joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bcb0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, r9
mov r15, r8
mov r13, rdx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [0x140061d6c]
mov ecx, dword [0x1400614b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001be2a
xor ebx, ebx
test r15, r15
je 0x14001be03
mov rbp, qword [rsp + 0x100]
cmp rbp, rsi
jbe 0x14001be03
mov ebx, dword [0x140061d68]
lea rdi, [rsp + 0x54]
mov dword [rdi], 0
mov rcx, rdi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand_s
mov rax, rbp
sub rax, rsi
sub rax, r15
xor edx, edx
div rbx
mov rcx, rax
mov eax, dword [rdi]
inc rcx
xor edx, edx
div rcx
mov r12, rdx
imul r12, rbx
mov qword [rsp + 0x38], rsi
add r12, rsi
sub rbp, r15
cmp r12, rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
ja 0x14001be8c
lea rsi, [rsp + 0x58]
lea rdi, [rsp + 0x60]
lea r14, [rbx - 1]
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x30
mov rcx, r13
xor r8d, r8d
mov r9, rdi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x14001bf3c
cmp qword [rsp + 0x58], 0x30
jne 0x14001bf4a
mov r9, rdi
mov r8, rsi
cmp dword [rsp + 0x80], 0x10000
jne 0x14001be6b
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rdx
neg rcx
and rcx, r14
lea rsi, [rcx + rdx]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rsi
cmp rdi, rcx
jb 0x14001be75
test rbx, rbx
je 0x14001be75
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14002f4d0
mov rax, rbx
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140061d6c]
call fcn.14002e2bc
cmp dword [0x140061d6c], 0xffffffff
jne 0x14001bd03
lea rdi, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 0x28]
mov dword [0x140061d68], eax
lea rcx, [0x140061d6c]
call fcn.14002e25c
jmp 0x14001bd03
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rdx, rdi
cmp rdx, rbp
mov r13, qword [rsp + 0x48]
mov rsi, r8
mov rdi, r9
jbe 0x14001bd89
cmp r12, qword [rsp + 0x38]
jbe 0x14001bf4a
dec qword [rsp + 0x40]
lea r14, [rsp + 0x58]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0x30
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov r9, rsi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x14001bf3c
cmp qword [rsp + 0x58], 0x30
jne 0x14001bf4a
cmp dword [rsp + 0x80], 0x10000
jne 0x14001bf1f
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rax
neg rcx
and rcx, qword [rsp + 0x40]
mov rbp, rax
lea rdx, [rcx + rax]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rdx
cmp rdi, rcx
jb 0x14001bf29
test rbx, rbx
je 0x14001bf29
jmp 0x14001be03
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rbp, rdi
mov qword [rsp + 0x38], rbp
cmp rbp, r12
jb 0x14001bea6
jmp 0x14001bf4a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x14001be03
Function at 0x14001bfc0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140061078]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14001bffe
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14001bff7
call fcn.1400033b0
jmp 0x14001bfde
Function at 0x140023b40
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 8
cmp qword [r8 + 0x18], 8
jb 0x140023b69
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140023bae
cmp dword [rsp + 0x38], 0xb
jne 0x140023bd3
mov rax, qword [rsp + 0x40]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
jmp 0x140023bbd
cmp eax, 2
jne 0x140023bf1
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002f4d0
mov rax, rsi
add rsp, 0x50
pop rsi
ret
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000042
mov qword [rsi + 8], rax
jmp 0x140023bbd
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3e
mov dword [rsi + 0xc], ecx
jmp 0x140023bbd

Function at 0x140024360
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
cmp qword [r8 + 0x18], 8
jb 0x140024387
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edi, edi
mov rdx, r8
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400243cf
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002f4d0
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], pe_nt_image_headers64
mov dword [rsi + 0xc], ecx
mov dil, 1
jmp 0x1400243b4

Function at 0x140024a10
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
lea rcx, sym.firefox.exe_Ordinal_0
and rcx, 0xfffffffffffffffc
mov qword [rax], rcx
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov byte [rax + 0x18], 0
je 0x140024a99
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x140024a99
