joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e52e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
xor ecx, ecx
xor r15b, r15b
mov r12, r9
mov eax, edx
movsxd rbp, r8d
movzx esi, cx
mov edi, ecx
mov r14d, ecx
mov byte [rsp + 0x20], cl
test edx, edx
jle 0x1400e5452
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test si, si
jne 0x1400e542b
test edi, edi
jg 0x1400e5357
mov rcx, r13
call fcn.140066de0
mov ecx, 0xff08
cmp ax, cx
je 0x1400e534a
mov esi, 4
mov rcx, r13
call fcn.140066de0
movzx edi, ax
add edi, edi
mov r9, qword [r13]
mov edx, 1
lea rcx, [rsp + 0x21]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x1400e544b
movzx eax, byte [rsp + 0x21]
dec edi
test al, al
js 0x1400e53aa
movzx r15d, al
test edi, edi
je 0x1400e53a8
mov r9, qword [r13]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
movzx eax, byte [rsp + 0x20]
dec edi
jmp 0x1400e53ae
mov al, 0x80
mov byte [rsp + 0x20], al
test al, al
jns 0x1400e53d4
and al, 0x7f
movzx ecx, al
inc cx
je 0x1400e53f4
mov eax, 0xffff
cmp rbx, rbp
jge 0x1400e53cd
mov byte [rbx + r12], r15b
inc rbx
add cx, ax
jne 0x1400e53c1
jmp 0x1400e53f4
mov rcx, qword [r13]
mov r8d, 1
or edx, 0xffffffff
call fcn.1401c1f88
movzx eax, byte [rsp + 0x21]
inc edi
mov byte [rbx + r12], al
inc rbx
cmp rbx, rbp
jl 0x1400e5420
mov rcx, qword [rsp + 0x80]
or r8d, 0xffffffff
mov r9d, 1
or edx, r8d
call fcn.1400615b0
movzx esi, ax
test ax, ax
jne 0x1400e542b
inc r14d
xor ebx, ebx
cmp r14d, dword [rsp + 0x68]
jl 0x1400e5326
movzx eax, si
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 4
jmp 0x1400e542e
movzx eax, si
jmp 0x1400e5433

Function at 0x1400e5560
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
movsxd rax, dword [rdx + 0xc]
mov r10, rdx
mov rbx, rcx
test eax, eax
jle 0x1400e55c0
mov byte [rax + rdx + 0x10], 0
movsxd rax, dword [rdx + 0xc]
lea rcx, [r10 + 0x10]
mov byte [rax + rdx + 0x11], 0
movsxd rax, dword [rdx + 0xc]
add rdx, 0x1a
mov byte [rax + rdx - 8], 0
call fcn.1400e5610
mov ecx, dword [r10 + 0xc]
mov r9, qword [rbx]
inc ecx
cmp byte [rax], 0x7a
movsxd rdx, ecx
lea rcx, [0x14021fe6c]
mov r8d, 1
cmove rax, rcx
mov rcx, rax
call fcn.1401c24f8
mov rdx, qword [rbx]
mov ecx, 0x7e
call fcn.1401c1ae4
mov rdx, qword [rbx]
mov ecx, 0x3e
call fcn.1401c1ae4
mov rdx, qword [rbx]
mov ecx, 0xa
add rsp, 0x20
pop rbx
jmp fcn.1401c1ae4
Function at 0x1400e7120
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x98
movsd xmm1, qword [0x140220428]
xorps xmm0, xmm0
movsxd rbx, r9d
mov edi, r8d
mov ebp, r8d
mov r13, rdx
imul edi, ebx
mov eax, edi
mov dword [rsp + 0xe8], edi
cvtsi2sd xmm0, rax
xor eax, eax
mulsd xmm0, qword [0x140220420]
addsd xmm0, qword [0x14021dde8]
comisd xmm0, xmm1
jb 0x1400e7191
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x1400e7191
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si r12, xmm0
mov qword [rsp + 0xd8], rsi
add r12, rax
mov ecx, r12d
mov qword [rsp + 0x20], r12
call fcn.1401bee78
mov r15, rax
test rax, rax
jne 0x1400e71bf
lea eax, [r15 + 1]
