joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e8878
Capabilities:
Contain obfuscated stackstrings
Reference http user-agent string

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x8d928]
mov eax, 0x8da10
call fcn.140013430
sub rsp, rax
mov rsi, rcx
mov dword [rsp + 0x30], 0x65746e49
lea r15, str.wininet.dll
mov dword [rsp + 0x34], 0x74656e72
mov rcx, r15
mov dword [rsp + 0x38], 0x6e65704f
mov rdi, rdx
mov word [rsp + 0x3c], 0x41
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [str.InternetOpenUrlAZwUnmapViewOfSecInternetReadFileNtMapViewOfSectiNtWaitForMultiplRtlCreateUserThr]
mov rcx, r15
movdqu xmmword [rsp + 0x40], xmm0
mov rbx, rax
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [0x1402482f0]
mov rcx, r15
movdqu xmmword [rsp + 0x58], xmm0
mov r14, rax
mov byte [rsp + 0x68], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and dword [rsp + 0x20], 0
lea rcx, str.Mozilla_5.0__Windows_NT_10__Win64__x64__rv:83.0__Gecko_20100101_Firefox_83.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r15, rax
call rbx
test rax, rax
je 0x1401e89bd
and qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rsi
mov rcx, rax
call r14
mov rbx, rax
test rax, rax
je 0x1401e89bd
mov esi, 0x8d9a0
lea rcx, [rsp + 0x70]
mov r8d, esi
xor edx, edx
call fcn.1401b05c0
lea r9, [rbp + 0x8d940]
mov r8d, esi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call r15
test eax, eax
je 0x1401e89bd
mov r8d, esi
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1401aff00
lea r11, [rsp + 0x8da10]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140002200
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, str.WMIC_PATH_WIN32_NETWORKADAPTER_WHERE_PHYSICALADAPTERTRUE_CALL_DISABLE__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.WMIC_PATH_WIN32_NETWORKADAPTER_WHERE_PHYSICALADAPTERTRUE_CALL_ENABLE__nul_2_1
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
Function at 0x14000499c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400049e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400049e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400049e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400049e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400049e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400049e8
xor al, al
add rsp, 0x28
ret
Function at 0x180002ce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
lea ebp, [rcx - 4]
mov rsi, r8
mov r14, rdx
mov edi, ecx
cmp ecx, ebp
jbe 0x180002d67
mov ebx, dword [rsp + 0x50]
mov eax, edi
sub eax, 0x8a
je 0x180002d46
sub eax, 1
je 0x180002d2d
sub eax, 3
je 0x180002d7f
cmp eax, 1
jne 0x180002d61
mov qword [0x1800bd620], rsi
mov qword [rsi + 0x88], r14
jmp 0x180002d61
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x43]
call fcn.180032360
mov ebx, eax
cmp eax, 2
jb 0x180002dad
add ebx, 0xfffffffe
jmp 0x180002d61
test ebx, ebx
je 0x180002d61
nop word [rax + rax]
mov edx, 0x10
xor ecx, ecx
call fcn.180055b70
add ebx, 0xffffffff
jne 0x180002d50
dec edi
cmp edi, ebp
ja 0x180002d05
movzx eax, byte [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
xor eax, eax
lea r8, [0x180066300]
mov qword [rsp + 0x28], rax
mov r9, rsi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [0x1800bd608], rax
setne al
jmp 0x180002d6c
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea r8, str.Erroneous_JPEG_marker_length
lea rdx, [0x1800a9f88]
call fcn.1800010e0
mov ecx, 1
call fcn.180076a04
int3
Function at 0x180003320
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
lea eax, [r8 - 6]
mov r12, rdx
mov dword [rsp + 0xc0], eax
mov rdx, rcx
cmp r8d, eax
jbe 0x18000357f
lea ebp, [r8 - 0x6f]
mov ecx, eax
mov dword [rsp + 0xc8], ebp
lea r8, [0x180000000]
mov rbx, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xc8]
mov r15, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rbx
nop dword [rax]
cmp ebp, 7
ja case.default.0x1800033a0
mov ecx, dword [r8 + rbp*4 + 0x35a4]
add rcx, r8
jmp rcx
mov rdi, qword [rsp + 0x48]
mov rax, qword [r12]
cmp dword [rdi + 0x30], 0
mov r14, qword [rdi + 0x18]
mov r15, qword [rax + 0x10]
je 0x180003402
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov edx, 0xee
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.180058ca0
mov rdx, qword [rsp + 0xb0]
lea r8, [0x180000000]
mov ecx, dword [rsp + 0xc0]
dec ebp
mov dword [rsp + 0xc8], ebp
lea eax, [rbp + 0x6f]
cmp eax, ecx
ja 0x180003390
jmp case.0x1800033a0.0
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rax
lea ecx, [r9 + 0x75]
mov qword [rsp + 0x20], 0
call fcn.180050dc0
jmp 0x1800033d7
mov rax, qword [r12]
mov r13d, dword [rax + 0x8c]
test r13d, r13d
je 0x18000350c
mov rbx, qword [rsp + 0x48]
mov ebp, 0x8b
cmp ebp, 0x8b
je 0x180003495
cmp ebp, 0x116
jne 0x1800034e4
mov edi, dword [rbx + 0x44]
test edi, edi
je 0x1800034e4
nop dword [rax]
movsx ecx, byte [rsi]
mov rdx, r14
call fcn.180078050
inc rsi
add edi, 0xffffffff
jne 0x180003480
jmp 0x1800034e4
test r15, r15
je 0x1800034c0
mov rax, qword [r12]
mov ecx, dword [rax + 0x8c]
sub ecx, r13d
mov dword [r15 + 8], ecx
mov rax, qword [r12]
mov ecx, dword [rax + 0x8c]
mov dword [r15 + 0xc], ecx
mov rcx, qword [r12]
call qword [r15]
mov rcx, qword [r12]
lea r8d, [r13 - 1]
mov rdx, qword [rbx + 0x38]
mov r9d, 1
mov dword [rsp + 0x20], 0
mov rax, qword [rcx + 8]
call qword [rax + 0x38]
mov rsi, qword [rax]
add ebp, 0x8b
cmp ebp, 0x1a1
jb 0x180003466
add r13d, 0xffffffff
jne 0x180003461
mov rbx, qword [rsp + 0x40]
mov ebp, dword [rsp + 0xc8]
test r15, r15
je 0x180003515
inc dword [r15 + 0x18]
mov rcx, r14
call fcn.1800775fc
jmp 0x1800033d7
mov r9, qword [0x1800bd648]
mov edx, 1
mov r8d, edx
mov rcx, r12
call fcn.18007c8f8
mov rbx, rax
mov qword [rsp + 0x40], rax
jmp 0x1800033d7
mov rcx, r14
call fcn.180076ef4
test eax, eax
je 0x1800033d7
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x25
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax]
jmp 0x1800033d7
mov rax, qword [rdx]
mov qword [rsp + 0x48], rax
jmp case.0x1800033a0.2
mov rbx, qword [rsp + 0xc8]
mov rax, rbx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800053c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r12d, [r8 + 0x23a]
mov r13, r9
mov ebx, r8d
cmp r8d, r12d
jae 0x1800054f1
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x20]
mov r15d, dword [rsp + 0x80]
cmp ebx, 0x111
ja 0x1800054ca
je 0x180005517
mov eax, ebx
sub eax, 0x5b
je 0x1800054aa
sub eax, 0x5d
je 0x180005484
cmp eax, 2
jne 0x1800054e5
mov edi, dword [r13]
test edi, edi
jle 0x1800054e5
nop dword [rax + rax]
mov rax, qword [rsi]
mov r8, rbp
mov rdx, qword [rax]
add rax, 8
mov qword [rsi], rax
mov rax, qword [r14]
mov rcx, qword [rax]
add rax, 8
mov qword [r14], rax
call fcn.180073920
dec edi
test edi, edi
jg 0x180005450
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
jmp 0x1800054e5
mov r8, qword [rsi + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x78]
mov r15d, eax
mov rcx, qword [rsp + 0x70]
jmp 0x1800054e5
mov rax, qword [rsp + 0xa0]
mov ebp, dword [rax]
movsxd rax, dword [rcx]
shl rax, 3
add qword [rsi], rax
movsxd rax, dword [rdx]
shl rax, 3
add qword [r14], rax
jmp 0x1800054e5
mov eax, ebx
sub eax, 0x117
je 0x1800054dc
cmp eax, 0x59
jne 0x1800054e5
xor eax, eax
jmp 0x1800054f6
cmp r15d, 0xb7
je 0x18000550e
add ebx, 0x5f
cmp ebx, r12d
jb 0x180005411
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea rdx, str._s:__s:__s:_UTPS_PBSrv_GetSize____returned__li__d__d
call fcn.1800010e0
mov ecx, 1
call fcn.180076a04
int3
Function at 0x180006c60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x50]
lea r15d, [rcx + 0x582]
mov r14, rdx
mov edi, ecx
cmp ecx, r15d
jae 0x180006d89
mov rbp, qword [rsp + 0x60]
xor r12d, r12d
mov rsi, qword [rsp + 0x60]
nop dword [rax]
cmp edi, 0x163
ja 0x180006d48
je 0x180006d38
mov eax, edi
sub eax, 0x51
je 0x180006d29
sub eax, 0x30
je 0x180006d77
sub eax, 0x55
je 0x180006d0c
sub eax, 8
je 0x180006cda
cmp eax, 0x30
je 0x180006d89
jmp 0x180006d7a
mov r9, qword [0x1800bd648]
mov edx, 1
mov rcx, rbp
lea r8d, [rdx + 0xb]
call fcn.18007c8f8
mov ecx, dword [rbp + 8]
call fcn.18007c49c
mov edx, 0x8b
mov dword [rbp + 8], eax
mov rcx, rbp
call fcn.180052060
jmp 0x180006d7a
mov rax, qword [r14]
mov rsi, qword [rax + 0x280]
mov qword [rax + 0x130], r12
mov rax, qword [r14]
mov dword [rax + 0xac], r12d
jmp 0x180006d7a
mov ecx, reloc.oledlg.dll_OleUIChangeSourceA
call fcn.180081e7c
mov rbp, rax
jmp 0x180006d7a
mov rax, qword [r14]
mov dword [rax + 0x254], r12d
mov dword [rsi + 0x18], r12d
jmp 0x180006d7a
mov eax, edi
sub eax, 0x16b
je 0x180006d77
sub eax, 0x85
je 0x180006d71
sub eax, 8
je 0x180006d89
cmp eax, 0x85
jne 0x180006d7a
mov dword [rsi + 0x24], r12d
mov qword [rsi + 0xf8], r12
jmp 0x180006d7a
mov dword [rsi + 0x1c], r12d
jmp 0x180006d7a
mov ebx, r12d
add edi, 0x8d
cmp edi, r15d
jb 0x180006ca0
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800173c0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
push r12
sub rsp, 0x68
lea r12d, [rdx + 3]
mov eax, edx
mov dword [rsp + 0x98], r12d
mov rdi, rcx
cmp edx, r12d
jae 0x180017650
mov qword [r11 - 0x18], rbx
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
sub eax, 0x92
je 0x1800175ca
sub eax, 1
je 0x1800175a1
cmp eax, 2
jne 0x180017619
mov rcx, qword [rdi]
mov edx, 1
movsxd r15, dword [rcx + 0x174]
mov eax, dword [rcx + 0x4c]
mov r9, qword [rcx + 8]
mov rbx, qword [rcx + 0x1f8]
imul eax, r15d
lea eax, [rax + rax*4]
movsxd r8, eax
shl r8, 3
call qword [r9]
mov rcx, qword [rdi]
mov r14, rax
mov dword [rsp + 0x90], 0
cmp dword [rcx + 0x4c], 0
mov rax, qword [rcx + 0x58]
jle 0x180017619
lea r13, [rax + 8]
lea r12, [rbx + 0x10]
nop word [rax + rax]
mov esi, 0xaa
cmp esi, 0xaa
je 0x1800174be
cmp esi, 0x490c
je 0x1800174b1
cmp esi, 0x916e
jne 0x180017561
lea eax, [r15 + r15*4]
movsxd rcx, eax
lea r14, [r14 + rcx*8]
jmp 0x180017561
lea rax, [r14 + r15*8]
mov qword [r12], rax
jmp 0x180017561
mov rcx, qword [rdi]
lea ebx, [r15 + r15*2]
mov eax, dword [r13 + 0x14]
mov r9d, ebx
imul eax, dword [rcx + 0x170]
mov r10, qword [rcx + 8]
shl eax, 3
cdq
idiv dword [r13]
mov edx, 1
mov r8d, eax
call qword [r10 + 0x10]
movsxd r8, ebx
lea rcx, [r14 + r15*8]
shl r8, 3
mov rdx, rax
mov rdi, rax
call fcn.180073920
test r15d, r15d
jle 0x180017559
mov r9, rdi
mov rdx, r15
shl rdx, 4
mov r8, r15
shl r8, 5
sub r9, rdx
mov r10, r15
sub r9, r14
neg r10
sub rdi, r8
shl r10, 5
mov rdx, r15
sub rdi, r14
lea rcx, [r8 + r14]
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9 + rcx]
mov qword [r10 + rcx], rax
mov rax, qword [rdi + rcx]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x180017540
mov rdi, qword [rsp + 0x80]
add esi, 0x4862
cmp esi, 0xd926
jbe 0x180017485
mov edx, dword [rsp + 0x90]
add r12, 8
mov rax, qword [rdi]
inc edx
add r13, 0x60
mov dword [rsp + 0x90], edx
cmp edx, dword [rax + 0x4c]
jl 0x180017480
mov r12d, dword [rsp + 0x98]
jmp 0x180017619
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x28]
call fcn.180076ef4
test eax, eax
je 0x180017619
mov rax, qword [rdi]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x25
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax]
jmp 0x180017619
mov rax, qword [rdi]
mov ebx, 0x1000
mov rsi, qword [rax + 0x28]
mov qword [rsp + 0x20], rsi
sub rbx, qword [rsi + 8]
je 0x180017610
mov r9, qword [rsi + 0x28]
mov r8, rbx
mov rcx, qword [rsi + 0x30]
mov edx, 1
call fcn.18007be3c
cmp rax, rbx
je 0x180017610
mov rax, qword [rdi]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x25
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rsi + 0x28]
call fcn.1800775fc
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp eax, r12d
jb 0x180017404
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
pop r12
pop rdi
ret
Function at 0x1800185d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rsp + 0x60]
lea r15, [0x180000000]
mov r14, qword [rsp + 0x60]
mov rsi, rdx
mov ebp, 7
nop dword [rax]
cmp ebp, 7
ja case.0x180018616.2
mov eax, ebp
mov ecx, dword [r15 + rax*4 + 0x1870c]
add rcx, r15
jmp rcx
xor edx, edx
mov r8d, 0x119
mov rcx, rsi
call fcn.180054bd0
mov byte [rsp + 0x50], al
jmp case.0x180018616.2
mov rax, qword [rdi + 0x40]
mov qword [rdi], rax
jmp case.0x180018616.2
mov qword [rdi + 8], r14
mov dword [rdi + 0x48], 0
mov dword [rsp + 0x50], 1
jmp case.0x180018616.2
mov rax, qword [rsi]
mov edx, 1
mov r8d, 0x1000
mov rdi, qword [rax + 0x28]
mov r9, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x40]
call fcn.18007c8f8
mov r14, rax
test rax, rax
jne case.0x180018616.2
mov ebx, 0x23
mov ecx, ebx
sub ecx, 0x21
je 0x1800186db
sub ecx, 1
je 0x1800186af
cmp ecx, 1
jne 0x1800186e1
cmp dword [rdi + 0x48], 0
je 0x1800186e1
mov rax, qword [rsi]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x2a
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax]
jmp 0x1800186e1
mov rax, qword [rsi]
mov edx, 0xffffffff
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x78
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + OleUIPromptUserA]
mov rax, qword [rdi + 0x40]
mov byte [rax], 0xff
mov rax, qword [rdi + 0x40]
mov byte [rax + 1], 0xd9
jmp 0x1800186e1
mov r14d, 2
dec ebx
cmp ebx, 0x20
ja 0x180018681
dec ebp
lea eax, [rbp + 0xf]
cmp eax, 0x10
ja 0x180018600
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180022f00
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
push r14
sub rsp, 0x30
mov ebx, dword [rsp + 0x50]
mov rsi, r8
xor r14d, r14d
mov edi, 0x75
cmp edi, 0x52
je 0x180022f8a
cmp edi, 0x75
je 0x180022f76
cmp edi, 0x35d0
je 0x180022f48
cmp edi, 0x6b4e
je 0x18002300e
jmp 0x180022ffc
mov rax, qword [rsi]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r14
mov r9d, 0xbb
xor edx, edx
mov qword [rsp + 0x58], rax
xor ecx, ecx
mov qword [rsp + 0x20], r14
call fcn.180047350
mov rbx, rax
jmp 0x180022ffc
mov rax, qword [rsi]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.180013570
jmp 0x180022ffc
mov rcx, qword [rsi]
mov eax, dword [rcx + 0x24]
cmp eax, 0xcf
je 0x180022fbc
cmp eax, 0xcc
je 0x180022fbc
mov rax, qword [rcx]
mov dword [rax + 0x28], 0x14
mov rax, qword [rsi]
mov rcx, qword [rax]
mov eax, dword [rax + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax]
mov ecx, dword [r14]
test ecx, ecx
jg 0x180022fcf
mov dword [r14], 1
mov ecx, 1
mov rdx, qword [rsi]
mov r8d, ecx
mov rax, qword [rdx + 0x278]
cmp dword [rax + 0x24], r14d
je 0x180022ff5
mov eax, dword [rdx + 0xac]
cmp ecx, eax
jle 0x180022ff5
mov dword [r14], eax
mov r8d, eax
mov rdx, qword [rsi]
mov dword [rdx + 0xb4], r8d
add edi, 0x4c53
cmp edi, 0x1314c
jbe 0x180022f25
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180023020
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
imul r12d, edx, 0x238
mov r13, r8
mov r15d, edx
mov rdi, rcx
mov ebx, edx
cmp edx, r12d
ja 0x180023137
mov rbp, qword [rsp + 0x68]
lea rcx, str.Bogus_message_code__d
mov rsi, qword [rsp + 0x68]
lea rdx, [0x180047fe0]
mov r14, qword [rsp + 0x68]
lea r8, [0x180024210]
lea r9, [0x180049820]
lea r10, [0x18004b4b0]
lea r11, [0x180031f60]
xor eax, eax
cmp ebx, 0x5418
ja 0x180023159
je 0x1800230fd
cmp ebx, 0x83
je 0x1800230ec
cmp ebx, 0x12b
je 0x1800230db
cmp ebx, 0x24d8
je 0x1800230d5
cmp ebx, 0x492d
jne 0x180023128
mov qword [rdi + 0x7c], rax
mov dword [rdi + 0x28], eax
mov qword [rdi + 0x88], rcx
jmp 0x180023128
mov qword [rdi + 0x20], rdx
jmp 0x180023128
mov rbp, qword [r13]
mov rax, qword [rbp + 0x20]
mov r14, qword [rbp + 0x30]
mov rsi, qword [rax]
jmp 0x180023128
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
mov qword [rdi + 0x18], r11
jmp 0x180023128
mov rax, qword [rdi]
mov ecx, dword [rax + 0x88]
test ecx, ecx
je 0x180023121
nop word [rax + rax]
movzx eax, byte [rsi]
inc rsi
mov byte [r14], al
inc r14
add ecx, 0xffffffff
jne 0x180023110
lea rcx, str.Bogus_message_code__d
imul eax, r15d, 0x47
add ebx, eax
cmp ebx, r12d
jbe 0x180023095
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp ebx, 0x6d82
je 0x1800231af
cmp ebx, 0x91d7
je 0x1800231d0
cmp ebx, 0xa705
jne 0x180023128
mov r8d, dword [rbp + 0x38]
mov edx, 1
mov r9, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
call fcn.18007be3c
lea rdx, [0x180047fe0]
lea r8, [0x180024210]
lea r9, [0x180049820]
lea r10, [0x18004b4b0]
lea r11, [0x180031f60]
jmp 0x180023121
mov dword [rdi + 0x90], 0x7b
mov qword [rdi + 0x98], rax
mov qword [rdi + 0xa0], 0
jmp 0x180023128
mov rax, rdi
jmp 0x18002313c
Function at 0x180032360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x70]
lea r15d, [r8 - 7]
mov r12, rdx
mov rdx, rcx
cmp r8d, r15d
jbe case.0x1800323c5.6
mov r13, qword [rsp + 0x78]
lea r14d, [r8 - 0x3a]
mov rbp, qword [rsp + 0x78]
lea r8, [0x180000000]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x78]
nop
cmp r14d, 9
ja case.0x1800323c5.3
mov ecx, dword [r8 + r14*4 + 0x32598]
add rcx, r8
jmp rcx
mov rcx, qword [0x1800bd5f0]
call fcn.18007b4a0
mov dword [rsp + 0x70], eax
cmp eax, 0xffffffff
je 0x18003256b
mov rcx, qword [0x1800bd5f0]
call fcn.18007b4a0
mov rdx, qword [rsp + 0x60]
lea r8, [0x180000000]
mov dword [rsp + 0x78], eax
jmp case.0x1800323c5.3
mov r9, qword [r13 + 0x18]
mov edx, 1
mov r8, qword [r13 + 0x40]
mov rcx, qword [r13 + 0x30]
mov rbp, qword [r13 + 0x48]
call fcn.18007c8f8
cmp rax, qword [r13 + 0x40]
je 0x180032435
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x2b
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax]
mov rax, qword [r13 + 0x20]
lea r8, [0x180000000]
mov rdi, qword [r13 + 0x30]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rax]
jmp case.0x1800323c5.3
mov ebx, dword [rsp + 0x70]
shl ebx, 8
add ebx, dword [rsp + 0x78]
jmp case.0x1800323c5.3
cmp dword [rsp + 0x78], 0xffffffff
je 0x180032540
jmp case.0x1800323c5.3
mov r13, qword [rdx]
dec r14d
lea eax, [r14 + 0x3a]
cmp eax, r15d
ja 0x1800323b0
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r12]
mov r9d, dword [rax + 0x30]
test r9d, r9d
je 0x180032536
mov edx, dword [rsp + 0x70]
nop word [rax + rax]
mov r8d, 0xa2
mov eax, r8d
sub eax, 0x9e
je 0x180032514
sub eax, 1
je 0x180032507
sub eax, 1
je 0x1800324e6
sub eax, 1
je 0x180032514
cmp eax, 1
jne 0x180032520
movzx eax, byte [rdi + 1]
movzx edx, byte [rdi]
shl eax, 8
or edx, eax
add rdi, 2
jmp 0x180032520
movzx eax, byte [rdi + 1]
movzx ecx, byte [rdi]
shl rax, 8
or rax, rcx
movzx eax, byte [rax + rbp]
mov byte [rsi], al
inc rsi
movzx edx, byte [rdi + 2]
add rdi, 3
jmp 0x180032520
movzx eax, byte [rdi]
shl eax, 8
or edx, eax
inc rdi
jmp 0x180032520
movsxd rax, edx
movzx ecx, byte [rax + rbp]
mov byte [rsi], cl
inc rsi
dec r8d
cmp r8d, 0x9d
ja 0x1800324b6
add r9d, 0xffffffff
jne 0x1800324b0
mov eax, 1
jmp 0x18003247d
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea r8, str.Forenede_Arabiske_Emirater
lea rdx, [0x1800a9f88]
call fcn.1800010e0
mov ecx, 1
call fcn.180076a04
int3
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea r8, str.Premature_EOF_in_JPEG_file
lea rdx, [0x1800a9f88]
call fcn.1800010e0
mov ecx, 1
call fcn.180076a04
int3
Function at 0x180038df0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r12d, [r8 - 7]
mov r13d, r8d
mov r14, rdx
mov rsi, rcx
cmp r8d, r12d
jbe case.0x180038e3f.0
lea r15d, [r8 - 0x3e]
lea rdx, [0x180000000]
cmp r15d, 0x10
ja case.0x180038e3f.3
mov ecx, dword [rdx + r15*4 + 0x38f5c]
add rcx, rdx
jmp rcx
mov byte [rsp + 0x80], 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne case.0x180038e3f.3
mov byte [rsp + 0x80], 0
jmp case.0x180038e3f.3
mov rcx, qword [0x1800bd680]
call fcn.18007b4a0
cmp eax, 0xffffffff
je 0x180038f31
mov dword [rsp + 0x24], eax
jmp case.0x180038e3f.3
cmp byte [rsp + 0x80], 0
je 0x180038ea2
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_TlsFree]
movzx eax, byte [0x1800bd6e1]
mov byte [rsp + 0x24], al
jmp case.0x180038e3f.3
movsx ebx, byte [rsi]
xor ebp, ebp
test ebx, ebx
je 0x180038eef
nop dword [rax + rax]
movsx edi, byte [r14]
inc rsi
inc r14
test edi, edi
je 0x180038f26
mov ecx, ebx
call fcn.180076e10
test eax, eax
je 0x180038ee2
mov ecx, ebx
call fcn.180077eec
mov ebx, eax
cmp ebx, edi
jne 0x180038f26
movsx ebx, byte [rsi]
inc ebp
test ebx, ebx
jne 0x180038ec0
mov rax, qword [rsp + 0x88]
inc rsi
cmp ebp, dword [rax]
jl 0x180038f26
dec r13d
dec r15d
cmp r13d, r12d
ja 0x180038e23
mov eax, dword [rsp + 0x24]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x180038f11
mov eax, 1
jmp 0x180038f11
mov ecx, 2
call fcn.18007711c
mov rcx, rax
lea r8, str.Premature_EOF_in_JPEG_file
lea rdx, [0x1800a9f88]
call fcn.1800010e0
mov ecx, 1
call fcn.180076a04
int3