lea r8, [rax + 8]
movsxd r9, dword [rcx + 0x3c]
lea r10, [rcx + r9]
mov qword [r8], r10
cmp dword [rcx + r9], 0x4550
jne 0x140024a99
movzx edx, word [r10 + 0x18]
cmp edx, 0x20b
jne 0x140024a99
mov r8d, dword [r10 + 0x50]
cmp r8d, 0x148
jb 0x140024a99
lea edx, [r8 - 1]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov ecx, dword [r10 + 0x84]
cmp ecx, 0x10
mov edx, 0x10
cmovb edx, ecx
cmp edx, 2
jb 0x140024a99
cmp dword [r10 + 0x90], r8d
setae byte [rax + 0x18]
ret
Function at 0x140024b20
Capabilities:
Map section object

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dword [rdx], 0
je 0x140024bd5
mov ebp, r8d
mov rdi, rdx
mov rcx, qword [0x140061dc0]
xor eax, eax
lea r8, [rsp + 0x50]
mov qword [r8], rax
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov rdx, 0xffffffffffffffff
xor r9d, r9d
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jns 0x140024ba8
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140024bde
cmp dword [rbx + 0x2c], 0
je 0x140024c0b
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007139f000000d6
jmp 0x140024c60
mov byte [rsi + 0x10], 0
jmp 0x140024c8c
call sub.ntdll.dll_RtlGetLastWin32Error
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0xcf
mov dword [rsi + 0xc], ecx
jmp 0x140024c64
movzx eax, bpl
mov dword [rbx + 0x28], eax
mov r8d, dword [rdi]
cmp r8, 0xfc8
ja 0x140024c48
lea rcx, [rbx + 0x38]
mov rdx, qword [rdi + 8]
call sub.ntdll.dll_memcpy
mov eax, dword [rdi]
test eax, eax
je 0x140024c48
cmp eax, 0x21
mov ecx, 0x20
cmovae ecx, eax
add ecx, 0x38
mov dword [rbx + 0x2c], ecx
mov byte [rsi + 0x10], 0
jmp 0x140024c64
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007007a000000df
mov qword [rsi + 8], rax
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140024c8c
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jns 0x140024c8c
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002f4d0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140025b50
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, rdx
mov rbp, rcx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rsi, [rsp + 0x28]
mov qword [rsi], 0
lea rcx, [0x140053020]
mov edx, 0x5100
xor r8d, r8d
mov r9, rsi
call sub.SHELL32.dll_SHGetKnownFolderPath
mov r14, qword [rsi]
test eax, eax
js 0x140025d41
xor esi, esi
lea rcx, [rsp + 0x50]
mov qword [rcx + 0x10], rsi
mov edi, 7
mov qword [rcx + 0x18], rdi
mov word [rcx], si
mov rdx, r14
call fcn.14000caa0
mov qword [rsp + 0x20], rsi
lea r12, [rsp + 0x30]
mov qword [r12 + 0x10], rsi
mov qword [r12 + 0x18], rdi
mov word [r12], si
mov rdx, qword [rbp + 0x38]
mov rcx, r12
call fcn.140025d90
mov rsi, qword [rbp + 0x38]
cmp qword [rbp + 0x40], 8
jb 0x140025bf8
mov rbp, qword [rbp + 0x28]
jmp 0x140025bfc
add rbp, 0x28
test rsi, rsi
je 0x140025c53
add rsi, rsi
xor edi, edi
mov r13, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rbp + rdi]
call r13
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x140025d2a
lea rbx, [rcx + 1]
mov qword [rsp + 0x40], rbx
mov rbx, r12
cmp rdx, 8
jb 0x140025c3f
mov rbx, qword [rsp + 0x30]
mov word [rbx + rcx*2], ax
mov word [rbx + rcx*2 + 2], 0
add rdi, 2
cmp rsi, rdi
jne 0x140025c0d
cmp qword [rsp + 0x48], 8
jb 0x140025c62
mov rcx, qword [rsp + 0x30]
jmp 0x140025c67
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.140025f30
test al, al
je 0x140025d69
lea rdx, [0x140059198]
lea rsi, [rsp + 0x50]
mov r8d, 0x1b
mov rcx, rsi
call fcn.14000a1e0
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14000a1e0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [r15 + 0x10], xmm1
movups xmmword [r15], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 7
mov word [rsi], 0
xor eax, eax
mov byte [r15 + 0x20], al
lea rcx, [rsp + 0x30]
call fcn.14001ea50
test rdi, rdi
je 0x140025cf1
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
lea rcx, [rsp + 0x50]
call fcn.14001ea50
test r14, r14
je 0x140025d09
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002f4d0
mov rax, r15
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x30]
mov edx, 1
mov r9d, eax
call fcn.140010fa0
jmp 0x140025c4a
mov edi, eax
mov rcx, r14
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [r15 + 0x20], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [r15], rax
mov dword [r15 + 8], 0x254
mov dword [r15 + 0xc], edi
jmp 0x140025d09
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [r15], rax
movabs rax, 0x8007000d00000261
mov qword [r15 + 8], rax
mov al, 1
mov rdi, qword [rsp + 0x20]
jmp 0x140025cd5
Function at 0x140026b50
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x240
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x238], rax
mov eax, dword [0x140061a98]
mov ecx, dword [0x1400614b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140026bd0
lea rcx, [0x140061a98]
call fcn.14002e2bc
cmp dword [0x140061a98], 0xffffffff
jne 0x140026bd0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140061a90], rax
lea rcx, [0x140061a98]
call fcn.14002e25c
cmp qword [0x140061a90], 0
je case.default.0x140026c04
lea rsi, str.user32.dll
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.14002f4d0
mov rcx, rsi
xor edx, edx
mov r8d, 0x800
add rsp, 0x240
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp ecx, 0xf9
ja 0x140026c43
mov eax, eax
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x140026c45
cmp eax, 0xf9
ja 0x140026c43
mov word [rsp + rax*2 + 0x20], 0x5c
inc rax
jmp 0x140026c45
xor eax, eax
lea rsi, [rsp + rax*2]
add rsi, 0x20
lea rdx, str.user32.dll
mov r8d, 0xa
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rsi + 0x14], 0
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.14002f4d0
nop
add rsp, 0x240
pop rsi
ret
invalid

Function at 0x1400276c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140061d64]
mov ecx, dword [0x1400614b0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140027710
mov esi, dword [0x140061d60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002f4d0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140061d64]
call fcn.14002e2bc
cmp dword [0x140061d64], 0xffffffff
jne 0x1400276f5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x140061d60], eax
lea rcx, [0x140061d64]
call fcn.14002e25c
jmp 0x1400276f5
Function at 0x14002a140
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebp, r9d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r12d, dword [rsp + 0x80]
mov eax, dword [0x140061de0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x14002a19b
cmp byte [0x140061de4], 0
je 0x14002a19b
mov eax, dword [0x1400614b0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
jmp 0x14002a1a0
call fcn.14002aff0
mov qword [rsi], rax
lea r14, [rsi + 8]
xor eax, eax
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], al
mov dword [rsi + 0x14], ebp
lea rcx, [rsi + 0x18]
mov qword [rsi + 0x20], rax
mov rdx, qword gs:[0x30]
mov edx, dword [rdx + 0x48]
mov dword [rsi + 0x28], edx
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
lea r15, [rsi + 0x40]
movups xmm1, xmmword [rbx]
movups xmmword [rsi + 0x40], xmm1
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov qword [rsi + 0x50], rdi
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x58], 8
mov dword [rsi + 0x70], r12d
mov byte [rsi + 0x74], al
call sub.ntdll.dll_RtlQueryPerformanceCounter
mov eax, dword [0x140061de0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
jne 0x14002a220
mov rcx, rsi
call fcn.14002b000
jmp 0x14002a25a
cmp byte [0x140061de4], 0
jne 0x14002a240
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je 0x14002a28a
mov byte [0x140061de4], 1
mov eax, dword [0x1400614b0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], rsi
lea rcx, [0x140061058]
mov rax, qword [0x140061058]
mov rax, qword [rax + 0x40]
mov rdx, r14
mov r8, r15
call qword [case.0x14002eb7e.0]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [0x140061de0], eax
jmp 0x14002a216
Function at 0x140030ee0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140030f17
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140030f17
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140030f17
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x140030f16

Function at 0x140031920
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14003195f
call fcn.140031a70
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002f4d0
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [str.kernel32ext_ms_win_ntuser_windowstation_l1_1_0]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140063aa8], 0
jne 0x14003199d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140063aa8], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140063af8]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140063a88]
mov qword [r8 + 8], rsi
lea rax, [0x140056860]
mov qword [r8 + 0x10], rax