jmp 0x1400e7307
xor esi, esi
lea rax, [0x1400e7320]
lea r8, [0x14021128c]
mov qword [rsp + 0x60], rax
lea rax, [fcn.140169310]
lea rcx, [rsp + 0x30]
lea r9d, [rsi + 0x58]
or edx, 0xffffffff
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x78], esi
call fcn.14015f340
test eax, eax
jne 0x1400e72fc
mov ecx, edi
mov qword [rsp + 0x90], r14
call fcn.1401bee78
mov edi, esi
mov esi, 1
mov r14, rax
mov qword [rsp + 0x28], rax
test ebp, ebp
jle 0x1400e7295
mov r14, qword [rsp + 0xf0]
mov r12d, dword [rsp + 0xe0]
mov rbp, rax
nop word [rax + rax]
mov r8d, esi
mov edx, edi
mov rcx, r13
call fcn.1400629c0
cmp word [r13 + 0x48], si
jne 0x1400e7273
test rbx, rbx
jle 0x1400e7273
mov rdx, r14
mov r8, rbx
nop
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
neg al
sbb cl, cl
mov byte [rdx - 1], cl
dec r8
jne 0x1400e7260
mov r8, rbx
mov rdx, r14
mov rcx, rbp
call fcn.1401bd6e0
inc edi
add rbp, rbx
cmp edi, r12d
jl 0x1400e7240
mov r12, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov eax, dword [rsp + 0xe8]
lea rcx, [rsp + 0x30]
mov edx, 4
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x4c], 0
call fcn.14015e6b0
lea rcx, [rsp + 0x30]
call fcn.14015f010
mov r9, qword [rsp + 0xd0]
mov edx, dword [rsp + 0x4c]
mov r9, qword [r9]
mov r8, rsi
mov rcx, r15
call fcn.1401c24f8
mov rcx, r14
call fcn.1401be23c
mov r14, qword [rsp + 0x90]
xor esi, esi
mov rcx, r15
call fcn.1401be23c
movzx eax, si
mov rsi, qword [rsp + 0xd8]
add rsp, 0x98
pop r15
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400e7e60
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov edi, dword [rsp + 0xb8]
mov ebx, dword [rsp + 0xb0]
movsxd rsi, dword [rsp + 0xc0]
imul ebx, edi
mov eax, ebx
movsxd r12, r9d
mov dword [rsp + 0x20], ebx
imul eax, esi
lea ecx, [rax + 0x400]
mov dword [rsp + 0xb8], eax
call fcn.1401bee78
mov r13, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x1400e7ed3
lea eax, [r13 + 1]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movsxd rcx, ebx
mov qword [rsp + 0x48], r15
call fcn.1401bee78
mov r15, rax
test rax, rax
jne 0x1400e7f05
mov rcx, r13
call fcn.1401be23c
lea eax, [r15 + 1]
mov r15, qword [rsp + 0x48]
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], r14
mov rbx, rsi
mov r14d, eax
mov ebp, eax
test esi, esi
jle 0x1400e7fea
movsxd rcx, dword [rsp + 0xa0]
lea edx, [r12 + rdi]
mov rax, r12
movsxd r12, dword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov rsi, rcx
mov dword [rsp + 0x24], edx
movsxd rdi, edx
nop word [rax + rax]
mov rdx, r15
mov r9, rax
cmp rax, rdi
jge 0x1400e7fae
mov eax, dword [rsp + 0xb0]
mov r13, qword [rsp + 0x98]
add eax, ecx
movsxd r10, eax
nop
cmp rsi, r10
jge 0x1400e7fa1
mov rax, r12
mov r8, r10
imul rax, r9
add rax, rsi
imul rax, rbx
add rax, rbp
add rax, r13
sub r8, rsi
nop
movzx ecx, byte [rax]
inc rdx
add rax, rbx
mov byte [rdx - 1], cl
dec r8
jne 0x1400e7f90
inc r9
cmp r9, rdi
jl 0x1400e7f70
mov r13, qword [rsp + 0x28]
mov r9d, dword [rsp + 0xb8]
mov edx, dword [rsp + 0x20]
movsxd r8, r14d
add r8, r13
mov rcx, r15
sub r9d, r14d
call fcn.1400e7b70
test eax, eax
je 0x1400e8034
mov ecx, dword [rsp + 0xa0]
add r14d, eax
mov rax, qword [rsp + 0x30]
inc rbp
cmp rbp, rbx
jl 0x1400e7f50
mov r12, qword [rsp + 0x90]
movsxd rdx, r14d
mov r8d, 1
mov r9, qword [r12]
mov rcx, r13
call fcn.1401c24f8
mov rcx, r15
call fcn.1401be23c
mov rcx, r13
call fcn.1401be23c
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, dword [rsp + 0x24]
mov edx, dword [rsp + 0xa8]
cmp edx, ecx
jge 0x1400e8007
mov eax, dword [rsp + 0xc0]
movsxd rbp, dword [rsp + 0xb0]
imul eax, r12d
movsxd r14, eax
mov eax, edx
imul eax, r12d
mov r12, qword [rsp + 0x90]
add eax, dword [rsp + 0xa0]
imul eax, dword [rsp + 0xc0]
movsxd rdi, eax
add rdi, qword [rsp + 0x98]
sub ecx, edx
mov esi, ecx
nop word [rax + rax]
mov r9, qword [r12]
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1401c24f8
add rdi, r14
dec rsi
jne 0x1400e8090
jmp 0x1400e8007
Function at 0x1400e8eb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 4
mov rdi, rcx
lea rcx, str.8BPS
lea r8d, [rdx - 3]
call fcn.1401c24f8
mov ecx, 1
mov rdx, rdi
call fcn.1400671a0
mov r9, qword [rdi]
xor eax, eax
lea edx, [rax + 6]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
mov word [rsp + 0x24], ax
call fcn.1401c24f8
movzx ecx, word [rbx + 0x64]
mov rdx, rdi
call fcn.1400671a0
mov ecx, dword [rbx + 0x54]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rbx + 0x50]
mov rdx, rdi
call fcn.140067100
movzx ecx, word [rbx + 0x62]
mov rdx, rdi
call fcn.1400671a0
movzx eax, word [rbx + 0x48]
cmp ax, 1
jne 0x1400e8f4f
xor ecx, ecx
jmp 0x1400e8f6c
cmp ax, 2
jne 0x1400e8f5c
mov ecx, 1
jmp 0x1400e8f6c
mov ecx, 2
cmp ax, 4
je 0x1400e8f6c
mov ecx, 3
mov rdx, rdi
call fcn.1400671a0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e92c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rsi, rdx
movsx edx, word [rdx + 0x64]
mov rdi, rcx
mov r14, r8
mov r9d, ebx
mov ecx, edx
test edx, edx
jle 0x1400e930c
mov rax, r8
nop word [rax + rax]
add r9d, dword [rax]
lea rax, [rax + 4]
dec rcx
jne 0x1400e9300
movsx rax, dx
mov rdx, rdi
lea ecx, [rax + rax*2]
lea ebp, [r9 + rcx*2]
xor ecx, ecx
call fcn.140067100
mov rdx, rdi
xor ecx, ecx
call fcn.140067100
mov ecx, dword [rsi + 0x54]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rsi + 0x50]
mov rdx, rdi
call fcn.140067100
movzx ecx, word [rsi + 0x64]
mov rdx, rdi
call fcn.1400671a0
cmp bx, word [rsi + 0x64]
jge 0x1400e9383
mov rdx, rdi
cmp ebx, 3
jne 0x1400e9362
mov ecx, 0xfffe
jmp 0x1400e9365
movzx ecx, bx
call fcn.1400671a0
movsxd rax, ebx
mov rdx, rdi
mov ecx, dword [r14 + rax*4]
call fcn.140067100
movsx eax, word [rsi + 0x64]
inc ebx
cmp ebx, eax
jl 0x1400e9353
mov r9, qword [rdi]
mov edx, 4
lea rcx, [0x14021a118]
lea r8d, [rdx - 3]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, str.norm
call fcn.1401c24f8
mov rdx, qword [rdi]
mov ecx, 0xff
call fcn.1401c1ae4
mov rdx, qword [rdi]
xor ecx, ecx
call fcn.1401c1ae4
mov rdx, qword [rdi]
xor ecx, ecx
call fcn.1401c1ae4
mov rdx, qword [rdi]
xor ecx, ecx
call fcn.1401c1ae4
mov rdx, rdi
mov ecx, 0x14
call fcn.140067100
mov rdx, rdi
xor ecx, ecx
call fcn.140067100
mov rdx, rdi
xor ecx, ecx
call fcn.140067100
lea rdx, str.Background
mov rcx, rdi
call fcn.1400e9430
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
lea eax, [rbp + 0x38]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x1400e9430
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400e9450
mov rdx, qword [rcx]
mov ecx, ebx
call fcn.1401c1ae4
mov r9, qword [rsi]
movsxd rdx, ebx
mov r8d, 1
mov rcx, rdi
call fcn.1401c24f8
test bl, 1
jne 0x1400e9486
mov rdx, qword [rsi]
xor ecx, ecx
call fcn.1401c1ae4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e9850
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdx
call fcn.140061e90
movzx eax, byte [0x1402001e0]
mov r14d, 1
movups xmm0, xmmword [str.Kolor_Raw_Format]
mov byte [rsp + 0x60], al
movzx eax, word [rdi + 0x4c]
xor ebx, ebx
movaps xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x32], ax
movsx eax, word [rdi + 0x62]
mov rcx, rdi
mov word [rsp + 0x30], r14w
mov word [rsp + 0x40], bx
imul eax, dword [rdi + 0x50]
cdq
and edx, 7
add eax, edx
lea rdx, [rsp + 0x20]
sar eax, 3
mov dword [rsp + 0x3c], eax
call fcn.14005fe70
movzx ebp, ax
test ax, ax
jne 0x1400e9995
mov rdx, qword [rsi]
lea ecx, [rbx + 0x4b]
call fcn.1401c1ae4
mov rdx, qword [rsi]
lea ecx, [rbx + 0x52]
call fcn.1401c1ae4
mov rdx, qword [rsi]
lea ecx, [rbx + 0x4f]
call fcn.1401c1ae4
mov rdx, qword [rsi]
mov ecx, r14d
call fcn.1401c1ae4
mov ecx, dword [rdi + 0x50]
mov rdx, rsi
call fcn.140067100
mov ecx, dword [rdi + 0x54]
mov rdx, rsi
call fcn.140067100
lea ecx, [rbx + 8]
mov rdx, rsi
call fcn.140067100
movsx eax, word [rdi + 0x4c]
cdq
and edx, 7
add eax, edx
mov rdx, rsi
sar eax, 3
mov ecx, eax
call fcn.140067100
cmp dword [rdi + 0x54], ebx
jle 0x1400e998d
mov r8d, r14d
mov edx, ebx
mov rcx, rdi
call fcn.1400629c0
movsx eax, word [rdi + 0x64]
mov r9, qword [rsi]
imul eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x28]
mov r8, r14
movsxd rdx, eax
call fcn.1401c24f8
cmp rax, r14
jne 0x1400e9988
inc ebx
cmp ebx, dword [rdi + 0x54]
jl 0x1400e9951
jmp 0x1400e998d
mov ebp, 6
mov rcx, rdi
call fcn.14005dcb0
movzx eax, bp
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e9c10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x150
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r10, rcx
mov qword [rsp + 0x28], rcx
mov ecx, dword [rdx + 0x50]
mov rbp, rdx
call fcn.1400e9b70
mov ecx, dword [rbp + 0x54]
mov r14d, eax
call fcn.1400e9b70
movsx r9d, word [rbp + 0x138]
mov edx, r14d
mov rcx, r10
mov r8d, eax
mov r13d, eax
mov dword [rsp + 0x24], eax
call fcn.1400e9ea0
lea rcx, [rsp + 0x40]
call fcn.140061e90
movsx ecx, word [rbp + 0x64]
mov eax, 1
mov word [rsp + 0x50], ax
movzx eax, cx
xor esi, esi
shl ax, 3
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x70], 0x534444
mov word [rsp + 0x52], ax
mov eax, ecx
mov rcx, rbp
mov dword [rsp + 0x44], 0x40000
lea edi, [rsi + 4]
imul eax, dword [rbp + 0x50]
mov dword [rsp + 0x5c], eax
call fcn.14005fe70
mov word [rsp + 0x20], ax
test ax, ax
jne 0x1400e9e79
mov qword [rsp + 0x190], rbx
mov ebx, r14d
mov qword [rsp + 0x148], r12
shl ebx, 4
movsxd rcx, ebx
call fcn.1401bee78
mov ecx, esi
mov r12, rax
mov qword [rsp + 0x38], rax
test r13d, r13d
jle 0x1400e9e54
mov eax, ebx
mov qword [rsp + 0x140], r15
cdq
and edx, 3
add eax, edx
sar eax, 2
cdqe
mov qword [rsp + 0x30], rax
nop word [rax + rax]
lea r15d, [rcx + 4]
mov rsi, r12
cmp r15d, dword [rbp + 0x54]
jle 0x1400e9d49
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x48]
xor edx, edx
lea eax, [rax*4]
movsxd r8, eax
call fcn.1401c0040
jmp 0x1400e9d56
mov edx, ecx
mov r8d, edi
mov rcx, rbp
call fcn.1400629c0
xor edi, edi
test r14d, r14d
jle 0x1400e9e20
lea r13d, [rdi + 4]
xor r12d, r12d
nop dword [rax + rax]
movsx r10d, word [rbp + 0x64]
movsxd rbx, dword [rsp + 0x5c]
mov rdx, r12
mov eax, r10d
mov r11, r13
imul eax, edi
movsxd r9, eax
add r9, qword [rsp + 0x48]
nop
mov rax, r9
mov r8, r13
nop word [rax + rax]
movzx ecx, byte [rax]
add rax, 3
mov byte [rsp + rdx*4 + 0xf0], cl
movzx ecx, byte [rax - 2]
mov byte [rsp + rdx*4 + 0xf1], cl
movzx ecx, byte [rax - 1]
mov byte [rsp + rdx*4 + 0xf2], cl
cmp r10w, r13w
jne 0x1400e9dd2
movzx ecx, byte [rax]
inc rax
jmp 0x1400e9dd7
mov ecx, 0xff
mov byte [rsp + rdx*4 + 0xf3], cl
inc rdx
dec r8
jne 0x1400e9da0
add r9, rbx
dec r11
jne 0x1400e9d90
movsx r8d, word [rbp + 0x138]
lea rcx, [rsp + 0xf0]
mov rdx, rsi
call fcn.1401681b0
add edi, r13d
add rsi, 0x10
cmp edi, r14d
jl 0x1400e9d70
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r8d, 1
mov r9, qword [rax]
mov rcx, r12
call fcn.1401c24f8
mov ecx, r15d
mov edi, 4
cmp r15d, r13d
jl 0x1400e9d20
mov r15, qword [rsp + 0x140]
mov rcx, r12
call fcn.1401be23c
mov rcx, rbp
call fcn.14005dcb0
movzx eax, word [rsp + 0x20]
mov r12, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x150
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e9ea0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov ebp, 4
mov edi, r8d
mov rbx, rcx
mov esi, edx
lea r8d, [rbp - 3]
lea rcx, str.DDS
mov edx, ebp
call fcn.1401c24f8
lea ecx, [rbp + 0x78]
mov rdx, rbx
call fcn.1400670d0
mov rdx, rbx
mov ecx, 0x1007
call fcn.1400670d0
mov rdx, rbx
mov ecx, edi
call fcn.1400670d0
mov rdx, rbx
mov ecx, esi
call fcn.1400670d0
imul esi, edi
mov eax, esi
cdq
and edx, 0xf
lea ecx, [rdx + rax]
mov rdx, rbx
sar ecx, 4
shl ecx, 3
call fcn.1400670d0
mov rdx, rbx
xor ecx, ecx
call fcn.1400670d0
lea ecx, [rbp - 3]
mov rdx, rbx
call fcn.1400670d0
mov rdx, rbx
xor ecx, ecx
call fcn.1400670d0
lea edi, [rbp + 6]
nop
mov rdx, rbx
xor ecx, ecx
call fcn.1400670d0
dec rdi
jne 0x1400e9f40
lea ecx, [rdi + 0x20]
mov rdx, rbx
call fcn.1400670d0
mov rdx, rbx
mov ecx, ebp
call fcn.1400670d0
mov rdx, rbx
mov ecx, 0x35545844
call fcn.1400670d0
mov edi, 5
mov rdx, rbx
xor ecx, ecx
call fcn.1400670d0
dec rdi
jne 0x1400e9f76
mov rdx, rbx
mov ecx, 0x1000
call fcn.1400670d0
mov rdx, rbx
xor ecx, ecx
call fcn.1400670d0
dec rbp
jne 0x1400e9f92
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400eaa00
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rcx
xor ecx, ecx
mov r15, r9
mov eax, edx
movsxd r12, r8d
movzx ebp, cx
mov edi, ecx
test edx, edx
jle 0x1400eab59
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x30], rsi
mov qword [r11 - 0x38], r13
mov r13, qword [rsp + 0x90]
mov ebx, ecx
test bp, bp
jne 0x1400eaae6
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x1400eab52
movzx eax, byte [rsp + 0x20]
test al, al
jns 0x1400eab08
mov rcx, qword [r14]
and al, 0x7f
movzx esi, al
call fcn.1401c3f28
mov r14d, eax
test si, si
je 0x1400eaad7
mov eax, 0xffff
nop word [rax + rax]
mov byte [rbx + r15], r14b
inc rbx
cmp rbx, r12
jl 0x1400eaad2
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r13
or edx, r8d
call fcn.1400615b0
movzx ebp, ax
test ax, ax
jne 0x1400eaad7
inc edi
mov eax, 0xffff
xor ebx, ebx
add si, ax
jne 0x1400eaaa0
mov r14, qword [rsp + 0x70]
cmp edi, dword [rsp + 0x78]
jl 0x1400eaa47
movzx eax, bp
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
movzx esi, al
test al, al
je 0x1400eaadc
nop
mov rcx, qword [r14]
call fcn.1401c3f28
inc rbx
mov byte [rbx + r15 - 1], al
cmp rbx, r12
jl 0x1400eab46
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r13
or edx, r8d
call fcn.1400615b0
movzx ebp, ax
test ax, ax
jne 0x1400eaadc
inc edi
xor ebx, ebx
mov eax, 0xffff
add si, ax
jne 0x1400eab10
jmp 0x1400eaadc
mov eax, 4
jmp 0x1400eaae9
movzx eax, bp
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x1400ebac0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
movsxd r10, r8d
mov r9d, ebx
test r8d, r8d
jle 0x1400ebaf0
nop dword [rax]
nop word [rax + rax]
mov byte [rsp + r9 + 0x40], dl
inc r9
shr edx, 8
cmp r9, r10
jl 0x1400ebae0
mov r9, qword [rcx]
lea rcx, [rsp + 0x40]
mov r8d, 1
mov rdx, r10
call fcn.1401c24f8
cmp rax, 1
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov r8d, 4
jmp 0x1400ebac0

Function at 0x1400ebb20
Capabilities:
Write file on windows

Disassembly:
mov r8d, 3
jmp 0x1400ebac0

Function at 0x1400ebb30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
movsxd r10, r8d
mov r9d, ebx
test r8d, r8d
jle 0x1400ebaf0
nop dword [rax]
nop word [rax + rax]
mov byte [rsp + r9 + 0x40], dl
inc r9
shr edx, 8
cmp r9, r10
jl 0x1400ebae0
mov r9, qword [rcx]
lea rcx, [rsp + 0x40]
mov r8d, 1
mov rdx, r10
call fcn.1401c24f8
cmp rax, 1
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov r8d, 4
jmp 0x1400ebac0
Function at 0x1400ebb40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [r8 + 8]
mov r9, qword [rcx]
mov rax, rdx
mov edx, 4
mov rsi, r8
mov rdi, rcx
lea r8d, [rdx - 3]
mov rcx, rax
mov byte [rsp + 0x30], 0
and ebx, 1
call fcn.1401c24f8
cmp rax, 1
jne 0x1400ebbd4
mov edx, dword [rsi + 8]
mov rcx, rdi
call fcn.1400ebb30
test eax, eax
je 0x1400ebbd4
mov r9, qword [rdi]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi]
mov r8d, 1
call fcn.1401c24f8
cmp rax, 1
jne 0x1400ebbd4
mov r9, qword [rdi]
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov edx, ebx
call fcn.1401c24f8
cmp rax, rbx
jne 0x1400ebbd4
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400ee940
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 0xd
mov rdi, r8
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 0xc]
call fcn.1401c1e14
cmp rax, 1
jne 0x1400eeab5
cmp byte [rsp + 0x20], 0x50
jne 0x1400eeab5
cmp byte [rsp + 0x21], 0x52
jne 0x1400eeab5
cmp byte [rsp + 0x22], 0x46
jne 0x1400eeab5
cmp byte [rsp + 0x23], 0x31
jne 0x1400eeab5
movzx eax, byte [rsp + 0x25]
movzx ecx, byte [rsp + 0x24]
movzx edx, byte [rsp + 0x28]
shl ecx, 8
shl edx, 8
or ecx, eax
movzx eax, byte [rsp + 0x26]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x27]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x29]
or edx, eax
movzx eax, byte [rsp + 0x2a]
mov dword [rdi], ecx
shl edx, 8
or edx, eax
movzx eax, byte [rsp + 0x2b]
shl edx, 8
or edx, eax
movzx eax, byte [rsp + 0x2c]
mov r8d, eax
shr eax, 5
mov dword [rdi + 4], edx
and r8d, 0x1f
inc eax
inc r8d
mov dword [rdi + 0xc], eax
mov dword [rdi + 8], r8d
test ecx, ecx
jle 0x1400eeab5
test edx, edx
jle 0x1400eeab5
cmp r8d, 8
jle 0x1400eea63
movups xmm0, xmmword [str.PRF:_pixel_size_incompatible_]
movups xmmword [rbx + 0x74], xmm0
movsd xmm1, qword [0x140220f60]
movsd qword [rbx + 0x84], xmm1
mov eax, dword [0x140220f68]
mov dword [rbx + 0x8c], eax
movzx eax, word [0x140220f6c]
mov word [rbx + 0x90], ax
mov eax, 9
jmp 0x1400eeaba
cmp eax, 3
je 0x1400eeab1
movups xmm0, xmmword [str.PRF:_plane_count_incompatible_]
movups xmmword [rbx + 0x74], xmm0
movsd xmm1, qword [0x140220f80]
movsd qword [rbx + 0x84], xmm1
mov eax, dword [0x140220f88]
mov dword [rbx + 0x8c], eax
movzx eax, word [0x140220f8c]
mov word [rbx + 0x90], ax
movzx eax, byte [0x140220f8e]
mov byte [rbx + 0x92], al
mov eax, 9
jmp 0x1400eeaba
xor eax, eax
jmp 0x1400eeaba
mov eax, 2
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1400eefe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 1
mov rdi, rcx
lea r8d, [rdx + 7]
mov rcx, rbx
call fcn.1401c1e14
test rax, rax
jne 0x1400ef019
mov eax, 4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.Willy_7
mov rcx, rbx
call fcn.1401c286c
test eax, eax
je 0x1400ef03c
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140066b20
mov dword [rbx + 8], eax
cmp eax, 0x104
je 0x1400ef053
cmp eax, 0x32
jne 0x1400ef02c
mov rcx, rdi
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0xc], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x10], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x14], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x18], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x1c], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x20], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x24], eax
call fcn.140066b20
mov dword [rbx + 0x28], eax
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret