joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010340
Capabilities:
Check for software breakpoints
Get system information on windows
Parse credit card information

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140010386
mov r15, qword [r14 + 0x20]
lea rcx, [0x140059960]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140010386
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400103b0
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1400338d6
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.14002e7b0
test al, al
je 0x1400338d6
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400338d6
mov r14, rax
mov rcx, rax
call fcn.14002e7b0
test al, al
je 0x1400338d6
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140010340
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x1400103b0
Capabilities:
Check for software breakpoints
Get system information on windows
Parse credit card information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
mov qword [rsp + 0x40], r9
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
cmp byte [rcx + 0x1c], 0
je 0x140011be2
mov rsi, r8
mov r14, rdx
mov rbx, rcx
mov r15d, dword [rcx + 0x18]
test r15b, 4
jne 0x140012087
mov rcx, r14
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], r14
mov dword [rsp + 0x108], 0
jmp 0x140010452

Function at 0x140013f40
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x14001413e
mov rdi, rcx
mov ebp, dword [rcx + 0x18]
shl ebp, 7
mov edx, ebp
or edx, 0x7f
mov ecx, dword [rcx + 0x14]
cmp edx, ecx
jb 0x140014008
cmp ecx, dword [rdi + 0x10]
jae 0x14001413e
mov eax, dword [0x140064ae4]
mov ecx, dword [0x1400624d0]
mov rdx, qword gs:[0x58]
invalid

Function at 0x140016e20
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
lea rcx, [0x140000000]
and rcx, 0xfffffffffffffffc
mov qword [rax], rcx
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov byte [rax + 0x18], 0
je 0x140016eac
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x140016eac
lea r8, [rax + 8]
movsxd r9, dword [rcx + 0x3c]
lea rdx, [rcx + r9]
mov qword [r8], rdx
cmp dword [rcx + r9], 0x4550
jne 0x140016eac
movzx r8d, word [rdx + 0x18]
cmp r8d, 0x20b
jne 0x140016eac
mov r8d, dword [rdx + 0x50]
cmp r8d, 0x148
jb 0x140016eac
lea r9d, [r8 - 1]
add rcx, r9
mov qword [rax + 0x10], rcx
mov ecx, dword [rdx + 0x84]
cmp ecx, 0x10
mov r9d, 0x10
cmovb r9d, ecx
cmp r9d, 2
jb 0x140016eac
cmp dword [rdx + 0x90], r8d
setae byte [rax + 0x18]
ret
Function at 0x140018630
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp byte [rcx + 0x6c], 0
je 0x1400187bb
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x60]
lea rbx, [rsp + 0x20]
lea r9, [rsp + 0x2c]
mov rcx, rbx
mov r8d, 2
call fcn.14001d970
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400187c2
cmp dword [rbx], 0
je 0x140018786
lea r14, [rdi + 0x30]
xor r12d, r12d
xorps xmm6, xmm6
lea r15, [rsp + 0x30]
mov rax, r12
shl rax, 4
test dword [rbx + rax + 0x10], 0xc0000020
jne 0x140018714
lea r13, [rbx + rax]
add r13, 8
test rsi, rsi
je 0x1400186d1
mov rax, qword [rsi]
cmp qword [rsi + 8], rax
jne 0x140018720
mov r8, qword [r13]
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x70], 0
mov ecx, 0x44
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_CopySid]
mov rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x40]
jne 0x14001876e
mov rcx, r14
mov r8, r15
call fcn.14001c110
inc r12
mov eax, dword [rbx]
cmp r12, rax
jb 0x1400186aa
jmp 0x140018786
mov ebp, 1
xor ecx, ecx
mov rdx, qword [r13]
mov r8, rcx
shl r8, 6
lea rcx, [r8 + rcx*4]
add rcx, rax
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x140018714
mov ecx, ebp
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, rax
sar rdx, 2
movabs r8, 0xf0f0f0f0f0f0f0f1
imul rdx, r8
inc ebp
cmp rdx, rcx
jbe 0x1400186d1
jmp 0x140018727
mov r8d, 0x44
mov rcx, rdx
mov rdx, r15
call sub.ntdll.dll_memcpy
add qword [rdi + 0x38], 0x44
jmp 0x140018714
mov rcx, rbx
call sub.mozglue.dll_void___cdecl_operator_delete___void____ptr64_
xor esi, esi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002ba50
mov eax, esi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 0x3f0
jmp 0x140018790
mov esi, dword [rsp + 0x2c]
jmp 0x140018790

Function at 0x14001e5e0
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140064a40]
test rax, rax
je 0x14001e623
mov rax, qword [0x140064a40]
test rax, rax
je 0x14001e670
mov rcx, qword [0x140064a40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
je 0x14001e673
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140055ac0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14001e676
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x14001e676
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x14001e676
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x14001e676
xor eax, eax
lock cmpxchg qword [0x140064a40], rcx
jmp 0x14001e5f8
int3
int3
int3
Function at 0x1400207a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x148
mov rsi, rcx
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x20], rcx
cmp rcx, 0x10001
jae 0x14002083d
mov r14d, 0x10000
sub r14, rsi
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
movzx edi, word [rsp + 0x28]
mov dword [rsp + 0x28], edi
cmp r14, rdi
jb 0x1400207dd
mov ecx, 0x800
mov r8d, 0x1000
mov edx, 0x800
mov rax, r8
shr rdx, 1
mov r8, rcx
cmp rcx, rsi
mov rcx, rdx
jae 0x140020808
neg eax
and edi, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14002ba50
mov rax, rdi
add rsp, 0x148
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, [0x140055060]
lea r8, str.size___kAllocGranularity
lea rcx, [rsp + 0x20]
call fcn.14003b990
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x2b
mov r9, rax
call fcn.14003a3c0
mov rcx, rdi
call fcn.14003a460
jmp 0x1400207cf

Function at 0x140020f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x140021014
mov rbx, rcx
mov rax, qword [rcx + 8]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx + 0x84], 0
je 0x140021014
cmp word [rax + rcx + 0x14], 0x78
jb 0x140021014
mov rsi, r8
mov rdi, rdx
mov edx, dword [rax + rcx + 0x88]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x140068010]
test rax, rax
je 0x140021014
cmp rdi, 0xffff
mov qword [rsp + 0x20], rsi
jbe 0x14002103c
mov r14, rax
mov edx, dword [rax + 0x20]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x140068010]
mov r15, rax
mov eax, dword [r14 + 0x18]
test rax, rax
je 0x140021014
lea rsi, [r15 + rax*4]
lea r13, [rdi + 1]
mov rbp, r15
mov r12, rsi
sub r12, rbp
mov rax, r12
sar rax, 2
shr r12, 0x3f
add r12, rax
and r12, 0xfffffffffffffffe
mov edx, dword [rbp + r12*2]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x140068010]
mov cl, byte [rdi]
test cl, cl
je 0x140020fe9
mov rdx, r13
cmp cl, byte [rax]
jne 0x140020feb
inc rax
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x140020fd9
xor ecx, ecx
lea r12, [r12*2]
add r12, rbp
movzx eax, byte [rax]
cmp cl, al
je 0x140021018
movzx ecx, cl
lea rdx, [r12 + 4]
cmp ecx, eax
cmovg rbp, rdx
cmovs rsi, r12
cmp rbp, rsi
jne 0x140020fa3
xor eax, eax
jmp 0x140021046
mov edx, dword [r14 + 0x24]
mov rax, qword [rbx]
mov rax, qword [rax + 8]
mov rcx, rbx
call qword [0x140068010]
sub r12, r15
sar r12, 1
movzx edi, word [rax + r12]
add di, word [r14 + 0x10]
mov rax, qword [rsp + 0x20]
mov word [rax], di
mov al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140028010
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov bpl, byte [rsp + 0x88]
mov r12d, dword [rsp + 0x80]
mov eax, dword [0x140062db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x140028094
cmp byte [0x140062db4], 1
jne 0x140028094
mov eax, dword [0x1400624d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x140028078
call fcn.14002b318
mov eax, dword [0x1400624d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x10]
jmp 0x140028099
call fcn.1400269c0
mov qword [rsi], rax
lea rdi, [rsi + 8]
xor eax, eax
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
mov dword [rsi + 0x14], ebx
lea rcx, [rsi + 0x18]
mov qword [rsi + 0x20], rax
mov rdx, qword gs:[0x30]
mov edx, dword [rdx + 0x48]
mov dword [rsi + 0x28], edx
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
lea rbx, [rsi + 0x40]
movups xmm1, xmmword [r15]
movups xmmword [rsi + 0x40], xmm1
mov dword [r15], 0
mov qword [r15 + 8], rax
mov qword [rsi + 0x50], r14
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x58], 8
mov dword [rsi + 0x70], r12d
mov byte [rsi + 0x74], bpl
call sub.ntdll.dll_RtlQueryPerformanceCounter
mov eax, dword [0x140062db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
jne 0x14002811d
mov rcx, rsi
call fcn.140024af0
jmp 0x140028178
cmp byte [0x140062db4], 1
je 0x14002813d
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je 0x1400281a8
mov byte [0x140062db4], 1
mov eax, dword [0x1400624d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x14002815e
call fcn.14002b318
mov eax, dword [0x1400624d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x10], rsi
lea rcx, [0x1400620b0]
mov rax, qword [0x1400620b0]
mov rax, qword [rax + 0x40]
mov rdx, rdi
mov r8, rbx
call qword [0x140068010]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [0x140062db0], eax
jmp 0x140028113
Function at 0x140028b50
Capabilities:
Map section object

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dword [rdx], 0
je 0x140028c07
mov ebx, r8d
mov rdi, rdx
mov rcx, qword [0x140062d80]
xor eax, eax
lea r8, [rsp + 0x50]
mov qword [r8], rax
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov rdx, 0xffffffffffffffff
xor r9d, r9d
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jns 0x140028bd9
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov r14, qword [rsp + 0x50]
test r14, r14
je 0x140028c10
cmp dword [r14 + 0x2c], 0
je 0x140028c3d
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007139f000000d8
jmp 0x140028c93
mov byte [rsi + 0x10], 0
jmp 0x140028cbf
call sub.ntdll.dll_RtlGetLastWin32Error
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0xd1
mov dword [rsi + 0xc], ecx
jmp 0x140028c97
movzx eax, bl
mov dword [r14 + 0x28], eax
mov r8d, dword [rdi]
cmp r8, 0xfc8
ja 0x140028c7b
lea rcx, [r14 + 0x38]
mov rdx, qword [rdi + 8]
call sub.ntdll.dll_memcpy
mov eax, dword [rdi]
test eax, eax
je 0x140028c7b
cmp eax, 0x21
mov ecx, 0x20
cmovae ecx, eax
add ecx, 0x38
mov dword [r14 + 0x2c], ecx
mov byte [rsi + 0x10], 0
jmp 0x140028c97
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007007a000000e1
mov qword [rsi + 8], rax
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140028cbf
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jns 0x140028cbf
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002ba50
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002abec
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14002ac64
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14002ac64
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14002ac64
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14002ac58
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14002ac76
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14002ac46
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14002ac66

Function at 0x14002b81c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002b866
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002b866
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002b866
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002b866
cmp dword [rcx + 0x84], 0xe
jbe 0x14002b866
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002b868
xor al, al
add rsp, 0x28
ret

Function at 0x14002c510
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x14002c539
mov r8, qword [r8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c590
cmp dword [rsp + 0x3c], 4
jne 0x14002c5a2
mov eax, dword [rsp + 0x44]
mov byte [rsi + 0x10], 0
bts rax, 0x20
mov qword [rsi], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002ba50
nop
add rsp, 0x50
pop rsi
ret
cmp eax, 2
jne 0x14002c5c0
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
jmp 0x14002c57c
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000043
mov qword [rsi + 8], rax
jmp 0x14002c57c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3f
mov dword [rsi + 0xc], ecx
jmp 0x14002c57c
Function at 0x14002c760
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x20]
mov rdx, rbx
call fcn.14002c860
cmp byte [rbx + 0x10], 0
jne 0x14002c79a
cmp dword [rsp + 0x20], 2
je 0x14002c84b
mov rcx, rdi
call fcn.140006db0
cmp qword [rax + 0x18], 8
jb 0x14002c7ac
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x14002c813
mov rcx, rdi
call fcn.1400065f0
cmp qword [rax + 0x18], 8
jb 0x14002c7d0
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x14002c819
lea rax, [rdi + 0x10]
cmp byte [rdi + 0x18], 0
jne 0x14002c845
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
xor eax, eax
mov byte [0x140062d34], al
mov byte [rsi + 0x10], al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002ba50
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
test eax, eax
je 0x14002c7be
jmp 0x14002c81d
test eax, eax
je 0x14002c7e2
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x87
mov dword [rsi + 0xc], ecx
jmp 0x14002c7fd
mov byte [rdi + 0x18], 0
jmp 0x14002c7ec
mov byte [rsi + 0x10], 0
jmp 0x14002c7fd

Function at 0x14002cc70
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14002ccc2
call fcn.14002cab0
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov rcx, rax
mov rax, rdx
call qword [0x140068010]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ba50
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [0x1400532c0]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140064a70], 0
jne 0x14002cd00
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140064a70], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140064ac0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140064a50]
mov qword [r8 + 8], rsi
lea rax, [0x140056f00]
mov qword [r8 + 0x10], rax
lea rax, [0x140051aa0]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140064ac8]
lea rdx, [0x1400515d0]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14002cc96
cmp qword [rsp + 0x28], 0
je 0x14002cc96
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140064ad0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x140056ef0]
mov qword [r8 + 0x10], rax
lea rax, [0x140051ae0]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140064ad8]
lea rdx, [0x1400515d0]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14002cc96
cmp qword [rsp + 0x28], 0
jne 0x14002ccae
jmp 0x14002cc96
Function at 0x14002d5c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov r15, qword [rcx]
mov r14, qword [r15 + 0x40]
lea rbx, [r14 + 2]
call fcn.140010130
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
jne 0x14002d654
mov rcx, qword [rdi]
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x40]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14000bfd0
mov rax, qword [r15]
mov rcx, qword [rax]
mov rdx, rbx
call fcn.14002d3a0
mov rcx, qword [rdi]
test al, al
jne 0x14002d5ff
mov rax, qword [rcx]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14002eab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rcx + 8]
lea rbx, [r14 + 2]
call fcn.140010130
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
je 0x14002eaf3
mov rcx, rbx
call fcn.14002e7b0
test al, al
je 0x14002eb46
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400101c0
mov rax, qword [rdi]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002eba0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140064ae4]
mov ecx, dword [0x1400624d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002ec43
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x14002ec1f
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140064ae0]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x14002ec06
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002ba50
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140064ae4]
call fcn.14002b1c8
cmp dword [0x140064ae4], 0xffffffff
jne 0x14002ebe0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140064ae0], eax
lea rcx, [0x140064ae4]
call fcn.14002b240
jmp 0x14002ebe0

Function at 0x1400313b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140062040]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400313f2
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14002ba50
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.140019210
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.14003c580
lea rcx, [rsp + 0x20]
call fcn.14003a460
jmp 0x1400313d8