lea rax, [0x140051090]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140063b00]
lea rdx, [0x140051130]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140031946
cmp qword [rsp + 0x28], 0
je 0x140031946
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140063b08]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x140056850]
mov qword [r8 + 0x10], rax
lea rax, [0x1400510c0]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140063b10]
lea rdx, [0x140051130]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140031946
cmp qword [rsp + 0x28], 0
jne 0x14003194b
jmp 0x140031946

Function at 0x140031ed0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
cmp qword [r8 + 0x18], 8
jb 0x140031ef7
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor edi, edi
mov rdx, r8
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140031f3f
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002f4d0
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], pe_nt_image_headers64
mov dword [rsi + 0xc], ecx
mov dil, 1
jmp 0x140031f24
Function at 0x1400323f0
Capabilities:
Delete registry value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [r8 + 0x18], 8
jb 0x140032402
mov r8, qword [r8]
mov rcx, qword [rdx]
mov rdx, r8
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x140032423
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
mov rax, rsi
add rsp, 0x20
pop rsi
ret
test eax, eax
jne 0x140032430
mov byte [rsi + 0x10], 0
mov byte [rsi], 1
jmp 0x14003241a
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x86
mov dword [rsi + 0xc], ecx
jmp 0x14003241a
Function at 0x1400328b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov ebp, r9d
mov r14, rdx
mov r15, rcx
mov rdi, qword [rsp + 0x120]
mov rax, qword [0x140061018]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rsi, [rsp + 0x60]
mov qword [rsi - 0x10], r8
lea rax, sym.firefox.exe_Ordinal_0
and rax, 0xfffffffffffffffc
mov qword [rsi - 8], rax
mov rcx, rsi
call fcn.140024a10
mov qword [rsi + 0x20], 0
cmp qword [rsi + 0x10], 0
je 0x140032ad1
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400256d0
cmp byte [rsi + 0x10], 0
jne 0x140032af0
cmp byte [rdi + 0x20], 0
je 0x140032a40
lea rsi, [rsp + 0x88]
mov dword [rsi], 4
mov qword [rsp + 0x30], rsi
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableThirdPartyModuleBlocking
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140032ac1
mov dword [rsp + 0x88], 4
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableThirdPartyModuleBlocking
mov rcx, 0xffffffff80000001
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140032ac1
cmp byte [rdi + 0x20], 0
je 0x140032b03
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x1400329e6
mov rdx, qword [rdi]
lea rsi, [rsp + 0x40]
mov dword [rsi], 0
mov qword [rsi + 8], 0
mov rcx, rsi
call fcn.1400252e0
lea rbx, [rsp + 0x88]
mov rcx, rbx
mov rdx, rsi
mov r8d, ebp
call fcn.140024b20
mov al, byte [rbx + 0x10]
mov byte [rsp + 0xb0], al
test al, al
jne 0x140032b0e
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0
test rcx, rcx
jne 0x140032b51
lea r9, [0x140061dc0]
lea rsi, [rsp + 0x88]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, 0xc0000000
call fcn.140011690
cmp byte [rsi + 0x10], 0
jne 0x140032b5c
xor eax, eax
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], al
lea r8, [rsp + 0x50]
mov rcx, r15
mov rdx, r14
xor r9d, r9d
call fcn.1400117d0
xor ecx, ecx
call fcn.140024aa0
cmp byte [rdi + 0x20], 0
je 0x140032a9e
mov rcx, rdi
call fcn.14001ea50
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14002f4d0
mov rax, r15
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp dword [rsp + 0x40], 1
jne 0x1400329cf
jmp 0x140032a40
mov byte [r15 + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_DllBlocklistInit.cpp
mov qword [r15], rax
movabs rax, 0x800700c1000000c6
mov qword [r15 + 8], rax
jmp 0x140032a90
mov byte [r15 + 0x10], 1
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [r15], xmm0
jmp 0x140032a90
int3
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0xa0], xmm0
mov byte [r15 + 0x10], 1
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [r15], xmm0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x140032a90
call qword [sym.imp.mozglue.dll_free]
jmp 0x140032a90
call qword [sym.imp.mozglue.dll_free]
jmp 0x140032a40
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [r15], xmm0
mov byte [r15 + 0x10], 1
jmp 0x140032a90