joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007d7f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp byte [rcx + 0x60], 0
je 0x18007d849
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x18007d827
lea rax, [rsi + 0x20]
cmp rcx, rax
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x1800d2010]
mov qword [rsi + 0x58], 0
mov rdi, qword [rsi + 0x10]
mov qword [rsi + 0x10], 0
test rdi, rdi
jne 0x18007d850
mov rdi, qword [rsi + 8]
mov qword [rsi + 8], 0
test rdi, rdi
jne 0x18007d862
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.1800765e0
mov rcx, rdi
call sym.mozglue.dll__aligned_free
jmp 0x18007d838
mov rcx, rdi
call fcn.1800765e0
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x18007e2a0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.18007e310
mov rcx, rsi
mov rdx, rdi
call fcn.1800201d0
mov rsi, qword [rdi]
test rsi, rsi
jne 0x18007e2ed
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.18007d570
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180062020
mov rcx, rsi
add rsp, 0x38
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x18007e770
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x18007e7a1
lea rax, [rsi + 0x20]
cmp rcx, rax
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [0x1800d2010]
mov qword [rsi + 0x58], 0
mov rdi, qword [rsi + 0x10]
mov qword [rsi + 0x10], 0
test rdi, rdi
jne 0x18007e7d1
mov rdi, qword [rsi + 8]
mov qword [rsi + 8], 0
test rdi, rdi
jne 0x18007e7e3
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
mov rcx, rdi
call fcn.1800765e0
mov rcx, rdi
call sym.mozglue.dll__aligned_free
jmp 0x18007e7b2
mov rcx, rdi
call fcn.1800765e0
mov rcx, rdi
call sym.mozglue.dll__aligned_free
jmp 0x18007e7c3

Function at 0x18007f120
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x18007f167
mov rsi, rdx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1800d2010]
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
jne 0x18007f151
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.1800765e0
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3
Function at 0x180082a30
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx]
test rax, rax
je 0x180082abe
mov qword [rsi], 0
mov rbx, qword [rdi + 8]
mov qword [rdi + 8], rax
test rbx, rbx
jne 0x180082af4
mov rbx, qword [rdi + 0x10]
mov qword [rdi + 0x10], 0
test rbx, rbx
jne 0x180082b09
mov rax, qword [rdi + 8]
test rax, rax
je 0x180082ad9
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov cx, 0x101
mov word [rax + 0x18], cx
movups xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], cx
movups xmmword [rax + 0x3c], xmm0
mov rax, qword [rdi + 8]
mov eax, dword [rax + 0x38]
mov dword [rdi + 0x18], eax
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
jne 0x180082add
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rdi + 8]
test rax, rax
jne 0x180082a7b
mov rax, qword [rdi + 0x10]
mov qword [rdi + 0x10], 0
mov qword [rdi + 8], rax
jmp 0x180082a76
xor eax, eax
jmp 0x180082aa4
mov rcx, rdi
call fcn.1800765e0
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
mov rcx, rbx
call fcn.1800765e0
mov rcx, rbx
call sym.mozglue.dll__aligned_free
jmp 0x180082a5d
mov rcx, rbx
call fcn.1800765e0
mov rcx, rbx
call sym.mozglue.dll__aligned_free
jmp 0x180082a72

Function at 0x180083250
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp dword [rcx + 0xc], 0x80000000
jbe 0x180083280
mov rcx, qword [rsi]
test rcx, rcx
je 0x180083279
lock dec qword [rcx]
jne 0x180083279
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free
nop
add rsp, 0x20
pop rsi
ret
mov r8, qword [rsi + 0x10]
mov rcx, rsi
mov edx, 0x80000000
call fcn.1800832a0
jmp 0x180083261

Function at 0x180083410
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
lock dec dword [rcx + 0x40]
je 0x180083421
add rsp, 0x20
pop rsi
ret
mov rsi, rcx
mov rax, qword [rcx + 0x18]
cmp rax, 0x10
jae 0x18008344e
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free
mov rcx, qword [rsi]
add rax, 0xfffffffffffff001
cmp rax, 0xffffffffffffefff
ja 0x180083473
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18008347a
mov rcx, rax
call sym.mozglue.dll__aligned_free
jmp 0x18008342e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180083a10
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x108]
test rcx, rcx
je 0x180083a2b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0xc8]
lea rax, [rsi + 0xe0]
cmp rcx, rax
je 0x180083a44
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0xa8]
lea rax, [rsi + 0xc0]
cmp rcx, rax
je 0x180083a5d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0xa0]
mov qword [rsi + 0xa0], 0
test rcx, rcx
je 0x180083a86
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov edx, 1
call qword [0x1800d2010]
mov rcx, qword [rsi + 0x78]
mov rdx, qword [rsi + 0x80]
call fcn.180083b10
mov rcx, qword [rsi + 0x40]
lea rax, [rsi + 0x58]
cmp rcx, rax
je 0x180083aa9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x20]
lea rax, [rsi + 0x38]
cmp rcx, rax
je 0x180083abc
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
test rcx, rcx
je 0x180083adf
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov edx, 1
call qword [0x1800d2010]
mov rdi, qword [rsi]
mov qword [rsi], 0
test rdi, rdi
jne 0x180083af5
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rdi
call sym.mozglue.dll_public_virtual:_void___cdecl_mozilla::baseprofiler::UniqueJSONStrings::destructor_void____ptr64
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x180084a90
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
cmp dword [rcx + 0x10], 0
jne 0x180084aac
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x180084ac5
add rsp, 0x28
jmp sym.mozglue.dll__aligned_free
lea rax, str.MOZ_RELEASE_ASSERT_stackPointer__0_
mov qword [sym.mozglue.dll_gMozCrashReason], rax
int3
nop
add rsp, 0x28
ret

Function at 0x180084ad0
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
mov eax, dword [0x1800ccf04]
mov ecx, dword [0x1800cb4e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x180084b5b
lea rcx, [0x1800ccf04]
call fcn.180060ac0
cmp dword [0x1800ccf04], 0xffffffff
jne 0x180084b5b
lea rcx, str.MOZ_BASE_PROFILER_VERBOSE_LOGGING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x180084b6a
lea rcx, str.MOZ_BASE_PROFILER_DEBUG_LOGGING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x180084b71
lea rcx, str.MOZ_BASE_PROFILER_LOGGING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor ecx, ecx
test rax, rax
setne cl
lea eax, [rcx + rcx*2]
mov dword [0x1800ccf00], eax
lea rcx, [0x1800ccf04]
call fcn.180060b40
cmp dword [0x1800ccf00], esi
setge al
add rsp, 0x20
pop rsi
ret
mov eax, 5
jmp 0x180084b49
mov eax, 4
jmp 0x180084b49
Function at 0x18008a060
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx + 0x38]
cmp rax, 0x10
jb 0x18008a09d
mov rcx, qword [rsi + 0x20]
add rax, 0xfffffffffffff001
cmp rax, 0xffffffffffffefff
ja 0x18008a098
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18008a0be
mov rcx, rax
call sym.mozglue.dll__aligned_free
mov qword [rsi + 0x30], 0
mov qword [rsi + 0x38], 0xf
mov byte [rsi + 0x20], 0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x18008a3d0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x18008a43f
mov rsi, rcx
mov rax, qword [rdi + 0x38]
cmp rax, 0x10
jb 0x18008a417
mov rcx, qword [rdi + 0x20]
add rax, 0xfffffffffffff001
cmp rax, 0xffffffffffffefff
ja 0x18008a412
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18008a447
mov rcx, rax
call sym.mozglue.dll__aligned_free
mov qword [rdi + 0x30], 0
mov qword [rdi + 0x38], 0xf
mov byte [rdi + 0x20], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18008a43f
add rsp, 0x28
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
nop
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x18008bf20
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x78]
mov rcx, qword [rax + 0x50]
mov qword [rax + 0x50], 0
mov rdx, qword [rsi + 0x78]
mov qword [rsp + 0x28], rdx
mov qword [rsi + 0x78], rcx
mov eax, dword [rdx + 0x38]
sub qword [rsi + 0x68], rax
mov rcx, qword [rsi + 0xc0]
test rcx, rcx
je 0x18008bf75
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1800d2010]
lea rdi, [rsp + 0x28]
mov rcx, rsi
mov rdx, rdi
call fcn.18008c2e0
sub qword [rsi + 0x70], rax
mov rsi, qword [rdi]
test rsi, rsi
jne 0x18008bfa6
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x38
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.1800765e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180062020
mov rcx, rsi
add rsp, 0x38
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x18008c2e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rax, rcx
mov rcx, qword [rdx]
mov r8d, dword [rcx + 0x38]
cmp r8d, dword [rax + 0x18]
jae 0x18008c2ff
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll_moz_malloc_usable_size
mov r8, qword [rax + 0x80]
test r8, r8
je 0x18008c31c
cmp qword [r8 + 0x50], 0
jne 0x18008c2f5
mov rcx, r8
call fcn.180076bc0
jmp 0x18008c336
mov qword [rdx], 0
mov rsi, qword [rax + 0x80]
mov qword [rax + 0x80], rcx
test rsi, rsi
jne 0x18008c33e
xor eax, eax
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
call fcn.1800765e0
mov rcx, rsi
call sym.mozglue.dll__aligned_free
jmp 0x18008c336

Function at 0x18008c9b0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, r9d
movapd xmm0, xmm2
mov rsi, rcx
mov dword [rcx + 4], edx
mulsd xmm0, qword [0x1800b7230]
addsd xmm0, qword [0x1800b7248]
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
cvttsd2si ecx, xmm0
cmp ecx, 2
mov eax, 1
cmovge eax, ecx
mov dword [rsi + 8], eax
and edi, 0x8000
mov ecx, edi
shr ecx, 0xf
mov byte [rsi + 0x18], cl
test edi, edi
jne 0x18008ca18
cmp eax, 0x270f
ja 0x18008ca18
movzx eax, ax
shr eax, 3
imul ecx, eax, 0x20c5
shr ecx, 0x14
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x18008ca70]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi + 0x10], rax
test rax, rax
je 0x18008ca50
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
lea rax, str.MOZ_CRASH__beginthreadex_failed_
mov qword [sym.mozglue.dll_gMozCrashReason], rax
int3
Function at 0x180090390
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x18009044c
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x18009044c
mov rax, qword [rsi]
mov rax, qword [rax + 0x18]
mov rcx, rsi
mov edx, 0xffffffff
call qword [0x1800d2010]
cmp eax, 0xffffffff
je 0x18009044a
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [0x1800d2010]
cmp eax, 3
je 0x180090463
cmp eax, 1
je 0x180090419
test eax, eax
jne 0x18009044a
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x180090440
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18009044a
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x18009044c
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062020
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x18009044c

Function at 0x180092470
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
mov edi, r8d
movaps xmm6, xmm1
mov ebx, ecx
mov r12, qword [rsp + 0xa8]
mov r15d, dword [rsp + 0xa0]
mov ecx, 3
call fcn.180084ad0
test al, al
je 0x1800924cb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
lea rcx, str._I__d__d__profiler_start_n
mov edx, eax
mov r8d, ebp
call fcn.180084b80
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
lea rcx, [0x1800ccfe0]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [0x1800cd010], ebp
cmp qword [0x1800cd020], 0
jne 0x1800924f7
xor ecx, ecx
call sym.mozglue.dll_void___cdecl_mozilla::baseprofiler::profiler_init_void____ptr64_
cmp qword [0x1800cd028], 0
jne 0x180092506
xor r14d, r14d
jmp 0x18009250e
call fcn.18008fb10
mov r14, rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
mov ecx, ebx
movaps xmm1, xmm6
mov r8d, edi
mov r9, rsi
call fcn.18008d2e0
mov dword [0x1800cd010], 0
lea rcx, [0x1800ccfe0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test r14, r14
je 0x18009257e
mov rcx, qword [r14 + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r14 + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x180092563
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.mozglue.dll__aligned_free
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1800925a0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rsi, r9
mov edi, r8d
movaps xmm6, xmm1
mov ebx, ecx
mov r12, qword [rsp + 0xb8]
mov r15d, dword [rsp + 0xb0]
mov ecx, 3
call fcn.180084ad0
test al, al
je 0x1800925fb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
lea rcx, str._I__d__d__profiler_ensure_started_n
mov edx, eax
mov r8d, ebp
call fcn.180084b80
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebp, eax
lea rcx, [0x1800ccfe0]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [0x1800cd010], ebp
cmp qword [0x1800cd020], 0
jne 0x180092627
xor ecx, ecx
call sym.mozglue.dll_void___cdecl_mozilla::baseprofiler::profiler_init_void____ptr64_
cmp qword [0x1800cd028], 0
jne 0x1800926a8
xor r14d, r14d
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r15d
mov ecx, ebx
movaps xmm1, xmm6
mov r8d, edi
mov r9, rsi
call fcn.18008d2e0
mov dword [0x1800cd010], 0
lea rcx, [0x1800ccfe0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test r14, r14
je 0x1800926fa
mov rcx, qword [r14 + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r14 + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x18009268d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.mozglue.dll__aligned_free
movsd xmm1, qword [r12]
mov r8b, byte [r12 + 8]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], edi
mov ecx, ebx
movaps xmm3, xmm6
call fcn.180092720
test al, al
je 0x18009270e
mov dword [0x1800cd010], 0
lea rcx, [0x1800ccfe0]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.18008fb10
mov r14, rax
jmp 0x180092634
Function at 0x1800927e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov ecx, 3
call fcn.180084ad0
test al, al
jne 0x180092883
cmp qword [0x1800cd020], 0
je 0x1800928b4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
lea rcx, [0x1800ccfe0]
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [0x1800cd010], esi
mov rdi, qword [0x1800cd028]
test rdi, rdi
jne 0x1800928a7
mov dword [0x1800cd010], 0
lea rcx, [0x1800ccfe0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test rdi, rdi
je 0x18009287b
test rsi, rsi
je 0x18009287b
mov rcx, qword [rsi + 0x10]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x18009286d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
nop
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
lea rcx, str._I__d__d__profiler_stop_n
mov edx, eax
mov r8d, esi
call fcn.180084b80
jmp 0x1800927f8
call fcn.18008fb10
mov rsi, rax
jmp 0x18009282d
lea rax, str.MOZ_RELEASE_ASSERT_CorePS::Exists___
mov qword [sym.mozglue.dll_gMozCrashReason], rax
int3

Function at 0x180095bc0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rdx, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.18007ce80
mov rsi, qword [rbx]
mov r8, qword [rbx + 8]
mov rcx, rdi
mov rdx, rsi
call fcn.180095c40
cmp dword [rbx + 0x10], 2
je 0x180095c17
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
test rsi, rsi
je 0x180095c01
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180062020
mov rcx, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
Function at 0x1800960c0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x1800cd028]
mov rbx, qword [rax + 0x78]
mov rcx, rbx
call fcn.180075db0
mov rdi, qword [rbx + 0xa8]
mov rax, qword [rbx + 0xc0]
cmp byte [rbx + 0x70], 0
je 0x18009611a
mov dword [rbx + 0x60], 0
add rbx, 0x30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, 0x1d0
add rcx, qword [0x1800cd028]
mov rdx, rdi
call fcn.180088da0
mov rax, qword [0x1800cd028]
mov rcx, qword [rax + 0x1c0]
test rcx, rcx
je 0x180096162
mov r14, qword [rax + 0x1b8]
mov edi, 0x18
xor ebx, ebx
cmp qword [r14 + rdi - 0x18], rsi
je 0x18009617e
inc rbx
add rdi, 0x10
cmp rcx, rbx
jne 0x18009614f
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shl rbx, 4
mov r15, qword [r14 + rbx + 8]
mov rsi, qword [rax + 0x78]
mov rcx, rsi
call fcn.180075db0
mov rax, qword [rsi + 0xa8]
mov r12, qword [rsi + 0xb0]
mov rax, qword [rsi + 0xc0]
cmp byte [rsi + 0x70], 0
je 0x1800961c2
mov dword [rsi + 0x60], 0
add rsi, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp byte [r15 + 0x10], 0
je 0x1800961ce
mov byte [r15 + 0x10], 0
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov dl, 1
call sym.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::Now_bool_
mov rax, qword [rsi + 0x10]
mov qword [r15 + 0x48], rax
movups xmm0, xmmword [rsi]
movups xmmword [r15 + 0x38], xmm0
mov qword [r15 + 0x28], r12
mov byte [r15 + 0x30], 1
mov rsi, qword [0x1800cd028]
mov rax, qword [rsi + 0x1d8]
mov r15, rsi
cmp rax, qword [rsi + 0x1e0]
je 0x1800962f3
lea rcx, [r14 + rbx]
add rcx, 8
mov rdx, qword [rsi + 0x1d0]
mov r8, qword [rcx]
mov qword [rcx], 0
mov qword [rdx + rax*8], r8
inc qword [rsi + 0x1d8]
mov rax, qword [r15 + 0x1b8]
mov rcx, qword [r15 + 0x1c0]
lea rdx, [rax + rbx]
add rdx, 0x10
mov r8, rcx
shl r8, 4
add r8, rax
cmp rdx, r8
jae 0x18009629f
add rax, rdi
mov rsi, rax
mov rax, qword [rsi - 8]
mov qword [rsi - 0x18], rax
lea rcx, [rsi - 0x10]
mov rdx, rsi
call fcn.180089e90
mov rax, qword [r15 + 0x1b8]
mov rcx, qword [r15 + 0x1c0]
mov rdx, rcx
shl rdx, 4
add rdx, rax
lea r8, [rsi + 0x10]
add rsi, 8
cmp rsi, rdx
mov rsi, r8
jb 0x180096263
dec rcx
mov qword [r15 + 0x1c0], rcx
shl rcx, 4
mov rsi, qword [rax + rcx + 8]
mov qword [rax + rcx + 8], 0
test rsi, rsi
je 0x180096162
mov rcx, qword [rsi]
test rcx, rcx
je 0x1800962d1
call sym.mozglue.dll_public:_void___cdecl_mozilla::baseprofiler::ThreadInfo::Release_void_const___ptr64
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180062020
mov rcx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.mozglue.dll__aligned_free
lea rcx, [rsi + 0x1d0]
call fcn.1800963f0
test al, al
je 0x180096316
mov rax, qword [rsi + 0x1d8]
mov r15, qword [0x1800cd028]
jmp 0x180096214
lea rax, str.MOZ_RELEASE_ASSERT_sInstance__mDeadProfiledThreads.append__std::move_thread.mProfiledThreadData___
mov qword [sym.mozglue.dll_gMozCrashReason], rax
int3