joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d890
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ebp + 8]
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea ecx, [ebp - 0x18]
mov dword [ecx], edx
mov dword [ebp - 0x20], 0x10056840
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x1001da16
mov esi, dword [ebp - 0x14]
mov ebx, esi
and ebx, 0xfffffffc
push ebx
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov edi, eax
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
mov ebx, edi
push edi
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x1001da0d
shr esi, 2
mov eax, dword [ebp - 0x14]
shr eax, 2
cmp eax, esi
cmovae eax, esi
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001da0d
xor edi, edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], edi
mov eax, dword [ebx + edi*4]
mov dword [ebp - 0x3c], eax
mov esi, 0x104
mov dword [ebp - 0x28], 0
mov ebx, esi
lea eax, [esi + esi]
test esi, esi
mov edi, 0xffffffff
mov dword [ebp - 0x38], eax
cmovns edi, eax
push edi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001da2b
push ebx
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001da60
mov dword [ebp - 0x2c], esi
cmp eax, ebx
mov esi, dword [ebp - 0x38]
je 0x1001da39
mov edi, eax
inc edi
lea esi, [eax + eax + 2]
mov eax, 0xffffffff
cmovs esi, eax
push esi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov ebx, eax
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, dword [ebp - 0x2c]
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x1001da57
push esi
call sym.mozglue.dll__aligned_free
add esp, 4
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov esi, dword [eax + edi*4]
mov ecx, dword [ebp - 0x20]
call dword [section..00cfg]
push esi
push ebx
lea eax, [ebp - 0x1c]
push eax
call ecx
add esp, 0xc
mov esi, ebx
push esi
call sym.mozglue.dll__aligned_free
add esp, 4
inc edi
cmp edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
jne 0x1001d928
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, dword [ebp + 8]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x1001d971
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
cmp ecx, 0x7a
je 0x1001d93d
jmp 0x1001d992
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov edi, dword [ebp - 0x24]
jmp 0x1001d9f7
Function at 0x1001dfc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 0xc]
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x100a5614], esi
je 0x1001e093
mov dword [0x100a5614], esi
lea edi, [ebp - 0x28]
mov ecx, edi
call fcn.10015c60
cmp byte [edi + 4], 0
jne 0x1001e0ae
lea ebx, [ebp - 0x28]
mov eax, dword [ebx]
mov dword [ebp - 0x30], eax
mov ecx, ebx
call fcn.10015cf0
cmp byte [ebx + 4], 0
jne 0x1001e0bc
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov edx, edi
push str.Theme
call fcn.10015da0
add esp, 4
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x14], 8
jb 0x1001e035
mov ebx, dword [ebp - 0x28]
mov eax, 4
lea ecx, [ebp - 0x2c]
push eax
push ecx
push eax
push 0
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
mov esi, dword [ebp + 8]
jbe 0x1001e06e
mov eax, dword [ebp - 0x28]
inc ecx
test ecx, 0x7ffff800
jne 0x1001e0dd
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
test ebx, ebx
jne 0x1001e0f1
xor eax, eax
mov byte [esi + 4], al
test edi, edi
je 0x1001e084
push edi
call sym.mozglue.dll__aligned_free
add esp, 4
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1001e09a
jmp 0x1001e0d1
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 1
mov dword [esi], eax
jmp 0x1001e0d1
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 1
mov dword [esi], eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x100a5614], 0
jmp 0x1001e09a
