Function at 0x18009e710
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r15d, dword [rsp + 0x100]
mov r13d, r9d
mov ebp, dword [rsp + 0x110]
mov esi, r8d
mov rax, qword [rcx]
xor r8d, r8d
mov r9d, dword [rsp + 0x108]
cmp ebp, 0x10
mov r10d, r8d
mov qword [rsp + 0x70], r8
sete r10b
mov dword [rsp + 0x30], r15d
inc r10d
mov r14, rcx
mov ecx, dword [rax + 8]
mov edi, r10d
imul edi, r13d
mov r12d, ecx
imul r12d, r10d
mov rbx, rdx
mov dword [rsp + 0x24], ecx
mov r11d, edi
imul r11d, r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x40], r11d
test r15d, r15d
js 0x18009f8da
test r9d, r9d
js 0x18009f8da
je 0x18009e7be
xor edx, edx
mov eax, 0x7fffffff
div r9d
cmp r15d, eax
jg 0x18009f8da
mov ecx, r15d
imul ecx, r9d
test ecx, ecx
js 0x18009f8da
test edi, edi
js 0x18009f8da
je 0x18009e7e7
mov eax, 0x7fffffff
cdq
idiv edi
cmp ecx, eax
jg 0x18009f8da
mov eax, r9d
imul eax, r11d
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x98], rax
mov r10, rax
mov qword [r14 + 0x18], rax
test rax, rax
je 0x18009f8de
movsxd r8, dword [rsp + 0x24]
test r8d, r8d
js 0x18009f8ca
test r15d, r15d
je 0x18009e835
xor edx, edx
mov eax, 0x7fffffff
div r15d
cmp r8d, eax
jg 0x18009f8ca
mov r11d, r8d
imul r11d, r15d
test r11d, r11d
js 0x18009f8ca
test ebp, ebp
js 0x18009f8ca
je 0x18009e861
xor edx, edx
mov eax, 0x7fffffff
div ebp
cmp r11d, eax
jg 0x18009f8ca
mov eax, r11d
imul eax, ebp
cmp eax, 0x7ffffff8
jg 0x18009f8ca
mov ecx, r11d
imul ecx, ebp
mov ebp, dword [rsp + 0x108]
add ecx, 7
shr ecx, 3
mov dword [rsp + 0x3c], ecx
lea eax, [rcx + 1]
imul eax, ebp
cmp esi, eax
jae 0x18009e8a6
lea r8, str.Corrupt_PNG
lea rdx, str.not_enough_pixels
jmp 0x18009f8ec
xor r9d, r9d
mov edx, r9d
mov dword [rsp + 0x34], edx
test ebp, ebp
je 0x18009f419
movsxd r14, r12d
movsxd r13, edi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r8
mov dword [rsp + 0x20], r11d
mov r11d, dword [rsp + 0x40]
mov ebp, edx
imul ebp, r11d
add rbp, r10
movzx r10d, byte [rbx]
inc rbx
mov qword [rsp + 0x50], rbp
mov rsi, rbp
cmp r10d, 4
ja 0x18009f3ef
cmp dword [rsp + 0x110], 8
jge 0x18009e933
cmp ecx, r15d
ja 0x18009f3dc
mov eax, dword [rsp + 0xf8]
mov r12d, 1
imul eax, r15d
mov r14d, r12d
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x30], ecx
sub eax, ecx
add rsi, rax
mov r15, rsi
lea rcx, [0x180000000]
sub r15, r11
test edx, edx
jne 0x18009e94d
movzx r10d, byte [r10 + rcx + 0xb85e8]
test r14, r14
jle 0x18009ea92
mov rdi, r15
mov r11, rsi
sub rdi, rbx
mov rdx, rbx
sub r11, rbx
mov r9, r14
nop dword [rax + rax]
mov r8, rdx
cmp r10d, 6
ja case.default.0x18009e986
movsxd rax, r10d
mov eax, dword [rcx + rax*4 + 0x9f918]
add rax, rcx
jmp rax
inc rdx
sub r9, 1
je 0x18009ea8a
lea rcx, [0x180000000]
jmp 0x18009e970
lea rdi, [0x180000000]
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [r11 + r8], al
sub r9, 1
je 0x18009eabb
mov r8, rdx
jmp 0x18009e9b0
lea rdi, [0x180000000]
movzx eax, byte [rdx]
inc rdx
mov byte [r11 + r8], al
sub r9, 1
je 0x18009eabb
mov r8, rdx
jmp 0x18009e9d0
movzx eax, byte [rdi + r8]
add al, byte [rdx]
inc rdx
mov byte [r11 + r8], al
sub r9, 1
je 0x18009ea8a
mov r8, rdx
jmp case.0x18009e986.2
movzx eax, byte [rdi + r8]
shr al, 1
add al, byte [rdx]
inc rdx
mov byte [r11 + r8], al
sub r9, 1
je 0x18009ea8a
mov r8, rdx
jmp case.0x18009e986.3
movzx eax, byte [rdi + r8]
xor ecx, ecx
test al, al
cmovne ecx, eax
add cl, byte [rdx]
inc rdx
mov byte [r11 + r8], cl
sub r9, 1
je 0x18009ea8a
mov r8, rdx
jmp case.0x18009e986.4
movzx eax, byte [rdx]
inc rdx
mov byte [r11 + r8], al
sub r9, 1
je 0x18009ea8a
mov r8, rdx
jmp case.0x18009e986.5
movzx eax, byte [rdx]
inc rdx
mov byte [r11 + r8], al
sub r9, 1
je 0x18009ea85
mov r8, rdx
jmp case.0x18009e986.6
mov r13, qword [rsp + 0x68]
mov r8d, dword [rsp + 0x24]
xor r9d, r9d
lea rdi, [0x180000000]
mov eax, dword [rsp + 0x110]
cmp eax, 8
jne 0x18009eae3
movsxd rax, dword [rsp + 0xf8]
cmp r8d, eax
je 0x18009eac5
movsxd rcx, r8d
mov byte [rcx + rsi], 0xff
jmp 0x18009eaca
mov r8d, dword [rsp + 0x24]
xor r9d, r9d
jmp 0x18009ea99
mov rcx, qword [rsp + 0x78]
add rbx, rcx
lea r11, [rax + r15]
add rax, rsi
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x28], rax
mov r8, rbx
jmp 0x18009eb3c
cmp eax, 0x10
jne 0x18009eb16
cmp r8d, dword [rsp + 0xf8]
je 0x18009eaf9
mov word [r14 + rsi], 0xffff
movsxd rax, r12d
lea r11, [r15 + r13]
add rbx, rax
mov qword [rsp + 0x48], r11
lea rax, [rsi + r13]
mov r8, rbx
mov qword [rsp + 0x28], rax
jmp 0x18009eb3c
inc rbx
lea r11, [r15 + 1]
cmp dword [rsp + 0x110], 8
lea rax, [rsi + 1]
mov r8, rbx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x28], rax
jl 0x18009f077
mov ecx, dword [rsp + 0x24]
cmp ecx, dword [rsp + 0xf8]
je 0x18009f077
cmp r10d, 6
ja case.default.0x18009eb6f
movsxd rcx, r10d
mov rbx, r8
lea r10, [0x180000000]
mov edx, dword [r10 + rcx*4 + 0x9f934]
add rdx, r10
jmp rdx
mov edx, dword [rsp + 0x100]
lea ecx, [rdx - 1]
cmp ecx, 1
jb 0x18009edde
movsxd r11, r12d
mov r10d, ecx
nop word [rax + rax]
test r14, r14
jle 0x18009ebb2
mov r9, rbx
mov rdx, rax
sub r9, rax
mov r8, r14
movzx ecx, byte [rdx + r9]
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18009eba1
mov byte [r14 + rax], 0xff
add rbx, r11
add rax, r13
sub r10, 1
jne 0x18009eb90
jmp 0x18009edd7
mov edx, dword [rsp + 0x100]
lea ecx, [rdx - 1]
cmp ecx, 1
jb 0x18009edde
movsxd rdi, r12d
mov r11d, ecx
test r14, r14
jle 0x18009ec15
mov r8, rax
mov r10, rax
sub r8, r13
mov rdx, rbx
sub r8, rbx
mov r9, r14
sub r10, rbx
nop dword [rax + rax]
movzx ecx, byte [rdx + r8]
add cl, byte [rdx]
mov byte [r10 + rdx], cl
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18009ec00
mov byte [r14 + rax], 0xff
add rbx, rdi
add rax, r13
sub r11, 1
jne 0x18009ebe1
jmp 0x18009edd7
mov edx, dword [rsp + 0x100]
lea ecx, [rdx - 1]
cmp ecx, 1
jb 0x18009edde
movsxd rbp, r12d
mov esi, ecx
mov r8, r9
test r12d, r12d
jle 0x18009ed81
cmp r12d, 8
jb 0x18009ed81
lea ecx, [r12 - 1]
movsxd rdx, ecx
lea rcx, [rdx + rbx]
lea r9, [rdx + rax]
cmp rax, rcx
ja 0x18009ec77
cmp r9, rbx
jae 0x18009ed81
lea rcx, [rdx + r11]
cmp rax, rcx
ja 0x18009ec89
cmp r9, r11
jae 0x18009ed81
cmp r12d, 0x40
jb 0x18009ed2f
mov edx, r12d
and edx, 0x8000003f
jge 0x18009eca5
dec edx
or edx, 0xffffffc0
inc edx
mov ecx, r12d
sub ecx, edx
mov rdx, r11
movsxd r10, ecx
sub rdx, rbx
lea rcx, [rbx + 0x10]
mov r9, rax
sub r9, rbx
nop dword [rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r8, 0x40
movdqu xmm1, xmmword [rcx + rdx - 0x10]
movdqu xmm2, xmmword [rcx]
lea rcx, [rcx + 0x40]
paddb xmm1, xmm0
movdqu xmm0, xmmword [rcx + rdx - 0x40]
movdqu xmmword [r9 + rcx - 0x50], xmm1
paddb xmm2, xmm0
movdqu xmm0, xmmword [rcx - 0x30]
movdqu xmm1, xmmword [rcx + rdx - 0x30]
movdqu xmmword [r9 + rcx - 0x40], xmm2
paddb xmm1, xmm0
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm2, xmmword [rcx + rdx - 0x20]
movdqu xmmword [r9 + rcx - 0x30], xmm1
paddb xmm2, xmm0
movdqu xmmword [r9 + rcx - 0x20], xmm2
cmp r8, r10
jl 0x18009ecc0
mov ecx, r12d
and cl, 0x3f
cmp cl, 8
jb 0x18009ed81
mov edx, r12d
and edx, 0x80000007
jge 0x18009ed41
dec edx
or edx, 0xfffffff8
inc edx
mov ecx, r12d
sub ecx, edx
mov rdx, r11
movsxd r10, ecx
sub rdx, rbx
lea rcx, [r8 + rbx]
mov r9, rax
sub r9, rbx
nop dword [rax]
movq xmm1, qword [rcx + rdx]
add r8, 8
movq xmm0, qword [rcx]
lea rcx, [rcx + 8]
paddb xmm1, xmm0
movq qword [r9 + rcx - 8], xmm1
cmp r8, r10
jl 0x18009ed60
cmp r8, r14
jge 0x18009edb4
mov r10, r11
lea rdx, [r8 + rbx]
mov rdi, rax
sub r10, rbx
sub rdi, rbx
mov r9, r14
sub r9, r8
nop dword [rax]
movzx ecx, byte [rdx + r10]
add cl, byte [rdx]
mov byte [rdi + rdx], cl
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18009eda0
mov byte [r14 + rax], 0xff
add rbx, rbp
add rax, r13
add r11, r13
mov r9d, 0
sub rsi, 1
jne 0x18009ec43
mov rbp, qword [rsp + 0x50]
mov edx, dword [rsp + 0x100]
lea rdi, [0x180000000]
cmp dword [rsp + 0x110], 0x10
jne 0x18009f3a1
test edx, edx
je 0x18009f3a1
mov eax, edx
nop dword [rax]
mov byte [r14 + rbp + 1], 0xff
add rbp, r13
sub rax, 1
jne 0x18009ee00
jmp 0x18009f3a1
mov edx, dword [rsp + 0x100]
lea ecx, [rdx - 1]
cmp ecx, 1
jb 0x18009edde
movsxd r15, r12d
mov ebp, ecx
test r14, r14
jle 0x18009ee71
mov r9, rax
mov rdi, rbx
sub r9, r13
sub rdi, r11
sub r9, r11
mov rsi, rax
sub rsi, r11
mov r8, r11
mov r10, r14
nop dword [rax + rax]
movzx edx, byte [r8 + r9]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
add edx, ecx
shr edx, 1
add dl, byte [rdi + r8 - 1]
mov byte [rsi + r8 - 1], dl
sub r10, 1
jne 0x18009ee50
mov byte [r14 + rax], 0xff
add rbx, r15
add rax, r13
add r11, r13
sub rbp, 1
jne 0x18009ee28
jmp 0x18009edd2
mov edx, dword [rsp + 0x100]
lea ecx, [rdx - 1]
cmp ecx, 1
jb 0x18009edde
movsxd rdx, r12d
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x60], rcx
nop dword [rax]
test r14, r14
jle 0x18009ef65
mov rcx, r11
mov r10, rax
sub rcx, rax
sub r10, r13
mov qword [rsp + 0x80], rcx
mov r12, r14
mov r14, qword [rsp + 0x80]
mov rcx, r13
sub rcx, rax
lea rax, [rcx + r11]
lea r11, [rbx + rcx]
nop word [rax + rax]
movzx r9d, byte [r10]
movzx ebp, byte [r10 + r14]
mov edx, r9d
movzx r15d, byte [rax + r10]
sub edx, ebp
mov esi, edx
lea r8d, [r15 + rdx]
mov ecx, r8d
sub ecx, r9d
mov edi, ecx
neg edi
cmovs edi, ecx
neg esi
cmovs esi, edx
sub r8d, ebp
mov ecx, r8d
neg ecx
cmovs ecx, r8d
cmp edi, esi
jg 0x18009ef2f
cmp edi, ecx
jle 0x18009ef38
cmp esi, ecx
mov r9d, ebp
cmovle r9d, r15d
add r9b, byte [r11 + r10]
mov byte [r10 + r13], r9b
inc r10
sub r12, 1
jne 0x18009eef0
mov rax, qword [rsp + 0x28]
mov r11, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x90]
add r11, r13
mov byte [r14 + rax], 0xff
add rax, r13
mov qword [rsp + 0x48], r11
add rbx, rdx
mov qword [rsp + 0x28], rax
sub rcx, 1
mov qword [rsp + 0x60], rcx
jne 0x18009eeb0
jmp 0x18009edd2
mov edx, dword [rsp + 0x100]
lea ecx, [rdx - 1]
cmp ecx, 1
jb 0x18009edde
movsxd rdi, r12d
mov r11d, ecx
nop word [rax + rax]
test r14, r14
jle 0x18009efe9
mov r8, rax
mov r10, rax
sub r8, r13
mov rdx, rbx
sub r8, rbx
mov r9, r14
sub r10, rbx
nop word [rax + rax]
movzx ecx, byte [rdx + r8]
lea rdx, [rdx + 1]
shr cl, 1
add cl, byte [rdx - 1]
mov byte [r10 + rdx - 1], cl
sub r9, 1
jne 0x18009efd0
mov byte [r14 + rax], 0xff
add rbx, rdi
add rax, r13
sub r11, 1
jne 0x18009efb0
jmp 0x18009edd7
mov edx, dword [rsp + 0x100]
lea ecx, [rdx - 1]
cmp ecx, 1
jb 0x18009edde
movsxd rdi, r12d
mov r11d, ecx
test r14, r14
jle 0x18009f055
mov r8, rax
mov r10, rax
sub r8, r13
mov rdx, rbx
sub r8, rbx
mov r9, r14
sub r10, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx + r8]
add cl, byte [rdx]
mov byte [r10 + rdx], cl
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18009f040
mov byte [r14 + rax], 0xff
add rbx, rdi
add rax, r13
sub r11, 1
jne 0x18009f018
jmp 0x18009edd7
mov edx, dword [rsp + 0x100]
jmp 0x18009ede5
mov esi, dword [rsp + 0x30]
dec esi
imul esi, r12d
mov dword [rsp + 0x28], esi
cmp r10d, 6
ja case.default.0x18009f0a7
movsxd rcx, r10d
lea r10, [0x180000000]
movsxd r8, esi
mov edx, dword [r10 + rcx*4 + 0x9f950]
add rdx, r10
jmp rdx
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18009f394
test esi, esi
jle 0x18009f394
mov r9, rax
mov rdx, rbx
sub r9, r14
sub r9, rbx
sub rax, rbx
movzx ecx, byte [rdx + r9]
add cl, byte [rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18009f0d0
jmp 0x18009f394
test esi, esi
jle 0x18009f221
cmp esi, 8
jb 0x18009f221
lea ecx, [rsi - 1]
xor r9d, r9d
movsxd rdx, ecx
lea rcx, [rdx + rbx]
lea r10, [rdx + rax]
cmp rax, rcx
ja 0x18009f119
cmp r10, rbx
jae 0x18009f221
lea rcx, [rdx + r11]
cmp rax, rcx
ja 0x18009f12b
cmp r10, r11
jae 0x18009f221
cmp esi, 0x40
jb 0x18009f1ce
mov edx, esi
and edx, 0x8000003f
jge 0x18009f145
dec edx
or edx, 0xffffffc0
inc edx
mov ecx, esi
sub ecx, edx
mov rdx, r11
movsxd rdi, ecx
sub rdx, rbx
lea rcx, [rbx + 0x10]
mov r10, rax
sub r10, rbx
nop dword [rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r9, 0x40
movdqu xmm1, xmmword [rcx + rdx - 0x10]
movdqu xmm2, xmmword [rcx]
lea rcx, [rcx + 0x40]
paddb xmm1, xmm0
movdqu xmm0, xmmword [rcx + rdx - 0x40]
movdqu xmmword [r10 + rcx - 0x50], xmm1
paddb xmm2, xmm0
movdqu xmm0, xmmword [rcx - 0x30]
movdqu xmm1, xmmword [rcx + rdx - 0x30]
movdqu xmmword [r10 + rcx - 0x40], xmm2
paddb xmm1, xmm0
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm2, xmmword [rcx + rdx - 0x20]
movdqu xmmword [r10 + rcx - 0x30], xmm1
paddb xmm2, xmm0
movdqu xmmword [r10 + rcx - 0x20], xmm2
cmp r9, rdi
jl 0x18009f160
mov ecx, esi
and cl, 0x3f
cmp cl, 8
jb 0x18009f221
mov edx, esi
and edx, 0x80000007
jge 0x18009f1df
dec edx
or edx, 0xfffffff8
inc edx
mov ecx, esi
sub ecx, edx
mov rdx, r11
movsxd rdi, ecx
sub rdx, rbx
lea rcx, [r9 + rbx]
mov r10, rax
sub r10, rbx
nop word [rax + rax]
movq xmm1, qword [rcx + rdx]
add r9, 8
movq xmm0, qword [rcx]
lea rcx, [rcx + 8]
paddb xmm1, xmm0
movq qword [r10 + rcx - 8], xmm1
cmp r9, rdi
jl 0x18009f200
cmp r9, r8
jge 0x18009f394
sub r11, rbx
lea rdx, [r9 + rbx]
sub rax, rbx
sub r8, r9
nop word [rax + rax]
movzx ecx, byte [rdx + r11]
add cl, byte [rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18009f240
jmp 0x18009f394
test esi, esi
jle 0x18009f394
mov r9, rax
mov r10, rbx
sub r9, r14
sub r10, r11
sub r9, r11
sub rax, r11
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r11 + r9]
movzx ecx, byte [r11]
lea r11, [r11 + 1]
add edx, ecx
shr edx, 1
add dl, byte [r10 + r11 - 1]
mov byte [rax + r11 - 1], dl
sub r8, 1
jne 0x18009f280
jmp 0x18009f394
test esi, esi
jle 0x18009f394
mov r10, rax
mov r12, r11
sub r10, r14
sub r12, rax
mov rcx, r14
sub rcx, rax
lea r13, [rcx + r11]
lea rbp, [rcx + rbx]
nop dword [rax + rax]
movzx r9d, byte [r10]
movzx esi, byte [r10 + r12]
mov ecx, r9d
movzx r15d, byte [r10 + r13]
sub ecx, esi
mov edi, ecx
lea edx, [r15 + rcx]
mov eax, edx
sub eax, r9d
mov r11d, eax
neg r11d
cmovs r11d, eax
neg edi
cmovs edi, ecx
sub edx, esi
mov eax, edx
neg eax
cmovs eax, edx
cmp r11d, edi
jg 0x18009f310
cmp r11d, eax
jle 0x18009f319
cmp edi, eax
mov r9d, esi
cmovle r9d, r15d
add r9b, byte [r10 + rbp]
mov byte [r14 + r10], r9b
inc r10
sub r8, 1
jne 0x18009f2d0
mov r13, qword [rsp + 0x68]
mov esi, dword [rsp + 0x28]
jmp 0x18009f394
test esi, esi
jle 0x18009f394
mov r9, rax
mov rdx, rbx
sub r9, r14
sub r9, rbx
sub rax, rbx
nop dword [rax + rax]
movzx ecx, byte [rdx + r9]
lea rdx, [rdx + 1]
shr cl, 1
add cl, byte [rdx - 1]
mov byte [rax + rdx - 1], cl
sub r8, 1
jne 0x18009f350
jmp 0x18009f394
test esi, esi
jle 0x18009f394
mov r9, rax
mov rdx, rbx
sub r9, r14
sub r9, rbx
sub rax, rbx
nop dword [rax]
movzx ecx, byte [rdx + r9]
add cl, byte [rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18009f380
lea rdi, [0x180000000]
movsxd rax, esi
add rbx, rax
mov edx, dword [rsp + 0x34]
xor r9d, r9d
mov ebp, dword [rsp + 0x108]
inc edx
mov r15d, dword [rsp + 0x100]
mov ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x34], edx
cmp edx, ebp
jae 0x18009f402
mov r12d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x24]
mov r10, qword [rsp + 0x98]
jmp 0x18009e8d2
lea r8, str.Corrupt_PNG
lea rdx, str.invalid_width
jmp 0x18009f8ec
lea r8, str.Corrupt_PNG
lea rdx, str.invalid_filter
jmp 0x18009f8ec
mov r11d, dword [rsp + 0x20]
mov r13d, dword [rsp + 0xf8]
mov r14, qword [rsp + 0xe0]
jmp 0x18009f420
lea rdi, [0x180000000]
movsxd rbx, dword [rsp + 0x110]
cmp ebx, 8
jge 0x18009f882
test ebp, ebp
je 0x18009f8c3
mov rsi, qword [r14 + 0x18]
lea r14, [rbx + 0xbe8e0]
add r14, rdi
movsxd rbp, r15d
imul r15d, r13d
mov r13d, dword [rsp + 0x118]
mov r12d, ecx
nop dword [rax]
mov eax, r9d
mov r9, rsi
imul eax, dword [rsp + 0x40]
sub r9, r12
add r9, r15
mov edi, eax
add r9, rdi
lea r8, [rsi + rax]
test r13d, r13d
jne 0x18009f485
movzx r10d, byte [r14]
jmp 0x18009f488
mov r10b, 1
mov ecx, r11d
cmp ebx, 4
jne 0x18009f50b
mov dword [rsp + 0x20], ecx
mov ebx, ecx
cmp ecx, 2
jl 0x18009f4e5
mov r11d, ecx
mov dword [rsp + 0x20], ecx
shr r11, 1
mov eax, r11d
neg eax
lea ebx, [rcx + rax*2]
nop dword [rax]
movzx eax, byte [r9]
shr al, 4
movzx edx, al
movzx ecx, r10b
imul edx, ecx
movzx ecx, r10b
mov byte [r8], dl
movzx eax, byte [r9]
inc r9
and al, 0xf
movzx edx, al
imul edx, ecx
mov byte [r8 + 1], dl
add r8, 2
sub r11, 1
jne 0x18009f4b0
mov r11d, dword [rsp + 0x20]
test ebx, ebx
jle 0x18009f7d5
movzx eax, byte [r9]
shr al, 4
movzx edx, al
movzx ecx, r10b
imul edx, ecx
mov byte [r8], dl
jmp 0x18009f7d5
cmp ebx, 2
jne 0x18009f5fc
mov dword [rsp + 0x20], ecx
mov rbx, rcx
cmp ecx, 4
jl 0x18009f5a5
mov r11, rcx
mov dword [rsp + 0x20], ecx
shr r11, 2
mov eax, r11d
neg eax
lea ebx, [rcx + rax*4]
nop word [rax + rax]
movzx eax, byte [r9]
shr al, 6
movzx edx, al
movzx ecx, r10b
imul edx, ecx
movzx eax, r10b
mov byte [r8], dl
movzx ecx, byte [r9]
shr cl, 4
and cl, 3
movzx ecx, cl
imul ecx, eax
movzx eax, r10b
mov byte [r8 + 1], cl
movzx ecx, byte [r9]
shr cl, 2
and cl, 3
movzx ecx, cl
imul ecx, eax
mov byte [r8 + 2], cl
movzx eax, byte [r9]
inc r9
and al, 3
movzx ecx, r10b
movzx edx, al
imul edx, ecx
mov byte [r8 + 3], dl
add r8, 4
sub r11, 1
jne 0x18009f540
test ebx, ebx
jle 0x18009f5c0
movzx eax, byte [r9]
shr al, 6
movzx edx, al
movzx ecx, r10b
imul edx, ecx
mov byte [r8], dl
inc r8
cmp ebx, 1
jle 0x18009f5df
movzx ecx, byte [r9]
shr cl, 4
and cl, 3
movzx eax, r10b
movzx ecx, cl
imul ecx, eax
mov byte [r8], cl
inc r8
mov r11d, dword [rsp + 0x20]
cmp ebx, 2
jle 0x18009f7d5
movzx ecx, byte [r9]
shr cl, 2
and cl, 3
jmp 0x18009f7c8
mov r11d, ecx
cmp ebx, 1
jne 0x18009f7d5
mov dword [rsp + 0x20], ecx
mov r11, rcx
cmp ecx, 8
jl 0x18009f6f8
mov rbx, rcx
mov dword [rsp + 0x20], ecx
shr rbx, 3
mov eax, ebx
neg eax
lea r11d, [rcx + rax*8]
nop dword [rax + rax]
movzx eax, byte [r9]
shr al, 7
movzx edx, al
movzx ecx, r10b
imul edx, ecx
movzx eax, r10b
mov byte [r8], dl
movzx ecx, byte [r9]
shr cl, 6
and cl, 1
movzx ecx, cl
imul ecx, eax
movzx eax, r10b
mov byte [r8 + 1], cl
movzx ecx, byte [r9]
shr cl, 5
and cl, 1
movzx ecx, cl
imul ecx, eax
movzx eax, r10b
mov byte [r8 + 2], cl
movzx ecx, byte [r9]
shr cl, 4
and cl, 1
movzx ecx, cl
imul ecx, eax
movzx eax, r10b
mov byte [r8 + 3], cl
movzx ecx, byte [r9]
shr cl, 3
and cl, 1
movzx ecx, cl
imul ecx, eax
movzx eax, r10b
mov byte [r8 + 4], cl
movzx ecx, byte [r9]
shr cl, 2
and cl, 1
movzx ecx, cl
imul ecx, eax
movzx eax, r10b
mov byte [r8 + 5], cl
movzx ecx, byte [r9]
shr cl, 1
and cl, 1
movzx ecx, cl
imul ecx, eax
mov byte [r8 + 6], cl
movzx eax, byte [r9]
inc r9
and al, 1
movzx ecx, r10b
movzx edx, al
imul edx, ecx
mov byte [r8 + 7], dl
add r8, 8
sub rbx, 1
jne 0x18009f630
test r11d, r11d
jle 0x18009f714
movzx eax, byte [r9]
shr al, 7
movzx edx, al
movzx ecx, r10b
imul edx, ecx
mov byte [r8], dl
inc r8
cmp r11d, 1
jle 0x18009f734
movzx ecx, byte [r9]
shr cl, 6
and cl, 1
movzx eax, r10b
movzx ecx, cl
imul ecx, eax
mov byte [r8], cl
inc r8
cmp r11d, 2
jle 0x18009f754
movzx ecx, byte [r9]
shr cl, 5
and cl, 1
movzx eax, r10b
movzx ecx, cl
imul ecx, eax
mov byte [r8], cl
inc r8
cmp r11d, 3
jle 0x18009f774
movzx ecx, byte [r9]
shr cl, 4
and cl, 1
movzx eax, r10b
movzx ecx, cl
imul ecx, eax
mov byte [r8], cl
inc r8
cmp r11d, 4
jle 0x18009f794
movzx ecx, byte [r9]
shr cl, 3
and cl, 1
movzx eax, r10b
movzx ecx, cl
imul ecx, eax
mov byte [r8], cl
inc r8
cmp r11d, 5
jle 0x18009f7b4
movzx ecx, byte [r9]
shr cl, 2
and cl, 1
movzx eax, r10b
movzx ecx, cl
imul ecx, eax
mov byte [r8], cl
inc r8
cmp r11d, 6
mov r11d, dword [rsp + 0x20]
jle 0x18009f7d5
movzx ecx, byte [r9]
shr cl, 1
and cl, 1
movzx eax, r10b
movzx ecx, cl
imul ecx, eax
mov byte [r8], cl
mov eax, dword [rsp + 0x24]
cmp eax, dword [rsp + 0xf8]
je 0x18009f859
lea rdx, [rsi + rdi]
lea rcx, [rbp - 1]
cmp eax, 1
jne 0x18009f814
test rcx, rcx
js 0x18009f859
nop dword [rax]
nop dword [rax + rax]
mov byte [rdx + rcx*2 + 1], 0xff
movzx eax, byte [rcx + rdx]
mov byte [rdx + rcx*2], al
sub rcx, 1
jns 0x18009f800
jmp 0x18009f859
test rcx, rcx
js 0x18009f859
lea r8, [rcx*2 + 1]
add r8, rdx
lea rdx, [rdx + rcx*4]
add r8, rcx
add rdx, 2
nop
sub rcx, 1
mov byte [rdx + 1], 0xff
movzx eax, byte [r8 + 1]
lea r8, [r8 - 3]
mov byte [rdx], al
lea rdx, [rdx - 4]
movzx eax, byte [r8 + 3]
mov byte [rdx + 3], al
movzx eax, byte [r8 + 2]
mov byte [rdx + 2], al
jns 0x18009f830
mov r9, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x110]
inc r9d
mov qword [rsp + 0x70], r9
cmp r9d, dword [rsp + 0x108]
jb 0x18009f460
mov eax, 1
jmp 0x18009f8fa
cmp ebx, 0x10
jne 0x18009f8c3
mov r9, qword [r14 + 0x18]
imul r13d, r15d
mov r8, r9
imul r13d, ebp
test r13d, r13d
je 0x18009f8c3
mov r10d, r13d
nop
movzx edx, byte [r9]
lea r9, [r9 + 2]
movzx ecx, byte [r8 + 1]
lea r8, [r8 + 2]
shl dx, 8
or dx, cx
mov word [r8 - 2], dx
sub r10, 1
jne 0x18009f8a0
mov eax, 1
jmp 0x18009f8fa
lea r8, str.Corrupt_PNG
lea rdx, str.too_large
jmp 0x18009f8ec
mov qword [r14 + 0x18], r8
lea r8, str.Out_of_memory
lea rdx, str.outofmem
lea rcx, str._STBI__Image_load_error_:__s___s_
call fcn.1800952b0
xor eax, eax
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret