joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418fb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [0x448010]
mov edi, edx
mov esi, ecx
xor eax, ebp
mov dword [esp + 0xc0], eax
mov eax, dword [0x448054]
cmp eax, 0xffffffff
je 0x418fe6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x418feb
call fcn.00419110
call fcn.004192b0
mov ebx, eax
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x448868]
mov dword [esp], 0x100
inc eax
movzx edx, al
lea ecx, [edx + edx*2]
cmp dword [ecx*4 + 0x44886c], 0
jne 0x419088
lea eax, [ecx*4 + 0x44886c]
mov dword [0x448868], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x448870], edi
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x448874]
mov dword [esi + 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
mov dword [esp + 8], 0xffffffff
cmp eax, 0xffffffff
mov dword [esp + 4], eax
je 0x419094
mov eax, dword [esi]
mov dword [esp + 8], 0x100
cmp eax, 0xff
mov dword [esp + 4], eax
jg 0x4190ce
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.0043c380
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
inc eax
dec dword [esp]
jne 0x419006
jmp 0x419043
lea eax, [esp + 8]
lea ecx, [esp + 4]
push str.slot____kInvalidSlotValue
push eax
push ecx
call fcn.00411bc0
add esp, 0xc
test eax, eax
je 0x41905d
lea edi, [esp + 8]
mov ecx, edi
push eax
push 0x159
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00411960
mov ecx, edi
call fcn.004119f0
jmp 0x41905d
lea eax, [esp + 8]
lea ecx, [esp + 4]
push str.slot____kThreadLocalStorageSize
push eax
push ecx
call fcn.00411bc0
add esp, 0xc
test eax, eax
je 0x419072
lea esi, [esp + 8]
mov ecx, esi
push eax
push 0x15a
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00411960
mov ecx, esi
call fcn.004119f0
jmp 0x419072
Function at 0x419110
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x810
mov eax, dword [0x448010]
xor eax, ebp
mov dword [esp + 0x808], eax
mov eax, dword [0x448054]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x419174
lea edi, [esp + 4]
push edi
call fcn.004194b0
add esp, 4
test al, al
je 0x41921e
mov ecx, dword [esp + 4]
cmp ecx, 0xffffffff
je 0x419244
mov eax, 0xffffffff
lock cmpxchg dword [0x448054], ecx
mov eax, dword [esp + 4]
jne 0x41928c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [esp + 8], eax
jne 0x4191e1
lea edi, [esp + 8]
push 0x800
push 0
push edi
call sub.ntdll.dll_memset
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push dword [esp + 8]
call ebx
push 0x800
call sub.mozglue.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push esi
push dword [esp + 8]
call ebx
mov ecx, dword [esp + 0x808]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 8]
push str.PlatformThreadLocalStorage::GetTLSValue_key___kUninitialized
push 0x43ef50
push eax
call fcn.004193c0
add esp, 0xc
test eax, eax
je 0x419183
lea esi, [esp + 8]
mov ecx, esi
push eax
push 0xb5
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00411960
mov ecx, esi
call fcn.004119f0
jmp 0x419183
lea esi, [esp + 8]
mov ecx, esi
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0x99
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00411920
mov ecx, esi
call fcn.004119f0
jmp 0x419150
push edi
call fcn.004194b0
add esp, 4
test al, al
je 0x419258
cmp dword [esp + 4], 0xffffffff
jne 0x419279
lea esi, [esp + 8]
mov ecx, esi
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0xa3
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00411920
mov ecx, esi
call fcn.004119f0
push 0xffffffffffffffff
call fcn.004194d0
add esp, 4
mov ecx, dword [esp + 4]
jmp 0x41915d
push eax
call fcn.004194d0
add esp, 4
mov eax, dword [0x448054]
mov dword [esp + 4], eax
jmp 0x419174
Function at 0x419df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x419e17
mov eax, dword [ecx + 4]
mov esi, ecx
mov edi, dword [eax + 0x3c]
cmp dword [eax + edi + 0x74], 0
je 0x419e17
cmp word [eax + edi + 0x14], 0x68
jae 0x419e21
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], edx
mov edx, dword [esi]
mov ecx, esi
push dword [eax + edi + 0x78]
call dword [edx + 4]
test eax, eax
je 0x419e17
mov edi, dword [ebp - 0x18]
cmp edi, 0xffff
ja 0x419e45
mov word [ebx], di
mov al, 1
jmp 0x419e19
mov edx, dword [esi]
mov ecx, esi
push dword [eax + 0x20]
mov dword [ebp - 0x10], eax
call dword [edx + 4]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x419e17
lea ecx, [edi + 1]
lea ebx, [edx + eax*4]
mov dword [ebp - 0x1c], edx
mov edi, edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], ecx
nop word cs:[eax + eax]
mov eax, ebx
mov edx, dword [esi]
sub eax, edi
mov ecx, eax
shr eax, 0x1f
sar ecx, 2
add eax, ecx
and eax, 0xfffffffe
lea ecx, [edi + eax*2]
mov dword [ebp - 0x24], ecx
mov ecx, esi
push dword [edi + eax*2]
call dword [edx + 4]
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx]
test cl, cl
je 0x419ebd
mov edx, dword [ebp - 0x20]
nop dword [eax]
cmp cl, byte [eax]
jne 0x419ebf
movzx ecx, byte [edx]
inc eax
inc edx
test cl, cl
jne 0x419eb0
xor ecx, ecx
movzx eax, byte [eax]
mov esi, dword [ebp - 0x24]
movzx ecx, cl
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [esi + 4]
cmovg edi, edx
cmovle ebx, esi
cmp ecx, eax
je 0x419ee9
mov esi, dword [ebp - 0x14]
xor eax, eax
cmp edi, ebx
jne 0x419e80
jmp 0x419e19
mov ecx, dword [ebp - 0x14]
mov edx, esi
mov esi, dword [ebp - 0x10]
mov eax, dword [ecx]
push dword [esi + 0x24]
mov edi, edx
call dword [eax + 4]
sub edi, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov word [ecx], ax
jmp 0x419e41
Function at 0x41adb0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x124
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4481bc]
mov edx, dword fs:[0x2c]
mov eax, dword [0x44949c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x41adf6
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043c380
add esp, 0x124
pop esi
pop edi
pop ebp
ret
push 0x44949c
call fcn.0043bc97
add esp, 4
cmp dword [0x44949c], 0xffffffff
jne 0x41ade2
lea eax, [ebp - 0x124]
push 0x118
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x12c], 0
cmp eax, 0xa
je 0x41ae55
xor edi, edi
cmp eax, 6
jne 0x41ae8b
push 0x442c58
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x12c]
push ecx
push 0
push 0
push dword [ebp - 0x120]
push dword [ebp - 0x124]
call eax
mov edi, dword [ebp - 0x12c]
push 0x5c
call sub.mozglue.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
push 0x4494b8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea edx, [ebp - 0x128]
mov ecx, esi
push edi
call fcn.0041aee0
add esp, 4
mov dword [0x449498], esi
push 0x44949c
call fcn.0043bce9
add esp, 4
jmp 0x41ade2
Function at 0x4252c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [0x448010]
mov esi, ecx
xor eax, ebp
test edx, edx
mov dword [esp + 0xd0], eax
jne 0x425303
xor edi, edi
cmp dword [esi + 8], 0
jne 0x425337
mov ecx, dword [esp + 0xd0]
xor ecx, ebp
call fcn.0043c380
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
push 0
push str._TargetNtMapViewOfSection_44
push 1
push str.NtMapViewOfSection
push 0x43f3ca
call fcn.00424b80
mov ecx, esi
push 1
push str._TargetNtUnmapViewOfSection_12
push 1
push 0x44067c
push 0x43f3ca
call fcn.00424b80
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esp + 4], eax
push 1
push 0x2000
push 0x10000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, dword [esi + 8]
mov dword [esp + 0xc], eax
shl ebx, 6
lea ecx, [ebx + 0x50]
mov dword [esp + 8], ecx
call fcn.004248f0
mov edi, eax
and eax, 0xfffff000
add ebx, 0x104f
add eax, dword [esp + 0xc]
and edi, 0xfff
and ebx, 0xfffff000
push 0x40
push 0x1000
push ebx
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test eax, eax
jne 0x4253c1
lea ecx, [esp + 0x18]
push str.thunk_base
push 0x1a8
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
call fcn.00411920
lea ecx, [esp + 0x18]
call fcn.004119f0
add ebx, edi
mov edi, dword [esp + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0x10
push 0xa4
push 0
push sym.firefox.exe_g_originals
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
mov ecx, esi
mov edx, ebx
push eax
push edi
call fcn.004256d0
add esp, 8
mov edi, eax
test eax, eax
jne 0x4252eb
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov edi, 0x2a
je 0x4252eb
cmp dword [esp + 0x14], 0x10
jne 0x4252eb
lea eax, [esp + 0x10]
push eax
push 0x20
push dword [esp + 0x10]
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [esi]
push 0xa4
push sym.firefox.exe_g_originals
push str.g_originals
call fcn.00437450
mov edi, eax
jmp 0x4252eb
Function at 0x426930
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x448010]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x2c]
mov esi, 5
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0x10], ecx
mov dword [edi], 0xffffffff
jne 0x4269bf
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
cmp dword [eax + 0x14], 7
jbe 0x426971
mov eax, dword [eax]
mov ebx, dword [ebx]
push 0
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x4269d3
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push 3
push 0
push 0
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [ebp - 0x14]
xor eax, eax
cmp ecx, 0xffffffff
mov dword [edi], ecx
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0xffffffff
jmp 0x4269b2

Function at 0x42b0d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, edx
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
push 0
push edx
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.004150e0
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x42b11d
push edi
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x42e6d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x448010]
mov edi, 5
add ecx, 0xfffffffb
xor eax, ebp
cmp ecx, 1
mov dword [ebp - 0x10], eax
jbe 0x42e707
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x54], 0x44
mov edi, dword [ebp + 0x18]
cmp dword [eax + 0x14], 7
jbe 0x42e78c
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
push eax
call dword [sym.imp.mozglue.dll__wcsdup]
add esp, 4
mov edx, dword [edi + 0x10]
cmp dword [edi + 0x14], 7
jbe 0x42e7a4
mov edi, dword [edi]
test edx, edx
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
cmove edi, edx
cmp dword [esi + 0x14], 7
jbe 0x42e7b7
mov esi, dword [esi]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x54]
push ebx
push ecx
push edi
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x58], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x42e84d
mov eax, dword [ebp + 8]
mov esi, 0x101c01
cmp eax, 6
mov eax, 0x1fffff
cmove esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov esi, dword [ebx + 4]
test eax, eax
je 0x42e867
add ebx, 4
cmp dword [ebp + 8], 6
mov edi, 0x100c43
mov eax, 0x1fffff
cmove edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push edi
push ebx
push dword [ebp - 0x5c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x42e6f3
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x42e6f3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42e84d
Function at 0x42e870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10], ebx
mov dword [ebx], 0
push edi
mov edi, eax
push esi
push edx
push ecx
push dword [ebp - 0x14]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x42e8df
mov edi, dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
push 0
push 0
push dword [ebp - 0x10]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x4303b0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x448010]
mov edi, 0x3f0
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x38], 0
jne 0x4303e4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, edi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, ecx
lea eax, [ebp - 0x58]
lea edx, [ecx + 0x30]
lea ecx, [ebp - 0x5c]
push eax
push 2
call fcn.004304f0
add esp, 8
mov edi, dword [ebp - 0x5c]
test edi, edi
je 0x430424
cmp dword [edi], 0
mov dword [ebp - 0x60], esi
je 0x4304dc
mov eax, dword [ebp - 0x60]
xor edx, edx
add eax, 0x18
mov dword [ebp - 0x64], eax
test dword [edi + edx*8 + 8], 0xc0000020
jne 0x430442
jmp 0x430455
mov edi, dword [ebp - 0x58]
jmp 0x4303ce
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x54]
push eax
push edx
call fcn.0041c180
nop word cs:[eax + eax]
mov edx, ebx
inc edx
cmp edx, dword [edi]
jae 0x4304dc
test dword [edi + edx*8 + 8], 0xc0000020
jne 0x430442
cmp dword [ebp + 8], 0
je 0x430465
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
jne 0x430497
lea eax, [ebp - 0x54]
mov ebx, edx
mov ecx, eax
push dword [edi + edx*8 + 4]
call fcn.004355d0
mov esi, dword [ebp - 0x60]
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
cmp edx, eax
je 0x430429
push 0x44
lea ecx, [ebp - 0x54]
push ecx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
add dword [esi + 0x1c], 0x44
jmp 0x430440
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x68], edx
nop
mov eax, dword [edi + edx*8 + 4]
add ecx, esi
mov dword [ebp - 0x6c], eax
call fcn.00435be0
push dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [ebp - 0x68]
test eax, eax
jne 0x430442
mov eax, dword [ebp + 8]
inc ebx
add esi, 0x44
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
cmp ebx, eax
jb 0x4304a0
jmp 0x430465
push edi
call sub.mozglue.dll_void___cdecl_operator_delete___void__
add esp, 4
xor edi, edi
jmp 0x4303ce
Function at 0x436fb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.0041aa50
test al, al
je 0x436fd4
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test edi, edi
je 0x436ff2
mov ecx, edi
call fcn.00434ee0
push edi
call sub.mozglue.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esi + 0x30]
call fcn.00412870
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x43700b
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov edi, dword [esi + 0x20]
test edi, edi
je 0x437022
mov ecx, edi
call fcn.00434ee0
push edi
call sub.mozglue.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esi + 0x18]
call fcn.00415140
lea ecx, [esi + 0x14]
call fcn.00415140
lea ecx, [esi + 0x10]
call fcn.00415140
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.0041aa10
Function at 0x438320
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x448010]
mov edi, dword [ebp + 8]
mov ebx, 0x1126
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
call fcn.00438080
add esp, 4
test al, al
je 0x438362
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x28]
mov ecx, edi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], 0
mov edx, esi
call fcn.00438520
mov ecx, esi
mov ebx, eax
call fcn.004385f0
mov ecx, esi
mov edx, esi
mov bh, al
call fcn.00438630
test bl, bl
jne 0x4383a6
test bh, bh
jne 0x4383a6
test al, al
je 0x4384df
test bh, bh
mov ebx, eax
je 0x4384e6
cmp dword [ebp - 0x14], 7
jbe 0x4383b9
mov esi, dword [ebp - 0x28]
lea edi, [ebp - 0x230]
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x438506
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov esi, eax
dec esi
cmp dword [ebp - 0x14], 7
jbe 0x4383eb
mov eax, dword [ebp - 0x28]
jmp 0x4383ee
lea eax, [ebp - 0x28]
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4384df
lea edi, [ebp - 0x28]
mov dword [ebp - 0x234], esi
nop dword [eax + eax]
cmp dword [ebp - 0x14], 7
mov eax, edi
jbe 0x43841b
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x438474
test eax, 0x400
jne 0x4384db
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 7
mov eax, edi
jbe 0x438440
mov eax, dword [ebp - 0x28]
mov edx, 0xffffffff
test ecx, ecx
je 0x43845b
cmp word [eax + ecx*2 - 2], 0x5c
lea ebx, [eax + ecx*2 - 2]
jne 0x438489
sub ebx, eax
sar ebx, 1
mov edx, ebx
mov edi, edx
sub edi, ecx
ja 0x4384b3
mov dword [ebp - 0x18], edx
mov word [eax + edx*2], 0
lea edi, [ebp - 0x28]
cmp dword [ebp - 0x18], esi
ja 0x438410
jmp 0x4384c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
dec eax
cmp eax, 3
jb 0x438432
cmp ebx, 0x7b
je 0x438432
jmp 0x4384ce
lea esi, [ecx + ecx]
mov edi, 2
sub edi, esi
mov esi, dword [ebp - 0x234]
nop dword [eax]
test edi, edi
je 0x43845b
add edi, 2
cmp word [ebx - 2], 0x5c
lea ebx, [ebx - 2]
jne 0x4384a0
jmp 0x438455
lea ecx, [ebp - 0x28]
push 0
push edi
mov edi, ecx
call fcn.00416500
cmp dword [ebp - 0x18], esi
ja 0x438410
mov ebx, 0x1126
lea ecx, [ebp - 0x28]
call fcn.0040dd20
jmp 0x43834b
xor ebx, ebx
jmp 0x4384ce
mov ebx, 0x7b
jmp 0x4384ce
lea ecx, [ebp - 0x28]
push 4
push 0x43fd00
push 0
call fcn.00421770
cmp dword [ebp - 0x14], 7
ja 0x4383b6
jmp 0x4383b9
test bl, bl
mov eax, 0x1126
mov ebx, 0x7b
cmovne ebx, eax
jmp 0x4384ce
Function at 0x439b90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x24
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 0xc], eax
push str.MOZ_ENABLE_HANDLE_VERIFIER
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x439bca
call fcn.00419ff0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0043c380
add esp, 0x24
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [str.kernel32AppInit_DLLs]
cmp dword [0x449700], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x64002e
mov dword [ebp - 0x14], 0x6c006c
mov word [ebp - 0x10], 0
jne 0x439c01
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x449700], eax
lea esi, [ebp - 0x2c]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x28], 0x44974c
mov dword [ebp - 0x24], 0x4496cc
mov dword [ebp - 0x20], 0x440dae
mov dword [ebp - 0x1c], 0x439cb0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x18], 0
push esi
push edi
push 0x439d10
push 0x449750
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x439bb4
cmp dword [ebp - 0x2c], 0
je 0x439bb4
mov dword [ebp - 0x28], 0x449754
mov dword [ebp - 0x24], 0x4496cc
mov dword [ebp - 0x20], 0x440d9e
mov dword [ebp - 0x1c], 0x439cd0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x18], 0
push esi
push edi
push 0x439d10
push 0x449758
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x439bb4
cmp dword [ebp - 0x2c], 0
jne 0x439bb9
jmp 0x439bb4