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1001e0fe
mov eax, ecx
jmp 0x1001e065
mov dword [esi], 7
mov al, 1
jmp 0x1001e074
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1001e720
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x100a5a68]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x1001e783
push 0x100a5a68
call fcn.1004f9c2
add esp, 4
cmp dword [0x100a5a68], 0xffffffff
jne 0x1001e783
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x100a5a64], eax
push 0x100a5a68
call fcn.1004f9c2
add esp, 4
mov esi, dword [0x100a5a64]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004f020
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x1001f970
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push str.MOZ_CRASHREPORTER_DISABLE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1001fa0e
cmp word [0x100a562c], 0
jne 0x1001fa0c
push 0x105
push 0x100a562c
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001fa0c
cmp eax, 0x105
je 0x1001fa0c
push 0x5c
push 0x100a562c
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1001fa0c
mov word [eax + 2], 0
push str.mozwer.dll
push 0x105
push 0x100a562c
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x1001fa0c
mov eax, dword [sym.mozglue.dll_enum_GeckoProcessType_mozilla::startup::sChildProcessType]
mov dword [0x100a5838], eax
mov dword [0x100a583c], 0x100a4860
push 0x100a5838
push 0x100a562c
call sub.kernel32.dll_WerRegisterRuntimeExceptionModule
test eax, eax
js 0x1001fa19
pop ebp
ret
cmp byte [eax], 0
je 0x1001f989
jmp 0x1001fa0c
mov word [0x100a562c], 0
jmp 0x1001fa0c

Function at 0x1001ff80
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push 2
push 0x20
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns bl
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004f020
mov eax, ebx
add esp, 0x24
pop ebx
pop ebp
ret

Function at 0x10020100
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [esp + 0xc], eax
mov eax, esp
push 8
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x10020141
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.1004f020
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
int3
Function at 0x1004e7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, edi
and eax, 0xfffffffc
je 0x1004e88f
lea esi, [eax - 1]
mov edi, esi
shr edi, 2
inc edi
mov ecx, edi
and ecx, 3
cmp eax, 0xd
jae 0x1004e800
xor eax, eax
xor ebx, ebx
jmp 0x1004e84b
and edi, 0xfffffffc
xor eax, eax
xor ebx, ebx
nop word [eax + eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 0xfffffffc
jne 0x1004e810
test ecx, ecx
je 0x1004e869
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1004e856
and esi, 0xfffffffc
add esi, 4
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1004e88a
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc esi
cmp edi, esi
jne 0x1004e876
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
xor eax, eax
cmp esi, edi
jb 0x1004e876
jmp 0x1004e88a

Function at 0x1004f9c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1004f9d1
pop dword [ebp - 0x3c]
mov eax, 0xf9f92d87
add eax, 0x160bcc4a
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3378c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x65432ace
sub ecx, 0x6542f227
xor ebx, ebx
add ebx, eax
mov edx, 0x100aec00
add edx, dword [ebp - 0x3c]
mov edi, 0x2325b1f7
sub edi, 0x356ab163
add dword [ebp - 0x28], eax
mov esi, dword [edx]
sub dword [ebp - 0x38], edx
sub esi, edi
sub dword [ebp - 0x28], esi
mov dword [ebx], esi
xor dword [ebp - 0x38], 0x1e3cd949
add ebx, 0xad96ad73
add ebx, 0x52695291
add edx, 4
loop 0x1004fa27
add eax, 0xd56f
mov ebx, eax
add eax, 0x8b9e15d6
add eax, 0x7461ea2f
mov ecx, 0x84291ca4
sub ecx, 0x74291ca4
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10051a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x100a400c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 4
cmp dword [eax + 0x14], 8
jb 0x10051a9d
mov eax, dword [eax]
lea edi, [ebp - 0x18]
lea ebx, [ebp - 0x14]
push edi
push ebx
push ecx
push 0x10
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, 7
test eax, eax
jne 0x10051abd
mov ecx, dword [ebp - 0x14]
setne byte [esi + 4]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10052820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x100a5624], 0
je 0x1005285b
mov eax, dword [0x100a5620]
and eax, 0xfffffffe
cmp eax, 4
jne 0x1005285b
mov byte [ebx + 4], 1
mov dword [ebx], 1
jmp 0x1005291b
lea edi, [ebp - 0x28]
mov ecx, edi
call fcn.10015c60
cmp byte [edi + 4], 0
jne 0x1005292f
lea ebx, [ebp - 0x28]
mov esi, dword [ebx]
mov ecx, ebx
call fcn.10015cf0
cmp byte [ebx + 4], 0
jne 0x1005293a
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov edx, edi
push str.Enabled
call fcn.10015da0
add esp, 4
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x14], 8
jb 0x100528a9
mov ebx, dword [ebp - 0x28]
mov eax, 4
lea ecx, [ebp - 0x2c]
push eax
push ecx
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x100528dd
mov eax, dword [ebp - 0x28]
inc ecx
test ecx, 0x7ffff800
jne 0x10052948
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
test ebx, ebx
jne 0x1005295c
cmp byte [0x100a5610], 0
mov ebx, dword [ebp + 8]
jne 0x100528fb
cmp byte [ebp + 0xc], 0
je 0x100528fb
lea ecx, [ebp - 0x28]
call fcn.10016350
mov al, byte [ebp + 0xc]
mov byte [0x100a5610], al
mov byte [ebx + 4], 0
test edi, edi
je 0x10052914
push edi
call sym.mozglue.dll__aligned_free
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov byte [ebx + 4], 1
mov dword [ebx], eax
jmp 0x1005291b
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 1
mov dword [ebx], eax
jmp 0x10052914
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1005296b
mov eax, ecx
jmp 0x100528d4
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 1
mov dword [ebx], 7
jmp 0x10052907
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x10054d10
Capabilities:
Get system information on windows
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.mozglue.dll_malloc
Function at 0x1005bac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [0x100a5434]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x1005bb47
push 0x100a5434
call fcn.1004f9c2
add esp, 4
cmp dword [0x100a5434], 0xffffffff
jne 0x1005bb47
push str.MOZ_BASE_PROFILER_VERBOSE_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1005bb53
push str.MOZ_BASE_PROFILER_DEBUG_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1005bb5a
push str.MOZ_BASE_PROFILER_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
lea eax, [ecx + ecx*2]
mov dword [0x100a5430], eax
push 0x100a5434
call fcn.1004f9c2
add esp, 4
cmp dword [0x100a5430], esi
setge al
pop esi
pop ebp
ret
mov eax, 5
jmp 0x1005bb35
mov eax, 4
jmp 0x1005bb35
Function at 0x1005f4e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov dword [ecx + 4], edx
mulsd xmm0, qword [0x10092230]
addsd xmm0, qword [0x100922b8]
sub esp, 8
movsd qword [esp], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
add esp, 8
fstp qword [esp]
cvttsd2si ecx, qword [esp]
xor eax, eax
inc eax
cmp ecx, 2
cmovge eax, ecx
mov dword [esi + 8], eax
mov ecx, 0x8000
and ecx, dword [ebp + 8]
mov edx, ecx
shr edx, 0xf
mov byte [esi + 0x10], dl
test ecx, ecx
jne 0x1005f554
cmp eax, 0x270f
ja 0x1005f554
movzx eax, ax
shr eax, 3
imul eax, eax, 0x20c5
shr eax, 0x14
push eax
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
xor eax, eax
push eax
push eax
push esi
push 0x1005f590
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x1005f578
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_CRASH__beginthreadex_failed_
int3
Function at 0x1006c0f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov edi, ecx
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, edx
sub eax, ecx
cmp eax, 0x1a4c
jge 0x1006c239
cmp edi, edx
je 0x1006c224
lea ebx, [edi + 0xcc]
cmp ebx, edx
je 0x1006c224
mov eax, 0xffffff34
lea esi, [ebp - 0xdc]
mov ecx, edi
mov dword [ebp - 0xe0], edi
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], eax
mov ecx, esi
push ebx
call fcn.10050ce0
mov eax, dword [ebp - 0xdc]
cmp eax, dword [edi]
jae 0x1006c1ad
mov ecx, edi
cmp ebx, edi
je 0x1006c1e6
xor edi, edi
mov esi, dword [ebp - 0xe8]
mov dword [ebp - 0xe4], ebx
mov ebx, dword [ebp - 0xec]
lea edx, [ebx + edi]
mov eax, dword [ebp - 0xe4]
lea ecx, [eax + edi]
call fcn.1006c890
add edi, 0xffffff34
cmp esi, edi
jne 0x1006c17e
mov ecx, dword [ebp - 0xe0]
lea esi, [ebp - 0xdc]
mov ebx, dword [ebp - 0xe4]
jmp 0x1006c1e6
mov ecx, ebx
cmp eax, dword [ebx - 0xcc]
jae 0x1006c1e6
lea ecx, [ebx - 0xcc]
mov edi, ecx
add ecx, 0xcc
mov edx, edi
call fcn.1006c890
lea ecx, [edi - 0xcc]
mov eax, dword [ebp - 0xdc]
cmp eax, dword [edi - 0xcc]
jb 0x1006c1bd
add ecx, 0xcc
mov edx, esi
call fcn.1006c890
mov ecx, esi
call fcn.10050a60
mov ecx, 0xcc
add ebx, ecx
mov eax, dword [ebp - 0xe8]
add eax, 0xffffff34
mov edx, dword [ebp - 0xec]
add edx, ecx
mov ecx, edx
mov edx, dword [ebp - 0xf0]
cmp ebx, edx
mov edi, dword [ebp - 0xe0]
jne 0x1006c146
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
test esi, esi
mov ebx, edx
mov ecx, edi
jle 0x1006c2d0
call fcn.1006c4b0
mov dword [ebp - 0xe8], edx
mov ecx, esi
shr ecx, 1
shr esi, 2
add esi, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], edi
sub eax, edi
mov edi, dword [ebp - 0xe8]
sar eax, 2
imul eax, eax, 0xfafafafb
mov ecx, ebx
sub ecx, edi
sar ecx, 2
imul ecx, ecx, 0xfafafafb
cmp eax, ecx
jge 0x1006c2a3
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xe4]
push esi
call fcn.1006c0f0
mov edx, ebx
add esp, 4
jmp 0x1006c2bc
mov edx, ebx
mov ecx, edi
push esi
call fcn.1006c0f0
add esp, 4
mov edx, dword [ebp - 0xe4]
mov edi, dword [ebp - 0xe0]
mov eax, edx
sub eax, edi
cmp eax, 0x1a4c
jge 0x1006c23c
jmp 0x1006c117
call fcn.1006c310
mov esi, ebx
sub esi, edi
cmp esi, 0xcd
jl 0x1006c224
mov ecx, edi
mov edx, ebx
call fcn.1006cbc0
mov eax, 0xffffff34
add ebx, eax
add esi, eax
cmp esi, 0xcc
jg 0x1006c2e5
jmp 0x1006c224
Function at 0x10071360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x10071402
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x10071402
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x10071400
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call edi
cmp eax, 3
je 0x10071416
cmp eax, 1
je 0x100713dc
test eax, eax
jne 0x10071400
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
sub edi, ebx
je 0x100713f7
push dword [esi + 0x4c]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10071400
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x10071402
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x10071402
Function at 0x10074830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor eax, eax
cmp byte [ecx + 0x40], 0
je 0x10074843
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
cmp dword [ecx + 0x10], 0
je 0x1007487b
cmp dword [ecx + 0x14], 0x10
mov eax, ecx
jb 0x10074855
mov eax, dword [ecx]
mov bl, byte [eax]
test bl, bl
je 0x1007487b
inc eax
xor edx, edx
movzx edi, bl
rol edx, 5
mov esi, edx
xor esi, edi
imul edx, esi, 0x9e3779b9
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x1007485e
imul edx, esi, 0xe35e67b1
movzx eax, byte [ecx + 0x18]
rol edx, 5
xor edx, eax
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, dword [ecx + 0x20]
imul eax, eax, 0x9e3779b9
rol eax, 5
imul eax, eax, 0x9e3779b9
cmp byte [ecx + 0x2c], 0
je 0x100748b1
rol eax, 5
xor eax, dword [ecx + 0x28]
imul eax, eax, 0x9e3779b9
cmp byte [ecx + 0x34], 0
je 0x100748c3
rol eax, 5
xor eax, dword [ecx + 0x30]
imul eax, eax, 0x9e3779b9
cmp byte [ecx + 0x3c], 0
je 0x1007483e
rol eax, 5
xor eax, dword [ecx + 0x38]
imul eax, eax, 0x9e3779b9
jmp 0x1007483e
Function at 0x10075190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, edx
mov edi, ecx
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [esp + 0x20], eax
push ecx
call fcn.100750a0
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x100751cf
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.1004f020
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ebx, [esp + 0x18]
mov ecx, edi
push 8
push ebx
call fcn.10068390
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x64], ecx
mov dword [esi + 0x60], eax
mov ecx, esi
call fcn.10064950
mov ebx, dword [esi + 0x3c]
cmp byte [esi + 0x38], 0
je 0x1007520f
lea eax, [esi + 0x18]
mov dword [esi + 0x30], 0
push eax
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
test ebx, ebx
jne 0x10075255
lea ebx, [esp + 0x14]
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.1005b3d0
mov eax, dword [ebx]
lea ebx, [esp + 0x18]
mov dword [ebx], eax
mov ecx, esi
mov edx, ebx
call fcn.1006c030
mov ebx, dword [ebx]
test ebx, ebx
je 0x1007524f
mov eax, dword [ebx]
mov ecx, dword [eax]
mov dword [esp + 4], ecx
call dword [section..00cfg]
mov ecx, ebx
push 1
call dword [esp + 8]
mov ebx, dword [esp + 0xc]
jmp 0x100752c4
mov ecx, esi
call fcn.10064950
mov ebx, dword [esi + 0x3c]
xor ecx, ecx
mov eax, 0
test ebx, ebx
je 0x10075287
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [esp + 4], ecx
call dword [section..00cfg]
mov ecx, ebx
call dword [esp + 4]
movzx ecx, al
and eax, 0xffffff00
cmp byte [esi + 0x38], 0
je 0x100752ae
mov dword [esp + 8], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x30], 0
push eax
mov dword [esp + 8], ecx
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
test ebx, ebx
je 0x1007535a
or eax, ecx
mov ebx, dword [esp + 0xc]
cmp eax, ebx
jb 0x1007536f
mov dword [esp + 0x18], edi
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
mov dword [eax], esi
mov ecx, esi
call fcn.10064950
lea edx, [esp + 0x10]
mov dword [edx], ebx
mov ecx, esi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10075390
add esp, 8
lea eax, [esp + 0x14]
mov eax, dword [eax]
cmp byte [eax + 0x38], 0
je 0x10075314
mov dword [eax + 0x30], 0
add eax, 0x18
push eax
call dword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
mov eax, 8
mov ecx, edi
push eax
lea ebx, [esp + 0x1c]
push ebx
call fcn.10068390
movsd xmm0, qword [esp + 0x18]
movsd qword [esi + 0x68], xmm0
mov ecx, edi
mov eax, 8
push eax
push ebx
call fcn.10068390
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x74], ecx
mov dword [esi + 0x70], eax
xor eax, eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x78], eax
jmp 0x100751bc
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_isSome___
int3
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_aBuffer.BufferLength__.value_____len_
int3
Function at 0x1007a1f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x1007a252
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
lea edi, [ebp - 0x1c]
push eax
push edi
push ebx
push 0x10
push str.AppsUseLightTheme
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
or eax, dword [edi]
sete bl
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004f020
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret