joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fc40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov r15, qword [rcx]
mov r14, qword [r15 + 0x40]
lea rbx, [r14 + 2]
call fcn.1400159a0
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
jne 0x14002fcd4
mov rax, qword [rdi]
mov rdx, qword [rax]
mov r8, qword [rax + 0x40]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140015350
mov rax, qword [r15]
mov rcx, qword [rax]
mov rdx, rbx
call fcn.1400348c0
test al, al
jne 0x14002fc7c
mov rax, qword [rdi]
mov rax, qword [rax]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400303d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
je 0x14003046e
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x140030420
mov rcx, rdi
call fcn.140018b90
mov rcx, rdi
call fcn.140051c60
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x140030493
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x140030438
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
jne 0x1400304d7
lea rcx, [rsi + 0x28]
call fcn.1400092e0
lea rcx, [rsi + 0x20]
call fcn.1400092e0
lea rcx, [rsi + 0x18]
call fcn.1400092e0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140009690
test rcx, rcx
jne 0x1400303e6
cmp dword [rsi + 0x14], 0
jne 0x1400303e6
cmp qword [rsi + 8], 0
je 0x1400303ff
xor ecx, ecx
jmp 0x1400303e6
mov rdx, qword [rsi + 0x68]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400304bb
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400304ec
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x58]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x140030429
mov rcx, rdi
call fcn.140018b90
mov rcx, rdi
call fcn.140051c60
jmp 0x140030445
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140031d00
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140031d52
call fcn.140031e60
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov rcx, rax
mov rax, rdx
call qword [0x140068010]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [0x1400532f0]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140064a80], 0
jne 0x140031d90
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140064a80], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140064ad0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140064a60]
mov qword [r8 + 8], rsi
lea rax, [0x140056c63]
mov qword [r8 + 0x10], rax
lea rax, [0x140051b00]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140064ad8]
lea rdx, [0x140051180]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140031d26
cmp qword [rsp + 0x28], 0
je 0x140031d26
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140064ae0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x140056c53]
mov qword [r8 + 0x10], rax
lea rax, [0x140051b40]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140064ae8]
lea rdx, [0x140051180]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140031d26
cmp qword [rsp + 0x28], 0
jne 0x140031d3e
jmp 0x140031d26

Function at 0x1400322b0
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400323b0
cmp byte [rbx + 0x10], 0
jne 0x1400322ea
cmp dword [rsp + 0x20], 2
je 0x14003239b
mov rcx, rdi
call fcn.14001db60
cmp qword [rax + 0x18], 8
jb 0x1400322fc
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x140032363
mov rcx, rdi
call fcn.14001da80
cmp qword [rax + 0x18], 8
jb 0x140032320
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x140032369
lea rax, [rdi + 0x10]
cmp byte [rdi + 0x18], 0
jne 0x140032395
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
xor eax, eax
mov byte [0x140062d44], al
mov byte [rsi + 0x10], al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
test eax, eax
je 0x14003230e
jmp 0x14003236d
test eax, eax
je 0x140032332
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x87
mov dword [rsi + 0xc], ecx
jmp 0x14003234d
mov byte [rdi + 0x18], 0
jmp 0x14003233c
mov byte [rsi + 0x10], 0
jmp 0x14003234d
Function at 0x140033810
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x10048
call fcn.14002c5b0
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x10040], rax
lea r8, [rsp + 0x38]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003389c
lea rdi, [rsp + 0x40]
lea rbx, [rsp + 0x34]
mov r14, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x10000
mov r9, rbx
call r14
test eax, eax
je 0x140033888
cmp dword [rsp + 0x34], 0x10000
je 0x14003385f
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x10048
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140034cf0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x228
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x220], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001d630
lea rdx, [rsp + 0x138]
mov rcx, rbx
call fcn.140034eb0
lea rbx, [rsp + 0x138]
mov rcx, rbx
call fcn.14001d630
lea r14, [rsp + 0x120]
mov rcx, rbx
mov rdx, r14
call fcn.140034f30
cmp byte [r14 + 0x10], 0
jne 0x140034e3b
cmp byte [rsp + 0x120], 0
je 0x140034e3b
lea rcx, str.MOZ_DISABLE_POISON_IO_INTERPOSER1
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov ecx, 0x38
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
xor r12d, r12d
mov ecx, 8
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbx + 0x10], rax
lea r15, [rbx + 0x18]
test rdi, rdi
lea r14, [0x140057bde]
cmovne r14, rdi
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x28], r12
mov qword [rbx + 0x30], 0xf
mov byte [rbx + 0x18], 0
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
cmp rax, 0xf
jbe 0x140034deb
mov rcx, r15
mov rdx, rdi
mov r8, r14
call fcn.140024050
jmp 0x140034e02
mov qword [rbx + 0x28], rdi
mov rcx, r15
mov rdx, r14
mov r8, rdi
call sub.ntdll.dll_memcpy
mov byte [rbx + rdi + 0x18], 0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140034fe0]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
jne 0x140034e7c
lea rcx, [rsp + 0x30]
call fcn.140036fa0
lea rcx, [rsp + 0x138]
call fcn.14001ec10
mov rcx, rsi
call fcn.140037030
lea rcx, [rsp + 0x38]
call fcn.14001ec10
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x228
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rsi, [rsp + 0x30]
mov qword [rsi], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140036fa0
lea rcx, [rsp + 0x138]
call fcn.14001ec10
jmp 0x140034e50
Function at 0x140037030
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
lea rdx, str.Firefox_Launcher
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x1400370f0
mov rsi, rax
mov rcx, qword [rdi]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r15, rax
lea r14, [rax + 8]
mov rcx, r14
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.ntdll.dll_memset
mov ebp, dword [rdi + 0xc]
mov dword [rbx], ebp
mov eax, dword [rdi + 8]
mov dword [rbx + 4], eax
lea rcx, [rbx + 8]
mov rdx, qword [rdi]
mov r8, r15
call sub.ntdll.dll_memcpy
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r12
mov word [rsp + 0x28], 0
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140037380
Capabilities:
Get token membership
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdi, [rsp + 0x3c]
mov dword [rdi], 0x44
lea r8, [rsp + 0x40]
mov ecx, 0x1a
xor edx, edx
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x140037458
lea rbx, [rsp + 0x40]
lea r8, [rsp + 0x38]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400374a1
cmp dword [rsp + 0x38], 0
je 0x1400374bc
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea r8, str.EnableLUA
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400374c5
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x26
jmp 0x140037482
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x14
mov byte [rsi + 0x10], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x19
jmp 0x140037471
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
jmp 0x140037485
cmp dword [rsp + 0x3c], 0
mov byte [rsi + 0x10], 0
sete byte [rsi]
jmp 0x140037485
Function at 0x1400378f0
Capabilities:
Delete file

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [rcx + 9], 0
je 0x140037968
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140037912
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x28]
cmp rax, 8
jb 0x14003794c
mov rcx, qword [rsi + 0x10]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
je 0x140037946
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400379a0
mov rcx, rax
call qword [sym.imp.mozglue.dll_free]
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x28], 7
mov word [rsi + 0x10], 0
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14003797c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x30], 0
cmp qword [rsi + 0x28], 8
jb 0x140037991
mov rcx, qword [rsi + 0x10]
jmp 0x140037995
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400378fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140038210
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x140038239
mov r8, qword [r8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140038290
cmp dword [rsp + 0x3c], 4
jne 0x1400382a2
mov eax, dword [rsp + 0x44]
mov byte [rsi + 0x10], 0
bts rax, 0x20
mov qword [rsi], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x50
pop rsi
ret
cmp eax, 2
jne 0x1400382c0
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
jmp 0x14003827c
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000043
mov qword [rsi + 8], rax
jmp 0x14003827c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3f
mov dword [rsi + 0xc], ecx
jmp 0x14003827c

Function at 0x1400382f0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
cmp qword [r8 + 0x18], 8
jb 0x14003831b
mov r8, qword [r8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edi, edi
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003836d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x79
mov dword [rsi + 0xc], ecx
mov dil, 1
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140038f70
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r12, [rsp + 0x48]
mov dword [r12], 0
mov qword [rsp + 0x30], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, r14
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140038fe1
cmp eax, 2
jne 0x140039063
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
jmp 0x140039089
mov r15d, dword [rsp + 0x48]
add r15, r15
mov rcx, r15
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.ntdll.dll_memset
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, r14
mov r8, rbx
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400390a8
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x68
mov dword [rsi + 0xc], ecx
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
jmp 0x140039089
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x5c
mov dword [rsi + 0xc], ecx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [str.RUNASADMIN]
movaps xmmword [rsp + 0x50], xmm0
movabs rax, 0x4e0049004d
mov qword [rsp + 0x5e], rax
lea rdx, [rsp + 0x4c]
mov dword [rdx], 0x20
lea r8, [rsp + 0x40]
mov qword [r8], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x14003912c
lea rbx, [rsp + 0x50]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
lea r14, [rsp + 0x4c]
lea r15, [rsp + 0x40]
mov r13, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov r8d, 0xb
mov rcx, rax
mov rdx, rbx
call r12
test eax, eax
je 0x14003913a
xor ebp, ebp
xor ecx, ecx
mov rdx, r14
mov r8, r15
call r13
test rax, rax
jne 0x140039105
jmp 0x14003912e
xor ebp, ebp
mov byte [rsi + 0x10], 0
mov byte [rsi], bpl
jmp 0x140039058
mov bpl, 1
jmp 0x14003912e
Function at 0x1400393d0
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x860
mov qword [rsp + 0x888], rdx
mov qword [rsp + 0x890], r8
mov qword [rsp + 0x898], r9
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x858], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140039475
lea rsi, [rsp + 0x888]
mov qword [rsp + 0x28], rsi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.mozglue.dll_protected:_void___cdecl_mozilla::PrintfTarget::constructor_void____ptr64]
lea rax, [0x140053618]
mov qword [rdi], rax
lea rbx, [rsp + 0x50]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x800
lea rdx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rcx, rdi
mov r8, rsi
call qword [sym.imp.mozglue.dll_public:_bool___cdecl_mozilla::PrintfTarget::vprint_char_const____ptr64__char____ptr64____ptr64]
mov rax, qword [rdi + 8]
mov ecx, 0x7ff
cmp rax, rcx
cmovb rcx, rax
mov byte [rsp + rcx + 0x50], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
cmp eax, 0xfffffffe
je 0x1400394e3
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
lea rdx, [0x140057240]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
test rax, rax
je 0x1400394e3
mov rsi, rax
lea rdi, [rsp + 0x888]
mov qword [rsp + 0x50], rdi
call fcn.140003fd0
mov rcx, qword [rax]
mov qword [rsp + 0x20], rdi
lea r8, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x860
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003bb50
Capabilities:
Read file via mapping

Disassembly:
test rdx, rdx
je 0x14003bb6d
mov rax, qword [rcx]
test rax, rax
je 0x14003bb6d
cmp rax, 0xffffffffffffffff
je 0x14003bb6d
cmp qword [rcx + 0x10], rdx
jae 0x14003bdf0
xor eax, eax
ret
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
cmp dword [rcx + 8], 0
mov r14, rdx
setne al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rdx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
je 0x14003be91
lea rdi, [rsp + 0x30]
mov r8d, 0x30
mov rcx, r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rdi + 0x18]
sub rcx, r15
add rcx, qword [rdi + 8]
test rax, rax
cmove rcx, rax
mov qword [rsi], rcx
mov bl, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002c610
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r14
xor ebx, ebx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
jne 0x14003be47
jmp 0x14003be75

Function at 0x14003bdf0
Capabilities:
Read file via mapping

Disassembly:
test rdx, rdx
je 0x14003bb6d
mov rax, qword [rcx]
test rax, rax
je 0x14003bb6d
cmp rax, 0xffffffffffffffff
je 0x14003bb6d
cmp qword [rcx + 0x10], rdx
jae 0x14003bdf0
xor eax, eax
ret
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rdi, r8
mov rbx, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
cmp dword [rcx + 8], 0
mov r14, rdx
setne al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rdx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
je 0x14003be91
lea rdi, [rsp + 0x30]
mov r8d, 0x30
mov rcx, r15
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rdi + 0x18]
sub rcx, r15
add rcx, qword [rdi + 8]
test rax, rax
cmove rcx, rax
mov qword [rsi], rcx
mov bl, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002c610
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r14
xor ebx, ebx
mov edx, ebp
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov qword [rdi], rax
test rax, rax
jne 0x14003be47
jmp 0x14003be75

Function at 0x14003d6b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140062080]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14003d6e0
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14003d6e0
mov rax, qword [rax + rcx]
jmp 0x14003d6e2
xor eax, eax
add rsp, 0x20
pop rsi
ret