joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515ad0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x3c]
cmp dword [0x57ef40], 0x7ff
ja 0x515bca
mov bl, byte [esp + 0x38]
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 4], 0
lea edi, [esp + 4]
mov ecx, edi
push eax
call fcn.0041dba0
mov ecx, edi
push esi
call fcn.0041e250
mov ecx, edi
push ebp
call fcn.0041e250
mov eax, 0x57ef30
mov edx, 0x57ef34
test bl, bl
cmovne edx, eax
mov ecx, edi
push edx
call fcn.0041e250
mov eax, dword [esp + 4]
movzx edx, word [eax]
test dx, dx
je 0x515b69
add eax, 2
mov ebx, 0x1505
mov ecx, ebx
nop dword [eax]
movzx edx, dx
shl ecx, 5
add ecx, ebx
add ecx, edx
movzx edx, word [eax]
add eax, 2
mov ebx, ecx
test dx, dx
jne 0x515b50
jmp 0x515b6e
mov ecx, 0x1505
mov dword [esp + 8], ecx
lea ebx, [esp + 0x10]
mov ecx, ebx
push edi
call fcn.0041dba0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
mov dword [esp + 0xc], eax
mov edx, esp
lea esi, [esp + 0xc]
mov ecx, 0x57ef38
push edx
push esi
push 0x56de47
push eax
call fcn.00516100
mov ebp, eax
lea ecx, [eax + 0x14]
push ebx
call fcn.0041dfd0
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x18], eax
mov ecx, ebx
call fcn.0041da60
mov ecx, edi
call fcn.0041da60
mov eax, dword [esp + 0x3c]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x516620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x51664a
test byte [eax + 0x74], 0x40
jne 0x51663c
push eax
call fcn.00541270
add esp, 4
jmp fcn.00526920
push str.png_read_update_info_png_start_read_image:_duplicate_call
push eax
call fcn.00522e00
add esp, 8
ret
Function at 0x5229e0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x5229ed
jmp ecx
push str.Call_to_NULL_write_function
push eax
call fcn.00522ad0
nop dword [eax + eax]
push edi
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x522a24
mov edi, dword [esp + 0x14]
push dword [esi + 0x5c]
push edi
push 1
push dword [esp + 0x1c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x522a27
pop esi
pop edi
ret
push str.Write_Error
push esi
call fcn.00522ad0
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x174]
test eax, eax
je 0x522a50
jmp eax
ret

Function at 0x523220
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x523240
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x523240
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x523240
push dword [esp + 8]
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x526920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ebx, dword [esi + 0x78]
test ebx, 0x1000
je 0x52696d
mov al, byte [edx + 0x19]
movzx ecx, word [esi + 0x144]
cmp al, 3
jne 0x526acd
test cx, cx
setne al
shl al, 2
or al, 2
mov byte [edx + 0x19], al
mov byte [edx + 0x18], 8
mov word [edx + 0x16], 0
cmp dword [esi + 0x138], 0
je 0x526b16
test bl, 0x80
je 0x526990
movzx eax, word [esi + 0x168]
mov word [edx + 0xb2], ax
movsd xmm0, qword [esi + 0x160]
movsd qword [edx + 0xaa], xmm0
mov eax, dword [esi + 0x2c0]
mov dword [edx + 0x28], eax
mov al, byte [edx + 0x18]
cmp al, 0x10
jne 0x5269b0
mov ecx, ebx
and ecx, 0x4000400
je 0x5269b0
mov byte [edx + 0x18], 8
mov al, 8
test ebx, 0x4000
je 0x5269bc
or byte [edx + 0x19], 2
test ebx, 0x600000
je 0x5269c8
and byte [edx + 0x19], 0xfd
test bl, 0x40
je 0x5269f5
mov cl, byte [edx + 0x19]
or cl, 4
cmp cl, 6
jne 0x5269f5
cmp dword [esi + 0x200], 0
je 0x5269f5
cmp al, 8
jne 0x5269f5
mov byte [edx + 0x19], 3
mov al, 8
test ebx, 0x200
jne 0x526a01
jmp 0x526a0f
test ebx, 0x200
je 0x526a0f
cmp al, 8
jne 0x526a0f
mov al, 8
cmp byte [edx + 0x19], 3
je 0x526a0f
mov byte [edx + 0x18], 0x10
mov al, 0x10
test bl, 4
je 0x526a1e
cmp al, 7
ja 0x526a1e
mov byte [edx + 0x18], 8
mov al, 8
mov cl, byte [edx + 0x19]
cmp cl, 3
je 0x526a2f
test cl, 2
jne 0x526aff
mov byte [edx + 0x1d], 1
mov ah, 1
test ebx, 0x40000
je 0x526a49
and cl, 0xfb
mov byte [edx + 0x19], cl
mov word [edx + 0x16], 0
test cl, 4
jne 0x526a58
test ebx, 0x8000
jne 0x526a66
jmp 0x526a7f
add ah, 1
mov byte [edx + 0x1d], ah
test ebx, 0x8000
je 0x526a7f
test cl, 0xfd
jne 0x526a7f
add ah, 1
mov byte [edx + 0x1d], ah
test ebx, 0x1000000
je 0x526a7f
or cl, 4
mov byte [edx + 0x19], cl
test ebx, 0x100000
je 0x526a9f
mov cl, byte [esi + 0x6c]
test cl, cl
je 0x526a93
mov byte [edx + 0x18], cl
mov al, cl
mov cl, byte [esi + 0x6d]
test cl, cl
je 0x526a9f
mov byte [edx + 0x1d], cl
jmp 0x526aa1
mov cl, ah
mul cl
mov byte [edx + 0x1e], al
movzx edi, al
mov ecx, dword [edx]
cmp al, 8
jb 0x526ab7
shr edi, 3
imul ecx, edi
jmp 0x526ac0
imul ecx, edi
add ecx, 7
shr ecx, 3
mov dword [edx + 0xc], ecx
mov dword [esi + 0x12c], ecx
pop esi
pop edi
pop ebx
ret
test cx, cx
je 0x526ae1
mov ecx, ebx
and ecx, 0x2000000
je 0x526ae1
or al, 4
mov byte [edx + 0x19], al
cmp byte [edx + 0x18], 7
ja 0x526aeb
mov byte [edx + 0x18], 8
mov word [edx + 0x16], 0
test bl, 0x80
jne 0x526972
jmp 0x526990
mov byte [edx + 0x1d], 3
mov ah, 3
test ebx, 0x40000
jne 0x526a3d
jmp 0x526a49
push str.Palette_is_NULL_in_indexed_image
push esi
call fcn.00522ad0
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x52ac70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dl, byte [ecx + 8]
cmp dl, 4
je 0x52aca7
test dl, dl
jne 0x52adea
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x52adea
xor edx, edx
xor esi, esi
cmp ecx, 8
jae 0x52ad03
mov edi, eax
jmp 0x52add9
mov dl, byte [ecx + 9]
cmp dl, 0x10
je 0x52acdf
cmp dl, 8
jne 0x52adea
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x52adea
xor edx, edx
nop word cs:[eax + eax]
nop
not byte [eax + edx]
add edx, 2
cmp edx, ecx
jb 0x52acd0
jmp 0x52adea
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x52adea
xor edx, edx
nop dword [eax]
not byte [eax + edx]
not byte [eax + edx + 1]
add edx, 4
cmp edx, ecx
jb 0x52acf0
jmp 0x52adea
cmp ecx, 0x20
jb 0x52ada6
mov esi, ecx
and esi, 0xffffffe0
lea edi, [esi - 0x20]
mov ebx, edi
shr ebx, 5
add ebx, 1
test edi, edi
je 0x52adef
mov ebp, ebx
and ebp, 0xfffffffe
xor edi, edi
pcmpeqd xmm0, xmm0
nop
movdqu xmm1, xmmword [eax + edi]
