joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54e990
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [esp + 0x18], esi
jne 0x54e9b7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x54e9c3
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x64]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x64], ecx
mov dword [esp + 0x14], ecx
jle 0x54eaec
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x14], edx
jmp 0x54ea08
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x54ea29
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov ebp, dword [edx + ecx*4]
lea eax, [edi + 0xfe]
lea esi, [edi + edi - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [esp + 0x24], ebp
xor esi, esi
mov edx, eax
cmp esi, edx
jle 0x54ea81
mov ecx, ebx
lea ebp, [edi + edi - 2]
imul ecx, ecx, 0x1fe
jmp 0x54ea60
add ecx, 0x1fe
lea eax, [ecx + edi + 0xfe]
cdq
idiv ebp
add ebx, 1
mov edx, eax
cmp esi, edx
jg 0x54ea60
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov al, byte [esp + 0x18]
imul bl
mov byte [esi + ebp], al
add esi, 1
cmp esi, 0xff
jle 0x54ea46
cmp dword [esp + 0x10], 0
je 0x54ead1
mov eax, 1
lea edx, [ebp - 1]
jmp 0x54eab0
movzx ebx, byte [ebp]
mov byte [edx], bl
movzx ebx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], bl
add eax, 1
sub edx, 1
cmp eax, 0xff
jle 0x54eab0
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], 4
add ecx, 1
cmp ecx, dword [eax + 0x64]
mov dword [esp + 0x1c], ecx
jl 0x54ea00
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18
ret

Function at 0x5565d0
Capabilities:
Terminate process

Disassembly:
movzx eax, byte [ecx]
movzx edx, byte [ecx + 1]
shl eax, 8
add eax, edx
movzx edx, byte [ecx + 2]
movzx ecx, byte [ecx + 3]
shl eax, 8
add eax, edx
shl eax, 8
add eax, ecx
cmp eax, 0x7fffffff
jbe 0x556604
mov eax, dword [esp + 4]
push edi
mov edi, str.PNG_unsigned_integer_out_of_range
jmp fcn.0054c480
ret
Function at 0x556640
Capabilities:
Terminate process

Disassembly:
mov al, byte [ebx + 0x12c]
cmp al, 8
push ebp
mov ebp, dword [esp + 8]
jae 0x5566cd
push esi
push edi
movzx edi, al
mov eax, dword [ebx + 0x54]
mov esi, 8
sub esi, edi
test eax, eax
mov dword [ebx + 0x2ac], 0x11
je 0x5566cf
push esi
lea ecx, [edi + ebp + 0x20]
push ecx
push ebx
call eax
add ebp, 0x20
push esi
push ebp
mov edx, edi
mov byte [ebx + 0x12c], 8
call fcn.0054ae00
add esp, 0x14
test eax, eax
je 0x5566bf
cmp edi, 4
jae 0x5566b3
add esi, 0xfffffffc
push esi
push ebp
mov edx, edi
call fcn.0054ae00
add esp, 8
test eax, eax
je 0x5566b3
mov edi, str.Not_a_PNG_file
mov eax, ebx
jmp fcn.0054c480
mov edi, str.PNG_file_corrupted_by_ASCII_conversion
mov eax, ebx
jmp fcn.0054c480
cmp edi, 3
jae 0x5566cb
or dword [ebx + 0x6c], 0x1000
pop edi
pop esi
pop ebp
ret
mov edi, str.Call_to_NULL_read_function
mov eax, ebx
jmp fcn.0054c480

Function at 0x5566e0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
test eax, eax
push edi
mov dword [esi + 0x2ac], 0x21
je 0x5567bc
push 8
lea ecx, [esp + 0xc]
push ecx
push esi
call eax
movzx edi, byte [esp + 0x14]
movzx edx, byte [esp + 0x15]
movzx eax, byte [esp + 0x16]
movzx ecx, byte [esp + 0x17]
shl edi, 8
add edi, edx
shl edi, 8
add edi, eax
shl edi, 8
add edi, ecx
add esp, 0xc
cmp edi, 0x7fffffff
jbe 0x55674b
mov edi, str.PNG_unsigned_integer_out_of_range
mov eax, esi
jmp fcn.0054c480
mov edx, dword [esp + 0xc]
test dl, 0x20
push ebx
lea ebx, [esi + 0x11c]
mov dword [ebx], edx
mov dword [esi + 0x110], 0
je 0x556778
mov eax, dword [esi + 0x70]
and eax, 0x300
cmp eax, 0x300
jne 0x556781
jmp 0x556797
test dword [esi + 0x70], 0x800
jne 0x556797
xor eax, eax
test ebx, ebx
je 0x556791
lea edx, [eax + 4]
mov ecx, ebx
call fcn.00566310
mov dword [esi + 0x110], eax
mov ecx, ebx
call fcn.00559a10
mov ecx, dword [esp + 0x14]
pop ebx
mov eax, edi
pop edi
mov dword [esi + 0x2ac], 0x41
pop esi
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
mov edi, str.Call_to_NULL_read_function
mov eax, esi
jmp fcn.0054c480

Function at 0x5567d0
Capabilities:
Terminate process

Disassembly:
test esi, esi
push edi
mov edi, eax
je 0x5567fe
mov eax, dword [esi + 0x54]
test eax, eax
je 0x55682e
push ebx
push edi
push esi
call eax
add esp, 0xc
test byte [esi + 0x11c], 0x20
je 0x556800
mov eax, dword [esi + 0x70]
and eax, 0x300
cmp eax, 0x300
jne 0x556809
pop edi
ret
test dword [esi + 0x70], 0x800
jne 0x5567fe
test edi, edi
mov eax, dword [esi + 0x110]
jne 0x55681d
xor eax, eax
mov dword [esi + 0x110], eax
pop edi
ret
mov edx, ebx
mov ecx, edi
call fcn.00566310
mov dword [esi + 0x110], eax
pop edi
ret
mov edi, str.Call_to_NULL_read_function
mov eax, esi
jmp fcn.0054c480
Function at 0x556840
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0xb4]
push edi
mov edi, eax
cmp edi, ebp
jbe 0x556869
mov ebx, dword [esi + 0xb4]
mov eax, dword [esi + 0xb0]
call fcn.005567d0
sub edi, ebp
cmp edi, ebp
ja 0x556852
test edi, edi
je 0x55687a
mov eax, dword [esi + 0xb0]
mov ebx, edi
call fcn.005567d0
call fcn.005568e0
test eax, eax
je 0x5568c4
mov al, byte [esi + 0x11c]
and al, 0x20
je 0x556896
test dword [esi + 0x70], 0x200
je 0x5568a3
test al, al
jne 0x5568b4
test dword [esi + 0x70], 0x400
je 0x5568b4
mov ecx, esi
call fcn.0054c600
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
test dword [esi + 0x70], 0x800000
je 0x5568cb
mov ecx, esi
call fcn.0054c600
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, str.CRC_error
jmp fcn.0054c5d0

Function at 0x5568e0
Capabilities:
Terminate process

Disassembly:
push ecx
test byte [esi + 0x11c], 0x20
push edi
mov edi, 1
je 0x556901
mov eax, dword [esi + 0x70]
and eax, 0x300
cmp eax, 0x300
jne 0x55690c
jmp 0x55690a
test dword [esi + 0x70], 0x800
je 0x55690c
xor edi, edi
mov eax, dword [esi + 0x54]
test eax, eax
mov dword [esi + 0x2ac], 0x81
je 0x556964
push 4
lea ecx, [esp + 8]
push ecx
push esi
call eax
add esp, 0xc
test edi, edi
je 0x55695f
mov eax, dword [esp + 4]
movzx ecx, byte [esp + 6]
movzx edx, al
shl edx, 8
movzx eax, ah
add edx, eax
movzx eax, byte [esp + 7]
shl edx, 8
add edx, ecx
shl edx, 8
add edx, eax
xor eax, eax
cmp edx, dword [esi + 0x110]
pop edi
setne al
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
mov edi, str.Call_to_NULL_read_function
mov eax, esi
jmp fcn.0054c480
Function at 0x556c70
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x18], eax
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, ecx
mov eax, dword [esi + 0x6c]
test al, 1
push edi
je 0x556c9a
mov edi, str.Out_of_place_IHDR
mov eax, esi
jmp fcn.0054c480
push ebx
mov ebx, 0xd
cmp dword [esp + 0x34], ebx
je 0x556cb2
mov edi, str.Invalid_IHDR_chunk
mov eax, esi
jmp fcn.0054c480
or eax, 1
mov dword [esi + 0x6c], eax
lea eax, [esp + 0x18]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
movzx edi, byte [esp + 0x18]
movzx eax, byte [esp + 0x19]
movzx ecx, byte [esp + 0x1a]
movzx edx, byte [esp + 0x1b]
shl edi, 8
add edi, eax
shl edi, 8
add edi, ecx
shl edi, 8
add edi, edx
cmp edi, 0x7fffffff
jbe 0x556d01
mov edi, str.PNG_unsigned_integer_out_of_range
mov eax, esi
jmp fcn.0054c480
movzx ecx, byte [esp + 0x1c]
movzx eax, byte [esp + 0x1d]
movzx edx, byte [esp + 0x1e]
shl ecx, 8
add ecx, eax
movzx eax, byte [esp + 0x1f]
shl ecx, 8
add ecx, edx
shl ecx, 8
add ecx, eax
cmp ecx, 0x7fffffff
jbe 0x556d38
mov edi, str.PNG_unsigned_integer_out_of_range
mov eax, esi
jmp fcn.0054c480
movzx eax, byte [esp + 0x22]
movzx edx, byte [esp + 0x21]
movzx ebx, byte [esp + 0x20]
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x23]
mov dword [esp + 0x14], eax
movzx eax, byte [esp + 0x24]
mov byte [esi + 0x123], al
movzx eax, byte [esp + 0x14]
mov byte [esi + 0x234], al
movzx eax, byte [esp + 0x10]
mov byte [esi + 0x254], al
movzx eax, dl
sub eax, 2
mov dword [esi + 0x270], edi
mov dword [esi + 0x274], ecx
mov dword [esi + 0xcc], edi
mov dword [esi + 0xd0], ecx
mov byte [esi + 0x127], bl
mov byte [esi + 0x126], dl
je 0x556dc6
sub eax, 2
je 0x556dbd
sub eax, 2
je 0x556db4
mov byte [esi + 0x12a], 1
jmp 0x556dcd
mov byte [esi + 0x12a], 4
jmp 0x556dcd
mov byte [esi + 0x12a], 2
jmp 0x556dcd
mov byte [esi + 0x12a], 3
mov al, byte [esi + 0x12a]
imul bl
mov byte [esi + 0x129], al
cmp al, 8
movzx eax, al
jb 0x556dea
shr eax, 3
imul eax, edi
jmp 0x556df3
imul eax, edi
add eax, 7
shr eax, 3
mov dword [esi + 0xdc], eax
movzx eax, byte [esp + 0x23]
push eax
movzx eax, byte [esp + 0x26]
push eax
movzx eax, byte [esp + 0x2c]
push eax
push edx
push ebx
push ecx
push esi
mov esi, ebp
call fcn.0054cd70
mov ecx, dword [esp + 0x44]
add esp, 0x1c
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005d28b3
add esp, 0x1c
ret
Function at 0x556e30
Capabilities:
Terminate process

Disassembly:
sub esp, 0x308
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
test al, 1
jne 0x556e4f
mov edi, str.Missing_IHDR_before_PLTE
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x556e6e
mov ecx, str.Invalid_PLTE_after_IDAT
call fcn.0054c4a0
mov eax, edi
pop edi
mov ecx, esi
pop esi
add esp, 0x308
jmp fcn.00556840
test al, 2
je 0x556e7e
mov edi, str.Duplicate_PLTE_chunk
mov eax, esi
jmp fcn.0054c480
mov cl, byte [esi + 0x126]
or eax, 2
test cl, 2
mov dword [esi + 0x6c], eax
jne 0x556e96
mov ecx, str.Ignoring_PLTE_chunk_in_grayscale_PNG
jmp 0x556e58
cmp edi, 0x300
ja 0x556f7a
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
mov edx, edi
sub edx, eax
jne 0x556f7a
mov eax, 0x55555556
imul edi
push ebx
push ebp
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
test ebp, ebp
jle 0x556f0b
lea edi, [esp + 0x1a]
mov dword [esp + 0x14], ebp
jmp 0x556ee0
mov ebx, 3
lea eax, [esp + 0x10]
call fcn.005567d0
mov al, byte [esp + 0x10]
mov cl, byte [esp + 0x11]
mov dl, byte [esp + 0x12]
mov byte [edi - 2], al
mov byte [edi - 1], cl
mov byte [edi], dl
add edi, ebx
sub dword [esp + 0x14], 1
jne 0x556ee0
xor eax, eax
mov ecx, esi
call fcn.00556840
mov edi, dword [esp + 0x31c]
lea eax, [esp + 0x18]
push eax
mov ebx, ebp
mov eax, edi
mov ecx, esi
call fcn.0054d180
add esp, 4
cmp byte [esi + 0x126], 3
jne 0x556f6f
test edi, edi
je 0x556f6f
test byte [edi + 8], 0x10
je 0x556f6f
cmp word [esi + 0x11a], bp
jbe 0x556f5b
mov ecx, str.Truncating_incorrect_tRNS_chunk_length
call fcn.0054c4a0
mov word [esi + 0x11a], bp
cmp word [edi + 0x16], bp
jbe 0x556f6f
mov ecx, str.Truncating_incorrect_info_tRNS_chunk_length
call fcn.0054c4a0
mov word [edi + 0x16], bp
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x308
ret
cmp cl, 3
je 0x556f89
mov ecx, str.Invalid_palette_chunk
jmp 0x556e58
mov edi, str.Invalid_palette_chunk
mov eax, esi
jmp fcn.0054c480

Function at 0x556fa0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
test al, 1
je 0x556fd0
test al, 4
je 0x556fd0
or eax, 0x18
test edi, edi
mov dword [esi + 0x6c], eax
je 0x556fc5
mov ecx, str.Incorrect_IEND_chunk_length
call fcn.0054c4a0
mov eax, edi
pop edi
mov ecx, esi
pop esi
jmp fcn.00556840
mov edi, str.No_image_in_file
mov eax, esi
jmp fcn.0054c480
Function at 0x556fe0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
test al, 1
jne 0x556fff
mov edi, str.Missing_IHDR_before_gAMA
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x55701b
mov ecx, str.Invalid_gAMA_after_IDAT
call fcn.0054c4a0
mov eax, edi
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
pop ecx
ret
test al, 2
je 0x557029
mov ecx, str.Out_of_place_gAMA_chunk
call fcn.0054c4a0
test ebp, ebp
je 0x557053
mov eax, dword [ebp + 8]
test al, 1
je 0x557053
test eax, 0x800
jne 0x557053
mov ecx, str.Duplicate_gAMA_chunk
call fcn.0054c4a0
mov eax, edi
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
pop ecx
ret
cmp edi, 4
je 0x557070
mov ecx, str.Incorrect_gAMA_chunk_length
call fcn.0054c4a0
mov eax, edi
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
pop ecx
ret
push ebx
mov ebx, 4
lea eax, [esp + 0x10]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
pop ebx
jne 0x5570ff
lea ecx, [esp + 0xc]
call fcn.00556610
mov edi, eax
test edi, edi
jg 0x5570ab
mov ecx, str.Ignoring_gAMA_chunk_with_out_of_range_gamma
call fcn.0054c4a0
pop edi
pop esi
pop ebp
pop ecx
ret
test ebp, ebp
je 0x5570ee
test dword [ebp + 8], 0x800
je 0x5570ee
cmp edi, 0xafc8
jl 0x5570c8
cmp edi, 0xb3b0
jle 0x5570ee
mov ecx, str.Ignoring_incorrect_gAMA_value_when_sRGB_is_also_present
call fcn.0054c4a0
push edi
push str.gamma____d_100000_
call fcn.005d813d
add eax, 0x40
push eax
call fcn.005d93d2
add esp, 0xc
pop edi
pop esi
pop ebp
pop ecx
ret
mov ecx, edi
mov eax, ebp
mov edx, esi
mov dword [esi + 0x15c], edi
call fcn.0054cc90
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x557110
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
test al, 1
mov byte [esp + 0x13], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x11], bl
mov byte [esp + 0x10], bl
jne 0x557142
mov edi, str.Missing_IHDR_before_sBIT
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x55715f
mov ecx, str.Invalid_sBIT_after_IDAT
call fcn.0054c4a0
mov eax, ebp
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test al, 2
je 0x55716d
mov ecx, str.Out_of_place_sBIT_chunk
call fcn.0054c4a0
cmp edi, ebx
je 0x557190
test byte [edi + 8], 2
je 0x557190
mov ecx, str.Duplicate_sBIT_chunk
call fcn.0054c4a0
mov eax, ebp
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ebx, 3
cmp byte [esi + 0x126], bl
je 0x5571a4
movzx ebx, byte [esi + 0x12a]
cmp ebp, ebx
jne 0x557250
cmp ebp, 4
ja 0x557250
lea eax, [esp + 0x10]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
jne 0x557263
mov ecx, 2
test byte [esi + 0x126], cl
je 0x55720a
movzx eax, byte [esp + 0x10]
movzx edx, byte [esp + 0x11]
mov byte [esi + 0x17c], al
movzx eax, byte [esp + 0x12]
mov byte [esi + 0x17d], dl
movzx edx, byte [esp + 0x13]
mov byte [esi + 0x17e], al
mov byte [esi + 0x180], dl
jmp 0x557231
mov al, byte [esp + 0x10]
mov byte [esi + 0x17f], al
mov byte [esi + 0x17c], al
mov byte [esi + 0x17d], al
mov byte [esi + 0x17e], al
movzx eax, byte [esp + 0x11]
mov byte [esi + 0x180], al
test edi, edi
je 0x557263
mov edx, dword [esi + 0x17c]
mov dword [edi + 0x44], edx
mov al, byte [esi + 0x180]
or dword [edi + 8], ecx
mov byte [edi + 0x48], al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, str.Incorrect_sBIT_chunk_length
call fcn.0054c4a0
mov eax, ebp
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x557560
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov edi, ecx
jne 0x55757d
mov edi, str.Missing_IHDR_before_sRGB
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x557599
mov ecx, str.Invalid_sRGB_after_IDAT
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
pop ecx
ret
test al, 2
je 0x5575a7
mov ecx, str.Out_of_place_sRGB_chunk
call fcn.0054c4a0
test edi, edi
je 0x5575cc
test dword [edi + 8], 0x800
je 0x5575cc
mov ecx, str.Duplicate_sRGB_chunk
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
pop ecx
ret
cmp ebx, 1
je 0x5575e9
mov ecx, str.Incorrect_sRGB_chunk_length
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebx
pop ecx
ret
mov ebx, 1
lea eax, [esp + 0xf]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
jne 0x55772d
movzx ebx, byte [esp + 0xf]
cmp ebx, 4
jl 0x557621
mov ecx, str.Unknown_sRGB_intent
call fcn.0054c4a0
pop edi
pop esi
pop ebx
pop ecx
ret
test edi, edi
je 0x557720
test byte [edi + 8], 1
je 0x557664
mov eax, dword [edi + 0x28]
cmp eax, 0xafc8
jl 0x557640
cmp eax, 0xb3b0
jle 0x557664
mov ecx, str.Ignoring_incorrect_gAMA_value_when_sRGB_is_also_present
call fcn.0054c4a0
mov eax, dword [edi + 0x28]
push eax
push str.incorrect_gamma__d_100000__n
call fcn.005d813d
add eax, 0x40
push eax
call fcn.005d93d2
add esp, 0xc
test byte [edi + 8], 4
je 0x557720
mov eax, dword [edi + 0x84]
cmp eax, 0x763e
jl 0x557716
cmp eax, 0x7e0e
jg 0x557716
mov eax, dword [edi + 0x88]
cmp eax, 0x7c9c
jl 0x557716
cmp eax, 0x846c
jg 0x557716
mov eax, dword [edi + 0x8c]
cmp eax, 0xf618
jl 0x557716
cmp eax, 0xfde8
jg 0x557716
mov eax, dword [edi + 0x90]
cmp eax, 0x7d00
jl 0x557716
cmp eax, 0x84d0
jg 0x557716
mov eax, dword [edi + 0x94]
cmp eax, 0x7148
jl 0x557716
cmp eax, 0x7918
jg 0x557716
mov eax, dword [edi + 0x98]
cmp eax, 0xe678
jl 0x557716
cmp eax, 0xee48
jg 0x557716
mov eax, dword [edi + 0x9c]
cmp eax, 0x36b0
jl 0x557716
cmp eax, 0x3e80
jg 0x557716
mov eax, dword [edi + 0xa0]
cmp eax, 0x1388
jl 0x557716
cmp eax, 0x1b58
jle 0x557720
mov ecx, str.Ignoring_incorrect_cHRM_value_when_sRGB_is_also_present
call fcn.0054c4a0
push ebx
mov ecx, edi
mov eax, esi
call fcn.0054d210
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x557d40
Capabilities:
Terminate process

Disassembly:
sub esp, 0x110
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push esi
mov esi, edx
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov edi, dword [esp + 0x120]
mov ebx, ecx
jne 0x557d75
mov edi, str.Missing_IHDR_before_tRNS
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x557d83
mov ecx, str.Invalid_tRNS_after_IDAT
jmp 0x557f0e
test edi, edi
je 0x557d97
test byte [edi + 8], 0x10
je 0x557d97
mov ecx, str.Duplicate_tRNS_chunk
jmp 0x557f0e
mov cl, byte [esi + 0x126]
test cl, cl
jne 0x557de7
cmp ebx, 2
je 0x557db0
mov ecx, str.Incorrect_tRNS_chunk_length
jmp 0x557f0e
mov ebx, 2
lea eax, [esp + 0xc]
call fcn.005567d0
mov ax, word [esp + 0xc]
movzx cx, al
movzx dx, ah
shl cx, 8
add cx, dx
mov word [esi + 0x11a], 1
mov word [esi + 0x194], cx
jmp 0x557ea4
cmp cl, 2
jne 0x557e4d
cmp ebx, 6
jne 0x557da6
lea eax, [esp + 0x10]
call fcn.005567d0
movzx eax, byte [esp + 0x10]
movzx ecx, byte [esp + 0x11]
movzx edx, byte [esp + 0x12]
shl ax, 8
add ax, cx
movzx ecx, byte [esp + 0x14]
mov word [esi + 0x18e], ax
movzx eax, byte [esp + 0x13]
shl dx, 8
add dx, ax
mov word [esi + 0x190], dx
movzx edx, byte [esp + 0x15]
shl cx, 8
add cx, dx
mov word [esi + 0x11a], 1
mov word [esi + 0x192], cx
jmp 0x557ea4
cmp cl, 3
jne 0x557f09
test al, 2
jne 0x557e64
mov ecx, str.Missing_PLTE_before_tRNS
call fcn.0054c4a0
movzx eax, word [esi + 0x118]
cmp ebx, eax
ja 0x557da6
cmp ebx, 0x100
ja 0x557da6
test ebx, ebx
jne 0x557e94
mov ecx, str.Zero_length_tRNS_chunk
call fcn.0054c4a0
xor eax, eax
jmp 0x557f15
lea eax, [esp + 0x18]
call fcn.005567d0
mov word [esi + 0x11a], bx
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
je 0x557ed2
pop edi
mov word [esi + 0x11a], 0
pop esi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.005d28b3
add esp, 0x110
ret
movzx ecx, word [esi + 0x11a]
push ecx
lea edx, [esp + 0x1c]
lea ebx, [esi + 0x18c]
push edx
mov eax, edi
mov ecx, esi
call fcn.0054d5e0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.005d28b3
add esp, 0x110
ret
mov ecx, str.tRNS_chunk_not_allowed_with_alpha_channel
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x110
ret
Function at 0x557f40
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov edi, edx
jne 0x557f6c
mov edi, str.Missing_IHDR_before_bKGD
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x557f95
mov ecx, str.Invalid_bKGD_after_IDAT
call fcn.0054c4a0
mov eax, ebp
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
mov cl, byte [esi + 0x126]
cmp cl, 3
jne 0x557fc9
test al, 2
jne 0x557fc9
mov ecx, str.Missing_PLTE_before_bKGD
call fcn.0054c4a0
mov eax, ebp
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
test edi, edi
je 0x557ff8
test byte [edi + 8], 0x20
je 0x557ff8
mov ecx, str.Duplicate_bKGD_chunk
call fcn.0054c4a0
mov eax, ebp
mov ecx, esi
call fcn.00556840
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
cmp cl, 3
push ebx
jne 0x558005
mov ebx, 1
jmp 0x558010
movzx ebx, cl
and ebx, 2
or ebx, 1
add ebx, ebx
cmp ebp, ebx
je 0x55803a
mov ecx, str.Incorrect_bKGD_chunk_length
call fcn.0054c4a0
mov eax, ebp
mov ecx, esi
call fcn.00556840
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
lea eax, [esp + 0x10]
call fcn.005567d0
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
jne 0x558158
mov al, byte [esi + 0x126]
cmp al, 3
jne 0x5580d5
test edi, edi
mov al, byte [esp + 0x10]
mov byte [esi + 0x138], al
je 0x55814b
movzx ecx, word [edi + 0x14]
test cx, cx
je 0x55814b
movzx dx, al
cmp dx, cx
jb 0x5580a3
mov ecx, str.Incorrect_bKGD_chunk_index_value
call fcn.0054c4a0
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
mov ecx, dword [esi + 0x114]
movzx eax, al
lea eax, [eax + eax*2]
movzx edx, byte [eax + ecx]
add eax, ecx
mov word [esi + 0x13a], dx
movzx cx, byte [eax + 1]
mov word [esi + 0x13c], cx
movzx edx, byte [eax + 2]
mov word [esi + 0x13e], dx
jmp 0x55814b
test al, 2
jne 0x558103
movzx ax, byte [esp + 0x10]
movzx cx, byte [esp + 0x11]
shl ax, 8
add ax, cx
mov word [esi + 0x140], ax
mov word [esi + 0x13c], ax
mov word [esi + 0x13a], ax
jmp 0x558144
movzx edx, byte [esp + 0x10]
movzx eax, byte [esp + 0x11]
movzx ecx, byte [esp + 0x12]
shl dx, 8
add dx, ax
movzx eax, byte [esp + 0x14]
mov word [esi + 0x13a], dx
movzx edx, byte [esp + 0x13]
shl cx, 8
add cx, dx
mov word [esi + 0x13c], cx
movzx ecx, byte [esp + 0x15]
shl ax, 8
add ax, cx
mov word [esi + 0x13e], ax
lea ecx, [esi + 0x138]
mov eax, edi
call fcn.0054cbe0
mov ecx, dword [esp + 0x18]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005d28b3
add esp, 0xc
ret
Function at 0x558170
Capabilities:
Terminate process

Disassembly:
sub esp, 0x20c
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
mov esi, dword [esp + 0x218]
mov eax, dword [esi + 0x6c]
test al, 1
push edi
mov ebx, edx
mov dword [esp + 0x10], ecx
jne 0x5581a7
mov edi, str.Missing_IHDR_before_hIST
mov eax, esi
jmp fcn.0054c480
test al, 4
je 0x5581b5
mov ecx, str.Invalid_hIST_after_IDAT
jmp 0x558268
test al, 2
jne 0x5581c3
mov ecx, str.Missing_PLTE_before_hIST
jmp 0x558268
test ecx, ecx
je 0x5581d7
test byte [ecx + 8], 0x40
je 0x5581d7
mov ecx, str.Duplicate_hIST_chunk
jmp 0x558268
movzx eax, word [esi + 0x118]
mov edi, ebx
shr edi, 1
cmp edi, eax
jne 0x558263
cmp edi, 0x100
ja 0x558263
push ebp
xor ebp, ebp
test edi, edi
jbe 0x55822e
jmp 0x558200
mov ebx, 2
lea eax, [esp + 0x10]
call fcn.005567d0
mov ax, word [esp + 0x10]
movzx cx, al
movzx dx, ah
shl cx, 8
add cx, dx
mov word [esp + ebp*2 + 0x18], cx
add ebp, 1
cmp ebp, edi
jb 0x558200
xor eax, eax
mov ecx, esi
call fcn.00556840
test eax, eax
pop ebp
jne 0x558276
mov edi, dword [esp + 0x10]
lea ebx, [esp + 0x14]
mov eax, esi
call fcn.0054ccd0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.005d28b3
add esp, 0x20c
ret
mov ecx, str.Incorrect_hIST_chunk_length
call fcn.0054c4a0
mov eax, ebx
mov ecx, esi
call fcn.00556840
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d28b3
add esp, 0x20c
ret