joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d630
Capabilities:
Access peb ldr_data
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rcx], rdx
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 2
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [0x140063af4]
mov ecx, dword [0x1400614b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001d75c
mov ebx, dword [0x140063af0]
lea rax, [r15 + r14]
dec rax
xor edx, edx
div rbx
mov r14, rax
mov rax, r15
xor edx, edx
div rbx
inc r14
sub r14, rax
je 0x14001d73b
mov r15, rax
lea rax, [rsi + 8]
mov qword [rsp + 0x28], rax
imul r15, rbx
cmp r14, 1
adc r14, 0
lea r13, [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001d7a5
mov qword [rsp + 0x20], r13
mov rdx, r15
mov r8, rbx
mov r9d, 0x40
call rbp
test eax, eax
je 0x14001d79d
mov r12d, dword [rsp + 0x30]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
je 0x14001d7af
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], r12d
mov qword [rcx + rax + 8], r15
inc qword [rsi + 0x10]
add r15, rbx
dec r14
jne 0x14001d6e4
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002ba20
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140063af4]
call fcn.14002af90
cmp dword [0x140063af4], 0xffffffff
jne 0x14001d69b
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x140063af0], eax
lea rcx, [0x140063af4]
call fcn.14002aff8
jmp 0x14001d69b
mov dword [rsp + 0x30], 0
mov rcx, rsi
call fcn.14001d7d0
jmp 0x14001d73b
mov rcx, qword [rsp + 0x28]
call fcn.140033430
test al, al
je 0x14001d7a5
mov rax, qword [rsi + 0x10]
jmp 0x14001d71e
Function at 0x14001d7d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140063af4]
mov ecx, dword [0x1400614b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001d886
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x14001d860
mov r14, qword [rsi + 8]
mov edi, dword [0x140063af0]
shl rbx, 4
xor r15d, r15d
lea r12, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rsi]
mov rcx, qword [rax]
test rcx, rcx
je 0x14001d857
mov rdx, qword [r14 + r15 + 8]
mov r9d, dword [r14 + r15]
mov qword [rsp + 0x20], r12
mov r8, rdi
call r13
add r15, 0x10
cmp rbx, r15
jne 0x14001d838
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140063af4]
call fcn.14002af90
cmp dword [0x140063af4], 0xffffffff
jne 0x14001d812
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140063af0], eax
lea rcx, [0x140063af4]
call fcn.14002aff8
jmp 0x14001d812
Function at 0x140022180
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x40]
mov dword [rdi], 4
mov qword [rsp + 0x30], rdi
lea r14, [rsp + 0x4c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000002
mov r8, rsi
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [r14], 1
sete bl
test eax, eax
je 0x1400222bf
mov dword [rsp + 0x4c], 8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000002
mov r8, rsi
mov r9d, 0x48
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp qword [rsp + 0x40], 1
sete bl
test eax, eax
je 0x1400222bf
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000001
mov r8, rsi
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [rsp + 0x4c], 1
sete bl
test eax, eax
je 0x1400222bf
mov dword [rsp + 0x4c], 8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000001
mov r8, rsi
mov r9d, 0x48
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
sete al
cmp qword [rsp + 0x40], 1
sete bl
and bl, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002ba20
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140023bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 8
cmp qword [r8 + 0x18], 8
jb 0x140023be9
mov r8, qword [r8]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140023c2e
cmp dword [rsp + 0x38], 0xb
jne 0x140023c51
mov rax, qword [rsp + 0x40]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
jmp 0x140023c3d
cmp eax, 2
jne 0x140023c6f
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0x50
pop rsi
ret
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000043
mov qword [rsi + 8], rax
jmp 0x140023c3d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3f
mov dword [rsi + 0xc], ecx
jmp 0x140023c3d
Function at 0x1400277a0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov bpl, byte [rsp + 0x88]
mov r12d, dword [rsp + 0x80]
mov eax, dword [0x140061db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x140027824
cmp byte [0x140061db4], 1
jne 0x140027824
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x140027808
call fcn.14002b198
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x10]
jmp 0x140027829
call fcn.140026150
mov qword [rsi], rax
lea rdi, [rsi + 8]
xor eax, eax
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
mov dword [rsi + 0x14], ebx
lea rcx, [rsi + 0x18]
mov qword [rsi + 0x20], rax
mov rdx, qword gs:[0x30]
mov edx, dword [rdx + 0x48]
mov dword [rsi + 0x28], edx
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
lea rbx, [rsi + 0x40]
movups xmm1, xmmword [r15]
movups xmmword [rsi + 0x40], xmm1
mov dword [r15], 0
mov qword [r15 + 8], rax
mov qword [rsi + 0x50], r14
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x58], 8
mov dword [rsi + 0x70], r12d
mov byte [rsi + 0x74], bpl
call sub.ntdll.dll_RtlQueryPerformanceCounter
mov eax, dword [0x140061db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
jne 0x1400278ad
mov rcx, rsi
call fcn.140024280
jmp 0x140027908
cmp byte [0x140061db4], 1
je 0x1400278cd
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je 0x140027938
mov byte [0x140061db4], 1
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x1400278ee
call fcn.14002b198
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x10], rsi
lea rcx, [0x140061060]
mov rax, qword [0x140061060]
mov rax, qword [rax + 0x40]
mov rdx, rdi
mov r8, rbx
call qword [0x140067010]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [0x140061db0], eax
jmp 0x1400278a3
Function at 0x1400282e0
Capabilities:
Map section object

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dword [rdx], 0
je 0x140028397
mov ebx, r8d
mov rdi, rdx
mov rcx, qword [0x140061d80]
xor eax, eax
lea r8, [rsp + 0x50]
mov qword [r8], rax
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov rdx, 0xffffffffffffffff
xor r9d, r9d
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jns 0x140028369
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov r14, qword [rsp + 0x50]
test r14, r14
je 0x1400283a0
cmp dword [r14 + 0x2c], 0
je 0x1400283cd
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007139f000000d8
jmp 0x140028423
mov byte [rsi + 0x10], 0
jmp 0x14002844f
call sub.ntdll.dll_RtlGetLastWin32Error
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0xd1
mov dword [rsi + 0xc], ecx
jmp 0x140028427
movzx eax, bl
mov dword [r14 + 0x28], eax
mov r8d, dword [rdi]
cmp r8, 0xfc8
ja 0x14002840b
lea rcx, [r14 + 0x38]
mov rdx, qword [rdi + 8]
call sub.ntdll.dll_memcpy
mov eax, dword [rdi]
test eax, eax
je 0x14002840b
cmp eax, 0x21
mov ecx, 0x20
cmovae ecx, eax
add ecx, 0x38
mov dword [r14 + 0x2c], ecx
mov byte [rsi + 0x10], 0
jmp 0x140028427
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007007a000000e1
mov qword [rsi + 8], rax
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14002844f
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jns 0x14002844f
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002c160
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rcx + 8]
lea rbx, [r14 + 2]
call fcn.140009d40
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
je 0x14002c1a3
mov rcx, rbx
call fcn.14002c040
test al, al
je 0x14002c1f6
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140009960
mov rax, qword [rdi]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002c3b0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140063af4]
mov ecx, dword [0x1400614b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002c453
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x14002c42f
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140063af0]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x14002c416
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140063af4]
call fcn.14002af90
cmp dword [0x140063af4], 0xffffffff
jne 0x14002c3f0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140063af0], eax
lea rcx, [0x140063af4]
call fcn.14002aff8
jmp 0x14002c3f0
Function at 0x14002c640
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x14002c669
mov r8, qword [r8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c6c0
cmp dword [rsp + 0x3c], 4
jne 0x14002c6d2
mov eax, dword [rsp + 0x44]
mov byte [rsi + 0x10], 0
bts rax, 0x20
mov qword [rsi], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0x50
pop rsi
ret
cmp eax, 2
jne 0x14002c6f0
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
jmp 0x14002c6ac
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000043
mov qword [rsi + 8], rax
jmp 0x14002c6ac
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3f
mov dword [rsi + 0xc], ecx
jmp 0x14002c6ac

Function at 0x14002ca80
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14002cad2
call fcn.14002cca0
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov rcx, rax
mov rax, rdx
call qword [0x140067010]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [0x1400522c0]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140063a80], 0
jne 0x14002cb10
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140063a80], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140063ad0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140063a60]
mov qword [r8 + 8], rsi
lea rax, [0x140055f48]
mov qword [r8 + 0x10], rax
lea rax, [0x140050c60]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140063ad8]
lea rdx, [0x140050790]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14002caa6
cmp qword [rsp + 0x28], 0
je 0x14002caa6
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140063ae0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x140055f38]
mov qword [r8 + 0x10], rax
lea rax, [0x140050ca0]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140063ae8]
lea rdx, [0x140050790]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14002caa6
cmp qword [rsp + 0x28], 0
jne 0x14002cabe
jmp 0x14002caa6
Function at 0x14002e6b0
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14002e6e2
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x14002e6e2
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x14002e6e2
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x14002e6e1

Function at 0x14002f580
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14002f5c2
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14002ba20
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.140005980
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.14003bb30
lea rcx, [rsp + 0x20]
call fcn.140039cb0
jmp 0x14002f5a8
Function at 0x140030660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x160], rax
test dl, dl
je 0x140030850
lea rax, str.TargetNtMapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x1400540c0]
lea r8, [0x140055760]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.14000f570
lea rax, str.TargetNtUnmapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, [0x14005574b]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.14000f570
mov rax, qword [rsi]
mov rdi, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, rdi
xor edx, edx
mov r9d, 0x2000
call r13
mov r14, rax
mov r12, qword [rsi + 0x10]
shl r12, 6
lea rbx, [r12 + 0x60]
mov rcx, rbx
call fcn.1400193a0
mov r15, rax
mov edx, r15d
and edx, 0xfffff000
add rdx, r14
and r15d, 0xfff
add r12, 0x105f
and r12, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, rdi
mov r8, r12
mov r9d, 0x1000
call r13
mov r14, rax
test rax, rax
je 0x14003085f
add r14, r15
lea r15, [rsp + 0x48]
mov qword [r15], rbx
mov dword [r15 + 0x18], 0
mov qword [r15 + 8], 0x20
lea rcx, [sym.firefox.exe_g_originals]
mov r8d, 0x158
xor edx, edx
call sub.ntdll.dll_memset
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9, r15
call fcn.14000fb90
test eax, eax
jne 0x140030828
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov r9d, 0x20
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, 0x2a
test eax, eax
je 0x14003082a
cmp qword [rsp + 0x40], 0x20
jne 0x14003082a
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8, rbx
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsi]
lea rdx, str.g_originals
lea r8, [sym.firefox.exe_g_originals]
mov r9d, 0x158
call fcn.1400173f0
mov ebp, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14002ba20
mov eax, ebp
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [rsi + 0x10], 0
jne 0x1400306ef
xor ebp, ebp
jmp 0x14003082a
lea r12, [rsp + 0x50]
mov dword [r12 - 8], 3
mov rcx, r12
call fcn.140005980
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
mov qword [r12 + 0xf0], rax
mov dword [r12 + 0xf8], 0x188
lea rcx, [rsp + 0x158]
call fcn.14003bb30
lea rcx, [rsp + 0x48]
call fcn.140039cb0
jmp 0x140030777
Function at 0x140030fa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov r15, qword [rcx]
mov r14, qword [r15 + 0x40]
lea rbx, [r14 + 2]
call fcn.140009d40
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
jne 0x140031034
mov rcx, qword [rdi]
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x40]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14001d630
mov rax, qword [r15]
mov rcx, qword [rax]
mov rdx, rbx
call fcn.140030e40
mov rcx, qword [rdi]
test al, al
jne 0x140030fdf
mov rax, qword [rcx]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400318e0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
je 0x14003197e
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x140031930
mov rcx, rdi
call fcn.140020f10
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x1400319a1
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x140031948
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
jne 0x1400319e5
lea rcx, [rsi + 0x28]
call fcn.14000b6f0
lea rcx, [rsi + 0x20]
call fcn.14000b6f0
lea rcx, [rsi + 0x18]
call fcn.14000b6f0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140017cb0
test rcx, rcx
jne 0x1400318f6
cmp dword [rsi + 0x14], 0
jne 0x1400318f6
cmp qword [rsi + 8], 0
jne 0x1400318f6
jmp 0x14003190f
mov rdx, qword [rsi + 0x68]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400319c9
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400319fa
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x58]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x140031939
mov rcx, rdi
call fcn.140020f10
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x140031955
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3