mov byte [esp + 0x10], 0
jle 0x561bb5
mov ecx, str.Invalid_number_of_histogram_entries_specified
call fcn.0054c4a0
pop esi
pop ebp
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
lea ecx, [ebx + ebx]
push edi
push ecx
lea ecx, [esp + 0x14]
call fcn.00560210
add esp, 4
xor edi, edi
test ebx, ebx
jle 0x561c0b
lea esp, [esp]
movzx eax, word [ebp + edi*2]
mov edx, eax
mov byte [esp + 0xd], al
mov eax, dword [esi + 0x50]
shr edx, 8
test eax, eax
mov byte [esp + 0xc], dl
je 0x561c60
push 2
lea ecx, [esp + 0x10]
push ecx
push esi
call eax
add esp, 0xc
mov edx, 2
lea ecx, [esp + 0xc]
call fcn.0054afb0
add edi, 1
cmp edi, ebx
jl 0x561bd0
mov eax, dword [esi + 0x110]
mov edx, eax
shr edx, 0x18
mov byte [esp + 0x10], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x13], al
mov eax, dword [esi + 0x50]
shr ecx, 0x10
shr edx, 8
test eax, eax
mov dword [esi + 0x2ac], 0x82
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], dl
je 0x561c60
push 4
lea ecx, [esp + 0x14]
push ecx
push esi
call eax
mov ecx, dword [esp + 0x24]
add esp, 0xc
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005d28b3
add esp, 0x10
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480

Function at 0x561e80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
mov al, 0x74
push esi
mov byte [esp + 0x10], al
mov byte [esp + 0x13], al
lea eax, [esp + 0xc]
push edi
push eax
mov esi, ecx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x19], 0x45
mov byte [esp + 0x1a], 0x58
mov byte [esp + 0x1c], 0
call fcn.00561c70
mov edi, eax
add esp, 4
test edi, edi
je 0x561f77
test ebx, ebx
je 0x561edf
cmp byte [ebx], 0
je 0x561edf
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
jmp 0x561ee1
xor ebx, ebx
lea ecx, [edi + ebx + 1]
push ebp
push ecx
lea ecx, [esp + 0x1c]
call fcn.00560210
mov ebp, dword [esp + 0x18]
add esp, 4
add edi, 1
test esi, esi
je 0x561f1e
test ebp, ebp
je 0x561f1e
test edi, edi
jbe 0x561f1e
mov eax, dword [esi + 0x50]
test eax, eax
je 0x561f62
push edi
push ebp
push esi
call eax
add esp, 0xc
mov edx, edi
mov ecx, ebp
call fcn.0054afb0
test ebx, ebx
je 0x561f2f
mov eax, ebx
mov ebx, dword [esp + 0x10]
mov ecx, esi
call fcn.005602e0
mov eax, esi
call fcn.00560320
test esi, esi
je 0x561f76
test ebp, ebp
je 0x561f76
mov eax, dword [esi + 0x240]
test eax, eax
push ebp
je 0x561f6e
push esi
call eax
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
call fcn.005d27e0
add esp, 4
pop ebp
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x14
ret
Function at 0x561f90
Capabilities:
Terminate process

Disassembly:
sub esp, 0x28
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x14]
push eax
mov esi, ecx
mov byte [esp + 0x30], 0x7a
mov byte [esp + 0x31], 0x54
mov byte [esp + 0x32], 0x58
mov byte [esp + 0x33], 0x74
mov byte [esp + 0x34], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00561c70
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x562025
cmp esi, ebx
je 0x56212a
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x56212a
mov eax, dword [esi + 0x240]
cmp eax, ebx
push ecx
je 0x562122
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret
cmp edi, ebx
je 0x5620e5
cmp byte [edi], bl
je 0x5620e5
cmp dword [esp + 0x40], 0xffffffff
je 0x5620e5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x40]
push ecx
push edi
lea ebx, [esp + 0x20]
mov ecx, eax
mov edx, esi
call fcn.00560380
lea edx, [eax + ebp + 2]
push edx
lea ecx, [esp + 0x38]
call fcn.00560210
mov ebx, dword [esp + 0x20]
add esp, 0xc
lea eax, [ebp + 1]
mov ecx, esi
call fcn.005602e0
mov edx, ebx
mov ecx, esi
call fcn.005600a0
test esi, esi
mov al, byte [esp + 0x40]
mov byte [esp + 0x13], al
je 0x5620b0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x5620d9
push 1
lea ecx, [esp + 0x17]
push ecx
push esi
call eax
add esp, 0xc
mov edx, 1
lea ecx, [esp + 0x13]
call fcn.0054afb0
lea edx, [esp + 0x18]
push edx
mov eax, esi
call fcn.005606d0
add esp, 4
mov eax, esi
call fcn.00560320
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480
push edi
mov edi, dword [esp + 0x18]
mov edx, edi
mov ecx, esi
call fcn.00561e80
add esp, 4
cmp esi, ebx
je 0x56212a
cmp edi, ebx
je 0x56212a
mov eax, dword [esi + 0x240]
cmp eax, ebx
push edi
je 0x562122
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret
call fcn.005d27e0
add esp, 4
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x28
ret
Function at 0x5623b0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x18
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [esp + 0x20], 2
mov al, 0x46
push esi
mov esi, ecx
mov byte [esp + 0x10], 0x6f
mov byte [esp + 0x11], al
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x73
mov byte [esp + 0x14], 0
jl 0x5623eb
mov ecx, str.Unrecognized_unit_type_for_oFFs_chunk
call fcn.0054c4a0
mov eax, dword [esp + 0x20]
mov ecx, eax
sar ecx, 0x18
mov edx, eax
sar edx, 0x10
mov byte [esp + 4], cl
mov ecx, eax
mov byte [esp + 5], dl
sar ecx, 8
mov edx, ebx
sar edx, 0x18
mov byte [esp + 6], cl
mov byte [esp + 7], al
mov eax, ebx
mov ecx, ebx
mov byte [esp + 8], dl
mov dl, byte [esp + 0x24]
sar eax, 0x10
sar ecx, 8
test esi, esi
mov byte [esp + 9], al
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], bl
mov byte [esp + 0xc], dl
je 0x562470
push 9
lea ecx, [esp + 0x14]
call fcn.00560210
mov eax, dword [esi + 0x50]
add esp, 4
test eax, eax
je 0x562480
push 9
lea ecx, [esp + 8]
push ecx
push esi
call eax
add esp, 0xc
mov edx, 9
lea ecx, [esp + 4]
call fcn.0054afb0
mov eax, esi
call fcn.00560320
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0x18
ret
push edi
mov edi, str.Call_to_NULL_write_function
mov eax, esi
jmp fcn.0054c480