joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1a50
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66f50c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6a0
push ebx
push esi
push edi
lea edi, [ebp - 0x6ac]
mov ecx, 0x1a8
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x61c]
call fcn.00401a69
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x620]
call fcn.00405024
mov byte [ebp - 4], 1
mov dword [ebp - 0x624], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x634], esp
push 0x6f2950
call fcn.006195e6
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x658], eax
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x638], esp
push 0x6f294c
call fcn.006195e6
mov dword [ebp - 0x65c], eax
lea ecx, [ebp - 0x61c]
mov byte [ebp - 4], 1
call fcn.004038d7
push ecx
mov ecx, esp
mov dword [ebp - 0x63c], esp
push 0x6f2950
call fcn.006195e6
mov dword [ebp - 0x660], eax
mov ecx, dword [ebp - 0x660]
mov dword [ebp - 0x664], ecx
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x640], esp
push 0x6f294c
call fcn.006195e6
mov dword [ebp - 0x668], eax
lea ecx, [ebp - 0x61c]
mov byte [ebp - 4], 1
call fcn.00406032
push 5
push 4
push str.SELECT__FROM_MI_Procedure_WHERE_LocationFlag_____d_AND_LocationFlag_____d
lea edx, [ebp - 0x620]
push edx
call fcn.0060da8c
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x644], esp
lea eax, [ebp - 0x620]
push eax
call fcn.006195e6
mov dword [ebp - 0x66c], eax
lea ecx, [ebp - 0x61c]
call fcn.00401a28
lea ecx, [ebp - 0x61c]
call fcn.00404e5d
mov dword [ebp - 0x628], eax
mov ecx, dword [0x6f2e3c]
mov dword [ebp - 0x62c], ecx
lea ecx, [ebp - 0x61c]
call fcn.00406884
lea ecx, [ebp - 0x61c]
call fcn.00406afa
cmp dword [0x6f2e3c], 0xbb8
jl 0x4c1c03
mov dword [ebp - 0x648], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x620]
call fcn.00619871
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x61c]
call fcn.004033a5
mov eax, dword [ebp - 0x648]
jmp 0x4c1cd3
mov edx, dword [ebp - 0x628]
cmp edx, dword [ebp - 0x62c]
jl 0x4c1ca2
lea ecx, [ebp - 0x630]
call fcn.00405024
mov byte [ebp - 4], 4
push 0xc8
mov eax, dword [ebp - 0x62c]
push eax
mov ecx, dword [ebp - 0x628]
push ecx
push str.LICENSING_ERROR_:_Licensed_No._of_DICOM_Studies_exceeded____n_nNumber_of_Pateints_Stored_t_t_d_nNumber_of_Patients_Licensed_on_Lock_t_d_nNumber_of_Patients_Licensed_by_default_t_d_n_nCAN_NOT_PROCESS_DICOM_STUDY._n
lea edx, [ebp - 0x630]
push edx
call fcn.0060da8c
add esp, 0x14
push 0
push 0x10
lea ecx, [ebp - 0x630]
call fcn.004073ce
push eax
call fcn.0062dd90
mov dword [ebp - 0x64c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x630]
call fcn.00619871
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x620]
call fcn.00619871
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x61c]
call fcn.004033a5
mov eax, dword [ebp - 0x64c]
jmp 0x4c1cd3
mov dword [ebp - 0x650], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x620]
call fcn.00619871
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x61c]
call fcn.004033a5
mov eax, dword [ebp - 0x650]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x6ac
cmp ebp, esp
call fcn.005e0cbc
mov esp, ebp
pop ebp
ret
Function at 0x51b3d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x674998
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x50]
mov ecx, 0x11
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00402d6f
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x248
call fcn.00615b90
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x25c
call fcn.00615250
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x270
call fcn.00615b90
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x4e0
call fcn.00401d5c
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CDICOMPrint.0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x64], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x6c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x7c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x80], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x84], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x500], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x504], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x508], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x510], 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x78], 0
mov byte [0x6e6d25], 0
mov byte [0x6e6d3d], 0
mov byte [0x6e6d56], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x70], 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00403da0
mov esi, esp
push 0
push str.C:PrintLog
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, esp
call fcn.005e0cbc
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x284], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x288], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x50
cmp ebp, esp
call fcn.005e0cbc
mov esp, ebp
pop ebp
ret
Function at 0x52a020
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67534b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x74]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jne 0x52a060
mov eax, dword [0x6f2868]
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x14]
call fcn.00405024
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00405024
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00405024
mov byte [ebp - 4], 2
push str.PRINT_LIST
mov ecx, dword [0x6f2914]
push ecx
push 0x6856dc
lea edx, [ebp - 0x14]
push edx
call fcn.0060da8c
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10c]
push ecx
push str.Image__0003d
lea edx, [ebp - 0x18]
push edx
call fcn.0060da8c
add esp, 0xc
mov esi, esp
push 0
lea ecx, [ebp - 0x14]
call fcn.004073ce
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, esp
call fcn.005e0cbc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10c]
push ecx
push str.Icon__0003d
lea edx, [ebp - 0x1c]
push edx
call fcn.0060da8c
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.0040584e
push eax
mov ecx, dword [ebp + 8]
call fcn.00406631
mov dword [ebp - 0x20], eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x24], esp
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.00619aa0
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x20]
call fcn.00404728
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov esi, esp
mov ecx, dword [ebp - 0x20]
call dword [edx + 0x58]
cmp esi, esp
call fcn.005e0cbc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10c]
add ecx, 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10c], ecx
push 0
push ecx
mov eax, esp
mov dword [ebp - 0x28], esp
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.00619aa0
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp + 8]
call fcn.00404728
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.00619871
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00619871
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00619871
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x74
cmp ebp, esp
call fcn.005e0cbc
mov esp, ebp
pop ebp
ret 4
Function at 0x5a7170
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esi], vtable.siplIP.0
test eax, eax
je 0x5a7190
push eax
call fcn.005e2ecd
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x5a71a7
push eax
call fcn.005e2ecd
add esp, 4
mov dword [esi + 8], 0
push str.C:DirTemp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esi + 0x18]
call fcn.00619871
pop esi
ret
Function at 0x5ab6a0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x14
fld dword [esp + 0x18]
push ebx
push ebp
fst qword [esp + 0xc]
fmul qword [0x6a4840]
push edi
mov dword [esp + 0xc], 0
sub esp, 8
fstp qword [esp]
call fcn.005e2d72
fadd st(0), st(0)
fadd qword [0x68dbd0]
call fcn.005e1f50
mov edi, dword [esp + 0x34]
mov ecx, eax
cdq
sub eax, edx
push 4
mov ebx, eax
push ecx
mov dword [edi], ecx
sar ebx, 1
call fcn.005e3b9a
mov ebp, dword [esp + 0x38]
add esp, 0x10
test eax, eax
mov dword [ebp], eax
jne 0x5ab712
push str.Error_callocing_the_gaussian_kernel_array._n
push 0x6eeca0
call fcn.005e35cf
add esp, 8
push 1
call fcn.005e246f
mov eax, dword [edi]
push esi
xor esi, esi
test eax, eax
jle 0x5ab77e
fld dword [esp + 0x28]
fmul dword [esp + 0x28]
fstp dword [esp + 0x30]
fld qword [0x6a4838]
fsqrt
fmul qword [esp + 0x14]
fstp qword [esp + 0x1c]
mov eax, esi
sub eax, ebx
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fstp qword [esp + 0x14]
fld qword [0x6a4830]
fld qword [esp + 0x14]
fmul qword [esp + 0x14]
fmul qword [0x6a4828]
fdiv dword [esp + 0x30]
call fcn.005e2020
fdiv qword [esp + 0x1c]
mov ecx, dword [ebp]
inc esi
fst dword [ecx + esi*4 - 4]
mov eax, dword [edi]
fadd dword [esp + 0x10]
cmp esi, eax
fstp dword [esp + 0x10]
jl 0x5ab737
mov ecx, dword [edi]
xor eax, eax
test ecx, ecx
pop esi
jle 0x5ab79b
mov edx, dword [ebp]
fld dword [edx + eax*4]
fdiv dword [esp + 0xc]
lea ecx, [edx + eax*4]
inc eax
fstp dword [ecx]
cmp eax, dword [edi]
jl 0x5ab787
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 0xc
Function at 0x5ab7b0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ebx
imul esi, edi
push 2
push esi
call fcn.005e3b9a
mov ecx, dword [esp + 0x30]
add esp, 8
test eax, eax
mov dword [ecx], eax
jne 0x5ab7f1
push str.Error_allocating_the_delta_x_image._n
push 0x6eeca0
call fcn.005e35cf
add esp, 8
push 1
call fcn.005e246f
push 2
push esi
call fcn.005e3b9a
mov edx, dword [esp + 0x34]
add esp, 8
test eax, eax
mov dword [edx], eax
jne 0x5ab81f
push str.Error_allocating_the_delta_x_image._n
push 0x6eeca0
call fcn.005e35cf
add esp, 8
push 1
call fcn.005e246f
mov ecx, dword [esp + 0x1c]
push ebp
test ebx, ebx
jle 0x5ab8da
mov eax, 0xfffffffe
mov esi, 1
sub eax, ecx
mov dword [esp + 0x10], esi
lea edx, [ecx + 2]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebx
jmp 0x5ab84d
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov bx, word [edx]
sub bx, word [edx - 2]
add eax, edx
mov ebp, dword [ebp]
mov word [eax + ebp], bx
lea ebx, [edi - 1]
cmp ebx, 1
mov eax, esi
jle 0x5ab8a7
dec ebx
lea eax, [edx + 2]
add esi, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov ebp, dword [esp + 0x2c]
mov si, word [eax]
mov ebx, dword [esp + 0x28]
sub si, word [eax - 4]
mov ebp, dword [ebp]
add ebx, eax
add eax, 2
mov word [ebx + ebp], si
mov esi, dword [esp + 0x20]
dec esi
mov dword [esp + 0x20], esi
jne 0x5ab879
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x2c]
mov bx, word [ecx + eax*2]
sub bx, word [ecx + eax*2 - 2]
add esi, edi
mov ebp, dword [ebp]
mov dword [esp + 0x10], esi
mov word [ebp + eax*2], bx
lea eax, [edi + edi]
add edx, eax
mov eax, dword [esp + 0x14]
dec eax
mov dword [esp + 0x14], eax
jne 0x5ab849
mov ebx, dword [esp + 0x24]
xor edx, edx
test edi, edi
mov dword [esp + 0x20], edx
jle 0x5ab9a2
dec ebx
mov ebp, edi
lea esi, [edi + edi]
lea eax, [ecx + edi*4]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x30]
mov ax, word [esi + ecx]
sub ax, word [ecx + edx*2]
mov ebx, dword [ebx]
mov word [ebx + edx*2], ax
mov ebx, dword [esp + 0x24]
cmp ebx, 1
mov eax, ebp
jle 0x5ab964
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
lea eax, [edx - 1]
mov dword [esp + 0x28], eax
imul eax, edi
add eax, ebp
mov edx, esi
lea ebp, [edi + edi]
sub edx, ebp
mov bp, word [ebx]
sub bp, word [edx + ecx]
mov edx, dword [esp + 0x30]
mov edx, dword [edx]
mov word [esi + edx], bp
lea edx, [edi + edi]
add esi, edx
add ebx, edx
mov edx, dword [esp + 0x28]
dec edx
mov dword [esp + 0x28], edx
jne 0x5ab932
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
mov bx, word [ecx + eax*2]
mov esi, eax
sub esi, edi
sub bx, word [ecx + esi*2]
mov esi, dword [esp + 0x30]
inc edx
inc ebp
mov esi, dword [esi]
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebp
mov word [esi + eax*2], bx
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x2c]
add esi, 2
add ebx, 2
cmp edx, edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], ebx
jl 0x5ab901
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret 0x14
Function at 0x5ab9c0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
mov eax, esi
push 2
imul eax, ebp
push eax
call fcn.005e3b9a
mov ecx, dword [esp + 0x28]
add esp, 8
test eax, eax
mov dword [ecx], eax
jne 0x5ab9fe
push str.Error_allocating_the_magnitude_image._n
push 0x6eeca0
call fcn.005e35cf
add esp, 8
push 1
call fcn.005e246f
push edi
xor edi, edi
test esi, esi
jle 0x5aba6b
push ebx
mov dword [esp + 0x20], esi
test ebp, ebp
jle 0x5aba5f
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
sub ebx, eax
lea esi, [eax + edi*2]
movsx eax, word [ebx + esi]
movsx ecx, word [esi]
mov edx, eax
imul edx, eax
mov eax, ecx
mov dword [esp + 0x10], edx
imul eax, ecx
fild dword [esp + 0x10]
mov dword [esp + 0x10], eax
fiadd dword [esp + 0x10]
fsqrt
fadd qword [0x6901b0]
call fcn.005e1f50
mov ecx, dword [esp + 0x28]
inc edi
add esi, 2
dec ebp
mov edx, dword [ecx]
mov word [edx + edi*2 - 2], ax
jne 0x5aba1b
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x20], eax
jne 0x5aba0a
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret 0x14
Function at 0x5b29e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x67eaf8
push eax
mov dword fs:[0], esp
push ebp
mov ebp, dword [esp + 0x28]
push esi
test ebp, ebp
push edi
je 0x5b2b4d
mov edx, dword [esp + 0x20]
test edx, edx
je 0x5b2b4d
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x5b2b4d
mov eax, dword [esp + 0x24]
test eax, eax
jle 0x5b2b26
mov esi, dword [esp + 0x28]
test esi, esi
jle 0x5b2b26
mov ecx, dword [esp + 0x2c]
cmp ecx, 8
je 0x5b2aad
jle 0x5b2a48
cmp ecx, 0x10
jle 0x5b2ad3
cmp ecx, 0x18
je 0x5b2ad3
mov eax, dword [0x6ed544]
mov dword [esp + 0x30], eax
push ecx
lea ecx, [esp + 0x34]
push str.LUT_Assign:_Does_not_support__d_bits_per_pixel
push ecx
mov dword [esp + 0x20], 0
call fcn.0060da8c
mov edx, dword [esp + 0x3c]
add esp, 0xc
push 0
push 0
push edx
call fcn.0062dd90
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 0xffffffff
call fcn.00619871
mov eax, 0xfffffffb
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x18
imul eax, esi
test eax, eax
jle 0x5b2b5b
mov ecx, edi
sub edx, edi
mov esi, eax
xor eax, eax
mov al, byte [edx + ecx]
inc ecx
dec esi
mov al, byte [ebp + eax*2]
mov byte [ecx - 1], al
jne 0x5b2abe
jmp 0x5b2b5b
cmp ecx, 8
jle 0x5b2aff
cmp ecx, 0x10
jg 0x5b2aff
imul eax, esi
mov esi, eax
xor eax, eax
test esi, esi
jle 0x5b2b5b
xor ecx, ecx
inc eax
mov cx, word [edx]
add edx, 2
cmp eax, esi
mov cl, byte [ebp + ecx*2]
mov byte [eax + edi - 1], cl
jl 0x5b2ae8
jmp 0x5b2b5b
cmp ecx, 0x18
jne 0x5b2b5b
imul eax, esi
lea ecx, [eax + eax*2]
test ecx, ecx
jle 0x5b2b5b
mov eax, edi
sub edx, edi
mov esi, ecx
xor ecx, ecx
mov cl, byte [eax + edx]
inc eax
dec esi
mov cl, byte [ebp + ecx*2]
mov byte [eax - 1], cl
jne 0x5b2b14
jmp 0x5b2b5b
push 0
push 0
push str.SiplProcess____LUT_Assign:_Height_Width_parameter_is_less_than_or__0.
call fcn.0062dd90
mov eax, 0xfffffffb
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x18
push 0
push 0
push str.SiplProcess____LUT_Assign:_LUT_pointer__Src___Dst_pointer_is_NULL
call fcn.0062dd90
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov eax, 0xfffffff4
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 0x18
Function at 0x5b4660
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x67eb60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [0x6ed544]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x4c], 0
push ecx
lea ecx, [esp + 0x58]
call fcn.006198df
mov edx, dword [esp + 0x54]
push 0x6eaf78
push edx
mov byte [esp + 0x54], 1
call fcn.005e242f
mov esi, eax
add esp, 8
test esi, esi
jne 0x5b4728
mov eax, dword [esp + 0x54]
push str._for_reading_n_nTerminate_application_
push eax
push str.QueryReadBMP:_Cant_open
lea ecx, [esp + 0x14]
push str._s_s_s
push ecx
call fcn.0060da8c
mov edx, dword [esp + 0x1c]
add esp, 0x14
push esi
push 4
push edx
call fcn.0062dd90
cmp eax, 6
jne 0x5b46f1
push esi
call fcn.005e246f
lea ecx, [esp + 0x54]
mov byte [esp + 0x4c], 0
call fcn.00619871
lea ecx, [esp + 8]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00619871
pop edi
mov eax, 0xfffffff2
pop esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 0x10
push esi
push 1
lea eax, [esp + 0x14]
push 0xe
push eax
call fcn.005e3cfb
push esi
push 1
lea ecx, [esp + 0x34]
push 0x28
push ecx
call fcn.005e3cfb
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x7c]
add esp, 0x20
mov dword [edx], eax
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x2a]
mov dword [ecx], edx
mov ecx, dword [esp + 0x60]
and eax, 0xffff
lea edx, [esp + 0x54]
mov dword [ecx], eax
push edx
lea ecx, [edi + 0x18]
mov byte [edi + 0x14], 1
call fcn.006199aa
lea ecx, [esp + 0x54]
mov byte [esp + 0x4c], 0
call fcn.00619871
lea ecx, [esp + 8]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00619871
mov ecx, dword [esp + 0x44]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret 0x10
Function at 0x5b8f20
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x67ec78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6ed544]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
test esi, esi
jge 0x5b8f87
push 0
push 0
push str.Alloc1D:_Size_is_negative._Cant_allocate_memory
call fcn.0062dd90
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ecx, [esi + esi]
push ecx
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
call ebp
test edi, edi
je 0x5b9069
cmp eax, esi
jl 0x5b9069
mov esi, dword [esp + 0x24]
mov dword [esi], edi
mov edx, dword [0x6f2528]
inc edx
mov dword [0x6f2528], edx
mov edx, dword [esi]
push edx
push 0
call ebx
push eax
call ebp
mov edi, dword [0x6f2530]
mov edx, dword [0x6f2534]
xor ecx, ecx
add edi, eax
adc edx, ecx
mov cx, word [esp + 0x2c]
test cx, cx
mov dword [0x6f2530], edi
mov dword [0x6f2534], edx
jne 0x5b902a
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov edx, dword [esp + 0x28]
xor eax, eax
test edx, edx
jle 0x5b9040
mov edi, dword [esi]
inc eax
cmp eax, edx
mov word [edi + eax*2 - 2], cx
jl 0x5b9034
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea eax, [esp + 0x10]
push str.Alloc1D:_Cannot_allocate_sufficient_memory__nTerminate_application_
push eax
call fcn.0060da8c
mov ecx, dword [esp + 0x18]
add esp, 8
push 0
push 4
push ecx
call fcn.0062dd90
cmp eax, 6
jne 0x5b9095
push 0
call fcn.005e246f
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x5bbea0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edx, edx
mov ebx, 1
mov eax, dword [esi + 0xc]
movsx edi, word [eax + 0x10]
test edi, edi
jle 0x5bbed0
mov ecx, dword [eax + 0xc]
add ecx, 6
cmp word [ecx - 2], bx
jne 0x5bbee1
cmp word [ecx], bx
jne 0x5bbee1
inc edx
add ecx, 0xa
cmp edx, edi
jl 0x5bbebd
mov dx, word [eax + 0x24]
cmp dx, bx
jne 0x5bbefa
mov word [eax + 0x26], 0
jmp 0x5bbf37
push str.Error:_Downsampling_is_not_supported._n
push 0x6eeca0
call fcn.005e35cf
add esp, 8
push 0xffffffffffffffff
call fcn.005e246f
cmp dx, 4
jle 0x5bbf18
push str.Too_many_components_for_interleaved_scan
push 0x6eeca0
call fcn.005e35cf
add esp, 8
push ebx
call fcn.005e246f
xor ecx, ecx
test dx, dx
jle 0x5bbf37
mov edx, 0x26
mov word [edx + eax], cx
mov eax, dword [esi + 0xc]
inc ecx
add edx, 2
movsx edi, word [eax + 0x24]
cmp ecx, edi
jl 0x5bbf24
mov eax, dword [esi + 0xc]
push 0
mov ecx, dword [eax]
shl ecx, 2
push ecx
push 0x6f3030
call fcn.005bbfd0
mov edx, dword [esi + 0xc]
push 0
mov eax, dword [edx]
shl eax, 2
push eax
push 0x6f302c
call fcn.005bbfd0
mov eax, dword [esi + 0xc]
push 0
movsx edi, word [eax + 0x24]
mov ecx, dword [eax]
shl edi, 1
imul ecx, edi
push ecx
push 0x6f3034
call fcn.004049da
mov edx, dword [esi + 0xc]
push 0
mov eax, dword [edx]
imul eax, edi
push eax
push 0x6f3038
call fcn.004049da
mov ecx, dword [esi + 0xc]
add esp, 0x30
xor eax, eax
cmp dword [ecx], 0
jle 0x5bbfcc
xor ecx, ecx
mov edx, dword [0x6f3034]
mov ebx, dword [0x6f3030]
add edx, ecx
mov dword [ebx + eax*4], edx
mov edx, dword [0x6f3038]
mov ebx, dword [0x6f302c]
add edx, ecx
add ecx, edi
mov dword [ebx + eax*4], edx
mov edx, dword [esi + 0xc]
inc eax
cmp eax, dword [edx]
jl 0x5bbfa0
pop edi
pop esi
pop ebx
ret
Function at 0x5bbfd0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x67ecf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [0x6ed544]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x28]
mov dword [esp + 0x1c], 0
test esi, esi
jge 0x5bc037
push 0
push 0
push str.Alloc1D:_Size_is_negative._Cant_allocate_memory
call fcn.0062dd90
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ecx, [esi*4]
push ecx
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
push edi
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapSize]
push eax
call ebp
test edi, edi
je 0x5bc11a
cmp eax, esi
jl 0x5bc11a
mov esi, dword [esp + 0x24]
mov dword [esi], edi
mov edx, dword [0x6f2528]
inc edx
mov dword [0x6f2528], edx
mov edx, dword [esi]
push edx
push 0
call ebx
push eax
call ebp
mov edi, dword [0x6f2530]
mov edx, dword [0x6f2534]
xor ecx, ecx
add edi, eax
adc edx, ecx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
mov dword [0x6f2530], edi
mov dword [0x6f2534], edx
jne 0x5bc0dc
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov edx, dword [esp + 0x28]
xor eax, eax
test edx, edx
jle 0x5bc0f1
mov edi, dword [esi]
inc eax
cmp eax, edx
mov dword [edi + eax*4 - 4], ecx
jl 0x5bc0e6
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea eax, [esp + 0x10]
push str.Alloc1D:_Cannot_allocate_sufficient_memory__nTerminate_application_
push eax
call fcn.0060da8c
mov ecx, dword [esp + 0x18]
add esp, 8
push 0
push 4
push ecx
call fcn.0062dd90
cmp eax, 6
jne 0x5bc146
push 0
call fcn.005e246f
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00619871
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret