joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400107c0
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rbp, qword [0x1400f7448]
mov rax, qword [rbp]
xor rax, rsp
mov qword [rsp + 0x90], rax
and r8, 0xfffffffffffffffc
mov qword [rsp + 0x40], r8
mov byte [rsp + 0x58], 0
je 0x1400108e1
movzx eax, word [r8]
cmp eax, 0x5a4d
jne 0x1400108e1
movsxd rcx, dword [r8 + 0x3c]
lea rax, [r8 + rcx]
mov qword [rsp + 0x48], rax
cmp dword [r8 + rcx], 0x4550
jne 0x1400108e1
movzx ecx, word [rax + 0x18]
cmp ecx, 0x20b
jne 0x1400108e1
mov ecx, dword [rax + 0x50]
cmp ecx, 0x148
jb 0x1400108e1
mov rdi, rdx
lea edx, [rcx - 1]
add r8, rdx
mov qword [rsp + 0x50], r8
cmp dword [rax + 0x84], 2
jb 0x140010867
cmp dword [rax + 0x90], ecx
setae byte [rsp + 0x58]
lea r8, str..text
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov r9d, 0x60000020
call fcn.140010960
cmp byte [rsp + 0x38], 0
je 0x1400108e1
mov rbx, qword [rsp + 0x28]
shr rbx, 1
add rbx, qword [rsp + 0x30]
mov al, byte [0x1401502f8]
test al, al
je 0x140010920
mov r15d, dword [0x140152804]
mov dword [rsp + 0x20], 0x80000000
lea r14, [rsp + 0x60]
mov rcx, r14
mov rdx, rdi
mov r8d, r15d
mov r9, rbx
call fcn.140010a60
mov rcx, rdi
mov edx, r15d
mov r8, r14
call fcn.140010c30
test eax, eax
je 0x14001090e
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x1400108e7
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x90]
xor rax, rsp
mov rcx, qword [rbp]
cmp rcx, rax
jne 0x14001091b
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsi], 0
mov byte [rsi + 8], 0
jmp 0x1400108e7
call fcn.140076380
lea rcx, [0x1401502f8]
call fcn.1400c0f74
test eax, eax
je 0x1400108a1
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x88]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c104b
jmp 0x1400108a1
Function at 0x140010960
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r12, qword [rdx + 0x10]
test r12, r12
je 0x140010a2c
mov r14d, r9d
mov rbx, r8
mov r15, qword [rdx]
mov rax, qword [rdx + 8]
movzx ecx, word [rax + 0x14]
add rcx, rax
add rcx, 0x18
cmp rcx, r15
setb r8b
cmp rcx, r12
seta dl
or dl, r8b
movzx ebp, word [rax + 6]
cmp bp, 0x60
mov eax, 0x60
cmovb eax, ebp
test dl, dl
mov edi, 4
cmove rdi, rcx
cmp dl, 1
jne 0x1400109cf
test ax, ax
jne 0x140010a4c
movzx ebp, ax
test rbp, rbp
je 0x140010a2c
nop word [rax + rax]
mov r8d, 8
mov rcx, rdi
mov rdx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x140010a01
add rdi, 0x28
add rbp, 0xffffffffffffffff
jne 0x1400109e0
jmp 0x140010a2c
test dword [rdi + 0x24], r14d
je 0x140010a2c
mov eax, dword [rdi + 0xc]
test rax, rax
je 0x140010a2c
mov ecx, dword [rdi + 8]
test rcx, rcx
je 0x140010a2c
add r15, rax
cmp r15, r12
ja 0x140010a4c
mov qword [rsi], rcx
mov qword [rsi + 8], r15
mov byte [rsi + 0x10], 1
jmp 0x140010a3a
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dword [0], 0x321
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3
Function at 0x140010a60
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r12, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x58], rax
test r9, r9
je 0x140010b6e
mov esi, dword [rsp + 0xc0]
test esi, esi
je 0x140010b6e
mov rbx, r9
mov r15d, r8d
mov al, byte [0x1401502f8]
test al, al
je 0x140010bb6
mov esi, esi
xor ebp, ebp
mov rax, rbx
sub rax, rsi
cmovae rbp, rax
cmp rbp, 0x100001
mov eax, 0x100000
cmovb rbp, rax
cmp rbx, rsi
mov edi, dword [0x140152804]
cmovb rbp, rax
mov al, byte [0x140150300]
test al, al
je 0x140010bf0
mov rax, qword [0x140152808]
xor ecx, ecx
mov rdx, rbx
add rdx, rsi
cmovae rcx, rdx
cmp rax, rcx
cmovb rcx, rax
add rbx, rsi
cmovb rcx, rax
mov edx, r15d
cmp rcx, rdx
jb 0x140010b6e
mov rbx, rbp
neg rbx
lea rax, [rdi - 1]
and rax, rbx
add rax, rbp
xor ebp, ebp
sub rcx, rdx
cmovae rbp, rcx
neg rdi
and rdi, rbp
sub rdi, rax
jbe 0x140010b6e
test rax, rax
setne cl
cmp rdi, 0xffffffffffffffff
setne dl
and dl, cl
mov rcx, rdi
or rcx, rax
setne cl
cmp dl, cl
jne 0x140010ba1
test rax, rax
mov ecx, 1
cmovne rcx, rax
mov qword [r12], rdi
mov qword [r12 + 8], rcx
mov byte [r12 + 0x10], 1
jmp 0x140010b7f
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], 0
mov rax, qword [rsp + 0x58]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140010bb1
mov rax, r12
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dword [0], 0x321
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
call fcn.140076380
lea rcx, [0x1401502f8]
call fcn.1400c0f74
test eax, eax
je 0x140010aaf
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c104b
jmp 0x140010aaf
lea rcx, [0x140150300]
call fcn.1400c0f74
test eax, eax
je 0x140010ae8
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
mov qword [0x140152808], rax
lea rcx, [0x140150300]
call fcn.1400c104b
jmp 0x140010ae8
Function at 0x140010c30
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, qword [0x1400f7448]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebx, ebx
test edx, edx
je 0x140010c65
mov rsi, rcx
cmp qword [rcx], 0
je 0x140010c65
cmp qword [rsi + 0x18], 0
je 0x140010c86
mov ebx, dword [rsi + 0x20]
mov rax, qword [rsp + 0x68]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x140010d64
mov eax, ebx
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov r14, r8
mov ebp, edx
mov al, byte [0x1401502f8]
test al, al
je 0x140010d69
mov ecx, dword [0x140152804]
xor ebx, ebx
mov eax, ebp
xor edx, edx
div ecx
sub ecx, edx
test edx, edx
cmove ecx, edx
add ecx, ebp
mov dword [rsi + 0x20], ecx
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x4000040
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsi + 8], rax
test rax, rax
je 0x140010d4c
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov rcx, rax
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x10], rax
test rax, rax
je 0x140010d57
mov rax, qword [rsi + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov rdx, qword [rsi]
mov r8d, dword [rsi + 0x20]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, rsi
call fcn.140010db0
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x140010c62
jmp 0x140010c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140010c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x140010c65
call fcn.140076380
lea rcx, [0x1401502f8]
call fcn.1400c0f74
test eax, eax
je 0x140010c99
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c104b
jmp 0x140010c99
Function at 0x140011010
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rbx, r9
mov r14, r8
mov r13, rdx
mov rsi, qword [0x1400f7448]
mov rax, qword [rsi]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov al, byte [0x1401502f8]
test al, al
je 0x14001125b
xor eax, eax
test r14, r14
je 0x140011234
mov r15, qword [rsp + 0xf0]
cmp r15, rbx
jbe 0x140011234
mov esi, dword [0x140152804]
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x44]
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand_s
mov rax, r15
sub rax, rbx
sub rax, r14
mov rcx, rax
shr rcx, 0x20
je 0x14001109f
xor edx, edx
div rsi
mov rcx, rax
jmp 0x1400110a5
xor edx, edx
div esi
mov ecx, eax
mov r12d, dword [rsp + 0x44]
add rcx, 1
cmp r12, rcx
jb 0x1400110bd
mov eax, r12d
xor edx, edx
div ecx
mov r12d, edx
imul r12, rsi
add r12, rbx
sub r15, r14
cmp r12, r15
jbe 0x140011171
cmp r12, rbx
jbe 0x140011225
add rsi, 0xffffffffffffffff
lea rbp, [rsp + 0x78]
lea r15, [rsp + 0x48]
jmp 0x1400110fc
add rbx, rcx
cmp rbx, r12
jae 0x140011225
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0x30
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9, r15
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140011217
cmp qword [rsp + 0x78], 0x30
jne 0x140011225
cmp dword [rsp + 0x68], 0x10000
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x60]
jne 0x1400110f0
mov rdx, rcx
neg rdx
and rdx, rsi
lea rdi, [rdx + rcx]
mov rax, rbx
sub rax, rdx
cmp rax, r14
mov eax, 0
cmovae rax, rdi
cmp rbx, rdx
jb 0x1400110f0
test rax, rax
je 0x1400110f0
jmp 0x14001122d
lea rax, [rsi - 1]
mov qword [rsp + 0x38], rax
lea rbp, [rsp + 0x78]
mov rdx, r12
jmp 0x14001119c
add rdx, rdi
cmp rdx, r15
ja 0x1400110d0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 0x30
mov rcx, r13
xor r8d, r8d
lea r9, [rsp + 0x48]
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x140011217
cmp qword [rsp + 0x78], 0x30
jne 0x140011225
cmp dword [rsp + 0x68], 0x10000
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
jne 0x140011190
mov rcx, rdi
neg rcx
and rcx, qword [rsp + 0x38]
mov r8, rbp
mov rbp, rsi
lea rsi, [rcx + rdi]
mov rax, rdx
sub rax, rcx
cmp rax, r14
mov eax, 0
cmovae rax, rsi
mov rsi, rbp
mov rbp, r8
cmp rdx, rcx
jb 0x140011190
test rax, rax
je 0x140011190
jmp 0x14001122d
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov rsi, qword [0x1400f7448]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
mov rdx, qword [rsi]
cmp rdx, rcx
jne 0x140011295
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1401502f8]
call fcn.1400c0f74
test eax, eax
je 0x14001104f
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x70]
mov dword [0x140152804], eax
lea rcx, [0x1401502f8]
call fcn.1400c104b
jmp 0x14001104f
call fcn.140076380
int3
Function at 0x140011450
Capabilities:
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, qword [0x1400f7448]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
cmp qword [rcx], 0
je 0x14001154c
mov rsi, rcx
cmp qword [rcx + 8], 0
je 0x14001154c
mov rdi, qword [rsi + 0x10]
test rdi, rdi
je 0x14001154c
cmp qword [rsi + 0x18], 0
je 0x14001154c
add edx, r8d
add edx, 0xffffffff
mov ecx, dword [rsi + 0x24]
mov al, 1
cmp edx, ecx
jb 0x14001154c
cmp ecx, dword [rsi + 0x20]
jae 0x14001154a
add rdi, rcx
mov al, byte [0x1401502f0]
test al, al
je 0x14001156b
mov edx, dword [0x140152800]
mov rcx, rdi
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14001154a
mov r14, qword [rsi]
mov edi, dword [rsi + 0x24]
add rdi, qword [rsi + 0x18]
mov al, byte [0x1401502f0]
test al, al
je 0x1400115a5
mov r8d, dword [0x140152800]
mov dword [rsp + 0x20], 0x20
mov rcx, r14
mov rdx, rdi
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140011542
mov al, byte [0x1401502f0]
test al, al
je 0x1400115df
mov eax, dword [0x140152800]
add dword [rsi + 0x24], eax
test rdi, rdi
setne al
jmp 0x14001154c
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
mov rdx, qword [rbx]
cmp rdx, rcx
jne 0x140011566
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140076380
lea rcx, [0x1401502f0]
call fcn.1400c0f74
test eax, eax
je 0x1400114ca
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c104b
jmp 0x1400114ca
lea rcx, [0x1401502f0]
call fcn.1400c0f74
test eax, eax
je 0x140011502
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c104b
jmp 0x140011502
lea rcx, [0x1401502f0]
call fcn.1400c0f74
test eax, eax
je 0x140011539
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c104b
jmp 0x140011539
Function at 0x1400131f0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbp, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1400f7448]
mov rax, qword [rax]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rcx], rdx
movaps xmm0, xmmword [0x1400f7610]
movups xmmword [rcx + 0x10], xmm0
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
mov al, byte [0x1401502f0]
test al, al
je 0x140013357
mov ebx, dword [0x140152800]
lea rax, [rdi + rbp]
add rax, 0xffffffffffffffff
mov rcx, rax
shr rcx, 0x20
je 0x140013263
xor edx, edx
div rbx
mov r15, rax
jmp 0x14001326a
xor edx, edx
div ebx
mov r15d, eax
mov rax, rdi
shr rax, 0x20
je 0x140013280
mov rax, rdi
xor edx, edx
div rbx
mov rdi, rax
jmp 0x140013288
mov eax, edi
xor edx, edx
div ebx
mov edi, eax
sub r15, rdi
inc r15
je 0x14001332f
lea rax, [rsi + 8]
mov qword [rsp + 0x28], rax
imul rdi, rbx
xor r13d, r13d
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x1400132d1
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], ebp
mov qword [rcx + rax + 8], rdi
add qword [rsi + 0x10], 1
add r13, 1
add rdi, rbx
cmp r13, r15
je 0x14001332f
mov rcx, qword [r14]
test rcx, rcx
je 0x140013327
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov r8, rbx
mov r9d, dword [rsp + 0xd0]
call r12
test eax, eax
je 0x14001331f
mov ebp, dword [rsp + 0x30]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
jne 0x1400132b0
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400134a0
test al, al
je 0x140013327
mov rax, qword [rsi + 0x10]
jmp 0x1400132b0
mov dword [rsp + 0x30], 0
mov rcx, rsi
call fcn.1400133a0
mov rax, qword [rsp + 0x60]
xor rax, rsp
mov rcx, qword [0x1400f7448]
mov rcx, qword [rcx]
cmp rcx, rax
jne 0x140013391
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1401502f0]
call fcn.1400c0f74
test eax, eax
je 0x140013242
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c104b
jmp 0x140013242
call fcn.140076380
int3
Function at 0x1400133a0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov al, byte [0x1401502f0]
test al, al
je 0x140013454
mov rbx, qword [r12 + 0x10]
test rbx, rbx
je 0x14001342a
mov rdi, qword [r12 + 8]
mov r15d, dword [0x140152800]
shl rbx, 4
xor esi, esi
lea r13, [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x140013409
add rsi, 0x10
cmp rbx, rsi
je 0x14001342a
mov rax, qword [r12]
mov rcx, qword [rax]
test rcx, rcx
je 0x140013400
mov r9d, dword [rdi + rsi]
mov rdx, qword [rdi + rsi + 8]
mov qword [rsp + 0x20], r13
mov r8, r15
call rbp
jmp 0x140013400
mov qword [r12 + 0x10], 0
mov rax, qword [rsp + 0x60]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x14001348e
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1401502f0]
call fcn.1400c0f74
test eax, eax
je 0x1400133d3
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
mov dword [0x140152800], eax
lea rcx, [0x1401502f0]
call fcn.1400c104b
jmp 0x1400133d3
call fcn.140076380
int3

Function at 0x140014f70
Capabilities:
Map section object

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rsi, rcx
mov rdi, qword [0x1400f7448]
mov rax, qword [rdi]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x140152010]
test rax, rax
jne 0x140015011
mov rcx, qword [0x140152008]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
lea r8, [rsp + 0x50]
mov rdx, 0xffffffffffffffff
xor r9d, r9d
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jns 0x140015000
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x140015032
mov qword [0x140152010], rax
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov rax, qword [rsp + 0x60]
xor rax, rsp
mov rcx, qword [rdi]
cmp rcx, rax
jne 0x140015087
mov rax, rsi
add rsp, 0x68
pop rdi
pop rsi
ret
call sub.ntdll.dll_RtlGetLastWin32Error
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._var_tmp_build_firefox_0553bfb9087f_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0xdb
mov dword [rsi + 0xc], ecx
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140015018
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jns 0x140015018
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
jmp 0x140015018
call fcn.140076380
int3
Function at 0x1400164c0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebp, r9d
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov r15b, byte [rsp + 0x88]
mov ebx, dword [rsp + 0x80]
mov eax, dword [0x14015201c]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x140016522
cmp byte [0x14015201a], 0
je 0x140016522
mov eax, dword [0x14014f600]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
jmp 0x140016527
call fcn.140018990
mov qword [rsi], rax
lea r14, [rsi + 8]
mov qword [rsi + 8], 0
mov byte [rsi + 0x10], 0
mov dword [rsi + 0x14], ebp
lea rcx, [rsi + 0x18]
mov qword [rsi + 0x20], 0
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [rsi + 0x28], eax
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmm1, xmmword [rdi]
movups xmmword [rsi + 0x40], xmm1
mov dword [rdi], 0
mov qword [rdi + 8], 0
mov qword [rsi + 0x50], r12
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x58], 8
mov dword [rsi + 0x70], ebx
mov byte [rsi + 0x74], r15b
call sub.ntdll.dll_RtlQueryPerformanceCounter
mov eax, dword [0x14015201c]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
jne 0x1400165ae
mov rcx, rsi
call fcn.1400189a0
jmp 0x1400165e8
cmp byte [0x14015201a], 0
jne 0x1400165ce
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je case.default.0x140016612
mov byte [0x14015201a], 1
mov eax, dword [0x14014f600]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], rsi
add rsi, 0x40
lea rcx, case.0x14001649e.0
mov rax, qword [case.0x14001649e.0]
mov rax, qword [rax + 0x30]
mov rdx, r14
mov r8, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp rax
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [0x14015201c], eax
jmp 0x1400165a4
Function at 0x14001dbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov r15, rcx
mov r14, qword [0x1400f7448]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx r8d, byte [rdx]
lea rbx, [rdx + 2]
test r8b, 1
je 0x14001dc0c
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi + 8]
jmp 0x14001dc12
shr r8, 1
mov rdx, rbx
add r8, r8
lea rcx, [rsp + 0x28]
call fcn.14001cf50
mov r11, qword [r15 + 8]
test r11, r11
je 0x14001ddc5
mov r8, rax
mov rax, r11
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, r11
sub rax, rcx
movabs rcx, 0x3333333333333333
mov rdx, rax
and rdx, rcx
shr rax, 2
and rax, rcx
add rax, rdx
mov rcx, rax
shr rcx, 4
add rcx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rcx
movabs r10, 0x101010101010101
imul r10, rax
shr r10, 0x38
cmp r10, 1
ja 0x14001dc9a
lea r9, [r11 - 1]
and r9, r8
jmp 0x14001dcc8
cmp r8, r11
jae 0x14001dca4
mov r9, r8
jmp 0x14001dcc8
mov rax, r8
or rax, r11
shr rax, 0x20
je 0x14001dcbd
mov rax, r8
xor edx, edx
div r11
mov r9, rdx
jmp 0x14001dcc8
mov eax, r8d
xor edx, edx
div r11d
mov r9d, edx
mov rax, qword [r15]
mov rax, qword [rax + r9*8]
test rax, rax
je 0x14001ddc5
mov rcx, qword [rax]
test rcx, rcx
je 0x14001ddc5
movzx edi, byte [rsi]
test dil, 1
je 0x14001dcf7
mov rdi, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x14001dcfa
shr rdi, 1
lea rsi, [r11 - 1]
jmp 0x14001dd18
and rax, rsi
cmp rax, r9
jne 0x14001ddc5
mov rcx, qword [rcx]
test rcx, rcx
je 0x14001ddc5
mov rax, qword [rcx + 8]
cmp rax, r8
jne 0x14001dd40
movzx eax, byte [rcx + 0x10]
test al, 1
je 0x14001dd70
mov rdx, qword [rcx + 0x18]
cmp rdx, rdi
jne 0x14001dd0c
jmp 0x14001dd7b
cmp r10d, 1
jbe 0x14001dd00
cmp rax, r11
jb 0x14001dd03
mov rdx, rax
or rdx, r11
shr rdx, 0x20
je 0x14001ddb9
xor edx, edx
div r11
mov rax, rdx
jmp 0x14001dd03
mov rdx, rax
shr rdx, 1
cmp rdx, rdi
jne 0x14001dd0c
test rdi, rdi
je 0x14001ddc7
test al, 1
je 0x14001dd8a
mov rax, qword [rcx + 0x20]
jmp 0x14001dd92
lea rax, [rcx + 0x10]
add rax, 2
xor edx, edx
nop word cs:[rax + rax]
nop
movzx ebp, word [rax + rdx*2]
cmp bp, word [rbx + rdx*2]
jne 0x14001dd0c
add rdx, 1
cmp rdi, rdx
jne 0x14001dda0
jmp 0x14001ddc7
xor edx, edx
div r11d
mov eax, edx
jmp 0x14001dd03
xor ecx, ecx
mov rax, qword [rsp + 0x30]
xor rax, rsp
mov rdx, qword [r14]
cmp rdx, rax
jne 0x14001dde7
mov rax, rcx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140076380
int3
Function at 0x140021500
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r14, rdx
mov rsi, rcx
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x40]
call fcn.140034aa0
test byte [rsp + 0x50], 1
je 0x140021548
mov rcx, qword [rsp + 0x60]
jmp 0x14002154d
lea rcx, [rsp + 0x52]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test byte [rsp + 0x50], 1
je 0x14002156b
mov rcx, qword [rsp + 0x60]
call fcn.1400c1280
test r14, r14
je 0x140021630
test edi, edi
je 0x140021630
mov ecx, edi
add rcx, rcx
call fcn.1400c1240
mov rbx, rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.140034aa0
test byte [rsp + 0x50], 1
je 0x1400215ae
mov rcx, qword [rsp + 0x60]
jmp 0x1400215b3
lea rcx, [rsp + 0x52]
mov rdx, rbx
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test byte [rsp + 0x50], 1
je 0x1400215d0
mov rcx, qword [rsp + 0x60]
call fcn.1400c1280
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x1400215f1
xor ecx, ecx
nop dword [rax]
lea rax, [rcx + 1]
cmp word [rbx + rcx*2 + 2], 0
mov rcx, rax
jne 0x1400215e0
jmp 0x1400215f3
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x20]
call fcn.140034b10
test byte [r14], 1
je 0x140021616
mov rcx, qword [r14 + 0x10]
call fcn.1400c1280
mov rax, qword [rsp + 0x60]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [r14], xmm0
mov rcx, rbx
call fcn.1400c12b0
test edi, edi
setne al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
mov rdx, qword [r15]
cmp rdx, rcx
jne 0x140021651
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140076380
int3