joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001e640
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
lea rax, [rsp + 0x30]
mov qword [rax], rcx
lea rcx, [0x180075430]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18001e7ce
lea rdi, [rsp + 0x3c]
mov r14d, dword [rdi]
mov ebx, r14d
and ebx, 0xfffffff8
mov rcx, rbx
call sym.mozglue.dll_moz_xmalloc
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8d, ebx
mov r9, rdi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18001e7c6
shr r14d, 3
mov eax, dword [rsp + 0x3c]
shr eax, 3
cmp eax, r14d
cmovae eax, r14d
test eax, eax
je 0x18001e7c6
mov ebp, eax
xor edi, edi
mov r14, qword [rsi + rdi*8]
mov ecx, 0x104
xor r13d, r13d
mov r15d, ecx
mov r12d, ecx
add r12, r12
mov rcx, r12
call sym.mozglue.dll_moz_xmalloc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
test r13, r13
jne 0x18001e7ed
mov rcx, r14
mov rdx, rbx
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001e7b2
mov r12d, eax
cmp eax, r15d
je 0x18001e7fa
inc r12d
lea r15, [r12 + r12]
mov rcx, r15
call sym.mozglue.dll_moz_xmalloc
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov rcx, r14
mov rdx, r12
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
jne 0x18001e818
mov rcx, rbx
call sym.mozglue.dll__aligned_free
mov r8, qword [rsi + rdi*8]
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov rdx, r14
call qword [0x1800d2010]
mov rbx, r14
mov rcx, rbx
call sym.mozglue.dll__aligned_free
inc rdi
cmp rdi, rbp
jne 0x18001e705
mov rcx, rsi
call sym.mozglue.dll__aligned_free
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r13
call sym.mozglue.dll__aligned_free
jmp 0x18001e73b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [r15 + r15]
mov r13, rbx
mov r12d, r15d
cmp eax, 0x7a
je 0x18001e711
jmp 0x18001e75a
mov rcx, r14
call sym.mozglue.dll__aligned_free
jmp 0x18001e7b2
Function at 0x18001ecc0
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp dword [0x1800cd1f4], edx
je 0x18001edc3
mov ebp, edx
mov dword [0x1800cd1f4], edx
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.180012470
cmp byte [rdi + 8], 0
jne 0x18001ede2
lea r14, [rsp + 0x38]
mov rdi, qword [r14]
mov rcx, r14
call fcn.180012520
cmp byte [r14 + 8], 0
jne 0x18001edee
mov rbx, qword [rsp + 0x38]
lea r8, str.Theme
mov rcx, r14
mov rdx, rbx
call fcn.1800125d0
mov dword [rsp + 0x34], ebp
cmp qword [rsp + 0x50], 8
jb 0x18001ed4a
mov r14, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rax, qword [rsp + 0x50]
cmp rax, 7
jbe 0x18001ed9a
mov rcx, qword [rsp + 0x38]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
jne 0x18001ee0d
call sym.mozglue.dll__aligned_free
mov al, 1
test ebp, ebp
jne 0x18001ee26
mov byte [rsi + 5], al
test rbx, rbx
je 0x18001edb4
mov rcx, rbx
call sym.mozglue.dll__aligned_free
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x18001edc7
jmp 0x18001ee01
mov byte [rsi + 5], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062020
mov rax, rsi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
mov byte [rsi + 5], 0
jmp 0x18001ee01
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
mov byte [rsi + 5], 0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1800cd1f4], 0
jmp 0x18001edc7
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18001ee33
mov rcx, rax
jmp 0x18001ed95
mov dword [rsi], 7
xor eax, eax
jmp 0x18001eda4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x18001f670
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x18001f6b6
mov r15, qword [r14 + 0x20]
lea rcx, [0x1800bfbb8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x18001f6b6
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.180014720
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x1800a21e6
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.1800a2200
test al, al
je 0x1800a21e6
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800a21e6
mov r14, rax
mov rcx, rax
call fcn.1800a2200
test al, al
je 0x1800a21e6
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x18001f670
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x18001f6e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1800cd8c4]
mov ecx, dword [0x1800cb4e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001f730
mov esi, dword [0x1800cd8c0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062020
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1800cd8c4]
call fcn.180060ac0
cmp dword [0x1800cd8c4], 0xffffffff
jne 0x18001f715
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x1800cd8c0], eax
lea rcx, [0x1800cd8c4]
call fcn.180060b40
jmp 0x18001f715

Function at 0x18001f770
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1800cd8d4]
mov ecx, dword [0x1800cb4e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001f7c0
mov esi, dword [0x1800cd8d0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062020
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1800cd8d4]
call fcn.180060ac0
cmp dword [0x1800cd8d4], 0xffffffff
jne 0x18001f7a5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x28]
mov dword [0x1800cd8d0], eax
lea rcx, [0x1800cd8d4]
call fcn.180060b40
jmp 0x18001f7a5

Function at 0x180020990
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.MOZ_CRASHREPORTER_DISABLE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x180020a46
cmp word [0x1800cd220], 0
jne 0x180020a41
lea rdx, [0x1800cd220]
xor ecx, ecx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x180020a41
cmp eax, 0x105
je 0x180020a41
lea rcx, [0x1800cd220]
mov dx, 0x5c
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
je 0x180020a41
mov word [rax + 2], 0
lea rcx, [0x1800cd220]
lea r8, str.mozwer.dll
mov edx, 0x105
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
jne 0x180020a41
mov eax, dword [sym.mozglue.dll_enum_GeckoProcessType_mozilla::startup::sChildProcessType]
mov dword [0x1800cd430], eax
lea rdx, [0x1800cd430]
lea rax, [sym.mozglue.dll_unsigned_long_long_unsigned___int64__gOOMAllocationSize]
mov qword [0x1800cd438], rax
lea rcx, [0x1800cd220]
call sub.KERNEL32.dll_WerRegisterRuntimeExceptionModule
test eax, eax
js 0x180020a51
add rsp, 0x28
ret
cmp byte [rax], 0
je 0x1800209aa
jmp 0x180020a41
mov word [0x1800cd220], 0
jmp 0x180020a41

Function at 0x1800218e0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180062020
mov eax, ebx
add rsp, 0x50
pop rbx
ret
Function at 0x180022160
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret

Function at 0x180022180
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1800221cd
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
mov al, 1
mov byte [rsi + 8], al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180062020
mov rax, rsi
add rsp, 0x30
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x1800221b4

Function at 0x1800221e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x180022222
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180062020
mov rax, rsi
add rsp, 0x30
pop rsi
ret
int3
Function at 0x180039be0
Capabilities:
Get system information on windows

Disassembly:
test rcx, rcx
jne sym.mozglue.dll__msize
xor eax, eax
ret
Function at 0x1800609e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov rax, rdx
and rax, 0xfffffffffffffff8
je 0x180060ab3
dec rax
mov r9, rax
shr r9, 3
inc r9
cmp rax, 7
jne 0x180060a08
xor eax, eax
xor r8d, r8d
jmp 0x180060a69
mov r10, r9
and r10, 0xfffffffffffffffe
xor eax, eax
xor r8d, r8d
nop word cs:[rax + rax]
mov r11, qword [rcx + r8]
mov rsi, qword [rcx + r8 + 8]
rol eax, 5
xor eax, r11d
shr r11, 0x20
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, r11d
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, esi
shr rsi, 0x20
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, esi
imul eax, eax, 0x9e3779b9
add r8, 0x10
add r10, 0xfffffffffffffffe
jne 0x180060a20
test r9b, 1
je 0x180060a93
mov r9, qword [rcx + r8]
rol eax, 5
xor eax, r9d
imul eax, eax, 0x9e3779b9
rol eax, 5
shr r9, 0x20
xor eax, r9d
imul eax, eax, 0x9e3779b9
add r8, 8
cmp r8, rdx
jae 0x180060ab1
movsx r9d, byte [rcx + r8]
rol eax, 5
xor eax, r9d
imul eax, eax, 0x9e3779b9
inc r8
cmp rdx, r8
jne 0x180060a98
pop rsi
ret
xor r8d, r8d
xor eax, eax
cmp r8, rdx
jb 0x180060a98
jmp 0x180060ab1

Function at 0x180062860
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1800cb774]
mov ecx, dword [0x1800cb4e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800628b4
mov bl, byte [0x1800cb770]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062020
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1800cb774]
call fcn.180060ac0
cmp dword [0x1800cb774], 0xffffffff
jne 0x180062897
mov eax, dword [0x1800cb600]
mov ecx, dword [0x1800cb4e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x180062923
lea rcx, [0x1800cb600]
call fcn.180060ac0
cmp dword [0x1800cb600], 0xffffffff
jne 0x180062923
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov qword [0x1800cb5f8], rax
lea rcx, [0x1800cb600]
call fcn.180060b40
mov rdi, qword [0x1800cb5f8]
cmp rdi, 0x1000
jne 0x1800629cc
call fcn.180002fa0
mov qword [0x1800cb640], rax
mov eax, dword [0x1800cb4e0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
je 0x1800629eb
call fcn.180002e80
mov qword [0x1800cb648], rax
lea rsi, [0x1800cb618]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1800cb648]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rax], rdx
mov r8, rcx
shl r8, 0x17
xor r8, rcx
mov rcx, rdx
shr rcx, 0x1a
xor rcx, rdx
xor rcx, r8
shr r8, 0x11
xor r8, rcx
mov qword [rax + 8], r8
add edx, r8d
and edx, 0x1ffff
inc edx
mov dword [0x1800cb610], edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, 0x1000
sete byte [0x1800cb770]
lea rcx, [0x1800cb774]
call fcn.180060b40
jmp 0x180062897
call fcn.180060de8
jmp 0x180062963
Function at 0x180064550
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x180064581
mov r8, qword [r8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdx
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, 7
test eax, eax
jne 0x1800645bc
mov ecx, dword [rsp + 0x44]
setne byte [rsi + 4]
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x50
pop rsi
ret

Function at 0x180064790
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r14d, dword [rcx + 0x10]
mov eax, dword [rcx]
lea ecx, [rax + rax]
test eax, eax
mov eax, 0x80
cmovne eax, ecx
inc r14d
cmp r14d, eax
cmovbe r14d, eax
lea rax, [r14*8]
lea rbx, [rax + rax*4]
mov rcx, rbx
call sym.mozglue.dll_moz_xmalloc
mov rdi, rax
test r14d, r14d
je 0x180064807
add rbx, 0xffffffffffffffd8
movabs rcx, 0xcccccccccccccccd
mov rax, rbx
mul rcx
shr rdx, 5
lea rax, [rdx + rdx*4]
lea r8, [rax*8 + 0x28]
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsi]
test rax, rax
jne 0x18006482c
mov rcx, qword [rsi + 8]
xchg qword [rsi + 8], rdi
mov dword [rsi], r14d
test rcx, rcx
jne 0x180064885
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
shl rax, 3
lea rbx, [rax + rax*4]
xor r15d, r15d
mov r12, qword [rsi + 8]
lea rcx, [r12 + r15]
call fcn.1800777c0
mov qword [rdi + r15], rax
mov rax, qword [r12 + r15 + 8]
mov qword [rdi + r15 + 8], rax
mov rax, qword [r12 + r15 + 0x10]
mov qword [rdi + r15 + 0x10], rax
mov eax, dword [r12 + r15 + 0x20]
mov dword [rdi + r15 + 0x20], eax
mov rax, qword [r12 + r15 + 0x18]
mov qword [rdi + r15 + 0x18], rax
mov eax, dword [r12 + r15 + 0x24]
mov dword [rdi + r15 + 0x24], eax
add r15, 0x28
cmp rbx, r15
je 0x18006480e
jmp 0x180064837
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.mozglue.dll__aligned_free
Function at 0x1800652f0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x1800cd214], 0
je 0x180065336
mov eax, dword [0x1800cd210]
and eax, 0xfffffffe
cmp eax, 4
jne 0x180065336
mov dword [rsi], 1
mov byte [rsi + 5], 0
jmp 0x180065423
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.180012470
cmp byte [rdi + 8], 0
jne 0x180065440
lea r15, [rsp + 0x40]
mov rdi, qword [r15]
mov rcx, r15
call fcn.180012520
cmp byte [r15 + 8], 0
jne 0x18006544b
mov r14, qword [rsp + 0x40]
lea r8, str.Enabled
mov rcx, r15
mov rdx, r14
call fcn.1800125d0
movzx eax, bl
mov dword [rsp + 0x3c], eax
cmp qword [rsp + 0x58], 8
jb 0x180065393
mov r15, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, rdi
mov rdx, r15
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rax, qword [rsp + 0x58]
cmp rax, 7
jbe 0x1800653e3
mov rcx, qword [rsp + 0x40]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
jne 0x180065457
call sym.mozglue.dll__aligned_free
test ebp, ebp
jne 0x180065470
cmp byte [0x1800cd1f0], 0
jne 0x180065402
test bl, bl
je 0x180065402
lea rcx, [rsp + 0x40]
call fcn.180012c60
mov byte [0x1800cd1f0], bl
mov al, 1
mov byte [rsi + 5], al
test r14, r14
je 0x18006541a
mov rcx, r14
call sym.mozglue.dll__aligned_free
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180062020
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
jmp 0x18006532d
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov byte [rsi + 5], 0
jmp 0x18006541a
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18006547a
mov rcx, rax
jmp 0x1800653de
mov dword [rsi], 7
xor eax, eax
jmp 0x18006540a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1800739e0
Capabilities:
Encode data using base64
Generate random numbers via rtlgenrandom
Get system information on windows
Query environment variable

Disassembly:
test dl, 8
jne 0x1800739ed
mov rcx, r8
jmp sym.mozglue.dll_malloc
mov ecx, 1
mov rdx, r8
jmp sym.mozglue.dll_calloc

Function at 0x180073a00
Capabilities:
Encode data using base64
Generate random numbers via rtlgenrandom
Get system information on windows
Query environment variable

Disassembly:
test dl, 0x18
je 0x180073a08
xor eax, eax
ret
mov rcx, r8
mov rdx, r9
jmp sym.mozglue.dll_realloc

Function at 0x180075670
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
lock dec dword [rcx + 0x48]
jne 0x180075681
add rsp, 0x20
pop rsi
ret
mov rsi, rcx
mov rax, qword [rcx + 0x28]
cmp rax, 0x10
jb 0x1800756b9
mov rcx, qword [rsi + 0x10]
add rax, 0xfffffffffffff001
cmp rax, 0xffffffffffffefff
ja 0x1800756b4
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1800756da
mov rcx, rax
call sym.mozglue.dll__aligned_free
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x28], 0xf
mov byte [rsi + 0x10], 0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1800765e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx + 0x50]
mov qword [rcx + 0x50], 0
test rsi, rsi
jne 0x1800765fc
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
call fcn.1800765e0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x180076930
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [rsi + 0x30], edi
mov edi, dword [rsi + 0x40]
lea eax, [rdi - 1]
mov dword [rsi + 0x40], eax
mov dword [rsi + 0x30], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp edi, 1
jle 0x180076972
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.180076990
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free

Function at 0x180076990
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, qword [rcx + 0x48]
mov qword [rcx + 0x48], 0
test rsi, rsi
jne 0x1800769ac
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
call fcn.1800765e0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free
Function at 0x180076bc0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1800cb028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rdx]
test rcx, rcx
jne 0x180076bf7
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180062020
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rdi, rdx
mov rax, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
lea rbx, [rsp + 0x20]
mov qword [rbx], rax
mov rdx, rbx
call fcn.180076c70
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180076c59
mov rax, qword [rdi]
mov qword [rdi], 0
mov rdi, qword [rsi + 0x50]
mov qword [rsi + 0x50], rax
test rdi, rdi
je 0x180076be1
mov rcx, rdi
call fcn.1800765e0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180062020
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp sym.mozglue.dll__aligned_free
mov rcx, rbx
call fcn.1800765e0
mov rcx, rbx
call sym.mozglue.dll__aligned_free
jmp 0x180076c1e

Function at 0x180076c70
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [rdx]
test rax, rax
je 0x180076c9d
mov r8, rcx
mov rcx, qword [rcx + 0x50]
test rcx, rcx
jne 0x180076c7d
mov qword [rdx], 0
mov rsi, qword [r8 + 0x50]
mov qword [r8 + 0x50], rax
test rsi, rsi
jne 0x180076ca3
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
call fcn.1800765e0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp sym.mozglue.dll__aligned_free
Function at 0x180077ab0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp byte [rcx + 0x48], 0
je 0x180077ab9
ret
xor edx, edx
cmp qword [rcx + 0x10], 0
je 0x180077b02
cmp qword [rcx + 0x18], 0x10
mov rax, rcx
jb 0x180077acf
mov rax, qword [rcx]
mov r8b, byte [rax]
test r8b, r8b
je 0x180077b02
inc rax
xor edx, edx
movzx r8d, r8b
rol edx, 5
mov r9d, edx
xor r9d, r8d
imul edx, r9d, 0x9e3779b9
mov r8b, byte [rax]
inc rax
test r8b, r8b
jne 0x180077adc
imul edx, r9d, 0xe35e67b1
rol edx, 5
movzx eax, byte [rcx + 0x20]
xor edx, eax
imul eax, edx, 0x9e3779b9
mov rdx, qword [rcx + 0x28]
rol eax, 5
xor eax, edx
shr rdx, 0x20
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, edx
imul eax, eax, 0x9e3779b9
cmp byte [rcx + 0x34], 0
je 0x180077b41
rol eax, 5
xor eax, dword [rcx + 0x30]
imul eax, eax, 0x9e3779b9
cmp byte [rcx + 0x3c], 0
je 0x180077b53
rol eax, 5
xor eax, dword [rcx + 0x38]
imul eax, eax, 0x9e3779b9
cmp byte [rcx + 0x44], 0
je 0x180077ab8
rol eax, 5
xor eax, dword [rcx + 0x40]
imul eax, eax, 0x9e3779b9
jmp 0x180077ab8