joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400039a0
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140003a8d
mov r15, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140003a2e
lea rax, [r15 + 1]
cmp rax, 2
jb case.default.0x140003a27
mov qword [rsi], r15
call fcn.140003aa0
mov rbx, rax
mov rbp, qword [rsp + 0x68]
call fcn.140003ab0
mov rcx, qword [rax]
mov rdi, qword [rcx + 8]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, r15
mov r8, rsi
mov r9, rbp
mov rax, rdi
call qword [case.0x14001b2ee.0]
mov ecx, r13d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.140003aa0
mov r14, rax
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsi]
call fcn.140003ab0
mov rcx, qword [rax]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x20], r14
mov rcx, rax
mov rdx, r12
mov r8, rsi
mov r9, rdi
mov rax, r10
call qword [case.0x14001b2ee.0]
mov r14, qword [rsi]
call fcn.140003ab0
mov rcx, qword [rax]
mov r8, qword [rcx]
mov rcx, rax
mov rdx, r14
mov rax, r8
call qword [case.0x14001b2ee.0]
mov qword [rsi], 0
jmp 0x1400039d4
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
clc
invalid
mov eax, 0xbeb9bc5d
pop rsi
jnp 0x1400af268
jp 0x1400af2d8
imul edx, dword [rsp + rdi], 0xffffffc0
test al, 0x5f
test eax, 0xfe13ba17
fild word [rcx + 5]
Function at 0x140008a00
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r12, rdx
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x50], rax
test r9, r9
je 0x140008b6f
mov esi, dword [rsp + 0xc0]
test esi, esi
je 0x140008b6f
mov rbx, r9
mov r15d, r8d
mov eax, dword [0x14005cb6c]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008ba1
mov esi, esi
xor edi, edi
mov rax, rbx
sub rax, rsi
cmovae rdi, rax
mov eax, 0x100000
cmp rdi, rax
cmovbe rdi, rax
cmp rbx, rsi
mov r13d, dword [0x14005cb68]
cmovb rdi, rax
mov eax, dword [0x14005cb78]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140008ae8
lea rcx, [0x14005cb78]
call fcn.14001aa20
cmp dword [0x14005cb78], 0xffffffff
jne 0x140008ae8
lea r14, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [r14 + 0x10]
mov qword [0x14005cb70], rax
lea rcx, [0x14005cb78]
call fcn.14001a9c0
mov rax, qword [0x14005cb70]
xor ecx, ecx
mov rdx, rbx
add rdx, rsi
cmovae rcx, rdx
cmp rax, rcx
cmovb rcx, rax
add rbx, rsi
cmovb rcx, rax
mov edx, r15d
cmp rcx, rdx
jb 0x140008b6f
mov rsi, rdi
neg rsi
lea rax, [r13 - 1]
and rax, rsi
add rax, rdi
xor ebx, ebx
sub rcx, rdx
cmovae rbx, rcx
neg r13
and r13, rbx
sub r13, rax
jbe 0x140008b6f
test rax, rax
setne cl
cmp r13, 0xffffffffffffffff
setne dl
mov rbp, r13
or rbp, rax
je 0x140008b52
and cl, dl
je 0x140008be3
test rax, rax
mov ecx, 1
cmovne rcx, rax
mov qword [r12], r13
mov qword [r12 + 8], rcx
mov byte [r12 + 0x10], 1
jmp 0x140008b80
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001bc70
mov rax, r12
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14005cb6c]
call fcn.14001aa20
cmp dword [0x14005cb6c], 0xffffffff
jne 0x140008a65
lea r14, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 0x28]
mov dword [0x14005cb68], eax
lea rcx, [0x14005cb6c]
call fcn.14001a9c0
jmp 0x140008a65
int3
Function at 0x140008bf0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rdx
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x140008df2
mov rdi, rcx
mov ebp, dword [rcx + 0x18]
shl ebp, 7
mov edx, ebp
or edx, 0x7f
mov ecx, dword [rcx + 0x14]
cmp edx, ecx
jae 0x140008cf3
mov ecx, ebp
add rcx, rax
lea r9, [rsp + 0x28]
mov qword [r9 - 8], rdi
mov dword [r9], 0
mov qword [r9 + 8], rcx
mov qword [r9 + 0x10], rcx
mov qword [r9 + 0x18], 0
mov dword [r9 + 0x20], 0x80
mov byte [r9 + 0x24], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140008e0d
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140008e1a
mov rdx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov ebx, dword [rsp + 0x28]
mov cl, byte [rsp + 0x4c]
test rdx, rdx
je 0x140008cb0
test rbp, rbp
je 0x140008cb0
test ebx, ebx
je 0x140008cb0
test cl, cl
je 0x140008cb0
inc dword [rdi + 0x18]
mov qword [rsi], rax
mov dword [rsi + 8], ebx
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbp
mov eax, dword [rsp + 0x40]
mov dword [rsi + 0x20], eax
mov eax, dword [rsp + 0x44]
mov dword [rsi + 0x24], eax
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x28], eax
mov byte [rsi + 0x2c], cl
mov byte [rsi + 0x30], 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001bc70
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
ret
cmp ecx, dword [rdi + 0x10]
jae 0x140008df2
mov eax, dword [0x14005cb64]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008d78
mov edx, dword [0x14005cb60]
mov ecx, dword [rdi + 0x14]
add rcx, qword [rdi + 8]
mov r8d, 0x1000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140008df2
mov eax, dword [0x14005cb64]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008db5
mov eax, dword [0x14005cb60]
add dword [rdi + 0x14], eax
mov rax, qword [rdi + 8]
jmp 0x140008c30
lea rcx, [0x14005cb64]
call fcn.14001aa20
cmp dword [0x14005cb64], 0xffffffff
jne 0x140008d1d
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x14005cb60], eax
lea rcx, [0x14005cb64]
call fcn.14001a9c0
jmp 0x140008d1d
lea rcx, [0x14005cb64]
call fcn.14001aa20
cmp dword [0x14005cb64], 0xffffffff
jne 0x140008d66
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x14005cb60], eax
lea rcx, [0x14005cb64]
call fcn.14001a9c0
jmp 0x140008d66
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x30], 0
jmp 0x140008cda
mov dword [rsp + 0x28], 0
jmp 0x140008c7b
mov ebx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov cl, byte [rsp + 0x4c]
jmp 0x140008cad
Function at 0x140009530
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, r9
mov r15, r8
mov r13, rdx
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [0x14005cb6c]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400096ab
xor ebx, ebx
test r15, r15
je 0x140009684
mov rbp, qword [rsp + 0x100]
cmp rbp, rsi
jbe 0x140009684
mov ebx, dword [0x14005cb68]
lea rdi, [rsp + 0x54]
mov dword [rdi], 0
mov rcx, rdi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand_s
lea rcx, [rsi + r15]
mov rax, rbp
sub rax, rcx
xor edx, edx
div rbx
mov rcx, rax
mov eax, dword [rdi]
inc rcx
xor edx, edx
div rcx
mov r12, rdx
imul r12, rbx
mov qword [rsp + 0x38], rsi
add r12, rsi
sub rbp, r15
cmp r12, rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
ja 0x14000970d
lea rsi, [rsp + 0x58]
lea rdi, [rsp + 0x60]
lea r14, [rbx - 1]
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x30
mov rcx, r13
xor r8d, r8d
mov r9, rdi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x1400097bd
cmp qword [rsp + 0x58], 0x30
jne 0x1400097cb
mov r9, rdi
mov r8, rsi
cmp dword [rsp + 0x80], 0x10000
jne 0x1400096ec
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rdx
neg rcx
and rcx, r14
lea rsi, [rcx + rdx]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rsi
cmp rdi, rcx
jb 0x1400096f6
test rbx, rbx
je 0x1400096f6
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001bc70
mov rax, rbx
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14005cb6c]
call fcn.14001aa20
cmp dword [0x14005cb6c], 0xffffffff
jne 0x140009583
lea rdi, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 0x28]
mov dword [0x14005cb68], eax
lea rcx, [0x14005cb6c]
call fcn.14001a9c0
jmp 0x140009583
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rdx, rdi
cmp rdx, rbp
mov r13, qword [rsp + 0x48]
mov rsi, r8
mov rdi, r9
jbe 0x14000960a
cmp r12, qword [rsp + 0x38]
jbe 0x1400097cb
dec qword [rsp + 0x40]
lea r14, [rsp + 0x58]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0x30
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov r9, rsi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x1400097bd
cmp qword [rsp + 0x58], 0x30
jne 0x1400097cb
cmp dword [rsp + 0x80], 0x10000
jne 0x1400097a0
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rax
neg rcx
and rcx, qword [rsp + 0x40]
mov rbp, rax
lea rdx, [rcx + rax]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rdx
cmp rdi, rcx
jb 0x1400097aa
test rbx, rbx
je 0x1400097aa
jmp 0x140009684
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rbp, rdi
mov qword [rsp + 0x38], rbp
cmp rbp, r12
jb 0x140009727
jmp 0x1400097cb
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x140009684
Function at 0x14000a350
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, qword [rdx + 8]
test rdi, rdi
je 0x14000a3bb
mov r15, r8
mov r13, rdx
mov r12, rcx
lea rbx, [rdx + 0x10]
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov rax, rdi
mov cl, byte [rax]
or cl, 2
cmp cl, 0x2f
jne 0x14000a3af
lea rsi, [rax + 1]
lea rcx, [rax + 2]
xor edx, edx
cmp byte [rax + 1], 0x2d
sete dl
cmove rsi, rcx
movsx ecx, byte [rdx + rax + 1]
test ecx, ecx
je 0x14000a3af
call r14
cmp al, 0x6f
je 0x14000a3cc
mov rax, qword [rbx]
add rbx, 8
test rax, rax
jne 0x14000a380
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movsx ecx, byte [rsi + 1]
test ecx, ecx
je 0x14000a3af
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x73
jne 0x14000a3af
movsx ecx, byte [rsi + 2]
test ecx, ecx
je 0x14000a3af
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x69
jne 0x14000a3af
movsx ecx, byte [rsi + 3]
test ecx, ecx
je 0x14000a3af
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6e
jne 0x14000a3af
movsx ecx, byte [rsi + 4]
test ecx, ecx
je 0x14000a3af
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x74
jne 0x14000a3af
cmp byte [rsi + 5], 0
jne 0x14000a3af
cmp dword [r12], 4
jne 0x14000a564
mov al, byte [rdi]
or al, 2
cmp al, 0x2f
jne 0x14000a564
lea rsi, [rdi + 1]
lea rax, [rdi + 2]
xor ecx, ecx
cmp byte [rdi + 1], 0x2d
sete cl
cmove rsi, rax
movsx ecx, byte [rcx + rdi + 1]
test ecx, ecx
je 0x14000a564
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6f
jne 0x14000a564
movsx ecx, byte [rsi + 1]
test ecx, ecx
je 0x14000a564
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x73
jne 0x14000a564
movsx ecx, byte [rsi + 2]
test ecx, ecx
je 0x14000a564
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x69
jne 0x14000a564
movsx ecx, byte [rsi + 3]
test ecx, ecx
je 0x14000a564
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x6e
jne 0x14000a564
movsx ecx, byte [rsi + 4]
test ecx, ecx
je 0x14000a564
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
cmp al, 0x74
jne 0x14000a564
cmp byte [rsi + 5], 0
jne 0x14000a564
lea rax, [r13 + 0x10]
mov rcx, qword [rax]
mov qword [rax - 8], rcx
add rax, 8
test rcx, rcx
jne 0x14000a4d7
dec dword [r12]
mov rax, qword [r13 + 8]
mov cl, byte [rax]
or cl, 2
cmp cl, 0x2f
jne 0x14000a564
lea rsi, [rax + 1]
lea rcx, [rax + 2]
cmp byte [rax + 1], 0x2d
cmove rsi, rcx
mov rdi, qword [r15]
test rdi, rdi
je 0x14000a564
mov bpl, byte [rdi]
mov rbx, rsi
test bpl, bpl
je 0x14000a545
inc rdi
mov rbx, rsi
movsx ecx, byte [rbx]
test ecx, ecx
je 0x14000a54a
call r14
movsx eax, al
movsx ecx, bpl
cmp eax, ecx
jne 0x14000a54a
inc rbx
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x14000a522
cmp byte [rbx], 0
je 0x14000a554
mov rdi, qword [r15 + 8]
add r15, 8
jmp 0x14000a50c
mov rax, qword [r13 + 0x10]
mov al, byte [rax]
or al, 2
cmp al, 0x2f
jne 0x14000a3bb
mov ecx, 0x7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000dda0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
cmp qword [r8 + 0x18], 7
jbe 0x14000ddc7
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edi, edi
mov rdx, r8
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000de0f
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001bc70
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x4e
mov dword [rsi + 0xc], ecx
mov dil, 1
jmp 0x14000ddf4

Function at 0x14000de40
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 8
cmp qword [r8 + 0x18], 7
jbe 0x14000de69
mov r8, qword [r8]
mov rcx, qword [rdx]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000deae
cmp dword [rsp + 0x38], 0xb
jne 0x14000ded3
mov rax, qword [rsp + 0x40]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
jmp 0x14000debd
cmp eax, 2
jne 0x14000def1
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001bc70
mov rax, rsi
add rsp, 0x50
pop rsi
ret
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d0000003f
mov qword [rsi + 8], rax
jmp 0x14000debd
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3b
mov dword [rsi + 0xc], ecx
jmp 0x14000debd
Function at 0x14000e7b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x14000e823
mov rdi, rdx
add rdi, 0x10
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x14000e817
lea rbx, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rbx, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x14000e817
call r14
cmp ax, 0x73
je 0x14000e85c
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x14000e7e2
xor edi, edi
lea rcx, str.MOZ_SAFE_MODE_RESTART
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14000e9cb
mov byte [rsi], dil
mov byte [rsi + 1], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001bc70
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx ecx, word [rbx + 2]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x61
jne 0x14000e817
movzx ecx, word [rbx + 4]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x66
jne 0x14000e817
movzx ecx, word [rbx + 6]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14000e817
movzx ecx, word [rbx + 8]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x2d
jne 0x14000e817
movzx ecx, word [rbx + 0xa]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6d
jne 0x14000e817
movzx ecx, word [rbx + 0xc]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x6f
jne 0x14000e817
movzx ecx, word [rbx + 0xe]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x64
jne 0x14000e817
movzx ecx, word [rbx + 0x10]
test cx, cx
je 0x14000e817
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, 0x65
jne 0x14000e817
cmp word [rbx + 0x12], 0
jne 0x14000e817
lea rdi, [rsp + 0x3c]
mov dword [rdi], 4
mov qword [rsp + 0x30], rdi
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000e9df
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000001
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000e9df
mov dil, 1
jmp 0x14000e825
cmp byte [rax], 0
movzx eax, dil
mov edi, 1
cmove edi, eax
jmp 0x14000e83b
cmp dword [rsp + 0x38], 1
mov dil, 1
je 0x14000e823
jmp 0x14000e825
Function at 0x14000eaf0
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
mov qword [rcx], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
mov byte [rcx + 0x18], 0
test rdx, rdx
je 0x14000eb64
movzx ecx, word [rdx]
cmp ecx, 0x5a4d
jne 0x14000eb64
lea r8, [rax + 8]
movsxd r9, dword [rdx + 0x3c]
lea r10, [rdx + r9]
mov qword [r8], r10
cmp dword [rdx + r9], 0x4550
jne 0x14000eb64
movzx ecx, word [r10 + 0x18]
cmp ecx, 0x20b
jne 0x14000eb64
mov r8d, dword [r10 + 0x50]
cmp r8d, 0x148
jb 0x14000eb64
lea ecx, [r8 - 1]
add rdx, rcx
mov qword [rax + 0x10], rdx
cmp dword [r10 + 0x84], 2
jb 0x14000eb64
cmp dword [r10 + 0x90], r8d
setae byte [rax + 0x18]
ret
Function at 0x140010670
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov edi, edx
mov r15, rcx
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r13, qword [rcx + 0x10]
mov ecx, edx
cmp r13, rcx
ja 0x14001082a
lea rdi, [r15 + 8]
cmp rcx, 0x20
mov eax, 0x20
cmova rax, rcx
mov rbx, rax
sub rbx, r13
jbe 0x140010704
mov rcx, qword [r15 + 0x18]
sub rcx, r13
mov rax, r13
cmp rcx, rbx
jb 0x140010850
test rbx, rbx
jle 0x140010701
mov rdx, qword [rdi]
lea rcx, [rdx + rax]
lea rbp, [rcx + rbx]
lea r8, [rax + rdx]
inc r8
cmp rbp, r8
cmova r8, rbp
sub r8, rcx
xor edx, edx
call sub.ntdll.dll_memset
mov rax, qword [r15 + 0x10]
add rax, rbx
mov qword [r15 + 0x10], rax
mov r14, qword [r15]
cmp qword [r14], 0
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
je 0x1400108b4
mov rsi, qword [r15 + 0x40]
add rsi, r13
mov r12, qword [r15 + 8]
add r12, r13
mov eax, dword [0x14005cb64]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14001086c
add rbx, rsi
cmp rbx, rsi
jbe 0x1400108b4
mov eax, dword [0x14005cb60]
mov qword [rsp + 0x30], rax
dec eax
mov qword [rsp + 0x38], rax
lea rbp, [rsp + 0x50]
mov r13, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x50], 0
mov r9, rbx
sub r9, rsi
mov rcx, qword [r14]
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov r8, r12
call r13
test eax, eax
je 0x1400108bb
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x40]
lea rcx, [rdi + r14]
inc rcx
mov rax, qword [r15 + 0x10]
mov rsi, rcx
sub rsi, rax
jbe 0x14001081b
mov rcx, qword [r15 + 0x18]
sub rcx, rax
cmp rcx, rsi
mov rbx, qword [rsp + 0x48]
jae 0x1400107e9
mov rcx, rbx
mov rdx, rsi
call fcn.140010910
test al, al
je 0x1400108ea
mov rax, qword [r15 + 0x10]
test rsi, rsi
jle 0x140010815
mov rdx, qword [rbx]
lea rcx, [rdx + rax]
lea rbp, [rcx + rsi]
lea r8, [rax + rdx]
inc r8
cmp rbp, r8
cmova r8, rbp
sub r8, rcx
xor edx, edx
call sub.ntdll.dll_memset
mov rax, qword [r15 + 0x10]
add rax, rsi
mov rcx, rax
add rdi, r14
mov qword [r15 + 0x10], rcx
mov rax, qword [r15 + 8]
mov byte [rax + rdi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14001bc70
mov eax, edi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
mov rdx, rbx
call fcn.140010910
test al, al
je 0x1400108f5
mov rax, qword [r15 + 0x10]
jmp 0x1400106d5
lea rcx, [0x14005cb64]
mov rbp, r14
call fcn.14001aa20
cmp dword [0x14005cb64], 0xffffffff
jne 0x140010752
lea r14, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 4]
mov dword [0x14005cb60], eax
lea rcx, [0x14005cb64]
call fcn.14001a9c0
mov r14, rbp
jmp 0x140010752
xor edi, edi
jmp 0x1400107a9
mov rdx, qword [rsp + 0x38]
mov rax, rdx
not rax
and rax, rbx
mov rcx, rbx
sub rcx, qword [rsp + 0x30]
test ebx, edx
cmovne rcx, rax
xor edi, edi
mov rbx, rcx
cmp rcx, rsi
ja 0x14001077c
jmp 0x1400107a9
int3
int3
Function at 0x140010a40
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14005cb6c]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140010a90
mov esi, dword [0x14005cb68]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bc70
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x14005cb6c]
call fcn.14001aa20
cmp dword [0x14005cb6c], 0xffffffff
jne 0x140010a75
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x28]
mov dword [0x14005cb68], eax
lea rcx, [0x14005cb6c]
call fcn.14001a9c0
jmp 0x140010a75

Function at 0x140010e70
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14005c018]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14005cb64]
mov ecx, dword [0x14005c2c8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140010ec0
mov esi, dword [0x14005cb60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bc70
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x14005cb64]
call fcn.14001aa20
cmp dword [0x14005cb64], 0xffffffff
jne 0x140010ea5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x14005cb60], eax
lea rcx, [0x14005cb64]
call fcn.14001a9c0
jmp 0x140010ea5