joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e780
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a4208
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00427820
test eax, eax
je 0x44e7ea
xor esi, esi
mov dword [esp + 0x14], esi
push 0x400
mov eax, connect
lea edi, [esp + 0x18]
mov dword [esp + 0x3c], esi
call fcn.0044eb30
add esp, 4
test eax, eax
jge 0x44e7ff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x44e7ea
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x14]
xor eax, eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea ecx, [esp + 0x28]
push ecx
push edi
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44e85a
call fcn.00405370
cmp eax, esi
jge 0x44e861
cmp edi, esi
je 0x44e845
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x18], 0x10
jne 0x44e83a
cmp dword [esp + 0x20], 0xffffffff
je 0x44e8a9
push esi
call fcn.00480cac
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
add edi, ecx
xor ecx, ecx
add esp, 4
cmp edx, ecx
jl 0x44e8a5
jg 0x44e887
cmp eax, edi
jbe 0x44e8a5
lea esi, [esp + 0x14]
call fcn.00406f60
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [esp + 0x14]
cmp ebx, 0xffffffff
je 0x44e8ce
push esi
call fcn.00480cac
mov ecx, dword [esp + 0x20]
lea edi, [ecx + ebx]
xor ecx, ecx
add esp, 4
cmp edx, ecx
jl 0x44e8ca
jg 0x44e887
cmp eax, edi
ja 0x44e887
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x24]
push edx
push eax
push 0x410
lea ebx, [esp + 0x20]
call fcn.0044ec90
add esp, 0xc
test eax, eax
je 0x44e83a
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
add eax, 0x410
push eax
call fcn.0044ec90
add esp, 0xc
test eax, eax
mov esi, ebx
je 0x44e88b
call fcn.00406f60
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e940
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a41cb
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebp
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x10], ebp
push ebp
mov eax, 0x40000000
lea edi, [esp + 0x14]
mov dword [esp + 0xbc], ebp
call fcn.0044eb30
add esp, 4
test eax, eax
jge 0x44e9b3
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x44e9ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x44ea92
lea esi, [esp + 0x10]
call fcn.0044eac0
push 0x8c
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.004854b0
mov eax, dword [esp + 0xd4]
mov edx, dword [esp + 0xd0]
mov ecx, dword [esp + 0xcc]
mov dword [esp + 0x30], eax
mov eax, ebx
mov dword [esp + 0x2c], edx
add esp, 0xc
mov dword [esp + 0x1c], ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x44e9f5
sub eax, edx
sar eax, 1
cmp eax, 0x3f
jb 0x44ea0e
mov eax, 0x3f
push eax
lea ecx, [esp + 0x2c]
push ebx
push ecx
call fcn.00480ce8
mov esi, dword [esp + 0x1c]
add esp, 0xc
push ebp
lea edx, [esp + 0x1c]
push edx
push ebp
push esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44ea54
call fcn.00405370
cmp eax, ebp
jge 0x44ea54
cmp esi, ebp
je 0x44ea50
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x44ea92
push ebp
lea eax, [esp + 0x18]
push eax
push 0x90
lea ecx, [esp + 0x28]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44ea78
call fcn.00405370
cmp eax, ebp
jl 0x44ea45
mov ecx, str.SOFTWARETencentQQPinyinValidKey
call fcn.004275f0
cmp esi, ebp
je 0x44ea8d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0047f460
add esp, 0xac
ret

Function at 0x44eac0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc08
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0xc04], eax
push 0xbff
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.004854b0
mov eax, dword [esi]
add esp, 0xc
push 0
lea ecx, [esp + 4]
push ecx
push 0xc00
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44eb10
call fcn.00405370
mov ecx, dword [esp + 0xc04]
xor ecx, esp
call fcn.0047f460
add esp, 0xc08
ret
Function at 0x44ebe0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4a4c39
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov dword [esp + 8], 0
mov edi, dword [esp + 0x1c]
call fcn.00427ce0
mov dword [esp + 0x14], 0
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
test eax, eax
mov dword [esp + 8], 1
jle 0x44ec50
lea ecx, [eax - 1]
test ecx, ecx
jl 0x44ec82
cmp ecx, eax
jg 0x44ec82
movzx eax, word [edx + ecx*2]
cmp ax, 0x5c
je 0x44ec50
push 0x5c
call fcn.004053f0
push 0xb
push 0x4bca28
push edi
call fcn.00405120
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44ec6f
call fcn.0044e4d0
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret
push 0x80070057
call fcn.004054d0
int3

Function at 0x44ec90
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a1cc8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x34]
mov edx, dword [ebx]
xor ebp, ebp
push ebp
lea ecx, [esp + 0x1c]
push ecx
push eax
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x44ece4
call fcn.00405370
cmp eax, ebp
jl 0x44ed26
mov dword [esp + 0x34], ebp
push edi
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x34], ebp
call fcn.0044ed80
mov esi, dword [esp + 0x34]
mov edx, dword [ebx]
push ebp
lea ecx, [esp + 0x18]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44ed3b
call fcn.00405370
cmp eax, ebp
jge 0x44ed41
push esi
call fcn.0047f807
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
cmp dword [esp + 0x14], edi
jne 0x44ed1d
mov eax, dword [esp + 0x3c]
push eax
push ecx
call fcn.004200c0
mov ecx, dword [esp + 0x40]
add esp, 4
push eax
push edi
mov edx, esi
call fcn.0041fe20
add esp, 0xc
push esi
mov edi, eax
call fcn.0047f807
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x44f610
Capabilities:
Create thread

Disassembly:
mov eax, dword [edi + 0x10]
sub esp, 8
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x44f641
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x44f74c
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x44f641
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], ebx
mov eax, dword [edi + 8]
cmp eax, ebx
mov dword [esp + 8], ebx
je 0x44f658
push eax
call fcn.0047f807
add esp, 4
mov dword [edi + 8], ebx
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x44f66b
push eax
call fcn.0047f807
add esp, 4
mov dword [edi + 0xc], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
push ebp
push esi
je 0x44f6d0
lea edx, [eax + 2]
jmp 0x44f680
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f680
sub eax, edx
sar eax, 1
mov esi, eax
xor ecx, ecx
lea ebp, [esi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047e5bc
lea ecx, [ebp + ebp]
push ecx
push ebx
push eax
mov dword [edi + 8], eax
call fcn.004854b0
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi + 8]
lea edx, [esi + esi]
push edx
push eax
push ecx
call fcn.00488b70
add esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x44f730
lea edx, [eax + 2]
jmp 0x44f6e0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44f6e0
sub eax, edx
sar eax, 1
mov esi, eax
xor ecx, ecx
lea ebp, [esi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047e5bc
lea ecx, [ebp + ebp]
push ecx
push ebx
push eax
mov dword [edi + 0xc], eax
call fcn.004854b0
mov eax, dword [esp + 0x30]
mov ecx, dword [edi + 0xc]
lea edx, [esi + esi]
push edx
push eax
push ecx
call fcn.00488b70
add esp, 0x1c
cmp dword [edi + 4], ebx
jne 0x44f75a
push 0x44
call fcn.0047f682
add esp, 4
cmp eax, ebx
je 0x44f755
mov esi, eax
call fcn.0044f490
jmp 0x44f757
xor eax, eax
pop ebx
add esp, 8
ret 0xc
xor eax, eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
push 0x3c
push ebx
push esi
call fcn.004854b0
mov eax, dword [esi + 0x40]
add esp, 0xc
cmp eax, ebx
mov dword [esi + 0x3c], ebx
je 0x44f77d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x40], ebx
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x18]
mov dword [edx + 0x3c], eax
mov ecx, dword [edi + 4]
mov dword [ecx], 0x3c
mov edx, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [edx + 0x10], eax
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0xc]
mov dword [ecx + 0x14], edx
mov eax, dword [edi + 4]
push ebx
push ebx
mov dword [eax + 4], 0x440
mov ecx, dword [edi + 4]
push ebx
push ebx
mov dword [ecx + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [edi + 4]
mov dword [edx + 0x40], eax
mov ecx, dword [edi + 4]
lea eax, [esp + 0xc]
push eax
push ebx
push ecx
push 0x44f810
push ebx
push ebx
mov dword [esp + 0x24], ebx
call fcn.00484764
add esp, 0x18
cmp eax, ebx
pop esi
pop ebp
je 0x44f7f7
mov edx, dword [esp + 4]
mov dword [esp + 8], 1
mov dword [edi + 0x14], edx
mov dword [edi + 0x10], eax
mov eax, dword [esp + 8]
pop ebx
add esp, 8
ret 0xc
Function at 0x454040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4a3c58
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
mov ebp, dword [esp + 0x40]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor ebx, ebx
cmp eax, ebx
je 0x4540e7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
je 0x4540f7
mov edi, vtable.CxMemFile.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], esi
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x44]
push eax
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], ebx
call fcn.00454110
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], edi
je 0x4540e1
cmp byte [esp + 0x24], bl
je 0x4540e1
push eax
call fcn.0047fdbd
add esp, 4
mov al, byte [esp + 0x40]
jmp 0x4540f9
lea edi, [ebp + 0x44]
mov ecx, 6
mov esi, str.Unable_to_load_resource_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
Function at 0x45e1a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x45e1f1
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 0x1c
push 1
push esi
call ecx
mov dword [esi + 0x180], eax
mov dword [eax], 0x45e010
mov dword [eax + 4], 0x45e170
mov byte [eax + 8], 0
add esp, 0xc
mov eax, esi
call fcn.0045de50
cmp byte [esi + 0x40], 0
je 0x45e1ea
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x45e26c
mov edx, dword [esi + 0x190]
cmp byte [edx + 0x10], 0
je 0x45e25c
mov eax, dword [esi + 8]
test eax, eax
je 0x45e216
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov ecx, dword [esi + 0x190]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
test eax, eax
je 0x45e258
cmp eax, 2
je 0x45e25c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45e207
cmp eax, 3
je 0x45e23e
cmp eax, 1
jne 0x45e207
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x45e207
mov edx, dword [esi + 0x11c]
add dword [eax + 8], edx
jmp 0x45e207
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
call fcn.0045e2a0
pop esi
ret
cmp eax, 0xcc
je 0x45e28e
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.0045e2a0
pop esi
ret
Function at 0x465880
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, eax
je 0x4658dd
test edi, edi
je 0x4658dd
mov eax, dword [esp + 0x14]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
add ebp, 1
cmp dword [esp + 0x24], 3
ja 0x465a4a
push ebx
mov ebx, dword [esp + 0x2c]
xor esi, esi
test ebx, ebx
mov dword [esp + 0x10], esi
jg 0x4658e5
mov esi, dword [esp + 0x18]
mov ecx, ebp
call fcn.0046fa50
test eax, eax
mov dword [edi + 0xa4], eax
jne 0x465922
mov ecx, str.Insufficient_memory_for_pCAL_purpose
call fcn.004665c0
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + esi*4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x34]
mov esi, dword [ecx + esi*4]
call fcn.004674d0
test eax, eax
je 0x465914
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, ebx
mov dword [esp + 0x10], eax
jl 0x4658e1
jmp 0x4658bc
mov eax, dword [esp + 0x18]
mov edi, str.Invalid_format_for_pCAL_parameter
jmp fcn.004665a0
mov edx, dword [esp + 0x1c]
push ebp
push edx
push eax
call fcn.00488b70
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dl, byte [esp + 0x34]
mov dword [edi + 0xa8], eax
mov eax, dword [esp + 0x3c]
add esp, 0xc
push eax
mov dword [edi + 0xac], ecx
mov byte [edi + 0xb8], dl
mov byte [edi + 0xb9], bl
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
add ebp, 1
mov ecx, ebp
call fcn.0046fa50
test eax, eax
mov dword [edi + 0xb0], eax
jne 0x465986
mov ecx, str.Insufficient_memory_for_pCAL_units
call fcn.004665c0
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
mov ecx, dword [esp + 0x30]
push ebp
push ecx
push eax
call fcn.00488b70
lea ebp, [ebx*4 + 4]
add esp, 0xc
mov ecx, ebp
call fcn.0046fa50
test eax, eax
mov dword [edi + 0xb4], eax
jne 0x4659bd
mov ecx, str.Insufficient_memory_for_pCAL_params
call fcn.004665c0
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
push ebp
push 0
push eax
call fcn.004854b0
add esp, 0xc
xor ebp, ebp
test ebx, ebx
jle 0x465a23
nop
mov edx, dword [esp + 0x34]
mov eax, dword [edx + ebp*4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [esp + 0x18]
mov ebx, eax
add ebx, 1
mov ecx, ebx
call fcn.0046fa50
mov ecx, dword [edi + 0xb4]
mov dword [ecx + ebp*4], eax
mov edx, dword [edi + 0xb4]
cmp dword [edx + ebp*4], 0
lea eax, [edx + ebp*4]
je 0x465a3a
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + ebp*4]
mov eax, dword [eax]
push ebx
push edx
push eax
call fcn.00488b70
add ebp, 1
add esp, 0xc
cmp ebp, dword [esp + 0x2c]
jl 0x4659d0
or dword [edi + 8], 0x400
or dword [edi + 0xbc], 0x80
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
mov ecx, str.Insufficient_memory_for_pCAL_parameter
call fcn.004665c0
pop ebx
pop ebp
pop edi
pop esi
pop ecx
ret
mov edi, str.Invalid_pCAL_equation_type
mov eax, esi
jmp fcn.004665a0
Function at 0x465a60
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x465b5f
test edi, edi
je 0x465b5f
mov ecx, dword [esp + 0xc]
cmp ecx, 1
je 0x465a8f
cmp ecx, 2
je 0x465a8f
mov edi, str.Invalid_sCAL_unit
jmp fcn.004665a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x465b98
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebp
mov ebx, eax
test ebx, ebx
jbe 0x465b94
cmp byte [esi], 0x2d
je 0x465b94
call fcn.004674d0
test eax, eax
je 0x465b94
mov esi, dword [esp + 0x20]
test esi, esi
je 0x465b86
push esi
call ebp
mov ebp, eax
test ebp, ebp
jbe 0x465b86
cmp byte [esi], 0x2d
je 0x465b86
call fcn.004674d0
test eax, eax
je 0x465b86
mov al, byte [esp + 0x18]
mov esi, dword [esp + 0x14]
add ebx, 1
mov ecx, ebx
mov byte [edi + 0xe0], al
call fcn.0046fa50
test eax, eax
mov dword [edi + 0xe4], eax
je 0x465b52
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
push eax
call fcn.00488b70
add ebp, 1
add esp, 0xc
mov ecx, ebp
call fcn.0046fa50
test eax, eax
mov dword [edi + 0xe8], eax
jne 0x465b61
mov edx, dword [edi + 0xe4]
mov ecx, esi
call fcn.0046fa20
mov dword [edi + 0xe4], 0
mov ecx, str.Memory_allocation_failed_while_processing_sCAL
call fcn.004665c0
pop esi
pop ebp
pop ebx
pop edi
ret
mov edx, dword [esp + 0x20]
push ebp
push edx
push eax
call fcn.00488b70
or dword [edi + 8], 0x4000
or dword [edi + 0xbc], 0x100
add esp, 0xc
pop esi
pop ebp
pop ebx
pop edi
ret
mov eax, dword [esp + 0x14]
mov edi, str.Invalid_sCAL_height
jmp fcn.004665a0
mov eax, dword [esp + 0x14]
mov edi, str.Invalid_sCAL_width
jmp fcn.004665a0

Function at 0x465bb0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, eax
je 0x465c39
test edi, edi
je 0x465c39
cmp ebx, 0x100
ja 0x465c1d
push 0
push 0x1000
push edi
push esi
call fcn.00466980
mov eax, 0x300
mov ecx, esi
call fcn.0046f980
mov edx, dword [esp + 0x1c]
lea ecx, [ebx + ebx*2]
push ecx
push edx
push eax
mov dword [esi + 0x114], eax
call fcn.00488b70
mov eax, dword [esi + 0x114]
mov dword [edi + 0x10], eax
mov word [esi + 0x118], bx
or dword [edi + 0xbc], 0x1000
add esp, 0x1c
or dword [edi + 8], 8
mov word [edi + 0x14], bx
pop edi
pop esi
ret
cmp byte [edi + 0x19], 3
jne 0x465c2f
mov edi, str.Invalid_palette_length
mov eax, esi
jmp fcn.004665a0
mov ecx, str.Invalid_palette_length
call fcn.004665c0
pop edi
pop esi
ret
Function at 0x466010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, eax
je 0x466117
test edi, edi
je 0x466117
cmp dword [esp + 0x10], 0
je 0x4660a0
push 0
push 0x2000
push edi
push esi
call fcn.00466980
mov eax, dword [esi + 0x23c]
add esp, 0x10
test eax, eax
push pe_nt_image_headers32
je 0x46605a
push esi
call eax
add esp, 8
jmp 0x466062
call fcn.00482392
add esp, 4
test eax, eax
jne 0x46607b
test dword [esi + 0x70], 0x100000
jne 0x46607b
mov edi, str.Out_of_Memory
mov eax, esi
jmp fcn.004665a0
mov dword [edi + 0x50], eax
mov dword [esi + 0x188], eax
lea eax, [ebp - 1]
cmp eax, 0xff
ja 0x4660a0
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 0x50]
push ebp
push ecx
push edx
call fcn.00488b70
add esp, 0xc
test ebx, ebx
je 0x466101
movzx ecx, byte [edi + 0x18]
mov eax, 1
shl eax, cl
mov cl, byte [edi + 0x19]
test cl, cl
jne 0x4660be
movzx edx, word [ebx + 8]
cmp edx, eax
jg 0x4660db
cmp cl, 2
jne 0x4660e5
movzx ecx, word [ebx + 2]
cmp ecx, eax
jg 0x4660db
movzx edx, word [ebx + 4]
cmp edx, eax
jg 0x4660db
movzx ecx, word [ebx + 6]
cmp ecx, eax
jle 0x4660e5
mov ecx, str.tRNS_chunk_has_out_of_range_samples_for_bit_depth
call fcn.004665c0
test ebp, ebp
mov edx, dword [ebx]
mov dword [edi + 0x54], edx
mov eax, dword [ebx + 4]
mov dword [edi + 0x58], eax
mov cx, word [ebx + 8]
mov word [edi + 0x5c], cx
jne 0x466101
mov ebp, 1
test ebp, ebp
mov word [edi + 0x16], bp
je 0x466117
or dword [edi + 8], 0x10
or dword [edi + 0xbc], 0x2000
pop edi
pop esi
pop ebp
ret

Function at 0x4663f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push ebp
lea ebp, [ecx + edx]
cmp ebp, dword [eax + 0x270]
push edi
mov edi, dword [esp + 0x10]
ja 0x46648b
lea ebp, [esi + edi]
cmp ebp, dword [eax + 0x274]
ja 0x46648b
cmp ecx, 0x7fffffff
jbe 0x466426
mov edi, str.invalid_width_in_fcTL____231_1_
jmp fcn.004665a0
cmp esi, 0x7fffffff
jbe 0x466438
mov edi, str.invalid_height_in_fcTL____231_1_
jmp fcn.004665a0
cmp edx, 0x7fffffff
jbe 0x46644a
mov edi, str.invalid_x_offset_in_fcTL____231_1_
jmp fcn.004665a0
cmp edi, 0x7fffffff
jbe 0x46645c
mov edi, str.invalid_y_offset_in_fcTL____231_1_
jmp fcn.004665a0
test bl, bl
je 0x466474
cmp bl, 1
je 0x466474
cmp bl, 2
je 0x466474
mov edi, str.invalid_dispose_op_in_fcTL
jmp fcn.004665a0
mov cl, byte [esp + 0x14]
test cl, cl
je 0x466495
cmp cl, 1
je 0x466495
mov edi, str.invalid_blend_op_in_fcTL
jmp fcn.004665a0
mov edi, str.dimensions_of_a_frame_are_greater_thanthe_ones_in_IHDR
jmp fcn.004665a0
pop edi
pop ebp
ret

Function at 0x466630
Capabilities:
Terminate process

Disassembly:
test dword [eax + 0x70], 0x800000
je 0x466643
push esi
mov esi, eax
call fcn.004665c0
pop esi
ret
push edi
mov edi, ecx
jmp fcn.004665a0
Function at 0x4671b0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
xor edi, edi
test ebx, ebx
mov esi, ecx
jne 0x4671cf
mov ecx, str.Image_width_is_zero_in_IHDR
call fcn.004665c0
lea edi, [ebx + 1]
test ebp, ebp
jne 0x4671e0
mov ecx, str.Image_height_is_zero_in_IHDR
call fcn.004665c0
lea edi, [ebp + 1]
cmp ebx, dword [esi + 0x258]
ja 0x4671f0
cmp ebx, 0xf4240
jbe 0x4671ff
mov ecx, str.Image_width_exceeds_user_limit_in_IHDR
call fcn.004665c0
mov edi, 1
cmp ebp, dword [esi + 0x25c]
ja 0x46720f
cmp ebp, 0xf4240
jbe 0x46721e
mov ecx, str.Image_height_exceeds_user_limit_in_IHDR
call fcn.004665c0
mov edi, 1
cmp ebx, 0x7fffffff
jbe 0x467235
mov ecx, str.Invalid_image_width_in_IHDR
call fcn.004665c0
mov edi, 1
cmp ebp, 0x7fffffff
jbe 0x46724c
mov ecx, str.Invalid_image_height_in_IHDR
call fcn.004665c0
mov edi, 1
cmp ebx, 0x1fffff8e
jbe 0x46725e
mov ecx, str.Width_is_too_large_for_libpng_to_process_pixels
call fcn.004665c0
mov ebx, dword [esp + 0x18]
cmp ebx, 1
je 0x46728a
cmp ebx, 2
je 0x46728a
cmp ebx, 4
je 0x46728a
cmp ebx, 8
je 0x46728a
cmp ebx, 0x10
je 0x46728a
mov ecx, str.Invalid_bit_depth_in_IHDR
call fcn.004665c0
mov edi, 1
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jl 0x4672a1
cmp ebp, 1
je 0x4672a1
cmp ebp, 5
je 0x4672a1
cmp ebp, 6
jle 0x4672b0
mov ecx, str.Invalid_color_type_in_IHDR
call fcn.004665c0
mov edi, 1
cmp ebp, 3
jne 0x4672bc
cmp ebx, 8
jg 0x4672d0
jmp 0x4672df
cmp ebp, 2
je 0x4672cb
cmp ebp, 4
je 0x4672cb
cmp ebp, 6
jne 0x4672df
cmp ebx, 8
jge 0x4672df
mov ecx, str.Invalid_color_type_bit_depth_combination_in_IHDR
call fcn.004665c0
mov edi, 1
cmp dword [esp + 0x20], 2
jl 0x4672f5
mov ecx, str.Unknown_interlace_method_in_IHDR
call fcn.004665c0
mov edi, 1
cmp dword [esp + 0x24], 0
je 0x46730b
mov ecx, str.Unknown_compression_method_in_IHDR
call fcn.004665c0
mov edi, 1
mov ebx, 0x1000
test dword [esi + 0x6c], ebx
je 0x467328
cmp dword [esi + 0x230], 0
je 0x467328
mov ecx, str.MNG_features_are_not_allowed_in_a_PNG_datastream
call fcn.004665c0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x467377
test byte [esi + 0x230], 4
je 0x46734d
cmp eax, 0x40
jne 0x46734d
test dword [esi + 0x6c], ebx
jne 0x46734d
cmp ebp, 2
je 0x46735c
cmp ebp, 6
je 0x46735c
mov ecx, str.Unknown_filter_method_in_IHDR
call fcn.004665c0
mov edi, 1
test dword [esi + 0x6c], ebx
je 0x467377
mov ecx, str.Invalid_filter_method_in_IHDR
call fcn.004665c0
mov edi, str.Invalid_IHDR_data
mov eax, esi
jmp fcn.004665a0
cmp edi, 1
jne 0x467388
mov edi, str.Invalid_IHDR_data
mov eax, esi
jmp fcn.004665a0
pop edi
pop esi
pop ebp
pop ebx
ret