joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023d10
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
cmp rdx, 1
jne 0x140023d85
mov r8, qword [r14]
cmp r8, 8
je 0x140023db9
mov rax, qword [r14 + 8]
test rax, rax
je 0x140023e26
mov rcx, rax
shr rcx, 0x3b
jne 0x140023d7e
mov rdx, rax
shl rdx, 4
lea rcx, [rdx - 1]
bsr rcx, rcx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
sub rbx, rdx
xor ecx, ecx
cmp rbx, 8
setae cl
lea rbx, [rcx + rax*2]
mov rax, rbx
shr rax, 0x3d
je 0x140023e2b
xor edi, edi
jmp 0x140023e5c
xor edi, edi
add rdx, qword [r14 + 8]
jb 0x140023e5c
mov rax, rdx
shr rax, 0x3c
jne 0x140023e5c
test rdx, rdx
je 0x140023dc0
lea rax, [rdx*8 - 1]
bsr rcx, rax
xor rcx, 0xffffffffffffffc0
add rcx, 0x41
jmp 0x140023dc2
mov ebx, 1
jmp 0x140023dd7
xor ecx, ecx
mov ebx, 1
shl rbx, cl
shr rbx, 3
mov r8, qword [r14]
cmp r8, 8
jne 0x140023e2b
lea r8, [rbx*8]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edi, edi
xor edx, edx
call sub.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x140023e5c
mov rdx, qword [r14 + 8]
test rdx, rdx
jle 0x140023e52
mov rcx, qword [r14]
lea rdx, [rcx + rdx*8]
mov rdi, rax
mov rsi, qword [rcx]
mov qword [rdi], rsi
add rcx, 8
add rdi, 8
cmp rcx, rdx
jb 0x140023e11
jmp 0x140023e52
mov ebx, 1
lea r9, [rbx*8]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edi, edi
xor edx, edx
call sub.ntdll.dll_RtlReAllocateHeap
test rax, rax
je 0x140023e5c
mov qword [r14], rax
mov qword [r14 + 0x10], rbx
mov dil, 1
mov eax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140028280
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140007a10
test al, al
je 0x1400282ae
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x1400282cf
mov rcx, rdi
call fcn.140028330
mov rcx, rdi
call fcn.14004fca0
lea rcx, [rsi + 0x58]
call fcn.140005f60
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x1400282e7
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
jne 0x140028319
lea rcx, [rsi + 0x28]
call fcn.140005df0
lea rcx, [rsi + 0x20]
call fcn.140005df0
lea rcx, [rsi + 0x18]
call fcn.140005df0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140006280
mov rcx, rdi
call fcn.140028330
mov rcx, rdi
call fcn.14004fca0
jmp 0x1400282f0

Function at 0x1400289e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14005f070]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140028a1e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140028a17
call fcn.140002780
jmp 0x1400289fe

Function at 0x140028c80
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x140028c95
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret
Function at 0x14002a690
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x160
mov r14, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x158], rax
test dl, dl
jne 0x14002a826
cmp qword [r14 + 0x10], 0
je 0x14002a88a
mov rax, qword [r14]
mov r15, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, r15
xor edx, edx
mov r9d, 0x2000
call r13
mov rsi, rax
mov rbx, qword [r14 + 0x10]
shl rbx, 6
lea r12, [rbx + 0x60]
mov rcx, r12
call fcn.140007180
mov rdi, rax
mov edx, edi
and edx, 0xfffff000
add rdx, rsi
and edi, 0xfff
add rbx, 0x105f
and rbx, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, r15
mov r8, rbx
mov r9d, 0x1000
call r13
mov rsi, rax
test rax, rax
je 0x14002a891
add rsi, rdi
lea rdi, [rsp + 0x40]
mov qword [rdi], r12
mov dword [rdi + 0x18], 0
mov qword [rdi + 8], 0x20
lea rcx, [sym.firefox.exe_g_originals]
mov r8d, 0x150
xor edx, edx
call sub.ntdll.dll_memset
mov rcx, r14
mov rdx, rsi
mov r8, r12
mov r9, rdi
call fcn.1400086a0
test eax, eax
jne 0x14002a7ff
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov r9d, 0x20
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, 0x2a
test eax, eax
je 0x14002a801
cmp qword [rsp + 0x38], 0x20
jne 0x14002a801
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rsi
mov r8, r12
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [r14]
lea rdx, str.g_originals
lea r8, [sym.firefox.exe_g_originals]
mov r9d, 0x150
call fcn.140007940
mov edi, eax
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140027a90
mov eax, edi
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.TargetNtMapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rsi, [0x140052b70]
lea r8, [0x140053eff]
mov rcx, r14
mov rdx, rsi
mov r9d, 1
call fcn.140006c30
lea rax, str.TargetNtUnmapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, [0x140053eea]
mov rcx, r14
mov rdx, rsi
mov r9d, 1
call fcn.140006c30
jmp 0x14002a6ca
xor edi, edi
jmp 0x14002a801
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
lea r9, str.thunk_base
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r8d, 0x188
call fcn.140034a00
mov rcx, rbx
call fcn.140034ac0
jmp 0x14002a74f

Function at 0x14002a8c0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret
Function at 0x14002abf0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x138], rax
test rdx, rdx
je 0x14002ac43
mov rsi, rdx
mov rdi, rcx
mov r15d, 0xffffffff
cmp rsi, r15
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14002ac63
add rdi, rbx
sub rsi, rbx
jne 0x14002ac21
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140027a90
nop
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
lea r9, str.success
lea r14, [rsp + 0x20]
mov rcx, r14
mov r8d, 0x20
call fcn.140034a00
mov rcx, r14
call fcn.140034ac0
jmp 0x14002ac3b

Function at 0x14002b0d0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140061740]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14002b162
lea rcx, [0x140061740]
call fcn.14002687c
cmp dword [0x140061740], 0xffffffff
jne 0x14002b162
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movups xmmword [0x140061730], xmm2
movups xmmword [0x140061720], xmm1
movups xmmword [0x140061710], xmm0
lea rcx, [0x140061740]
call fcn.14002681c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027a90
nop
add rsp, 0x60
pop rsi
ret
Function at 0x14002d810
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14002d84f
call fcn.14002d960
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027a90
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [str.kernel32ext_ms_win_ntuser_windowstation_l1_1_0]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140061b28], 0
jne 0x14002d88d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140061b28], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140061b78]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140061b08]
mov qword [r8 + 8], rsi
lea rax, [0x140054698]
mov qword [r8 + 0x10], rax
lea rax, [0x14004eff0]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140061b80]
lea rdx, [0x14004f090]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14002d836
cmp qword [rsp + 0x28], 0
je 0x14002d836
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140061b88]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x140054688]
mov qword [r8 + 0x10], rax
lea rax, [0x14004f020]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140061b90]
lea rdx, [0x14004f090]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14002d836
cmp qword [rsp + 0x28], 0
jne 0x14002d83b
jmp 0x14002d836

Function at 0x14002dec0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
cmp qword [r8 + 0x18], 8
jb 0x14002dee7
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor edi, edi
mov rdx, r8
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002df2f
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027a90
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x4e
mov dword [rsi + 0xc], ecx
mov dil, 1
jmp 0x14002df14
Function at 0x14002e0e0
Capabilities:
Delete registry value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [r8 + 0x18], 8
jb 0x14002e0f2
mov r8, qword [r8]
mov rcx, qword [rdx]
mov rdx, r8
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x14002e113
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
mov rax, rsi
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x14002e120
mov byte [rsi + 0x10], 0
mov byte [rsi], 1
jmp 0x14002e10a
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x5c
mov dword [rsi + 0xc], ecx
jmp 0x14002e10a

Function at 0x14002e930
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14002e967
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14002e967
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x14002e967
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x14002e966

Function at 0x14002eb70
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x10048
call fcn.140027a20
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x10040], rax
lea r8, [rsp + 0x38]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14002ebfb
lea r14, [rsp + 0x40]
lea rbx, [rsp + 0x34]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r14
mov r8d, 0x10000
mov r9, rbx
call rdi
test eax, eax
je 0x14002ebe7
cmp dword [rsp + 0x34], 0x10000
je 0x14002ebbf
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.140027a90
nop
add rsp, 0x10048
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002f0a0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e8
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001d8c0
lea rdx, [rsp + 0x118]
mov rcx, rbx
call fcn.14002f220
lea rbx, [rsp + 0x118]
mov rcx, rbx
call fcn.14001d8c0
lea rsi, [rsp + 0x100]
mov rcx, rbx
mov rdx, rsi
call fcn.140030080
cmp byte [rsi + 0x10], 0
jne 0x14002f1ab
cmp byte [rsp + 0x100], 0
je 0x14002f1ab
lea rcx, str.MOZ_DISABLE_POISON_IO_INTERPOSER1
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov ecx, 0x38
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
movups xmm0, xmmword [r14]
movups xmmword [rax], xmm0
xor esi, esi
mov ecx, 8
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbx + 0x10], rax
test rdi, rdi
lea rdx, [0x14005586d]
cmovne rdx, rdi
lea rcx, [rbx + 0x18]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x30], 0xf
mov byte [rbx + 0x18], 0
call fcn.1400022d0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140031060]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
jne 0x14002f1e8
lea rcx, [rsp + 0x30]
call fcn.140032cd0
lea rcx, [rsp + 0x118]
call fcn.14001def0
mov rcx, r14
call fcn.14002f2b0
lea rcx, [rsp + 0x38]
call fcn.14001def0
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140027a90
nop
add rsp, 0x1e8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rsi, [rsp + 0x30]
mov qword [rsi], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140032cd0
lea rcx, [rsp + 0x118]
call fcn.14001def0
jmp 0x14002f1c0

Function at 0x14002f2b0
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
lea rdx, str.Firefox_Launcher
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x14002f36f
mov r14, rax
mov rcx, qword [rdi]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r15, rax
lea rsi, [rax + 8]
mov rcx, rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.ntdll.dll_memset
mov ebp, dword [rdi + 0xc]
mov dword [rbx], ebp
mov eax, dword [rdi + 8]
mov dword [rbx + 4], eax
lea rcx, [rbx + 8]
mov rdx, qword [rdi]
mov r8, r15
call sub.ntdll.dll_memcpy
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], r12
mov word [rsp + 0x28], 0
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
mov rcx, r14
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14002fd20
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r8
mov rdi, rdx
mov r12, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r15, [rsp + 0x4c]
mov dword [r15], 0
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, rdi
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14002fd94
cmp eax, 2
jne 0x14002fe20
xor eax, eax
mov byte [r12 + 0x10], al
mov byte [r12], al
jmp 0x14002fe4d
mov esi, dword [rsp + 0x4c]
add rsi, rsi
mov rcx, rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.ntdll.dll_memset
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, rdi
mov r8, rbx
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14002fe6e
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [r12 + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [r12], rax
mov dword [r12 + 8], 0x65
mov dword [r12 + 0xc], ecx
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
jmp 0x14002fe4d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [r12 + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [r12], rax
mov dword [r12 + 8], 0x59
mov dword [r12 + 0xc], ecx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140027a90
mov rax, r12
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [0x14005178e]
mov qword [rsp + 0x5e], rax
movaps xmm0, xmmword [str.RUNASADMIN]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x48]
mov dword [rdx], 0x20
lea r8, [rsp + 0x40]
mov qword [r8], 0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x14002feed
lea r15, [rsp + 0x50]
mov rsi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
lea r13, [rsp + 0x48]
lea rdi, [rsp + 0x40]
mov rbx, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov r8d, 0xb
mov rcx, rax
mov rdx, r15
call rsi
test eax, eax
je 0x14002fefe
xor ebp, ebp
xor ecx, ecx
mov rdx, r13
mov r8, rdi
call rbx
test rax, rax
jne 0x14002fec8
jmp 0x14002feef
xor ebp, ebp
mov byte [r12 + 0x10], 0
mov byte [r12], bpl
jmp 0x14002fe15
mov bpl, 1
jmp 0x14002feef
Function at 0x140030160
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x140030189
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400301e2
cmp dword [rsp + 0x3c], 4
jne 0x1400301f4
mov eax, dword [rsp + 0x44]
mov byte [rsi + 0x10], 0
bts rax, 0x20
mov qword [rsi], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140027a90
mov rax, rsi
add rsp, 0x50
pop rsi
ret
cmp eax, 2
jne 0x140030212
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
jmp 0x1400301cc
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d0000003f
mov qword [rsi + 8], rax
jmp 0x1400301cc
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3b
mov dword [rsi + 0xc], ecx
jmp 0x1400301cc

Function at 0x140030240
Capabilities:
Get token membership
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdi, [rsp + 0x3c]
mov dword [rdi], 0x44
lea r8, [rsp + 0x40]
mov ecx, 0x1a
xor edx, edx
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x140030318
lea rbx, [rsp + 0x40]
lea r8, [rsp + 0x38]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140030363
cmp dword [rsp + 0x38], 0
je 0x14003037e
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea r8, str.EnableLUA
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140030387
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x26
jmp 0x140030342
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x14
mov byte [rsi + 0x10], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140027a90
mov rax, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x19
jmp 0x140030331
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
jmp 0x140030345
cmp dword [rsp + 0x3c], 0
mov byte [rsi + 0x10], 0
sete byte [rsi]
jmp 0x140030345
Function at 0x140032dc0
Capabilities:
Delete file

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [rcx + 9], 0
je 0x140032df3
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140032de2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140006560
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140032e07
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x30], 0
cmp qword [rsi + 0x28], 8
jb 0x140032e1c
mov rcx, qword [rsi + 0x10]
jmp 0x140032e20
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140032dce

Function at 0x140033db0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x860
mov qword [rsp + 0x888], rdx
mov qword [rsp + 0x890], r8
mov qword [rsp + 0x898], r9
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x858], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140033e55
lea rsi, [rsp + 0x888]
mov qword [rsp + 0x28], rsi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.mozglue.dll_protected:_void___cdecl_mozilla::PrintfTarget::constructor_void____ptr64]
lea rax, [0x1400512b8]
mov qword [rdi], rax
lea rbx, [rsp + 0x50]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x800
lea rdx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rcx, rdi
mov r8, rsi
call qword [sym.imp.mozglue.dll_public:_bool___cdecl_mozilla::PrintfTarget::vprint_char_const____ptr64__char____ptr64____ptr64]
mov rax, qword [rdi + 8]
mov ecx, 0x7ff
cmp rax, rcx
cmovb rcx, rax
mov byte [rsp + rcx + 0x50], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
cmp eax, 0xfffffffe
je 0x140033ec3
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
lea rdx, [0x140054c90]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
test rax, rax
je 0x140033ec3
mov rsi, rax
lea rdi, [rsp + 0x888]
mov qword [rsp + 0x50], rdi
call fcn.140012ef0
mov rcx, qword [rax]
mov qword [rsp + 0x20], rdi
lea r8, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.140027a90
nop
add rsp, 0x860
pop rbx
pop rdi
pop rsi
ret