joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ea95
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x14001e8bb]
mov rdx, rax
lea rax, [0x1400d0e30]
mov rcx, rax
call fcn.14001dec6
mov eax, dword [0x140029670]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001eae8
mov rax, qword [rbp - 0x10]
jmp 0x14001ec48
call fcn.14001d630
mov qword [rbp - 0x10], rax
mov rax, qword [0x1400d2050]
test rax, rax
je 0x14001eb04
cmp qword [rbp - 0x10], 0
jne 0x14001eb0e
mov eax, 0
jmp 0x14001ec48
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.14001d754
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x14001ebe9
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x140029670]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x14001ec44
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14001ed42
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call fcn.14001ea95
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call fcn.14001e8e9
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x14001edaf
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_longjmp]
call rax
mov eax, dword [0x140029670]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001eef3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14001ee4c
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001ee07
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001d50c
mov qword [rbp - 0x10], 0
mov eax, dword [0x140029670]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14001eef3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001ee86
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x14001eef3
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001d50c
mov qword [rbp - 0x10], 0
mov eax, dword [0x140029670]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140001c30
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, qword [rdx + 8]
test rsi, rsi
je 0x140001e4a
mov r15, r8
mov r13, rdx
mov r12, rcx
lea rbx, [rdx + 0x10]
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov rdi, rsi
movzx eax, byte [rdi]
or al, 2
cmp al, 0x2f
je 0x140001c80
mov rdi, qword [rbx]
add rbx, 8
test rdi, rdi
jne 0x140001c64
jmp 0x140001e4a
cmp byte [rdi + 1], 0x2d
je 0x140001e5b
add rdi, 1
movsx ecx, byte [rdi]
test ecx, ecx
je 0x140001c6d
call r14
cmp al, 0x6f
jne 0x140001c6d
movsx ecx, byte [rdi + 1]
test ecx, ecx
je 0x140001c6d
call r14
cmp al, 0x73
jne 0x140001c6d
movsx ecx, byte [rdi + 2]
test ecx, ecx
je 0x140001c6d
call r14
cmp al, 0x69
jne 0x140001c6d
movsx ecx, byte [rdi + 3]
test ecx, ecx
je 0x140001c6d
call r14
cmp al, 0x6e
jne 0x140001c6d
movsx ecx, byte [rdi + 4]
test ecx, ecx
je 0x140001c6d
call r14
cmp al, 0x74
jne 0x140001c6d
cmp byte [rdi + 5], 0
jne 0x140001c6d
cmp dword [r12], 4
jne 0x140001e64
mov al, byte [rsi]
or al, 2
cmp al, 0x2f
jne 0x140001e64
lea rdi, [rsi + 1]
lea rax, [rsi + 2]
xor ecx, ecx
cmp byte [rsi + 1], 0x2d
sete cl
cmove rdi, rax
movsx ecx, byte [rcx + rsi + 1]
test ecx, ecx
je 0x140001e64
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6f
jne 0x140001e64
movsx ecx, byte [rdi + 1]
test ecx, ecx
je 0x140001e64
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x73
jne 0x140001e64
movsx ecx, byte [rdi + 2]
test ecx, ecx
je 0x140001e64
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x69
jne 0x140001e64
movsx ecx, byte [rdi + 3]
test ecx, ecx
je 0x140001e64
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6e
jne 0x140001e64
movsx ecx, byte [rdi + 4]
test ecx, ecx
je 0x140001e64
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x74
jne 0x140001e64
cmp byte [rdi + 5], 0
jne 0x140001e64
lea rax, [r13 + 0x10]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x140001d9b
add dword [r12], 0xffffffff
mov rax, qword [r13 + 8]
mov cl, byte [rax]
or cl, 2
cmp cl, 0x2f
jne 0x140001e64
cmp byte [rax + 1], 0x2d
lea rsi, [rax + 1]
lea rax, [rax + 2]
cmove rsi, rax
mov rdi, qword [r15]
test rdi, rdi
je 0x140001e64
mov al, byte [rsi]
mov byte [rsp + 0x27], al
test al, al
setne r12b
jmp 0x140001dfd
test cl, cl
je 0x140001e3e
mov rdi, qword [r15 + 8]
add r15, 8
test rdi, rdi
je 0x140001e64
mov bl, byte [rdi]
mov ecx, r12d
test bl, bl
je 0x140001dec
mov ebp, 1
mov ecx, r12d
mov al, byte [rsp + 0x27]
test cl, 1
je 0x140001df0
movsx ecx, al
call r14
movsx eax, al
movsx ecx, bl
cmp eax, ecx
jne 0x140001df0
movzx ebx, byte [rdi + rbp]
movzx eax, byte [rsi + rbp]
test al, al
setne cl
add rbp, 1
test bl, bl
jne 0x140001e12
jmp 0x140001dec
mov rax, qword [r13 + 0x10]
mov al, byte [rax]
or al, 2
cmp al, 0x2f
je 0x140001e64
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rdi, 2
jmp 0x140001c8e
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
ud2
Function at 0x140001ea0
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x10048
call fcn.140047730
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x140055018]
xor rax, rsp
mov qword [rsp + 0x10040], rax
lea r8, [rsp + 0x38]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140001f52
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov rcx, rsi
mov r8d, 0x10000
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001f3e
cmp dword [rsp + 0x34], 0x10000
jne 0x140001f3e
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x34]
mov rcx, rsi
mov r8d, 0x10000
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001f3e
cmp dword [rsp + 0x34], 0x10000
je 0x140001f70
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.1400477a0
nop
add rsp, 0x10048
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r14, [rsp + 0x40]
lea rbx, [rsp + 0x34]
mov rdi, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, r14
mov r8d, 0x10000
mov r9, rbx
call rdi
test eax, eax
je 0x140001f3e
cmp dword [rsp + 0x34], 0x10000
je 0x140001f81
jmp 0x140001f3e
Function at 0x140002bc0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x1e8
mov rsi, rcx
mov rax, qword [0x140055018]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.140002d10
lea rdx, [rsp + 0x118]
mov rcx, rdi
call fcn.140002de0
lea rdi, [rsp + 0x118]
mov rcx, rdi
call fcn.140002d10
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.140007350
cmp byte [rsp + 0x110], 0
jne 0x140002c98
cmp byte [rsp + 0x100], 0
je 0x140002c98
lea rcx, str.MOZ_DISABLE_POISON_IO_INTERPOSER1
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
mov ecx, 8
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rdi + 0x10], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14000dda0]
xor ecx, ecx
xor edx, edx
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
jne 0x140002cd2
lea rcx, [rsp + 0x30]
call fcn.14000faa0
lea rcx, [rsp + 0x118]
call fcn.140002f40
mov rcx, rsi
call fcn.140002e60
lea rcx, [rsp + 0x38]
call fcn.140002f40
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400477a0
nop
add rsp, 0x1e8
pop rdi
pop rsi
ret
mov qword [rsp + 0x30], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call fcn.14000faa0
lea rcx, [rsp + 0x118]
call fcn.140002f40
cmp byte [0x140055ac4], 0
je 0x140002cad
jmp 0x140002ca5

Function at 0x140002e60
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, rcx
lea rdx, [0x14004cd66]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140002f25
mov r14, rax
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r15, rax
lea rsi, [rax + 8]
mov rcx, rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.ntdll.dll_memset
mov ebp, dword [rbx + 0xc]
mov dword [rdi], ebp
mov eax, dword [rbx + 8]
mov dword [rdi + 4], eax
lea rcx, [rdi + 8]
mov rdx, qword [rbx]
mov r8, r15
call sub.ntdll.dll_memcpy
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], 0
mov word [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r14
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test rdi, rdi
je 0x140002f0f
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
mov rcx, r14
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140005760
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, qword [rdx + 8]
test rax, rax
je 0x14000599e
mov r14, r8
mov r12, rdx
mov r15, rcx
lea rbx, [rdx + 0x10]
mov rdi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
jmp 0x1400057a0
mov rax, qword [rbx]
add rbx, 8
test rax, rax
je 0x14000599e
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140005790
lea rsi, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rsi, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140005790
call rdi
cmp ax, 0x6f
jne 0x140005790
movzx ecx, word [rsi + 2]
test cx, cx
je 0x140005790
call rdi
cmp ax, 0x73
jne 0x140005790
movzx ecx, word [rsi + 4]
test cx, cx
je 0x140005790
call rdi
cmp ax, 0x69
jne 0x140005790
movzx ecx, word [rsi + 6]
test cx, cx
je 0x140005790
call rdi
cmp ax, 0x6e
jne 0x140005790
movzx ecx, word [rsi + 8]
test cx, cx
je 0x140005790
call rdi
cmp ax, 0x74
jne 0x140005790
cmp word [rsi + 0xa], 0
jne 0x140005790
cmp dword [r15], 4
jne 0x1400059ac
mov rax, qword [r12 + 8]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400059ac
lea rsi, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rsi, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400059ac
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6f
jne 0x1400059ac
movzx ecx, word [rsi + 2]
test cx, cx
je 0x1400059ac
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x73
jne 0x1400059ac
movzx ecx, word [rsi + 4]
test cx, cx
je 0x1400059ac
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x69
jne 0x1400059ac
movzx ecx, word [rsi + 6]
test cx, cx
je 0x1400059ac
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6e
jne 0x1400059ac
movzx ecx, word [rsi + 8]
test cx, cx
je 0x1400059ac
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x74
jne 0x1400059ac
cmp word [rsi + 0xa], 0
jne 0x1400059ac
lea rax, [r12 + 0x10]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x1400058fe
add dword [r15], 0xffffffff
mov rax, qword [r12 + 8]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400059ac
cmp word [rax + 2], 0x2d
lea r15, [rax + 2]
lea rax, [rax + 4]
cmove r15, rax
mov rbx, qword [r14]
test rbx, rbx
jne 0x140005953
jmp 0x1400059ac
test al, al
je 0x14000598d
mov rbx, qword [r14 + 8]
add r14, 8
test rbx, rbx
je 0x1400059ac
movzx ecx, word [r15]
test cx, cx
setne al
cmp word [rbx], 0
je 0x140005942
mov esi, 2
test al, 1
je 0x140005946
call rdi
cmp ax, word [rbx + rsi - 2]
jne 0x140005946
movzx ecx, word [r15 + rsi]
test cx, cx
setne al
cmp word [rbx + rsi], 0
lea rsi, [rsi + 2]
jne 0x140005968
jmp 0x140005942
mov rax, qword [r12 + 0x10]
movzx eax, word [rax]
or eax, 2
cmp ax, 0x2f
je 0x1400059ac
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
ud2
Function at 0x140005b30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140055018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x140005d11
mov rdi, rdx
add rdi, 0x10
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx eax, word [rbx]
or eax, 2
cmp ax, 0x2f
je 0x140005b90
mov rbx, qword [rdi]
add rdi, 8
test rbx, rbx
jne 0x140005b66
jmp 0x140005d11
cmp word [rbx + 2], 0x2d
je 0x140005cfe
add rbx, 2
movzx ecx, word [rbx]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x73
jne 0x140005b72
movzx ecx, word [rbx + 2]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x61
jne 0x140005b72
movzx ecx, word [rbx + 4]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x66
jne 0x140005b72
movzx ecx, word [rbx + 6]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x65
jne 0x140005b72
movzx ecx, word [rbx + 8]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x2d
jne 0x140005b72
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x6d
jne 0x140005b72
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x6f
jne 0x140005b72
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x64
jne 0x140005b72
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x140005b72
call r14
cmp ax, 0x65
jne 0x140005b72
cmp word [rbx + 0x12], 0
jne 0x140005b72
mov dword [rsp + 0x3c], 4
lea rdi, [rsp + 0x3c]
mov qword [rsp + 0x30], rdi
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140005d07
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000001
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140005d07
mov dil, 1
jmp 0x140005d13
add rbx, 4
jmp 0x140005b9f
cmp dword [rsp + 0x38], 1
mov dil, 1
jne 0x140005d13
xor edi, edi
lea rcx, str.MOZ_SAFE_MODE_RESTART
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140005d46
mov byte [rsi], dil
mov byte [rsi + 1], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400477a0
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp byte [rax], 0
movzx eax, dil
mov edi, 1
cmove edi, eax
jmp 0x140005d25
Function at 0x140006c60
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140055018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
cmp qword [r8 + 0x18], 7
jbe 0x140006c87
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor edi, edi
mov rdx, r8
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140006ccf
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400477a0
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str.z:_task_1581954009_build_src_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x4e
mov dword [rsi + 0xc], ecx
mov dil, 1
jmp 0x140006cb4
Function at 0x140007420
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140055018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 7
jbe 0x140007449
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400074a0
cmp dword [rsp + 0x3c], 4
jne 0x1400074af
mov eax, dword [rsp + 0x44]
mov byte [rsi + 0x10], 0
mov dword [rsi], eax
mov byte [rsi + 4], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400477a0
mov rax, rsi
add rsp, 0x50
pop rsi
ret
cmp eax, 2
jne 0x1400074cd
mov byte [rsi + 0x10], 0
mov byte [rsi + 4], 0
jmp 0x14000748a
mov byte [rsi + 0x10], 1
lea rax, str.z:_task_1581954009_build_src_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d0000003f
mov qword [rsi + 8], rax
jmp 0x14000748a
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str.z:_task_1581954009_build_src_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3b
mov dword [rsi + 0xc], ecx
jmp 0x14000748a

Function at 0x140007570
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140055018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
cmp qword [r8 + 0x18], 7
jbe 0x140007597
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edi, edi
mov rdx, r8
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400075df
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400477a0
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str.z:_task_1581954009_build_src_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x4e
mov dword [rsi + 0xc], ecx
mov dil, 1
jmp 0x1400075c4

Function at 0x140007610
Capabilities:
Delete registry value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [r8 + 0x18], 7
jbe 0x140007622
mov r8, qword [r8]
mov rcx, qword [rdx]
mov rdx, r8
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x140007643
mov byte [rsi + 0x10], 0
mov byte [rsi], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x140007650
mov byte [rsi + 0x10], 0
mov byte [rsi], 1
jmp 0x14000763a
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str.z:_task_1581954009_build_src_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x5c
mov dword [rsi + 0xc], ecx
jmp 0x14000763a