joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400defe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor eax, eax
movzx edi, dx
mov rbx, rcx
mov rcx, qword [rcx + 0x100]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x1400df030
cmp byte [rsp + 0x40], al
jne 0x1400df061
lea rdx, str.none
lea rcx, [rsp + 0x20]
mov r8d, 0x1f
call fcn.1401beb90
jmp 0x1400df0e3
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400df070
dec eax
movsxd rcx, eax
test eax, eax
jle 0x1400df09d
movzx edx, byte [rsp + rcx + 0x40]
cmp dl, 0x5c
je 0x1400df09b
cmp dl, 0x2f
je 0x1400df09b
dec rcx
dec eax
test rcx, rcx
jg 0x1400df082
test eax, eax
je 0x1400df0a1
inc eax
movsxd rcx, eax
lea rdx, [rsp + 0x40]
add rdx, rcx
movzx eax, byte [rdx]
test al, al
je 0x1400df0e3
lea r8, [rsp + 0x20]
lea r9, [rsp + 0x40]
sub r8, rcx
sub r8, r9
cmp al, 0x2e
je 0x1400df0e3
cmp rcx, 0x1f
jge 0x1400df0e3
mov byte [r8 + rdx], al
inc rcx
lea rdx, [rsp + 0x40]
add rdx, rcx
movzx eax, byte [rdx]
test al, al
jne 0x1400df0c3
mov r9, qword [rbx]
mov edx, 0x20
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 0x1f]
call fcn.1401c24f8
mov ecx, 1
mov rdx, rbx
call fcn.1400671a0
mov ecx, 1
mov rdx, rbx
call fcn.1400671a0
xor ecx, ecx
call fcn.1401bf51c
mov rdx, rbx
lea ecx, [rax + 0x7c25b080]
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
mov ecx, 0x494d5653
call fcn.140067100
mov rdx, rbx
mov ecx, 0x494d5653
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
movzx ecx, di
call fcn.1400671a0
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x1400dfbc0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
lea rcx, [rsp + 0x20]
mov r14, r8
call fcn.14006e770
lea rax, [rsp + 0x20]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1400dfbf6
movsd xmm0, qword [str.ldf.dll]
lea rcx, [rsp + 0x20]
movsd qword [rax], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400dfdcc
lea rdx, str.ILD_Compress_EndProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ILD_Compress_Compress
mov rcx, rdi
mov qword [0x1402ace30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ILD_Compress_SetCallback
mov rcx, rdi
mov qword [0x1402ace38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ILD_Compress_SetProp
mov rcx, rdi
mov qword [0x1402ace40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ILD_Compress_StartProcess
mov rcx, rdi
mov qword [0x1402ace48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ILD_Compress_AppendPage
mov rcx, rdi
mov qword [0x1402ace50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1402ace30], 0
mov qword [0x1402ace58], rax
je 0x1400dfdb7
cmp qword [0x1402ace38], 0
je 0x1400dfdb7
cmp qword [0x1402ace40], 0
je 0x1400dfdb7
cmp qword [0x1402ace48], 0
je 0x1400dfdb7
cmp qword [0x1402ace50], 0
je 0x1400dfdb7
test rax, rax
je 0x1400dfdb7
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x178], rsi
mov esi, 1
mov ecx, esi
mov edx, 0x4d0
call fcn.1401be1f8
mov rbx, rax
test rax, rax
jne 0x1400dfd5d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, si
mov rbx, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x140
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 8]
call fcn.1400df8e0
mov edx, 0x1b
mov rcx, rbp
call fcn.140066480
mov qword [rbx], rax
test rax, rax
jne 0x1400dfd93
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1401be23c
mov eax, 5
jmp 0x1400dfd31
lea rcx, [rbx + 8]
mov rdx, rax
mov qword [rbx + 0x4c0], rdi
call fcn.1400dff40
mov byte [rbx + 0x4c8], sil
mov qword [r14], rbx
xor eax, eax
jmp 0x1400dfd31
lea rcx, str.Cant_get_address_of_function__n
call fcn.1401bdc60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 2
jmp 0x1400dfd41
Function at 0x1400e08d0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov esi, 1
mov edx, 0x408
mov ecx, esi
call fcn.1401be1f8
mov rdi, rax
mov qword [rbx], rax
test rax, rax
jne 0x1400e091b
movzx eax, si
jmp 0x1400e0ade
lea rcx, [rsp + 0x20]
call fcn.14006e770
lea rax, [rsp + 0x20]
dec rax
nop dword [rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1400e0930
mov ecx, dword [0x140212140]
movsd xmm0, qword [str.ldf_jpm.dll]
movsd qword [rax], xmm0
mov dword [rax + 8], ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rdi + 0x398], rax
test rax, rax
je 0x1400e0ad1
lea rdx, [0x14021eb30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Compress_Set_License
mov qword [rdi + 0x3c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Compress_Set_Property
mov qword [rdi + 0x3c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Compress_Set_Resolution
mov qword [rdi + 0x3d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Compress_Page
mov qword [rdi + 0x3d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Compress_End
mov qword [rdi + 0x3e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Document_Add_External_Page_As_Copy
mov qword [rdi + 0x3e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Document_End
mov qword [rdi + 0x3f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rdi + 0x398]
lea rdx, str.JPM_Document_Export_Document
mov qword [rdi + 0x3f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rdi + 0x3c0], 0
mov qword [rdi + 0x400], rax
je 0x1400e0ab8
cmp qword [rdi + 0x3c8], 0
je 0x1400e0ab8
cmp qword [rdi + 0x3d0], 0
je 0x1400e0ab8
cmp qword [rdi + 0x3d8], 0
je 0x1400e0ab8
cmp qword [rdi + 0x3e0], 0
je 0x1400e0ab8
cmp qword [rdi + 0x3e8], 0
je 0x1400e0ab8
cmp qword [rdi + 0x3f0], 0
je 0x1400e0ab8
cmp qword [rdi + 0x3f8], 0
je 0x1400e0ab8
test rax, rax
je 0x1400e0ab8
xor eax, eax
mov dword [rdi + 0x3a8], eax
jmp 0x1400e0ade
lea rcx, str.Cant_get_address_of_function__n
call fcn.1401bdc60
mov rcx, qword [rdi + 0x398]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call fcn.1401be23c
mov eax, 2
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401bd600
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400e1370
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x210
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rbp, rcx
lea rcx, [rsp + 0xf0]
movzx edi, r8b
mov rbx, rdx
call fcn.14006e770
lea rcx, [rsp + 0xf0]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400e13b3
movsd xmm0, qword [str.lwf_jp2.dll]
mov eax, dword [0x14021ec40]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400e15a3
lea rdx, str.JP2_Compress_Start
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.JP2_Compress_SetLicense
mov rcx, rsi
mov qword [0x1402ace60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.JP2_Compress_SetProp
mov rcx, rsi
mov qword [0x1402ace68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.JP2_Compress_Image
mov rcx, rsi
mov qword [0x1402ace70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.JP2_Compress_End
mov rcx, rsi
mov qword [0x1402ace78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1402ace60], 0
mov qword [0x1402ace80], rax
je 0x1400e158e
cmp qword [0x1402ace68], 0
je 0x1400e158e
cmp qword [0x1402ace70], 0
je 0x1400e158e
cmp qword [0x1402ace78], 0
je 0x1400e158e
test rax, rax
je 0x1400e158e
lea rdx, [rsp + 0x20]
movzx r9d, dil
mov r8, rbx
mov rcx, rbp
call fcn.1400e15d0
movzx edi, ax
test ax, ax
jne 0x1400e1572
lea rcx, [rsp + 0x40]
call fcn.140061e90
movzx eax, word [0x14020de40]
movups xmm0, xmmword [str.LuraWave_JPEG_2000_Format]
movsd xmm1, qword [0x14020de38]
mov word [rsp + 0x88], ax
mov eax, 8
mov word [rsp + 0x52], ax
mov eax, 0x7f0
movaps xmmword [rsp + 0x70], xmm0
movsd qword [rsp + 0x80], xmm1
cmp word [rbx + 0x48], ax
jne 0x1400e151a
movsx eax, word [rbx + 0x4c]
cdq
and edx, 7
add eax, edx
sar eax, 3
jmp 0x1400e151f
mov eax, 1
mov word [rsp + 0x50], ax
mov eax, dword [rbx + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x5c], eax
call fcn.14005fe70
movzx edi, ax
test ax, ax
jne 0x1400e1572
mov ecx, dword [rsp + 0x20]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0xffffffff
call qword [0x1402ace78]
test eax, eax
je 0x1400e156a
mov edi, 6
mov rcx, rbx
call fcn.14005dcb0
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1400e1580
call qword [0x1402ace80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, di
jmp 0x1400e15a8
lea rcx, str.Cant_get_address_of_function__n
call fcn.1401bdc60
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 2
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x240]
add rsp, 0x210
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e1cc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rdx]
mov rbx, r8
mov rdi, rdx
mov rcx, qword [rcx]
call fcn.1401c2310
movsxd r9, dword [rdi + 8]
mov rcx, qword [rdi + 0x10]
mov dword [rcx + r9*4], eax
mov rcx, qword [rdi]
inc dword [rdi + 8]
mov rdx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400c96c0

Function at 0x1400e2050
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0xa0]
mov rsi, rdx
mov edx, 0x1c
mov r15, r9
mov r9, qword [rcx]
mov r14, r8
mov rbx, rcx
lea r8d, [rdx - 0x1b]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
jne 0x1400e20a4
mov eax, 2
jmp 0x1400e2124
lea rdx, str.CAD_camera_image_1.0
lea rcx, [rsp + 0x20]
mov r8d, 0x15
call fcn.1401c5410
test eax, eax
jne 0x1400e209a
mov rcx, rbx
call fcn.140066de0
mov rcx, rbx
movzx eax, ax
mov dword [rsi], eax
call fcn.140066de0
mov rcx, rbx
movzx eax, ax
mov dword [r14], eax
call fcn.140066de0
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, qword [rbx]
call fcn.1401c3f28
mov word [r15], ax
dec ax
cmp ax, 1
ja 0x1400e209a
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, qword [rbx]
call fcn.1401c3f28
mov word [rdi], ax
mov rcx, qword [rbx]
call fcn.1401c1a94
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400e2140
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rdi, rdx
mov rsi, rcx
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x1400e2266
xor ebp, ebp
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
mov ebx, ebp
movzx ecx, al
shr cl, 6
cmp cl, 1
jne 0x1400e21ad
movzx ebx, al
mov edx, 0xff
mov rcx, rdi
and ebx, 0x3f
movsxd r8, ebx
call fcn.1401c0040
jmp 0x1400e2242
cmp cl, 2
jne 0x1400e21c7
movzx ebx, al
xor edx, edx
mov rcx, rdi
and ebx, 0x3f
movsxd r8, ebx
call fcn.1401c0040
jmp 0x1400e2242
cmp cl, 3
jne 0x1400e21d7
movzx ebx, al
and ebx, 0x3f
movsxd rdx, ebx
jmp 0x1400e2229
and al, 0x3f
cmp al, 1
jne 0x1400e21fa
mov rcx, rsi
call fcn.140066de0
mov edx, 0xff
mov rcx, rdi
movzx ebx, ax
mov r8d, ebx
call fcn.1401c0040
jmp 0x1400e2242
cmp al, 2
jne 0x1400e2218
mov rcx, rsi
call fcn.140066de0
xor edx, edx
mov rcx, rdi
movzx ebx, ax
mov r8d, ebx
call fcn.1401c0040
jmp 0x1400e2242
cmp al, 3
jne 0x1400e223c
mov rcx, rsi
call fcn.140066de0
movzx ebx, ax
mov edx, ebx
mov r9, qword [rsi]
mov r8d, 1
mov rcx, rdi
call fcn.1401c1e14
jmp 0x1400e2242
sub al, 4
cmp al, 1
jbe 0x1400e2280
mov r9, qword [rsi]
mov edx, 1
movsxd rax, ebx
lea rcx, [rsp + 0x30]
mov r8d, edx
add rdi, rax
call fcn.1401c1e14
test rax, rax
jne 0x1400e2180
mov eax, 4
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
movzx eax, bp
jmp 0x1400e226b
Function at 0x1400e2700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rdx, rcx
mov ecx, 0x53445058
mov rbx, r8
call qword [r8 + 0x10]
mov ecx, dword [rdi]
mov rdx, rsi
call qword [rbx + 0x10]
mov r9, qword [rsi]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rdi + 4]
call fcn.1401c24f8
mov ecx, dword [rdi + 0xc]
mov rdx, rsi
call qword [rbx + 0x10]
mov ecx, dword [rdi + 0x10]
mov rdx, rsi
call qword [rbx + 0x10]
mov ecx, dword [rdi + 0x14]
mov rdx, rsi
call qword [rbx + 0x10]
mov ecx, dword [rdi + 0x18]
mov rdx, rsi
call qword [rbx + 0x10]
mov ecx, dword [rdi + 0x1c]
mov rdx, rsi
call qword [rbx + 0x10]
mov r9, qword [rsi]
mov edx, 0x64
lea r8d, [rdx - 0x63]
lea rcx, [rdi + 0x20]
call fcn.1401c24f8
mov r9, qword [rsi]
mov edx, 0x18
lea r8d, [rdx - 0x17]
lea rcx, [rdi + 0x84]
call fcn.1401c24f8
mov r9, qword [rsi]
mov edx, 0x64
lea r8d, [rdx - 0x63]
lea rcx, [rdi + 0x9c]
call fcn.1401c24f8
mov r9, qword [rsi]
lea rcx, [rdi + 0x100]
mov edx, 0xc8
mov r8d, 1
call fcn.1401c24f8
mov r9, qword [rsi]
lea rcx, [rdi + 0x1c8]
mov edx, 0xc8
mov r8d, 1
call fcn.1401c24f8
mov ecx, dword [rdi + 0x290]
mov rdx, rsi
call qword [rbx + 0x10]
mov r9, qword [rsi]
mov edx, 0x68
lea r8d, [rdx - 0x67]
lea rcx, [rdi + 0x294]
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400e2820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
mov rdx, rcx
movzx ecx, word [r14]
mov rdi, r8
call qword [r8 + 8]
movzx ecx, word [r14 + 2]
mov rdx, rbx
call qword [rdi + 8]
mov ecx, dword [r14 + 4]
mov rdx, rbx
call qword [rdi + 0x10]
mov ecx, dword [r14 + 8]
mov rdx, rbx
call qword [rdi + 0x10]
lea rsi, [r14 + 0x10]
lea rbp, [r14 + 0x34]
mov r15d, 8
nop dword [rax]
mov ecx, dword [rsi - 4]
mov rdx, rbx
call qword [rdi + 0x10]
mov ecx, dword [rsi]
mov rdx, rbx
call qword [rdi + 0x10]
mov rcx, rbx
movss xmm1, dword [rsi + 4]
cvtps2pd xmm1, xmm1
call qword [rdi + 0x18]
mov ecx, dword [rsi + 8]
mov rdx, rbx
call qword [rdi + 0x10]
mov rcx, rbx
movss xmm1, dword [rsi + 0xc]
cvtps2pd xmm1, xmm1
call qword [rdi + 0x18]
movzx ecx, byte [rsi + 0x10]
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, byte [rsi + 0x11]
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, byte [rsi + 0x12]
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, byte [rsi + 0x13]
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, word [rsi + 0x14]
mov rdx, rbx
call qword [rdi + 8]
movzx ecx, word [rsi + 0x16]
mov rdx, rbx
call qword [rdi + 8]
mov ecx, dword [rsi + 0x18]
mov rdx, rbx
call qword [rdi + 0x10]
mov ecx, dword [rsi + 0x1c]
mov rdx, rbx
call qword [rdi + 0x10]
mov ecx, dword [rsi + 0x20]
mov rdx, rbx
call qword [rdi + 0x10]
mov r9, qword [rbx]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
mov rcx, rbp
call fcn.1401c24f8
add rbp, 0x48
lea rsi, [rsi + 0x48]
dec r15
jne 0x1400e2880
mov r9, qword [rbx]
lea rcx, [r14 + 0x24c]
lea edx, [r15 + 0x34]
lea r8d, [r15 + 1]
call fcn.1401c24f8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400e2970
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rdi, rcx
mov rdx, rcx
mov ecx, dword [r14]
mov rbp, r8
call qword [r8 + 0x10]
mov ecx, dword [r14 + 4]
mov rdx, rdi
call qword [rbp + 0x10]
mov rcx, rdi
movss xmm1, dword [r14 + 8]
cvtps2pd xmm1, xmm1
call qword [rbp + 0x18]
movss xmm1, dword [r14 + 0xc]
mov rcx, rdi
cvtps2pd xmm1, xmm1
call qword [rbp + 0x18]
mov ecx, dword [r14 + 0x10]
mov rdx, rdi
call qword [rbp + 0x10]
mov ecx, dword [r14 + 0x14]
mov rdx, rdi
call qword [rbp + 0x10]
mov r9, qword [rdi]
mov edx, 0x64
lea r8d, [rdx - 0x63]
lea rcx, [r14 + 0x18]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x18
lea r8d, [rdx - 0x17]
lea rcx, [r14 + 0x7c]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [r14 + 0x94]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [r14 + 0xb4]
call fcn.1401c24f8
lea rbx, [r14 + 0xd4]
mov esi, 4
nop
movzx ecx, word [rbx]
mov rdx, rdi
call qword [rbp + 8]
lea rbx, [rbx + 2]
dec rsi
jne 0x1400e2a40
lea rbx, [r14 + 0xdc]
mov esi, 2
nop
mov ecx, dword [rbx]
mov rdx, rdi
call qword [rbp + 0x10]
lea rbx, [rbx + 4]
dec rsi
jne 0x1400e2a60
mov r9, qword [rdi]
lea rcx, [r14 + 0xe4]
lea edx, [rsi + 0x1c]
lea r8d, [rsi + 1]
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r14
ret

Function at 0x1400e2fc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r13
push r15
sub rsp, 0x40
mov edx, 4
movsxd rbp, r9d
mov r15d, r8d
mov rdi, rcx
call fcn.140066ff0
mov rcx, rdi
call fcn.140066b20
mov dword [rsp + 0x20], eax
cdqe
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.1401bee78
mov r13, rax
test rax, rax
jne 0x1400e3016
lea eax, [r13 + 1]
add rsp, 0x40
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x70], rbx
mov ebx, r15d
mov qword [rsp + 0x80], r12
imul ebx, ebp
movsxd rcx, ebx
call fcn.1401bee78
mov rcx, r13
mov r12, rax
test rax, rax
jne 0x1400e304b
call fcn.1401be23c
lea eax, [r12 + 1]
jmp 0x1400e30e8
mov r9, qword [rdi]
mov rdx, qword [rsp + 0x28]
mov esi, 1
mov r8d, esi
mov qword [rsp + 0x88], r14
xor r14d, r14d
call fcn.1401c1e14
mov ecx, dword [rsp + 0x20]
mov r9, r12
mov r8d, ebx
mov rdx, r13
call fcn.1400ba9b0
mov ebx, r14d
test r15d, r15d
jle 0x1400e30cc
mov edi, r14d
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
movsxd rdx, edi
mov r8, rbp
add rdx, r12
call fcn.1401bd6e0
mov rcx, qword [rsp + 0x90]
or r8d, 0xffffffff
or edx, r8d
mov r9d, esi
call fcn.1400615b0
movzx r14d, ax
test ax, ax
jne 0x1400e30cc
inc ebx
add edi, ebp
cmp ebx, r15d
jl 0x1400e3090
mov rcx, r12
call fcn.1401be23c
mov rcx, r13
call fcn.1401be23c
movzx eax, r14w
mov r14, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e3190
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r8d, dword [rdx + 0x54]
mov rdi, rdx
mov edx, dword [rdx + 0x50]
mov r14, rcx
call fcn.1400e32a0
lea rcx, [rsp + 0x20]
call fcn.140061e90
mov eax, 0x10
lea rdx, [rsp + 0x20]
movups xmm0, xmmword [str.Flexible_Image_Transport_System]
movups xmm1, xmmword [0x140200788]
mov word [rsp + 0x24], ax
lea ebp, [rax - 0xf]
mov eax, dword [rdi + 0x50]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov rcx, rdi
mov dword [rsp + 0x30], 0x80001
mov dword [rsp + 0x3c], eax
call fcn.14005fe70
movzx esi, ax
test ax, ax
jne 0x1400e3275
mov qword [rsp + 0x110], rbx
xor ebx, ebx
cmp dword [rdi + 0x54], ebx
jle 0x1400e3265
nop word [rax + rax]
mov r8d, ebp
mov edx, ebx
mov rcx, rdi
call fcn.1400629c0
movsxd rdx, dword [rsp + 0x3c]
mov r9, qword [r14]
mov rcx, qword [rsp + 0x28]
mov r8, rbp
call fcn.1401c24f8
test rax, rax
je 0x1400e3260
inc ebx
cmp ebx, dword [rdi + 0x54]
jl 0x1400e3230
jmp 0x1400e3265
mov esi, 6
mov rcx, rdi
call fcn.14005dcb0
mov rbx, qword [rsp + 0x110]
movzx eax, si
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
mov rbp, qword [rsp + 0x118]
add rsp, 0xe0
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e32a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, r8d
mov esi, edx
mov rdi, rcx
lea r8, [0x14021ed10]
lea rdx, str.SIMPLE____22s
lea rcx, [rbp - 0x60]
call fcn.1401bea4c
or rbx, 0xffffffffffffffff
lea rax, [rbp - 0x60]
mov rdx, rbx
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e32f0
mov r9, qword [rdi]
lea rcx, [rbp - 0x60]
mov r8d, 1
call fcn.1401c24f8
lea rax, [rbp - 0x60]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3312
mov rcx, rdi
call fcn.1400e34f0
lea r8, [0x1401f4ba8]
lea rdx, str.BITPIX____22s
lea rcx, [rbp - 0x60]
call fcn.1401bea4c
lea rax, [rbp - 0x60]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3341
mov r9, qword [rdi]
lea rcx, [rbp - 0x60]
mov r8d, 1
call fcn.1401c24f8
lea rax, [rbp - 0x60]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3363
mov rcx, rdi
call fcn.1400e34f0
lea r8, [0x1401f4c10]
lea rdx, str.NAXIS_____22s
lea rcx, [rbp - 0x60]
call fcn.1401bea4c
lea rax, [rbp - 0x60]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3392
mov r9, qword [rdi]
lea rcx, [rbp - 0x60]
mov r8d, 1
call fcn.1401c24f8
lea rax, [rbp - 0x60]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e33b4
mov rcx, rdi
call fcn.1400e34f0
lea rdx, str.NAXIS1____d
lea rcx, [rbp - 0x60]
mov r8d, esi
call fcn.1401bea4c
lea rax, [rbp - 0x60]
mov rdx, rbx
nop
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e33e0
mov r9, qword [rdi]
lea rcx, [rbp - 0x60]
mov r8d, 1
call fcn.1401c24f8
lea rax, [rbp - 0x60]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3402
mov rcx, rdi
call fcn.1400e34f0
lea rdx, str.NAXIS2____d
lea rcx, [rbp - 0x60]
mov r8d, r14d
call fcn.1401bea4c
lea rax, [rbp - 0x60]
mov rdx, rbx
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3430
mov r9, qword [rdi]
lea rcx, [rbp - 0x60]
mov r8d, 1
call fcn.1401c24f8
lea rax, [rbp - 0x60]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3452
mov rcx, rdi
call fcn.1400e34f0
lea rdx, [0x14021dab8]
lea rcx, [rbp - 0x60]
call fcn.1401bea4c
lea rax, [rbp - 0x60]
mov rdx, rbx
nop word [rax + rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400e3480
mov r9, qword [rdi]
lea rcx, [rbp - 0x60]
mov r8d, 1
call fcn.1401c24f8
lea rax, [rbp - 0x60]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400e34a0
mov rdx, rbx
mov rcx, rdi
call fcn.1400e34f0
mov ebx, 0x960
nop dword [rax]
mov rdx, qword [rdi]
mov ecx, 0x20
call fcn.1401c1ae4
dec rbx
jne 0x1400e34c0
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret