joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a1b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x810
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [esp + 0x808], eax
mov eax, dword [0x435028]
cmp eax, 0xffffffff
mov dword [esp + 4], eax
jne 0x40a214
lea edi, [esp + 4]
push edi
call fcn.0040a550
add esp, 4
test al, al
je 0x40a2be
mov ecx, dword [esp + 4]
cmp ecx, 0xffffffff
je 0x40a2e4
mov eax, 0xffffffff
lock cmpxchg dword [0x435028], ecx
mov eax, dword [esp + 4]
jne 0x40a32c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [esp + 8], eax
jne 0x40a281
lea edi, [esp + 8]
push 0x800
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edi
push dword [esp + 8]
call ebx
push 0x800
call sub.mozglue.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push esi
push dword [esp + 8]
call ebx
mov ecx, dword [esp + 0x808]
xor ecx, ebp
call fcn.0042da80
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 8]
push str.PlatformThreadLocalStorage::GetTLSValue_key___kUninitialized
push 0x42f1b8
push eax
call fcn.0040a460
add esp, 0xc
test eax, eax
je 0x40a223
lea esi, [esp + 8]
mov ecx, esi
push eax
push 0xb5
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00401c20
mov ecx, esi
call fcn.00401cb0
jmp 0x40a223
lea esi, [esp + 8]
mov ecx, esi
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0x99
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00401be0
mov ecx, esi
call fcn.00401cb0
jmp 0x40a1f0
push edi
call fcn.0040a550
add esp, 4
test al, al
je 0x40a2f8
cmp dword [esp + 4], 0xffffffff
jne 0x40a319
lea esi, [esp + 8]
mov ecx, esi
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0xa3
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
call fcn.00401be0
mov ecx, esi
call fcn.00401cb0
push 0xffffffffffffffff
call fcn.0040a570
add esp, 4
mov ecx, dword [esp + 4]
jmp 0x40a1fd
push eax
call fcn.0040a570
add esp, 4
mov eax, dword [0x435028]
mov dword [esp + 4], eax
jmp 0x40a214
Function at 0x40ae90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40aeb7
mov eax, dword [ecx + 4]
mov esi, ecx
mov edi, dword [eax + 0x3c]
cmp dword [eax + edi + 0x74], 0
je 0x40aeb7
cmp word [eax + edi + 0x14], 0x68
jae 0x40aec1
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], edx
mov edx, dword [esi]
mov ecx, esi
push dword [eax + edi + 0x78]
call dword [edx + 4]
test eax, eax
je 0x40aeb7
mov edi, dword [ebp - 0x18]
cmp edi, 0xffff
ja 0x40aee5
mov word [ebx], di
mov al, 1
jmp 0x40aeb9
mov edx, dword [esi]
mov ecx, esi
push dword [eax + 0x20]
mov dword [ebp - 0x10], eax
call dword [edx + 4]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x40aeb7
lea ecx, [edi + 1]
lea ebx, [edx + eax*4]
mov dword [ebp - 0x1c], edx
mov edi, edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], ecx
nop word cs:[eax + eax]
mov eax, ebx
mov edx, dword [esi]
sub eax, edi
mov ecx, eax
shr eax, 0x1f
sar ecx, 2
add eax, ecx
and eax, 0xfffffffe
lea ecx, [edi + eax*2]
mov dword [ebp - 0x24], ecx
mov ecx, esi
push dword [edi + eax*2]
call dword [edx + 4]
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx]
test cl, cl
je 0x40af5d
mov edx, dword [ebp - 0x20]
nop dword [eax]
cmp cl, byte [eax]
jne 0x40af5f
movzx ecx, byte [edx]
inc eax
inc edx
test cl, cl
jne 0x40af50
xor ecx, ecx
movzx eax, byte [eax]
mov esi, dword [ebp - 0x24]
movzx ecx, cl
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [esi + 4]
cmovg edi, edx
cmovle ebx, esi
cmp ecx, eax
je 0x40af89
mov esi, dword [ebp - 0x14]
xor eax, eax
cmp edi, ebx
jne 0x40af20
jmp 0x40aeb9
mov ecx, dword [ebp - 0x14]
mov edx, esi
mov esi, dword [ebp - 0x10]
mov eax, dword [ecx]
push dword [esi + 0x24]
mov edi, edx
call dword [eax + 4]
sub edi, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov word [ecx], ax
jmp 0x40aee1
Function at 0x40be50
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x124
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4350e4]
mov edx, dword fs:[0x2c]
mov eax, dword [0x436124]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x40be96
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042da80
add esp, 0x124
pop esi
pop edi
pop ebp
ret
push 0x436124
call fcn.0042d3b7
add esp, 4
cmp dword [0x436124], 0xffffffff
jne 0x40be82
lea eax, [ebp - 0x124]
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x12c], 0
cmp eax, 0xa
je 0x40bef5
xor edi, edi
cmp eax, 6
jne 0x40bf2b
push 0x43185a
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetProductInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x12c]
push ecx
push 0
push 0
push dword [ebp - 0x120]
push dword [ebp - 0x124]
call eax
mov edi, dword [ebp - 0x12c]
push 0x5c
call sub.mozglue.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
push 0x436140
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea edx, [ebp - 0x128]
mov ecx, esi
push edi
call fcn.0040bf80
add esp, 4
mov dword [0x436120], esi
push 0x436124
call fcn.0042d409
add esp, 4
jmp 0x40be82
Function at 0x416390
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [0x43500c]
mov esi, ecx
xor eax, ebp
test edx, edx
mov dword [esp + 0xd0], eax
jne 0x4163d3
xor edi, edi
cmp dword [esi + 8], 0
jne 0x416407
mov ecx, dword [esp + 0xd0]
xor ecx, ebp
call fcn.0042da80
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
push 0
push str._TargetNtMapViewOfSection_44
push 1
push str.NtMapViewOfSection
push 0x42f62a
call fcn.00415c50
mov ecx, esi
push 1
push str._TargetNtUnmapViewOfSection_12
push 1
push str.NtUnmapViewOfSection
push 0x42f62a
call fcn.00415c50
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esp + 4], eax
push 1
push 0x2000
push 0x10000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, dword [esi + 8]
mov dword [esp + 0xc], eax
shl ebx, 6
lea ecx, [ebx + 0x50]
mov dword [esp + 8], ecx
call fcn.004159c0
mov edi, eax
and eax, 0xfffff000
add ebx, 0x104f
add eax, dword [esp + 0xc]
and edi, 0xfff
and ebx, 0xfffff000
push 0x40
push 0x1000
push ebx
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test eax, eax
jne 0x416491
lea ecx, [esp + 0x18]
push str.thunk_base
push 0x1a8
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
call fcn.00401be0
lea ecx, [esp + 0x18]
call fcn.00401cb0
add ebx, edi
mov edi, dword [esp + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0x10
push 0xa4
push 0
push sym.plugin_container.exe_g_originals
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x18]
mov ecx, esi
mov edx, ebx
push eax
push edi
call fcn.004167a0
add esp, 8
mov edi, eax
test eax, eax
jne 0x4163bb
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov edi, 0x2a
je 0x4163bb
cmp dword [esp + 0x14], 0x10
jne 0x4163bb
lea eax, [esp + 0x10]
push eax
push 0x20
push dword [esp + 0x10]
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [esi]
push 0xa4
push sym.plugin_container.exe_g_originals
push str.g_originals
call fcn.00428560
mov edi, eax
jmp 0x4163bb
Function at 0x417a20
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x43500c]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x2c]
mov esi, 5
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0x10], ecx
mov dword [edi], 0xffffffff
jne 0x417aaf
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
cmp dword [eax + 0x14], 7
jbe 0x417a61
mov eax, dword [eax]
mov ebx, dword [ebx]
push 0
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x417ac3
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push 3
push 0
push 0
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [ebp - 0x14]
xor eax, eax
cmp ecx, 0xffffffff
mov dword [edi], ecx
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042da80
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0xffffffff
jmp 0x417aa2

Function at 0x41c1e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, edx
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
push 0
push edx
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.00406170
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x41c22d
push edi
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x41f7e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x43500c]
mov edi, 5
add ecx, 0xfffffffb
xor eax, ebp
cmp ecx, 1
mov dword [ebp - 0x10], eax
jbe 0x41f817
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042da80
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x54], 0x44
mov edi, dword [ebp + 0x18]
cmp dword [eax + 0x14], 7
jbe 0x41f89c
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
push eax
call dword [sym.imp.mozglue.dll__wcsdup]
add esp, 4
mov edx, dword [edi + 0x10]
cmp dword [edi + 0x14], 7
jbe 0x41f8b4
mov edi, dword [edi]
test edx, edx
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
cmove edi, edx
cmp dword [esi + 0x14], 7
jbe 0x41f8c7
mov esi, dword [esi]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x54]
push ebx
push ecx
push edi
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x58], eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x41f95d
mov eax, dword [ebp + 8]
mov esi, 0x101c01
cmp eax, 6
mov eax, 0x1fffff
cmove esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov esi, dword [ebx + 4]
test eax, eax
je 0x41f977
add ebx, 4
cmp dword [ebp + 8], 6
mov edi, 0x100c43
mov eax, 0x1fffff
cmove edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push edi
push ebx
push dword [ebp - 0x5c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41f803
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x41f803
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41f95d
Function at 0x41f980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10], ebx
mov dword [ebx], 0
push edi
mov edi, eax
push esi
push edx
push ecx
push dword [ebp - 0x14]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x41f9ef
mov edi, dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
push 0
push 0
push dword [ebp - 0x10]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x4214c0
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [0x43500c]
mov edi, 0x3f0
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 0x38], 0
jne 0x4214f4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042da80
mov eax, edi
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, ecx
lea eax, [ebp - 0x58]
lea edx, [ecx + 0x30]
lea ecx, [ebp - 0x5c]
push eax
push 2
call fcn.00421600
add esp, 8
mov edi, dword [ebp - 0x5c]
test edi, edi
je 0x421534
cmp dword [edi], 0
mov dword [ebp - 0x60], esi
je 0x4215ec
mov eax, dword [ebp - 0x60]
xor edx, edx
add eax, 0x18
mov dword [ebp - 0x64], eax
test dword [edi + edx*8 + 8], 0xc0000020
jne 0x421552
jmp 0x421565
mov edi, dword [ebp - 0x58]
jmp 0x4214de
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x54]
push eax
push edx
call fcn.0040d220
nop word cs:[eax + eax]
mov edx, ebx
inc edx
cmp edx, dword [edi]
jae 0x4215ec
test dword [edi + edx*8 + 8], 0xc0000020
jne 0x421552
cmp dword [ebp + 8], 0
je 0x421575
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp dword [eax + 4], ecx
jne 0x4215a7
lea eax, [ebp - 0x54]
mov ebx, edx
mov ecx, eax
push dword [edi + edx*8 + 4]
call fcn.004266e0
mov esi, dword [ebp - 0x60]
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
cmp edx, eax
je 0x421539
push 0x44
lea ecx, [ebp - 0x54]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add dword [esi + 0x1c], 0x44
jmp 0x421550
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x68], edx
nop
mov eax, dword [edi + edx*8 + 4]
add ecx, esi
mov dword [ebp - 0x6c], eax
call fcn.00426cf0
push dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [ebp - 0x68]
test eax, eax
jne 0x421552
mov eax, dword [ebp + 8]
inc ebx
add esi, 0x44
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xf0f0f0f1
cmp ebx, eax
jb 0x4215b0
jmp 0x421575
push edi
call sub.mozglue.dll_void___cdecl_operator_delete___void__
add esp, 4
xor edi, edi
jmp 0x4214de
Function at 0x4280c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
call fcn.0040baf0
test al, al
je 0x4280e4
push 0x32
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, dword [esi + 0x20]
mov dword [esi + 0x20], 0
test edi, edi
je 0x428102
mov ecx, edi
call fcn.00425ff0
push edi
call sub.mozglue.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esi + 0x30]
call fcn.004036b0
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x42811b
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov edi, dword [esi + 0x20]
test edi, edi
je 0x428132
mov ecx, edi
call fcn.00425ff0
push edi
call sub.mozglue.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esi + 0x18]
call fcn.004061d0
lea ecx, [esi + 0x14]
call fcn.004061d0
lea ecx, [esi + 0x10]
call fcn.004061d0
mov ecx, esi
pop esi
pop edi
pop ebp
jmp fcn.0040bab0
Function at 0x429430
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x43500c]
mov edi, dword [ebp + 8]
mov ebx, 0x1126
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
call fcn.00429190
add esp, 4
test al, al
je 0x429472
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042da80
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x28]
mov ecx, edi
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], 0
mov edx, esi
call fcn.00429630
mov ecx, esi
mov ebx, eax
call fcn.00429700
mov ecx, esi
mov edx, esi
mov bh, al
call fcn.00429740
test bl, bl
jne 0x4294b6
test bh, bh
jne 0x4294b6
test al, al
je 0x4295ef
test bh, bh
mov ebx, eax
je 0x4295f6
cmp dword [ebp - 0x14], 7
jbe 0x4294c9
mov esi, dword [ebp - 0x28]
lea edi, [ebp - 0x230]
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x429616
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov esi, eax
dec esi
cmp dword [ebp - 0x14], 7
jbe 0x4294fb
mov eax, dword [ebp - 0x28]
jmp 0x4294fe
lea eax, [ebp - 0x28]
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4295ef
lea edi, [ebp - 0x28]
mov dword [ebp - 0x234], esi
nop dword [eax + eax]
cmp dword [ebp - 0x14], 7
mov eax, edi
jbe 0x42952b
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429584
test eax, 0x400
jne 0x4295eb
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 7
mov eax, edi
jbe 0x429550
mov eax, dword [ebp - 0x28]
mov edx, 0xffffffff
test ecx, ecx
je 0x42956b
cmp word [eax + ecx*2 - 2], 0x5c
lea ebx, [eax + ecx*2 - 2]
jne 0x429599
sub ebx, eax
sar ebx, 1
mov edx, ebx
mov edi, edx
sub edi, ecx
ja 0x4295c3
mov dword [ebp - 0x18], edx
mov word [eax + edx*2], 0
lea edi, [ebp - 0x28]
cmp dword [ebp - 0x18], esi
ja 0x429520
jmp 0x4295d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
dec eax
cmp eax, 3
jb 0x429542
cmp ebx, 0x7b
je 0x429542
jmp 0x4295de
lea esi, [ecx + ecx]
mov edi, 2
sub edi, esi
mov esi, dword [ebp - 0x234]
nop dword [eax]
test edi, edi
je 0x42956b
add edi, 2
cmp word [ebx - 2], 0x5c
lea ebx, [ebx - 2]
jne 0x4295b0
jmp 0x429565
lea ecx, [ebp - 0x28]
push 0
push edi
mov edi, ecx
call fcn.004075a0
cmp dword [ebp - 0x18], esi
ja 0x429520
mov ebx, 0x1126
lea ecx, [ebp - 0x28]
call fcn.00401890
jmp 0x42945b
xor ebx, ebx
jmp 0x4295de
mov ebx, 0x7b
jmp 0x4295de
lea ecx, [ebp - 0x28]
push 4
push str.._
push 0
call fcn.00412840
cmp dword [ebp - 0x14], 7
ja 0x4294c6
jmp 0x4294c9
test bl, bl
mov eax, 0x1126
mov ebx, 0x7b
cmovne ebx, eax
jmp 0x4295de
Function at 0x42ac90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x24
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push str.MOZ_ENABLE_HANDLE_VERIFIER
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x42acca
call fcn.0040b090
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042da80
add esp, 0x24
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [str.kernel32AppInit_DLLs]
cmp dword [0x436388], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x64002e
mov dword [ebp - 0x14], 0x6c006c
mov word [ebp - 0x10], 0
jne 0x42ad01
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x436388], eax
lea esi, [ebp - 0x2c]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x28], 0x4363d4
mov dword [ebp - 0x24], 0x436354
mov dword [ebp - 0x20], 0x4309d4
mov dword [ebp - 0x1c], 0x42adb0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x18], 0
push esi
push edi
push 0x42ae10
push 0x4363d8
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x42acb4
cmp dword [ebp - 0x2c], 0
je 0x42acb4
mov dword [ebp - 0x28], 0x4363dc
mov dword [ebp - 0x24], 0x436354
mov dword [ebp - 0x20], 0x4309c4
mov dword [ebp - 0x1c], 0x42add0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x18], 0
push esi
push edi
push 0x42ae10
push 0x4363e0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x42acb4
cmp dword [ebp - 0x2c], 0
jne 0x42acb9
jmp 0x42acb4

Function at 0x42b6f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [0x4350e4]
mov edx, dword fs:[0x2c]
mov eax, dword [0x4363ec]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x42b753
push 0x4363ec
call fcn.0042d3b7
add esp, 4
cmp dword [0x4363ec], 0xffffffff
jne 0x42b753
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov dword [0x4363e8], eax
push 0x4363ec
call fcn.0042d409
add esp, 4
mov esi, dword [0x4363e8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042da80
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x42c080
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x43500c]
mov esi, edx
mov edi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx + 0x10]
shl ebx, 7
mov edx, ebx
call fcn.0042c1c0
test al, al
je 0x42c15a
add ebx, dword [edi + 4]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x80
mov byte [ebp - 0x14], 1
push eax
push 0x40
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x42c19a
mov eax, dword [ebp - 0x30]
test eax, eax
mov dword [ebp - 0x34], eax
je 0x42c1a6
mov cl, byte [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
test cl, cl
je 0x42c11f
test ebx, ebx
je 0x42c11f
test eax, eax
je 0x42c11f
test edx, edx
je 0x42c11f
inc dword [edi + 0x10]
mov edi, dword [ebp - 0x34]
mov dword [esi], edi
mov dword [esi + 4], edx
mov edx, dword [ebp - 0x20]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov edi, dword [ebp - 0x1c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp - 0x18]
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edx
mov byte [esi + 0x1c], cl
mov byte [esi + 0x20], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042da80
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
jmp 0x42c146
mov dword [ebp - 0x2c], 0
jmp 0x42c0f2
mov edx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov cl, byte [ebp - 0x14]
jmp 0x42c11c

Function at 0x42c210
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 8], eax
mov ecx, dword [0x4350e4]
mov edx, dword fs:[0x2c]
mov eax, dword [0x436420]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42c256
mov esi, dword [0x43641c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042da80
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
push 0x436420
call fcn.0042d3b7
add esp, 4
cmp dword [0x436420], 0xffffffff
jne 0x42c23e
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov dword [0x43641c], eax
push 0x436420
call fcn.0042d409
add esp, 4
jmp 0x42c23e