movdqu xmm2, xmmword [eax + edi + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [eax + edi], xmm1
movdqu xmmword [eax + edi + 0x10], xmm2
movdqu xmm1, xmmword [eax + edi + 0x20]
movdqu xmm2, xmmword [eax + edi + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [eax + edi + 0x20], xmm1
movdqu xmmword [eax + edi + 0x30], xmm2
add edi, 0x40
add ebp, 0xfffffffe
jne 0x52ad30
test bl, 1
je 0x52ad9d
movdqu xmm0, xmmword [eax + edi]
movdqu xmm1, xmmword [eax + edi + 0x10]
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [eax + edi], xmm0
movdqu xmmword [eax + edi + 0x10], xmm1
cmp ecx, esi
je 0x52adea
test cl, 0x18
je 0x52adf8
mov ebx, esi
mov esi, ecx
and esi, 0xfffffff8
lea edi, [eax + esi]
pcmpeqd xmm0, xmm0
nop word cs:[eax + eax]
nop
movq xmm1, qword [eax + ebx]
pxor xmm1, xmm0
movq qword [eax + ebx], xmm1
add ebx, 8
cmp esi, ebx
jne 0x52adc0
cmp ecx, esi
je 0x52adea
sub ecx, esi
nop dword [eax + eax]
not byte [edi + edx]
add edx, 1
cmp ecx, edx
jne 0x52ade0
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
test bl, 1
jne 0x52ad7b
jmp 0x52ad9d
add eax, esi
jmp 0x52aca0
Function at 0x52cba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x52ccf5
mov edi, dword [esp + 0x14]
test edi, edi
je 0x52ccf5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x52ccf5
mov ebp, dword [esp + 0x20]
test ebp, ebp
jle 0x52ccf5
push 0x14
push ebp
push dword [eax + 0xfc]
push dword [eax + 0xf8]
push edi
call fcn.00542a20
add esp, 0x14
test eax, eax
je 0x52cce5
mov esi, eax
mov eax, dword [esp + 0x18]
push dword [eax + 0xf8]
push edi
call fcn.005428b0
add esp, 8
mov eax, dword [esp + 0x18]
mov dword [eax + 0xf8], esi
or byte [eax + 0xf5], 2
mov eax, dword [eax + 0xfc]
lea eax, [eax + eax*4]
lea esi, [esi + eax*4]
jmp 0x52cc5f
mov dword [esi + 8], 0
xor edi, edi
mov dword [esi + 0xc], edi
add esi, 0x14
mov eax, dword [esp + 0x18]
add dword [eax + 0xfc], 1
mov edi, dword [esp + 0x14]
lea eax, [ebp - 1]
add ebx, 0x14
cmp ebp, 1
mov ebp, eax
jle 0x52ccf5
mov eax, dword [ebx]
mov dword [esi], eax
mov byte [esi + 4], 0
movzx eax, byte [ebx + 0x10]
and eax, 0xb
jne 0x52cc90
test byte [edi + 0x71], 0x80
jne 0x52ccfa
push str.png_set_unknown_chunks_now_expects_a_valid_location
push edi
call fcn.00522de0
add esp, 8
mov eax, dword [edi + 0x70]
and eax, 0xb
je 0x52ccfa
mov ecx, eax
mov edx, eax
neg edx
and edx, eax
mov eax, edx
xor eax, ecx
cmp ecx, edx
jne 0x52cc90
mov byte [esi + 0x10], cl
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x52cc30
push eax
push edi
call fcn.00542990
add esp, 8
mov dword [esi + 8], eax
test eax, eax
je 0x52ccd0
mov edi, dword [ebx + 0xc]
push edi
push dword [ebx + 8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x52cc39
push 1
push str.unknown_chunk:_out_of_memory
push edi
call fcn.00522ff0
add esp, 0xc
jmp 0x52cc4e
push 1
push str.too_many_unknown_chunks
push edi
call fcn.00522ff0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push str.invalid_location_in_png_set_unknown_chunks
push edi
call fcn.00522ad0
nop word cs:[eax + eax]
nop
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x52cdad
mov esi, dword [esp + 0x18]
test esi, esi
je 0x52cdad
mov edi, dword [esp + 0x1c]
test edi, edi
js 0x52cdad
cmp dword [esi + 0xfc], edi
jle 0x52cdad
mov ebx, dword [esp + 0x20]
test bl, 0xb
je 0x52cd50
and ebx, 0xb
jne 0x52cd90
jmp 0x52cd73
push str.invalid_unknown_chunk_location
push ebp
call fcn.00522e00
add esp, 8
test bl, 4
mov eax, 1
mov ebx, 8
cmove ebx, eax
and ebx, 0xb
jne 0x52cd90
test byte [ebp + 0x71], 0x80
jne 0x52cdb2
push str.png_set_unknown_chunks_now_expects_a_valid_location
push ebp
call fcn.00522de0
add esp, 8
mov ebx, dword [ebp + 0x70]
and ebx, 0xb
je 0x52cdb2
nop
mov eax, ebx
mov ecx, ebx
neg ecx
and ecx, ebx
mov ebx, ecx
xor ebx, eax
cmp eax, ecx
jne 0x52cd90
mov ecx, dword [esi + 0xf8]
lea edx, [edi + edi*4]
mov byte [ecx + edx*4 + 0x10], al
pop esi
pop edi
pop ebx
pop ebp
ret
push str.invalid_location_in_png_set_unknown_chunks
push ebp
call fcn.00522ad0
nop dword [eax]
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x52cdd6
mov eax, dword [esp + 8]
and eax, 5
mov dword [ecx + 0x24c], eax
ret
xor eax, eax
ret
Function at 0x53c680
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x53c68d
jmp ecx
push str.Call_to_NULL_read_function
push eax
call fcn.00522ad0
nop dword [eax + eax]
push edi
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x53c6c4
mov edi, dword [esp + 0x14]
push dword [esi + 0x5c]
push edi
push 1
push dword [esp + 0x1c]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, edi
jne 0x53c6c7
pop esi
pop edi
ret
push str.Read_Error
push esi
call fcn.00522ad0
nop word cs:[eax + eax]
nop dword [eax]

Function at 0x53cd10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x11], 0
mov dword [esp + 0xd], 0
mov eax, dword [ecx + 0x70]
test al, 1
jne 0x53ce82
cmp dword [ebp + 0x10], 0xd
jne 0x53ce8d
or eax, 1
mov dword [ecx + 0x70], eax
lea edi, [esp + 8]
push 0xd
push edi
push dword [ebp + 8]
call fcn.0053c680
add esp, 0xc
push 0xd
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0051ab50
add esp, 0xc
push 0
push edi
call fcn.0053cb40
add esp, 8
mov eax, dword [esp + 8]
bswap eax
mov dword [esp + 4], eax
test eax, eax
js 0x53ce98
mov esi, dword [esp + 0xc]
bswap esi
test esi, esi
js 0x53cea3
movzx eax, byte [esp + 0x10]
movzx ecx, byte [esp + 0x11]
mov dword [esp + 0x20], ecx
movzx ebx, byte [esp + 0x13]
movzx ecx, byte [esp + 0x14]
mov edi, dword [esp + 4]
mov edx, dword [ebp + 8]
mov dword [edx + 0xfc], edi
mov dword [esp + 0x18], esi
mov dword [edx + 0x100], esi
mov dword [esp + 0x24], eax
mov byte [edx + 0x14c], al
mov dword [esp + 0x28], ecx
mov byte [edx + 0x148], cl
mov eax, dword [esp + 0x20]
mov byte [edx + 0x14b], al
mov dword [esp + 0x1c], ebx
mov byte [edx + 0x250], bl
movzx ebx, byte [esp + 0x12]
mov byte [edx + 0x270], bl
mov ah, al
add ah, 0xfe
mov al, 1
cmp ah, 4
ja 0x53ce1d
movsx eax, ah
mov al, byte [eax + 0x578c3f]
mov byte [edx + 0x14f], al
mul byte [esp + 0x24]
mov byte [edx + 0x14e], al
movzx edi, al
cmp al, 8
jb 0x53ce40
shr edi, 3
mov esi, dword [esp + 4]
imul edi, esi
jmp 0x53ce4d
mov esi, dword [esp + 4]
imul edi, esi
add edi, 7
shr edi, 3
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10c], edi
push eax
push ebx
push dword [esp + 0x30]
push dword [esp + 0x2c]
push dword [esp + 0x34]
push ecx
push esi
push dword [ebp + 0xc]
push edx
call fcn.0052bd20
add esp, 0x24
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.out_of_place
push ecx
call fcn.00522d40
push str.invalid
push ecx
call fcn.00522d40
push str.PNG_unsigned_integer_out_of_range
push edi
call fcn.00522ad0
push str.PNG_unsigned_integer_out_of_range
push dword [ebp + 8]
call fcn.00522ad0
Function at 0x53d1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x70]
mov ecx, eax
not ecx
test cl, 5
jne 0x53d1db
mov edi, dword [esp + 0x14]
or eax, 0x18
mov dword [esi + 0x70], eax
push edi
push esi
call fcn.0053cb40
add esp, 8
test edi, edi
je 0x53d1d8
push str.invalid
push esi
call fcn.00522fd0
add esp, 8
pop esi
pop edi
ret
push str.out_of_place
push esi
call fcn.00522d40
nop word cs:[eax + eax]

Function at 0x53d1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
mov dword [esp], 0
mov ecx, dword [esi + 0x70]
test cl, 1
je 0x53d2a0
mov eax, dword [esp + 0x18]
test cl, 6
je 0x53d224
push eax
push esi
call fcn.0053cb40
add esp, 8
push str.out_of_place
jmp 0x53d294
cmp eax, 4
jne 0x53d285
mov edi, esp
push 4
push edi
push esi
call fcn.0053c680
add esp, 0xc
push 4
push edi
push esi
call fcn.0051ab50
add esp, 0xc
push 0
push esi
call fcn.0053cb40
add esp, 8
test eax, eax
jne 0x53d280
mov edi, dword [esp + 0x14]
mov eax, dword [esp]
bswap eax
test eax, eax
mov ecx, 0xffffffff
cmovns ecx, eax
lea eax, [esi + 0x2c0]
push ecx
push eax
push esi
call fcn.0051b970
add esp, 0xc
push edi
push esi
call fcn.0051bb20
add esp, 8
add esp, 4
jmp 0x53d29d
push eax
push esi
call fcn.0053cb40
add esp, 8
push str.invalid
push esi
call fcn.00522fd0
add esp, 0xc
pop esi
pop edi
ret
push str.missing_IHDR
push esi
call fcn.00522d40
nop dword [eax + eax]
Function at 0x53d2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x70]
test al, 1
je 0x53d459
mov ebx, dword [esp + 0x24]
test al, 6
je 0x53d2eb
push ebx
push esi
call fcn.0053cb40
add esp, 8
push str.out_of_place
push esi
call fcn.00522fd0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 0x20]
test edi, edi
je 0x53d2fd
test byte [edi + 8], 2
jne 0x53d3f0
cmp byte [esi + 0x14b], 3
jne 0x53d317
mov cl, 8
mov eax, 3
cmp ebx, 4
jbe 0x53d32d
jmp 0x53d3d6
movzx eax, byte [esi + 0x14f]
mov cl, byte [esi + 0x14c]
cmp ebx, 4
ja 0x53d3d6
cmp eax, ebx
jne 0x53d3d6
movzx eax, cl
imul eax, eax, 0x1010101
mov dword [esp], eax
mov ebp, esp
push ebx
push ebp
push esi
mov byte [esp + 0x13], cl
call fcn.0053c680
add esp, 0xc
push ebx
push ebp
push esi
call fcn.0051ab50
add esp, 0xc
push 0
push esi
call fcn.0053cb40
add esp, 8
test eax, eax
jne 0x53d451
test ebx, ebx
mov cl, byte [esp + 7]
je 0x53d3ba
mov al, byte [esp]
test al, al
je 0x53d404
cmp al, cl
ja 0x53d404
cmp ebx, 1
je 0x53d3ba
mov al, byte [esp + 1]
test al, al
je 0x53d404
cmp al, cl
ja 0x53d404
cmp ebx, 2
je 0x53d3ba
mov al, byte [esp + 2]
test al, al
je 0x53d404
cmp al, cl
ja 0x53d404
cmp ebx, 3
je 0x53d3ba
mov al, byte [esp + 3]
test al, al
je 0x53d404
cmp al, cl
ja 0x53d404
test byte [esi + 0x14b], 2
mov al, byte [esp]
jne 0x53d41a
lea edx, [esp + 1]
mov byte [esi + 0x1a3], al
mov ecx, eax
mov ah, al
jmp 0x53d426
push str.invalid
push esi
call fcn.00522fd0
add esp, 8
push ebx
push esi
call fcn.0053cb40
jmp 0x53d2e3
push ebx
push esi
call fcn.0053cb40
add esp, 8
push str.duplicate
jmp 0x53d2dd
push str.invalid
push esi
call fcn.00522fd0
add esp, 8
add esp, 8
jmp 0x53d2e6
lea edx, [esp + 3]
mov cl, byte [esp + 1]
mov ah, byte [esp + 2]
mov dl, byte [edx]
lea ebx, [esi + 0x1a0]
mov byte [esi + 0x1a0], al
mov byte [esi + 0x1a1], cl
mov byte [esi + 0x1a2], ah
mov byte [esi + 0x1a4], dl
push ebx
push edi
push esi
call fcn.0052c3e0
add esp, 0xc
add esp, 8
jmp 0x53d2e6
push str.missing_IHDR
push esi
call fcn.00522d40
nop word cs:[eax + eax]
nop
Function at 0x53d470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
mov ecx, dword [esi + 0x70]
test cl, 1
je 0x53d68d
mov eax, dword [ebp + 0x10]
test cl, 6
je 0x53d4b7
push eax
push esi
call fcn.0053cb40
add esp, 8
push str.out_of_place
jmp 0x53d658
cmp eax, 0x20
jne 0x53d649
lea edi, [esp + 0x30]
push 0x20
push edi
push esi
call fcn.0053c680
add esp, 0xc
push 0x20
push edi
push esi
call fcn.0051ab50
add esp, 0xc
push 0
push esi
call fcn.0053cb40
add esp, 8
test eax, eax
jne 0x53d661
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
bswap ebx
bswap eax
test eax, eax
mov ecx, 0xffffffff
mov dword [esp + 0x1c], eax
cmovns ecx, eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x38]
bswap eax
test eax, eax
mov ecx, 0xffffffff
mov dword [esp + 0x18], eax
cmovns ecx, eax
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x3c]
bswap eax
test eax, eax
mov ecx, 0xffffffff
mov dword [esp + 0x14], eax
cmovns ecx, eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x40]
bswap eax
test eax, eax
mov ecx, 0xffffffff
mov dword [esp + 0x10], eax
cmovns ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x44]
bswap eax
test eax, eax
mov edi, 0xffffffff
mov dword [esp + 0xc], eax
cmovns edi, eax
mov ecx, dword [esp + 0x48]
bswap ecx
test ecx, ecx
mov eax, 0xffffffff
mov dword [esp + 8], ecx
cmovns eax, ecx
mov edx, dword [esp + 0x4c]
bswap edx
test edx, edx
mov ecx, 0xffffffff
mov dword [esp + 4], edx
cmovns ecx, edx
test ebx, ebx
mov edx, 0xffffffff
cmovs ebx, edx
mov dword [esp + 0x74], ebx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
js 0x53d669
cmp dword [esp + 0x1c], 0
js 0x53d669
cmp dword [esp + 0x18], 0
js 0x53d669
cmp dword [esp + 0x14], 0
js 0x53d669
cmp dword [esp + 0x10], 0
js 0x53d669
cmp dword [esp + 0xc], 0
js 0x53d669
cmp dword [esp + 8], 0
js 0x53d669
cmp dword [esp + 4], 0
js 0x53d669
movzx eax, word [esi + 0x30a]
test eax, 0x8000
jne 0x53d661
mov edi, dword [ebp + 0xc]
test al, 0x10
jne 0x53d670
lea ecx, [esi + 0x2c0]
or eax, 0x10
mov word [esi + 0x30a], ax
lea eax, [esp + 0x5c]
push 1
push eax
push ecx
push esi
call fcn.0051bc00
add esp, 0x10
push edi
push esi
call fcn.0051bb20
jmp 0x53d65e
push eax
push esi
call fcn.0053cb40
add esp, 8
push str.invalid
push esi
call fcn.00522fd0
add esp, 8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.invalid_values
jmp 0x53d658
or eax, 0x8000
mov word [esi + 0x30a], ax
push edi
push esi
call fcn.0051bb20
add esp, 8
push str.duplicate
jmp 0x53d658
push str.missing_IHDR
push esi
call fcn.00522d40
nop dword [eax + eax]
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x405660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40566f
pop dword [ebp - 0x40]
mov eax, 0x4bbb7f77
add eax, 0xb484d6f8
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x38c96
push 0
mov eax, 0x2fb1b7da
sub eax, 0x2f70d702
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x3e983666
add ecx, 0xc1680fe7
mov ebx, eax
mov edi, 0x81ffff6f
add edi, 0x7e413c55
add edi, dword [ebp - 0x40]
mov edx, 0xc9d37d9b
add edx, 0x64091771
add dword [ebp - 0x28], ecx
mov esi, dword [edi]
sub dword [ebp - 8], 0xcfb29778
add esi, edx
xor dword [ebp - 0x10], esi
mov dword [ebx], esi
sub dword [ebp - 0x24], esi
add ebx, 0x932808d5
sub ebx, 0x932808d1
add edi, 0xbae899c3
sub edi, 0xbae899bf
loop 0x4056ce
add eax, 0xbce45e9d
sub eax, 0xbce35296
xor ebx, ebx
add ebx, eax
add eax, 0xb4411a
add eax, 0xff4bbeeb
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x409607
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f19
and dword [ebp - 4], 0
cmp dword [0x412990], 0
mov ebx, eax
jne 0x4096b8
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409769
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409769
push eax
call fcn.00405660
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412990], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412994], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412998], eax
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x4129a0], eax
test eax, eax
je 0x4096b8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x41299c], eax
mov eax, dword [0x41299c]
cmp eax, ebx
je 0x409710
cmp dword [0x4129a0], ebx
je 0x409710
push eax
call fcn.00405660
push dword [0x4129a0]
mov esi, eax
call fcn.00405660
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409710
test edi, edi
je 0x409710
call esi
test eax, eax
je 0x409707
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409707
test byte [ebp - 0xc], 1
jne 0x409710
or dword [ebp + 0x10], 0x200000
jmp 0x409749
mov eax, dword [0x412994]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409749
mov eax, dword [0x412998]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412990]
call fcn.00405660
pop ecx
test eax, eax
je 0x409769
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40976b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret