joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400115f0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r12, rdx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x50], rax
test r9, r9
je 0x140011763
mov esi, dword [rsp + 0xc0]
test esi, esi
je 0x140011763
mov rbx, r9
mov r15d, r8d
mov eax, dword [0x14005fd34]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011795
mov esi, esi
xor edi, edi
mov rax, rbx
sub rax, rsi
cmovae rdi, rax
cmp rdi, 0x100001
mov eax, 0x100000
cmovb rdi, rax
cmp rbx, rsi
mov r13d, dword [0x14005fd30]
cmovb rdi, rax
mov eax, dword [0x14005fd40]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x1400116dc
lea rcx, [0x14005fd40]
call fcn.14002687c
cmp dword [0x14005fd40], 0xffffffff
jne 0x1400116dc
lea r14, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [r14 + 0x10]
mov qword [0x14005fd38], rax
lea rcx, [0x14005fd40]
call fcn.14002681c
mov rax, qword [0x14005fd38]
xor ecx, ecx
mov rdx, rbx
add rdx, rsi
cmovae rcx, rdx
cmp rax, rcx
cmovb rcx, rax
add rbx, rsi
cmovb rcx, rax
mov edx, r15d
cmp rcx, rdx
jb 0x140011763
mov rsi, rdi
neg rsi
lea rax, [r13 - 1]
and rax, rsi
add rax, rdi
xor ebx, ebx
sub rcx, rdx
cmovae rbx, rcx
neg r13
and r13, rbx
sub r13, rax
jbe 0x140011763
test rax, rax
setne cl
cmp r13, 0xffffffffffffffff
setne dl
mov rbp, r13
or rbp, rax
je 0x140011746
and cl, dl
je 0x1400117d7
test rax, rax
mov ecx, 1
cmovne rcx, rax
mov qword [r12], r13
mov qword [r12 + 8], rcx
mov byte [r12 + 0x10], 1
jmp 0x140011774
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140027a90
mov rax, r12
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14005fd34]
call fcn.14002687c
cmp dword [0x14005fd34], 0xffffffff
jne 0x140011655
lea r14, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 0x28]
mov dword [0x14005fd30], eax
lea rcx, [0x14005fd34]
call fcn.14002681c
jmp 0x140011655
int3
Function at 0x1400119e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x140011bed
mov rdi, rcx
mov ebp, dword [rcx + 0x18]
shl ebp, 7
mov edx, ebp
or edx, 0x7f
mov ecx, dword [rcx + 0x14]
cmp edx, ecx
jb 0x140011aa8
cmp ecx, dword [rdi + 0x10]
jae 0x140011bed
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011b6b
mov edx, dword [0x14005fd28]
mov ecx, dword [rdi + 0x14]
add rcx, qword [rdi + 8]
mov r8d, 0x1000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140011bed
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011bac
mov eax, dword [0x14005fd28]
add dword [rdi + 0x14], eax
mov rax, qword [rdi + 8]
mov ecx, ebp
add rcx, rax
lea r9, [rsp + 0x28]
mov qword [r9 - 8], rdi
mov dword [r9], 0
mov qword [r9 + 8], rcx
mov qword [r9 + 0x10], rcx
mov qword [r9 + 0x18], 0
mov dword [r9 + 0x20], 0x80
mov byte [r9 + 0x24], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140011c08
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140011c15
mov rdx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov ebx, dword [rsp + 0x28]
mov cl, byte [rsp + 0x4c]
test rdx, rdx
je 0x140011b28
test rbp, rbp
je 0x140011b28
test ebx, ebx
je 0x140011b28
test cl, cl
je 0x140011b28
inc dword [rdi + 0x18]
mov qword [rsi], rax
mov dword [rsi + 8], ebx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbp
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x20], eax
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x24], eax
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x28], eax
mov byte [rsi + 0x2c], cl
mov byte [rsi + 0x30], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140027a90
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x14005fd2c]
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x140011a4e
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
jmp 0x140011a4e
lea rcx, [0x14005fd2c]
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x140011a9b
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
jmp 0x140011a9b
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x30], 0
jmp 0x140011b52
mov dword [rsp + 0x28], 0
jmp 0x140011af3
mov ebx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov cl, byte [rsp + 0x4c]
jmp 0x140011b25
Function at 0x140012140
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, r9
mov rbp, r8
mov r15, rdx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [0x14005fd34]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400122bf
xor ebx, ebx
test rbp, rbp
je 0x140012298
mov r14, qword [rsp + 0x100]
cmp r14, rsi
jbe 0x140012298
mov ebx, dword [0x14005fd30]
lea rdi, [rsp + 0x54]
mov dword [rdi], 0
mov rcx, rdi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand_s
mov rax, r14
sub rax, rsi
sub rax, rbp
xor edx, edx
div rbx
mov rcx, rax
mov eax, dword [rdi]
inc rcx
xor edx, edx
div rcx
mov r12, rdx
imul r12, rbx
mov qword [rsp + 0x38], rsi
add r12, rsi
mov qword [rsp + 0x48], rbp
sub r14, rbp
cmp r12, r14
mov qword [rsp + 0x40], rbx
ja 0x14001231f
lea rsi, [rsp + 0x58]
lea rdi, [rsp + 0x60]
lea rbp, [rbx - 1]
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x30
mov r13, r15
mov rcx, r15
xor r8d, r8d
mov r9, rdi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x1400123d2
cmp qword [rsp + 0x58], 0x30
jne 0x1400123e0
mov r9, rdi
mov r8, rsi
cmp dword [rsp + 0x80], 0x10000
jne 0x140012300
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rdx
neg rcx
and rcx, rbp
lea rsi, [rcx + rdx]
mov rax, rdi
sub rax, rcx
cmp rax, qword [rsp + 0x48]
mov ebx, 0
cmovae rbx, rsi
cmp rdi, rcx
jb 0x14001230a
test rbx, rbx
je 0x14001230a
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140027a90
mov rax, rbx
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14005fd34]
call fcn.14002687c
cmp dword [0x14005fd34], 0xffffffff
jne 0x140012193
lea rdi, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 0x28]
mov dword [0x14005fd30], eax
lea rcx, [0x14005fd34]
call fcn.14002681c
jmp 0x140012193
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rdx, rdi
cmp rdx, r14
mov r15, r13
mov rsi, r8
mov rdi, r9
jbe 0x140012219
cmp r12, qword [rsp + 0x38]
jbe 0x1400123e0
mov rsi, r15
dec qword [rsp + 0x40]
lea r14, [rsp + 0x58]
lea r15, [rsp + 0x60]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0x30
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov r9, r15
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x1400123d2
cmp qword [rsp + 0x58], 0x30
jne 0x1400123e0
cmp dword [rsp + 0x80], 0x10000
jne 0x1400123b5
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rax
neg rcx
and rcx, qword [rsp + 0x40]
mov rbp, rax
lea rdx, [rcx + rax]
mov rax, rdi
sub rax, rcx
cmp rax, qword [rsp + 0x48]
mov ebx, 0
cmovae rbx, rdx
cmp rdi, rcx
jb 0x1400123bf
test rbx, rbx
je 0x1400123bf
jmp 0x140012298
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rbp, rdi
mov qword [rsp + 0x38], rbp
cmp rbp, r12
jb 0x14001233c
jmp 0x1400123e0
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x140012298
Function at 0x140012f00
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
lea rcx, sym.firefox.exe_Ordinal_0
and rcx, 0xfffffffffffffffc
mov qword [rax], rcx
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov byte [rax + 0x18], 0
je 0x140012f7c
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x140012f7c
lea r8, [rax + 8]
movsxd r9, dword [rcx + 0x3c]
lea r10, [rcx + r9]
mov qword [r8], r10
cmp dword [rcx + r9], 0x4550
jne 0x140012f7c
movzx edx, word [r10 + 0x18]
cmp edx, 0x20b
jne 0x140012f7c
mov r8d, dword [r10 + 0x50]
cmp r8d, 0x148
jb 0x140012f7c
lea edx, [r8 - 1]
add rcx, rdx
mov qword [rax + 0x10], rcx
cmp dword [r10 + 0x84], 2
jb 0x140012f7c
cmp dword [r10 + 0x90], r8d
setae byte [rax + 0x18]
ret
Function at 0x140015390
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov edi, edx
mov r15, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r13, qword [rcx + 0x10]
mov ecx, edx
cmp r13, rcx
ja 0x14001554c
lea rdi, [r15 + 8]
cmp rcx, 0x21
mov eax, 0x20
cmovae rax, rcx
mov rbx, rax
sub rbx, r13
jbe 0x140015424
mov rcx, qword [r15 + 0x18]
sub rcx, r13
mov rax, r13
cmp rcx, rbx
jb 0x140015572
test rbx, rbx
jle 0x140015421
mov rdx, qword [rdi]
lea rcx, [rdx + rax]
lea rbp, [rbx + rcx]
lea r8, [rdx + rax]
inc r8
cmp rbp, r8
cmova r8, rbp
sub r8, rcx
xor edx, edx
call sub.ntdll.dll_memset
mov rax, qword [r15 + 0x10]
add rax, rbx
mov qword [r15 + 0x10], rax
mov r14, qword [r15]
cmp qword [r14], 0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
je 0x1400155d6
mov rsi, qword [r15 + 0x40]
add rsi, r13
mov r12, qword [r15 + 8]
add r12, r13
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001558e
add rbx, rsi
cmp rbx, rsi
jbe 0x1400155d6
mov eax, dword [0x14005fd28]
mov qword [rsp + 0x30], rax
dec eax
mov qword [rsp + 0x38], rax
lea rbp, [rsp + 0x50]
mov r13, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x50], 0
mov r9, rbx
sub r9, rsi
mov rcx, qword [r14]
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov r8, r12
call r13
test eax, eax
je 0x1400155dd
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
lea rcx, [rdi + rbp]
inc rcx
mov rax, qword [r15 + 0x10]
mov rsi, rcx
sub rsi, rax
jbe 0x14001553d
mov rcx, qword [r15 + 0x18]
sub rcx, rax
cmp rcx, rsi
mov rbx, qword [rsp + 0x48]
jae 0x140015509
mov rcx, rbx
mov rdx, rsi
call fcn.140015630
test al, al
je 0x14001560c
mov rax, qword [r15 + 0x10]
test rsi, rsi
jle 0x140015537
mov rdx, qword [rbx]
lea rcx, [rdx + rax]
lea r8, [rsi + rax]
add r8, rdx
add rax, rdx
inc rax
cmp r8, rax
cmovbe r8, rax
sub r8, rcx
xor edx, edx
call sub.ntdll.dll_memset
mov rax, qword [r15 + 0x10]
add rax, rsi
mov rcx, rax
add rdi, rbp
mov qword [r15 + 0x10], rcx
mov rax, qword [r15 + 8]
mov byte [rax + rdi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140027a90
mov eax, edi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
mov rdx, rbx
call fcn.140015630
test al, al
je 0x140015617
mov rax, qword [r15 + 0x10]
jmp 0x1400153f5
lea rcx, [0x14005fd2c]
mov rbp, r14
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x140015472
lea r14, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
mov r14, rbp
jmp 0x140015472
xor edi, edi
jmp 0x1400154c9
mov rdx, qword [rsp + 0x38]
mov rax, rdx
not rax
and rax, rbx
mov rcx, rbx
sub rcx, qword [rsp + 0x30]
test ebx, edx
cmovne rcx, rax
xor edi, edi
mov rbx, rcx
cmp rcx, rsi
ja 0x14001549c
jmp 0x1400154c9
int3
int3
Function at 0x140018880
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140018938
mov rbx, qword [rsi + 0x10]
test rbx, rbx
jne 0x1400188f1
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027a90
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi + 8]
mov r14d, dword [0x14005fd28]
shl rbx, 4
xor edi, edi
lea r12, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rsi]
mov rcx, qword [rax]
test rcx, rcx
je 0x14001892d
mov rdx, qword [r15 + rdi + 8]
mov r9d, dword [r15 + rdi]
mov qword [rsp + 0x20], r12
mov r8, r14
call r13
add rdi, 0x10
cmp rbx, rdi
je 0x1400188cb
jmp 0x14001890e
lea rcx, [0x14005fd2c]
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x1400188c2
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
jmp 0x1400188c2
Function at 0x14001b220
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, qword [rdx + 8]
test rdi, rdi
je 0x14001b28b
mov r15, r8
mov r13, rdx
mov r12, rcx
lea rbx, [rdx + 0x10]
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov rax, rdi
mov cl, byte [rax]
or cl, 2
cmp cl, 0x2f
jne 0x14001b27f
lea rsi, [rax + 1]
lea rcx, [rax + 2]
xor edx, edx
cmp byte [rax + 1], 0x2d
sete dl
cmove rsi, rcx
movsx ecx, byte [rdx + rax + 1]
test ecx, ecx
je 0x14001b27f
call r14
cmp al, 0x6f
je 0x14001b29c
mov rax, qword [rbx]
add rbx, 8
test rax, rax
jne 0x14001b250
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movsx ecx, byte [rsi + 1]
test ecx, ecx
je 0x14001b27f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x73
jne 0x14001b27f
movsx ecx, byte [rsi + 2]
test ecx, ecx
je 0x14001b27f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x69
jne 0x14001b27f
movsx ecx, byte [rsi + 3]
test ecx, ecx
je 0x14001b27f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6e
jne 0x14001b27f
movsx ecx, byte [rsi + 4]
test ecx, ecx
je 0x14001b27f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x74
jne 0x14001b27f
cmp byte [rsi + 5], 0
jne 0x14001b27f
cmp dword [r12], 4
jne 0x14001b414
mov al, byte [rdi]
or al, 2
cmp al, 0x2f
jne 0x14001b414
lea rsi, [rdi + 1]
lea rax, [rdi + 2]
xor ecx, ecx
cmp byte [rdi + 1], 0x2d
sete cl
cmove rsi, rax
movsx ecx, byte [rcx + rdi + 1]
test ecx, ecx
je 0x14001b414
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6f
jne 0x14001b414
movsx ecx, byte [rsi + 1]
test ecx, ecx
je 0x14001b414
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x73
jne 0x14001b414
movsx ecx, byte [rsi + 2]
test ecx, ecx
je 0x14001b414
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x69
jne 0x14001b414
movsx ecx, byte [rsi + 3]
test ecx, ecx
je 0x14001b414
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6e
jne 0x14001b414
movsx ecx, byte [rsi + 4]
test ecx, ecx
je 0x14001b414
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x74
jne 0x14001b414
cmp byte [rsi + 5], 0
jne 0x14001b414
mov rax, qword [r13 + 0x10]
mov cl, byte [rax]
or cl, 2
cmp cl, 0x2f
jne 0x14001b414
lea rsi, [rax + 1]
lea rcx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rsi, rcx
mov rdi, qword [r15]
test rdi, rdi
je 0x14001b414
mov bpl, byte [rdi]
mov rbx, rsi
test bpl, bpl
je 0x14001b3f5
inc rdi
mov rbx, rsi
movsx ecx, byte [rbx]
test ecx, ecx
je 0x14001b3fa
call r14
movsx eax, al
movsx ecx, bpl
cmp eax, ecx
jne 0x14001b3fa
inc rbx
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x14001b3d2
cmp byte [rbx], 0
je 0x14001b404
mov rdi, qword [r15 + 8]
add r15, 8
jmp 0x14001b3bc
mov rax, qword [r13 + 0x18]
mov al, byte [rax]
or al, 2
cmp al, 0x2f
jne 0x14001b28b
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14001d6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 8
cmp qword [r8 + 0x18], 8
jb 0x14001d6f9
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d73e
cmp dword [rsp + 0x38], 0xb
jne 0x14001d763
mov rax, qword [rsp + 0x40]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
jmp 0x14001d74d
cmp eax, 2
jne 0x14001d781
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140027a90
mov rax, rsi
add rsp, 0x50
pop rsi
ret
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d0000003f
mov qword [rsi + 8], rax
jmp 0x14001d74d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3b
mov dword [rsi + 0xc], ecx
jmp 0x14001d74d

Function at 0x14001dde0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
cmp qword [r8 + 0x18], 8
jb 0x14001de07
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edi, edi
mov rdx, r8
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001de4f
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027a90
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x4e
mov dword [rsi + 0xc], ecx
mov dil, 1
jmp 0x14001de34
Function at 0x14001e650
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x14001e6c3
mov rdi, rdx
add rdi, 0x10
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14001e6b7
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14001e6b7
call r14
cmp ax, 0x73
je 0x14001e6fc
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14001e682
xor edi, edi
lea rcx, str.MOZ_SAFE_MODE_RESTART
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001e86b
mov byte [rsi], dil
mov byte [rsi + 1], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027a90
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x61
jne 0x14001e6b7
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x66
jne 0x14001e6b7
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001e6b7
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x2d
jne 0x14001e6b7
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6d
jne 0x14001e6b7
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6f
jne 0x14001e6b7
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x64
jne 0x14001e6b7
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14001e6b7
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14001e6b7
cmp word [rbx + 0x12], 0
jne 0x14001e6b7
lea rdi, [rsp + 0x3c]
mov dword [rdi], 4
mov qword [rsp + 0x30], rdi
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14001e87f
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000001
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14001e87f
mov dil, 1
jmp 0x14001e6c5
cmp byte [rax], 0
movzx eax, dil
mov edi, 1
cmove edi, eax
jmp 0x14001e6db
cmp dword [rsp + 0x38], 1
mov dil, 1
je 0x14001e6c3
jmp 0x14001e6c5
Function at 0x140020d40
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14005f018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14005fd2c]
mov ecx, dword [0x14005f488]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140020d90
mov esi, dword [0x14005fd28]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140027a90
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x14005fd2c]
call fcn.14002687c
cmp dword [0x14005fd2c], 0xffffffff
jne 0x140020d75
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x14005fd28], eax
lea rcx, [0x14005fd2c]
call fcn.14002681c
jmp 0x140020d75

Function at 0x1400238d0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, r9d
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov r15d, dword [rsp + 0x80]
mov eax, dword [0x14005fda0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x140023929
cmp byte [0x14005fda4], 0
je 0x140023929
mov eax, dword [0x14005f488]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
jmp 0x14002392e
call fcn.1400242a0
mov qword [rsi], rax
lea r14, [rsi + 8]
xor eax, eax
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], al
mov dword [rsi + 0x14], ebp
lea rcx, [rsi + 0x18]
mov qword [rsi + 0x20], rax
mov rdx, qword gs:[0x30]
mov edx, dword [rdx + 0x48]
mov dword [rsi + 0x28], edx
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmm1, xmmword [rdi]
movups xmmword [rsi + 0x40], xmm1
mov dword [rdi], 0
mov qword [rdi + 8], rax
mov qword [rsi + 0x50], rbx
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x58], 8
mov dword [rsi + 0x70], r15d
mov byte [rsi + 0x74], al
call sub.ntdll.dll_RtlQueryPerformanceCounter
mov eax, dword [0x14005fda0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
jne 0x1400239aa
mov rcx, rsi
call fcn.1400242b0
jmp 0x1400239e4
cmp byte [0x14005fda4], 0
jne 0x1400239ca
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je 0x140023a13
mov byte [0x14005fda4], 1
mov eax, dword [0x14005f488]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], rsi
lea r8, [rsi + 0x40]
lea rcx, [0x14005f050]
mov rax, qword [0x14005f050]
mov rax, qword [rax + 0x38]
mov rdx, r14
call qword [case.0x14002713e.0]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [0x14005fda0], eax
jmp 0x1400239a0