joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14064a1b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14064a33f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14064a1e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14064a1cf
add dl, dl
jne 0x14064a1f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14064a256
xor eax, eax
add dl, dl
jne 0x14064a205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14064a30d
add dl, dl
jne 0x14064a216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064a223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064a230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064a23d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14064a24a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14064a1de
mov eax, 1
add dl, dl
jne 0x14064a266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14064a273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14064a25b
sub eax, ebx
mov ebx, 1
jne 0x14064a2ac
mov ecx, 1
add dl, dl
jne 0x14064a28e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14064a29b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14064a283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064a1de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14064a2c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14064a2d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14064a2bd
cmp eax, 0x7d00
jae 0x14064a2fb
cmp eax, 0x500
jb 0x14064a2f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064a1de
cmp eax, 0x7f
ja 0x14064a2fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064a1de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14064a332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14064a1de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180007d60
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.18004c640
test al, al
je 0x180007dec
test rdi, rdi
mov r8d, 1
cmovne r8, rdi
cmp rsi, 9
mov edx, 8
cmovae rdx, rsi
cmp r8, 0x1f1
jb 0x180007daa
mov rcx, qword [0x1800a66c8]
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.180007e00
mov eax, dword [0x1800a64f4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x180007d9f
mov rcx, qword [0x1800a66c8]
mov eax, dword [0x1800a64f4]
mov rdi, qword gs:[0x58]
mov rax, qword [rdi + rax*8]
mov qword [rax + 8], rcx
jmp 0x180007d9f
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x180007e00
Capabilities:
Encode data using base64

Disassembly:
mov r11, rdx
lea rax, [rdx + r8]
dec rax
neg rdx
and rdx, rax
cmp rdx, r8
jb 0x180007e6f
cmp rdx, 0x1001
jae 0x180007e2f
cmp rdx, 0xf00
ja 0x180007e41
xor r8d, r8d
jmp fcn.18002fdb0
cmp r11, 0x1000
ja 0x180007e49
cmp rdx, 0xfc001
jae 0x180007e49
xor r8d, r8d
jmp fcn.180037d70
mov edx, 0xfff
mov r9, 0xfffffffffffff000
lea r10, [r8 + rdx]
and r10, r9
cmp r10, r8
jb 0x180007e6f
add r11, rdx
and r11, r9
mov r9, r10
add r9, r11
jae 0x180007e72
xor eax, eax
ret
lea rax, [r11 + r11]
cmp r10, r11
cmovb r9, rax
add r9, 0xfffffffffffff000
cmp r9, 0xfc000
jbe 0x180007eaf
cmp r11, 0x100000
ja 0x180007ea1
mov r8d, 0x100000
mov rdx, r10
jmp 0x180007ea7
mov rdx, r10
mov r8, r11
xor r9d, r9d
jmp fcn.180004050
mov rdx, r11
mov r8, r10
jmp 0x1800514d0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r9
mov r15, r8
mov rsi, rdx
mov r12, rcx
lea r14, [rcx + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, r12
mov rdx, rdi
call fcn.18004ff50
test rax, rax
je 0x180051581
mov rbx, rax
mov r13, rax
and r13, 0xfffffffffff00000
lea rax, [rsi - 1]
and rax, rbx
je 0x180051585
mov rcx, rsi
sub rcx, rax
sub rdi, rcx
sub rsi, rax
je 0x180051570
mov eax, ebx
shr eax, 0xc
movzx r8d, al
mov rcx, rsi
shr rcx, 0xc
mov rdx, rsi
or rdx, 3
lea rax, [r8 + r8*2]
mov qword [r13 + rax*8 + 0x30], rdx
mov rax, rdi
or rax, 3
add rcx, r8
lea rcx, [rcx + rcx*2]
mov qword [r13 + rcx*8 + 0x30], rax
mov rcx, r12
mov rdx, rbx
xor r8d, r8d
call fcn.180027370
add rbx, rsi
cmp rdi, r15
je 0x1800515c9
mov r8, rbx
sub r8, r13
shr r8, 0xc
jmp 0x18005158e
xor ebx, ebx
jmp 0x1800515ce
mov eax, ebx
shr eax, 0xc
movzx r8d, al
mov rdx, rbx
mov rcx, r15
shr rcx, 0xc
mov rsi, r15
or rsi, 3
lea rax, [r8 + r8*2]
mov qword [r13 + rax*8 + 0x30], rsi
sub rdi, r15
or rdi, 3
add rcx, r8
lea rax, [rcx + rcx*2]
mov qword [r13 + rax*8 + 0x30], rdi
add rdx, r15
mov rcx, r12
xor r8d, r8d
call fcn.180027370
add qword [r12 + 0x58], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000a320
Capabilities:
Hash data using murmur3

Disassembly:
cmp dword [rcx + 4], 0
je 0x18000a3ca
mov eax, dword [rcx + 8]
rol eax, 1
mov edx, dword [rcx + 0xc]
rol edx, 7
add edx, eax
mov eax, dword [rcx + 0x10]
rol eax, 0xc
add eax, edx
mov r9d, dword [rcx + 0x14]
rol r9d, 0x12
add r9d, eax
add r9d, dword [rcx]
mov r8d, dword [rcx + 0x28]
add rcx, 0x18
and r8d, 0xf
cmp r8d, 4
jb 0x18000a380
imul eax, dword [rcx], 0xc2b2ae3d
add eax, r9d
rol eax, 0x11
add rcx, 4
imul r9d, eax, 0x27d4eb2f
add r8, 0xfffffffffffffffc
cmp r8, 3
ja 0x18000a35f
test r8, r8
je 0x18000a3a6
xor edx, edx
movzx eax, byte [rcx + rdx]
imul eax, eax, 0x165667b1
add eax, r9d
rol eax, 0xb
imul r9d, eax, 0x9e3779b1
inc rdx
cmp r8, rdx
jne 0x18000a387
mov eax, r9d
shr eax, 0xf
xor eax, r9d
imul eax, eax, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
mov r9d, 0x165667b1
add r9d, dword [rcx + 0x10]
jmp 0x18000a34a
Function at 0x18000b410
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rdi
push rbx
cmp rdx, 0x10
jae 0x18000b496
add r8d, 0x165667b1
mov esi, r8d
add esi, edx
and edx, 0xf
cmp rdx, 4
jb 0x18000b44d
imul eax, dword [rcx], 0xc2b2ae3d
add eax, esi
rol eax, 0x11
add rcx, 4
imul esi, eax, 0x27d4eb2f
add rdx, 0xfffffffffffffffc
cmp rdx, 3
ja 0x18000b42e
test rdx, rdx
je 0x18000b471
xor eax, eax
movzx ebx, byte [rcx + rax]
imul ebx, ebx, 0x165667b1
add ebx, esi
rol ebx, 0xb
imul esi, ebx, 0x9e3779b1
inc rax
cmp rdx, rax
jne 0x18000b454
mov eax, esi
shr eax, 0xf
xor eax, esi
imul eax, eax, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop rbx
pop rdi
pop rsi
ret
lea r9, [rcx + rdx]
add r9, 0xfffffffffffffff1
lea r10d, [r8 + 0x24234428]
lea r11d, [r8 - 0x7a143589]
lea esi, [r8 + 0x61c8864f]
imul eax, dword [rcx], 0x85ebca77
add eax, r10d
rol eax, 0xd
imul edi, dword [rcx + 4], 0x85ebca77
add edi, r11d
rol edi, 0xd
imul r10d, eax, 0x9e3779b1
imul eax, dword [rcx + 8], 0x85ebca77
add eax, r8d
rol eax, 0xd
imul ebx, dword [rcx + 0xc], 0x85ebca77
imul r11d, edi, 0x9e3779b1
add ebx, esi
rol ebx, 0xd
imul r8d, eax, 0x9e3779b1
imul esi, ebx, 0x9e3779b1
add rcx, 0x10
cmp rcx, r9
jb 0x18000b4b3
rol r10d, 1
rol r11d, 7
add r11d, r10d
rol r8d, 0xc
add r8d, r11d
rol esi, 0x12
add esi, r8d
jmp 0x18000b423
Function at 0x180010940
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x18001098d
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
mov al, 1
mov byte [rsi + 8], al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004b970
mov rax, rsi
add rsp, 0x30
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x180010974

Function at 0x180012f20
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
mov qword [rcx], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
mov byte [rcx + 0x18], 0
test rdx, rdx
je 0x180012fa1
movzx ecx, word [rdx]
cmp ecx, 0x5a4d
jne 0x180012fa1
lea r8, [rax + 8]
movsxd r9, dword [rdx + 0x3c]
lea r10, [rdx + r9]
mov qword [r8], r10
cmp dword [rdx + r9], 0x4550
jne 0x180012fa1
movzx ecx, word [r10 + 0x18]
cmp ecx, 0x20b
jne 0x180012fa1
mov r8d, dword [r10 + 0x50]
cmp r8d, 0x148
jb 0x180012fa1
lea ecx, [r8 - 1]
add rdx, rcx
mov qword [rax + 0x10], rdx
mov ecx, dword [r10 + 0x84]
cmp ecx, 0x10
mov edx, 0x10
cmovb edx, ecx
cmp edx, 2
jb 0x180012fa1
cmp dword [r10 + 0x90], r8d
setae byte [rax + 0x18]
ret

Function at 0x180013ae0
Capabilities:
Get number of processors

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x180013b55
mov rdi, rdx
mov rbx, rcx
lea rsi, [rcx + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov r14, qword [rbx + 0x10]
mov qword [rbx + 0x10], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test r14, r14
je 0x180013b55
mov rax, qword [rdi]
mov rax, qword [rax + 0x10]
mov rcx, rdi
mov rdx, r14
call qword [case.0x18004a5de.0]
mov rdi, qword [r14]
mov rax, qword [r14 + 8]
test rax, rax
jg 0x180013b60
cmp rdi, 0x60
jne 0x180013be5
mov rcx, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.mozglue.dll_galigned_free
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rsi, [rax + rax*2]
shl rsi, 5
add rsi, rdi
add rdi, 0x28
mov r8, qword [rdi + 0x18]
cmp r8, 8
je 0x180013b91
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
call sub.ntdll.dll_RtlFreeHeap
cmp qword [rdi + 8], 0
je 0x180013bae
mov rcx, rdi
call sub.ntdll.dll_RtlFreeUnicodeString
mov dword [rdi], 0
mov qword [rdi + 8], 0
cmp qword [rdi - 8], 0
je 0x180013bcd
lea rcx, [rdi - 0x10]
call sub.ntdll.dll_RtlFreeUnicodeString
mov dword [rdi - 0x10], 0
mov qword [rdi - 8], 0
lea rax, [rdi + 0x60]
add rdi, 0x38
cmp rdi, rsi
mov rdi, rax
jb 0x180013b6f
mov rdi, qword [r14]
jmp 0x180013b3a
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, rdi
call sub.ntdll.dll_RtlFreeHeap
jmp 0x180013b44
Function at 0x180014e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, dword [rcx + 0x18]
shl ebx, 7
mov edx, ebx
mov r8d, 0x80
call fcn.180014f50
test al, al
je 0x180014f0a
mov ecx, ebx
add rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov qword [r9 - 8], rdi
mov dword [r9], 0
mov qword [r9 + 8], rcx
mov qword [r9 + 0x10], rcx
mov qword [r9 + 0x18], 0
mov dword [r9 + 0x20], 0x80
mov byte [r9 + 0x24], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180014f22
mov r8, qword [rsp + 0x28]
test r8, r8
je 0x180014f2f
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x30]
mov cl, byte [rsp + 0x54]
test rdx, rdx
je 0x180014ec8
test rbx, rbx
je 0x180014ec8
test eax, eax
je 0x180014ec8
test cl, cl
je 0x180014ec8
inc dword [rdi + 0x18]
mov qword [rsi], r8
mov dword [rsi + 8], eax
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbx
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x20], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsi + 0x24], eax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov byte [rsi + 0x2c], cl
mov byte [rsi + 0x30], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004b970
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x30], 0
jmp 0x180014ef2
mov dword [rsp + 0x30], 0
jmp 0x180014e93
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov cl, byte [rsp + 0x54]
jmp 0x180014ec5
Function at 0x180014f50
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 8], 0
je 0x1800150a5
mov rsi, rcx
lea ecx, [rdx + r8]
dec ecx
mov eax, dword [rsi + 0x14]
cmp ecx, eax
jb 0x18001501e
cmp eax, dword [rsi + 0x10]
jae 0x1800150a5
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180015023
mov edx, dword [0x1800a80a0]
mov ecx, dword [rsi + 0x14]
add rcx, qword [rsi + 8]
mov r8d, 0x1000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x180015000
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180015064
mov eax, dword [0x1800a80a0]
add dword [rsi + 0x14], eax
test rdi, rdi
setne sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004b970
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov sil, 1
jmp 0x180015007
lea rcx, [0x1800a80a4]
call fcn.18004a330
cmp dword [0x1800a80a4], 0xffffffff
jne 0x180014faf
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a398
jmp 0x180014faf
lea rcx, [0x1800a80a4]
call fcn.18004a330
cmp dword [0x1800a80a4], 0xffffffff
jne 0x180014ff7
lea rbx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a398
jmp 0x180014ff7
xor esi, esi
jmp 0x180015007
Function at 0x180015250
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov r15, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [rcx + 1]
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001539d
mov ebx, dword [0x1800a80b0]
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov r8d, ebx
mov r9, r15
call fcn.180015510
mov eax, dword [0x1800a80c8]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180015354
lea rcx, [0x1800a80d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1800a80a8]
lea rdx, [rsp + 0x30]
call fcn.1800156f0
test rax, rax
je 0x1800153de
mov rdi, rax
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, ebx
call fcn.180015400
test eax, eax
je 0x1800153de
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 1
lea rcx, [0x1800a80d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004b970
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1800a80c8]
call fcn.18004a330
cmp dword [0x1800a80c8], 0xffffffff
jne 0x1800152de
lea rcx, [0x1800a80d0]
mov edx, 0xfa0
mov r8d, 0x1000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x1800a80c4], 1
lea rcx, [0x1800a80c8]
call fcn.18004a398
jmp 0x1800152de
lea rcx, [0x1800a80b4]
call fcn.18004a330
cmp dword [0x1800a80b4], 0xffffffff
jne 0x1800152a0
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a398
jmp 0x1800152a0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x18001532a
Function at 0x180015400
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x70], rax
test edx, edx
je 0x1800154fe
mov rsi, rcx
cmp qword [rcx + 8], 0
jne 0x1800154a2
mov r14, r8
mov ebx, edx
lea r15, [rsi + 1]
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800154c1
mov edi, dword [0x1800a80b0]
xor ebp, ebp
mov eax, ebx
xor edx, edx
div edi
sub edi, edx
test edx, edx
cmove edi, edx
add edi, ebx
mov dword [rsi + 0x10], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov rcx, r15
mov rdx, rax
mov r8d, edi
call fcn.180015d40
mov qword [rsi + 8], rax
test rax, rax
je 0x1800154a5
mov ebp, dword [rsi + 0x10]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18004b970
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1800a80b4]
call fcn.18004a330
cmp dword [0x1800a80b4], 0xffffffff
jne 0x180015457
lea rbp, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a398
jmp 0x180015457
xor ebp, ebp
jmp 0x1800154a5
Function at 0x180015510
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r12, rdx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x58], rax
test r9, r9
je 0x18001567f
mov esi, dword [rsp + 0xc0]
test esi, esi
je 0x18001567f
mov rbx, r9
mov r15d, r8d
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180015692
mov edi, esi
xor esi, esi
mov rax, rbx
sub rax, rdi
cmovae rsi, rax
cmp rsi, 0x100001
mov eax, 0x100000
cmovb rsi, rax
cmp rbx, rdi
mov ebp, dword [0x1800a80b0]
cmovb rsi, rax
mov eax, dword [0x1800a80c0]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1800155f9
lea rcx, [0x1800a80c0]
call fcn.18004a330
cmp dword [0x1800a80c0], 0xffffffff
jne 0x1800155f9
lea r14, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [r14 + 0x10]
mov qword [0x1800a80b8], rax
lea rcx, [0x1800a80c0]
call fcn.18004a398
mov rax, qword [0x1800a80b8]
lea rcx, [rbx + rdi]
cmp rax, rcx
cmovb rcx, rax
add rbx, rdi
cmovb rcx, rax
mov edx, r15d
cmp rcx, rdx
jb 0x18001567f
mov rdi, rsi
neg rdi
lea rax, [rbp - 1]
and rax, rdi
add rax, rsi
xor ebx, ebx
sub rcx, rdx
cmovae rbx, rcx
neg rbp
and rbp, rbx
sub rbp, rax
jbe 0x18001567f
test rax, rax
je 0x1800156d4
cmp rbp, 0xffffffffffffffff
je 0x1800156d4
mov qword [r12], rbp
mov qword [r12 + 8], rax
mov byte [r12 + 0x10], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004b970
mov rax, r12
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], 0
jmp 0x180015660
lea rcx, [0x1800a80b4]
call fcn.18004a330
cmp dword [0x1800a80b4], 0xffffffff
jne 0x180015573
lea r14, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a398
jmp 0x180015573
lea rax, str.MOZ_RELEASE_ASSERT___elements__extentSize__0____elements__extentSize___dynamic_extent__
mov qword [sym.mozglue.dll_gMozCrashReason], rax
int3
Function at 0x180016110
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, r9
mov r15, r8
mov r13, rdx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001628a
xor ebx, ebx
test r15, r15
je 0x180016263
mov rbp, qword [rsp + 0x100]
cmp rbp, rsi
jbe 0x180016263
mov ebx, dword [0x1800a80b0]
lea rdi, [rsp + 0x54]
mov dword [rdi], 0
mov rcx, rdi
call fcn.180091df0
mov rax, rbp
sub rax, rsi
sub rax, r15
xor edx, edx
div rbx
mov rcx, rax
mov eax, dword [rdi]
inc rcx
xor edx, edx
div rcx
mov r12, rdx
imul r12, rbx
mov qword [rsp + 0x38], rsi
add r12, rsi
sub rbp, r15
cmp r12, rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
ja 0x1800162ec
lea rsi, [rsp + 0x58]
lea rdi, [rsp + 0x60]
lea r14, [rbx - 1]
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x30
mov rcx, r13
xor r8d, r8d
mov r9, rdi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x18001639c
cmp qword [rsp + 0x58], 0x30
jne 0x1800163aa
mov r9, rdi
mov r8, rsi
cmp dword [rsp + 0x80], 0x10000
jne 0x1800162cb
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rdx
neg rcx
and rcx, r14
lea rsi, [rcx + rdx]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rsi
cmp rdi, rcx
jb 0x1800162d5
test rbx, rbx
je 0x1800162d5
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18004b970
mov rax, rbx
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1800a80b4]
call fcn.18004a330
cmp dword [0x1800a80b4], 0xffffffff
jne 0x180016163
lea rdi, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a398
jmp 0x180016163
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rdx, rdi
cmp rdx, rbp
mov r13, qword [rsp + 0x48]
mov rsi, r8
mov rdi, r9
jbe 0x1800161e9
cmp r12, qword [rsp + 0x38]
jbe 0x1800163aa
dec qword [rsp + 0x40]
lea r14, [rsp + 0x58]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0x30
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov r9, rsi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x18001639c
cmp qword [rsp + 0x58], 0x30
jne 0x1800163aa
cmp dword [rsp + 0x80], 0x10000
jne 0x18001637f
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rax
neg rcx
and rcx, qword [rsp + 0x40]
mov rbp, rax
lea rdx, [rcx + rax]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rdx
cmp rdi, rcx
jb 0x180016389
test rbx, rbx
je 0x180016389
jmp 0x180016263
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rbp, rdi
mov qword [rsp + 0x38], rbp
cmp rbp, r12
jb 0x180016306
jmp 0x1800163aa
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x180016263
Function at 0x180018680
Capabilities:
Access peb ldr_data
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbp, r9
mov rbx, r8
mov rsi, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rcx], rdx
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 2
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800187a6
mov edi, dword [0x1800a80a0]
lea rax, [rbx + rbp]
dec rax
xor edx, edx
div rdi
mov rcx, rax
mov rax, rbx
xor edx, edx
div rdi
inc rcx
sub rcx, rax
je 0x180018785
mov rbx, rax
mov r15d, dword [rsp + 0xd0]
lea rax, [rsi + 8]
mov qword [rsp + 0x28], rax
imul rbx, rdi
cmp rcx, 2
mov ebp, 1
cmovae rbp, rcx
lea r12, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbx
mov rdx, rdi
mov r8d, r15d
mov r9, r12
call r13
test eax, eax
je 0x1800187e7
mov r14d, dword [rsp + 0x30]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
je 0x1800187f9
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], r14d
mov qword [rcx + rax + 8], rbx
inc qword [rsi + 0x10]
add rbx, rdi
dec rbp
jne 0x18001873e
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004b970
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1800a80a4]
call fcn.18004a330
cmp dword [0x1800a80a4], 0xffffffff
jne 0x1800186e8
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a398
jmp 0x1800186e8
mov dword [rsp + 0x30], 0
mov rcx, rsi
call fcn.1800735a0
jmp 0x180018785
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.180073690
test al, al
je 0x1800187ef
mov rax, qword [rsi + 0x10]
jmp 0x180018768