joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180096330
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, qword [0x1800cd020]
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x18009636e
mov rsi, rcx
mov rcx, qword [rdi + 0x18]
lea rdx, [rcx + rax*8]
lea rbx, [rcx + 8]
lea r8, [rax*8]
cmp qword [rbx - 8], rsi
je 0x180096376
add rbx, 8
add r8, 0xfffffffffffffff8
jne 0x18009635e
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
cmp rbx, rdx
jae 0x1800963b9
mov rax, qword [rbx]
mov qword [rbx], 0
mov qword [rbx - 8], rax
test rsi, rsi
je 0x18009639e
mov rcx, rsi
call fcn.18001c930
mov rcx, rsi
call sym.mozglue.dll__aligned_free
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x20]
lea rdx, [rcx + rax*8]
add rbx, 8
cmp rbx, rdx
jae 0x1800963b9
mov rsi, qword [rbx - 8]
jmp 0x18009637b
lea rdx, [rax - 1]
mov qword [rdi + 0x20], rdx
mov rsi, qword [rcx + rax*8 - 8]
mov qword [rcx + rax*8 - 8], 0
test rsi, rsi
je 0x18009636e
mov rcx, rsi
call fcn.18001c930
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x180097050
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
test rdx, rdx
jne 0x180097060
add rsp, 0x20
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call fcn.18007d4c0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x18009b750
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
xor esi, esi
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18009b7e3
mov rdi, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
lea r8, str.AppsUseLightTheme
mov rcx, rdi
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
or eax, dword [rsi]
sete sil
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180062020
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x18009bde0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x54], 0
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x18009be1f
mov rdx, qword [rbx]
lea r12, [rsp + 0x54]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov rcx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18009be6f
mov byte [rsi + 0x18], 1
mov dword [rsi], 7
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062020
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r15d, dword [rsp + 0x54]
test r15b, 0xf
je 0x18009be86
mov byte [rsi + 0x18], 1
mov dword [rsi], 0xd
jmp 0x18009be4f
add r15, r15
mov rcx, r15
call sym.mozglue.dll_malloc
test rax, rax
je 0x18009bef2
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
cmp qword [rbx + 0x18], 8
jb 0x18009beb0
mov rbx, qword [rbx]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 8
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x18009bf01
mov byte [rsi + 0x18], 1
mov dword [rsi], 7
mov rcx, rdi
call sym.mozglue.dll__aligned_free
jmp 0x18009be4f
mov byte [rsi + 0x18], 1
mov dword [rsi], 3
jmp 0x18009be4f
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], 0x10
mov eax, dword [rsp + 0x54]
cmp eax, 0x10
jae 0x18009bf2c
movups xmmword [rsi + 8], xmm0
mov byte [rsi + 0x18], 0
mov qword [rsi], 0x10
jmp 0x18009bee5
mov edx, 0x10
xor ecx, ecx
lea rbx, [rsp + 0x38]
xor r14d, r14d
mov r15, rdi
movups xmm6, xmmword [r15]
cmp rcx, qword [rsp + 0x48]
je 0x18009bf73
add r15, 0x10
shl rcx, 4
movups xmmword [rdx + rcx], xmm6
mov rcx, qword [rsp + 0x40]
inc rcx
mov qword [rsp + 0x40], rcx
inc r14
mov r8d, eax
shr r8d, 4
cmp r14, r8
jb 0x18009bf3e
jmp 0x18009bf8f
mov rcx, rbx
call fcn.18009c090
test al, al
je 0x18009bfb7
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x54]
jmp 0x18009bf49
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov byte [rsi + 0x18], 0
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
cmp rax, 0x10
je 0x18009bf23
mov qword [rsi], rax
jmp 0x18009bee5
mov byte [rsi + 0x18], 1
mov dword [rsi], 3
mov rcx, qword [rsp + 0x38]
cmp rcx, 0x10
je 0x18009bee5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18009bee5
Function at 0x18009c170
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x860
mov rsi, rcx
mov qword [rsp + 0x888], rdx
mov qword [rsp + 0x890], r8
mov qword [rsp + 0x898], r9
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x858], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x18009c20f
lea r8, [rsp + 0x888]
mov qword [rsp + 0x28], r8
lea rdi, [rsp + 0x30]
mov qword [rdi + 8], 0
lea rax, [0x1800b9a00]
mov qword [rdi], rax
lea rbx, [rsp + 0x50]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x800
mov rcx, rdi
mov rdx, rsi
call sym.mozglue.dll_public:_bool___cdecl_mozilla::PrintfTarget::vprint_char_const____ptr64__char____ptr64____ptr64
mov rax, qword [rdi + 8]
mov ecx, 0x7ff
cmp rax, rcx
cmovb rcx, rax
mov byte [rsp + rcx + 0x50], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
cmp eax, 0xfffffffe
je 0x18009c279
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
lea rdx, [0x1800bbef6]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
test rax, rax
je 0x18009c279
mov rdi, rax
lea rbx, [rsp + 0x888]
mov qword [rsp + 0x50], rbx
call fcn.180004180
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x860
pop rbx
pop rdi
pop rsi
ret
Function at 0x18009ccb0
Capabilities:
Get system information on windows
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r15, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov r13d, dword [rsp + 0x90]
lea eax, [r13*2]
cdqe
shl rax, 3
test r13d, r13d
mov r12, 0xffffffffffffffff
cmovns r12, rax
mov rcx, r12
call sym.mozglue.dll_moz_xmalloc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
test r13d, r13d
jle 0x18009cd27
mov eax, r13d
shl rax, 4
xor ecx, ecx
movups xmm0, xmmword [r15 + rcx]
movups xmmword [rdi + rcx], xmm0
add rcx, 0x10
cmp rax, rcx
jne 0x18009cd15
shl r13d, 4
cmp qword [rbx + 0x18], 8
jb 0x18009cd35
mov rbx, qword [rbx]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x18009cd7a
mov dword [rsi], 7
xor eax, eax
mov byte [rsi + 5], al
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sym.mozglue.dll__aligned_free
mov al, 1
jmp 0x18009cd60

Function at 0x18009cd80
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x1800cd1f0], 0
je 0x18009cdbe
lea rcx, str.MOZ_SKELETON_UI_RESTARTING
lea rdx, [0x1800bfeda]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [0x1800cb0f0]
mov dil, 1
cmp rcx, 0xffffffffffffffff
je 0x18009cdc6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18009cdc6
mov dword [rsi], 1
xor edi, edi
mov byte [rsi + 5], dil
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x18009e1c0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1800cd4ac]
mov ecx, dword [0x1800cb4e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18009e1f0
mov al, byte [0x1800cd4a8]
add rsp, 0x28
ret
lea rcx, [0x1800cd4ac]
call fcn.180060ac0
cmp dword [0x1800cd4ac], 0xffffffff
jne 0x18009e1e5
lea rcx, str.MOZ_DISABLE_WALKTHESTACK
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18009e231
cmp byte [rax], 0
sete al
mov byte [0x1800cd4a8], al
lea rcx, [0x1800cd4ac]
call fcn.180060b40
jmp 0x18009e1e5
mov al, 1
jmp 0x18009e21d
Function at 0x18009eea0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x18009ef3a
mov ebp, eax
inc eax
movsxd r15, eax
mov rcx, r15
call sym.mozglue.dll_moz_xmalloc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, edi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x18009ef53
cdqe
mov byte [r14 + rax], 0
mov qword [rsi], r14
jmp 0x18009ef41
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsi], 0
mov rcx, r14
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp sym.mozglue.dll__aligned_free

Function at 0x1800a2180
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x18001f6b6
mov r15, qword [r14 + 0x20]
lea rcx, [0x1800bfbb8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x18001f6b6
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.180014720
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1800a21e6
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.1800a2200
test al, al
je 0x1800a21e6
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800a21e6
mov r14, rax
mov rcx, rax
call fcn.1800a2200
test al, al
je 0x1800a21e6
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x18001f670
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1800a2bc0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x1800cd8c4]
mov ecx, dword [0x1800cb4e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800a2c63
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x1800a2c3f
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x1800cd8c0]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x1800a2c26
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1800cd8c4]
call fcn.180060ac0
cmp dword [0x1800cd8c4], 0xffffffff
jne 0x1800a2c00
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1800cd8c0], eax
lea rcx, [0x1800cd8c4]
call fcn.180060b40
jmp 0x1800a2c00

Function at 0x1800a2ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rcx + 8]
lea rbx, [r14 + 2]
call fcn.18001f6e0
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
je 0x1800a2ce3
mov rcx, rbx
call fcn.1800a2200
test al, al
je 0x1800a2d36
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.180017f10
mov rax, qword [rdi]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1800a3190
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor edi, edi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1800a32bc
mov rsi, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x1800a32b3
mov rbx, rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x20], 0x40
xor edi, edi
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1800a32d8
mov r14, rax
mov ebp, dword [rax + 0x3c]
lea r15, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, ebp
xor edx, edx
div dword [r15 + 0x28]
mov r15d, edx
sub ebp, edx
lea rax, [r15 + 0x108]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov edx, 4
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x1800a32a1
mov edi, dword [rax + r15 + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180062020
mov eax, edi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
jmp 0x1800a32b3
Function at 0x1800a32f0
Capabilities:
Get file version info

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, rdx
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1800a33b7
mov ebp, eax
mov r14d, eax
mov rcx, r14
call sym.mozglue.dll_moz_xmalloc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
xor edx, edx
mov r8d, ebp
mov r9, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1800a33d7
lea r8, [rsp + 0x28]
mov qword [r8], 0
lea rdx, [0x1800bfe38]
lea r9, [rsp + 0x34]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1800a33f7
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0xc]
shl rcx, 0x20
or rax, rcx
mov qword [rsi], rax
mov dword [rsi + 8], 0
mov rcx, rdi
call sym.mozglue.dll__aligned_free
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov qword [rsi], 0
mov dword [rsi + 8], ecx
jmp 0x1800a339e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov qword [rsi], 0
mov dword [rsi + 8], ecx
jmp 0x1800a3396
xor eax, eax
jmp 0x1800a338c

Function at 0x1800a3690
Capabilities:
Get system information on windows

Disassembly:
test rcx, rcx
jne 0x1800a3696
ret
lea rax, [0x1800cb130]
mov qword [rcx + 8], rax
jmp 0x1800a3890
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rdi, [0x1800cb118]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rsi, qword [0x1800cb120]
mov qword [0x1800cb120], 0
mov byte [0x1800cb128], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test rsi, rsi
je 0x1800a3992
mov rdi, qword [rsi]
mov rax, qword [rsi + 8]
test rax, rax
jle 0x1800a3962
lea rbx, [rax + rax*2]
shl rbx, 5
add rbx, rdi
add rdi, 0x28
mov r8, qword [rdi + 0x18]
cmp r8, 8
je 0x1800a3913
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
call sub.ntdll.dll_RtlFreeHeap
cmp qword [rdi + 8], 0
je 0x1800a3930
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
mov dword [rdi], 0
mov qword [rdi + 8], 0
cmp qword [rdi - 8], 0
je 0x1800a394f
lea rcx, [rdi - 0x10]
call sub.ntdll.dll_RtlFreeUnicodeString
mov dword [rdi - 0x10], 0
mov qword [rdi - 8], 0
lea rax, [rdi + 0x60]
add rdi, 0x38
cmp rdi, rbx
mov rdi, rax
jb 0x1800a38f1
mov rdi, qword [rsi]
cmp rdi, 0x60
je 0x1800a3983
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sub.ntdll.dll_RtlFreeHeap
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800a3890
Capabilities:
Get system information on windows

Disassembly:
test rcx, rcx
jne 0x1800a3696
ret
lea rax, [0x1800cb130]
mov qword [rcx + 8], rax
jmp 0x1800a3890
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rdi, [0x1800cb118]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rsi, qword [0x1800cb120]
mov qword [0x1800cb120], 0
mov byte [0x1800cb128], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test rsi, rsi
je 0x1800a3992
mov rdi, qword [rsi]
mov rax, qword [rsi + 8]
test rax, rax
jle 0x1800a3962
lea rbx, [rax + rax*2]
shl rbx, 5
add rbx, rdi
add rdi, 0x28
mov r8, qword [rdi + 0x18]
cmp r8, 8
je 0x1800a3913
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
call sub.ntdll.dll_RtlFreeHeap
cmp qword [rdi + 8], 0
je 0x1800a3930
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
mov dword [rdi], 0
mov qword [rdi + 8], 0
cmp qword [rdi - 8], 0
je 0x1800a394f
lea rcx, [rdi - 0x10]
call sub.ntdll.dll_RtlFreeUnicodeString
mov dword [rdi - 0x10], 0
mov qword [rdi - 8], 0
lea rax, [rdi + 0x60]
add rdi, 0x38
cmp rdi, rbx
mov rdi, rax
jb 0x1800a38f1
mov rdi, qword [rsi]
cmp rdi, 0x60
je 0x1800a3983
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sub.ntdll.dll_RtlFreeHeap
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800aaec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
cmp qword [rcx + 0x40028], 0
jne 0x1800aaef5
mov eax, dword [rsp + 0x70]
mov r10d, dword [rsp + 0x68]
mov r11d, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.180054780
nop
add rsp, 0x38
ret
add rsp, 0x38
jmp fcn.1800aaf00
Function at 0x1800b2a30
Capabilities:
Hash data using murmur3

Disassembly:
test rcx, rcx
je 0x1800b2abe
cmp rdx, 0x10
jae 0x1800b2ac5
lea eax, [rdx + 0x165667b1]
cmp rdx, 4
jb 0x1800b2a72
imul r8d, dword [rcx], 0xc2b2ae3d
add r8d, eax
rol r8d, 0x11
add rcx, 4
imul eax, r8d, 0x27d4eb2f
add rdx, 0xfffffffffffffffc
cmp rdx, 3
ja 0x1800b2a4f
test rdx, rdx
je 0x1800b2a9c
xor r8d, r8d
movzx r9d, byte [rcx + r8]
imul r9d, r9d, 0x165667b1
add r9d, eax
rol r9d, 0xb
imul eax, r9d, 0x9e3779b1
inc r8
cmp rdx, r8
jne 0x1800b2a7a
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
mov eax, 0x165667b1
jmp 0x1800b2a9c
lea rax, [rcx + rdx]
add rax, 0xfffffffffffffff1
movdqa xmm0, xmmword [0x1800b7450]
movdqa xmm1, xmmword [0x1800b7460]
movdqa xmm2, xmmword [0x1800b7470]
movdqu xmm3, xmmword [rcx]
pshufd xmm4, xmm3, 0xf5
pmuludq xmm3, xmm1
pshufd xmm3, xmm3, 0xe8
pmuludq xmm4, xmm1
pshufd xmm4, xmm4, 0xe8
punpckldq xmm3, xmm4
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrld xmm0, 0x13
pslld xmm3, 0xd
por xmm3, xmm0
pshufd xmm4, xmm3, 0xf5
pmuludq xmm3, xmm2
pshufd xmm0, xmm3, 0xe8
pmuludq xmm4, xmm2
pshufd xmm3, xmm4, 0xe8
punpckldq xmm0, xmm3
add rcx, 0x10
cmp rcx, rax
jb 0x1800b2ae5
movdqa xmm1, xmmword [0x1800b7480]
pshufd xmm2, xmm0, 0xf5
pmuludq xmm0, xmm1
pshufd xmm3, xmm0, 0xed
pshufd xmm1, xmm1, 0xf5
pmuludq xmm1, xmm2
pshufd xmm2, xmm1, 0xed
punpckldq xmm3, xmm2
pshufd xmm0, xmm0, 0xe8
pshufd xmm1, xmm1, 0xe8
punpckldq xmm0, xmm1
por xmm0, xmm3
pshufd xmm1, xmm0, 0xee
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0x55
paddd xmm0, xmm1
movd eax, xmm0
add eax, edx
and edx, 0xf
jmp 0x1800b2a49
Function at 0x140015b30
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001595c