joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ebp + 8], 0
je 0x416063
mov edi, edx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x416063
mov dword [ebp - 0x18], ecx
cmp word [eax + edx + 0x14], 0x68
jb 0x416063
mov eax, dword [eax + edx + 0x78]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x10]
call ebx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416063
cmp edi, 0xffff
jbe 0x416097
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push dword [ebp - 0x10]
call ebx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x18]
test ecx, ecx
je 0x416063
lea esi, [eax + ecx*4]
mov dword [ebp - 0x24], edi
lea ecx, [edi + 1]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov edi, eax
mov dword [ebp - 0x28], esi
sub esi, edi
mov eax, esi
sar eax, 2
shr esi, 0x1f
add esi, eax
and esi, 0xfffffffe
mov dword [ebp - 0x10], edi
mov eax, dword [edi + esi*2]
mov dword [ebp - 0x2c], eax
mov edi, dword [ebp - 0x18]
mov eax, dword [edi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push dword [ebp - 0x2c]
call ebx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x4160a7
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x10]
cmp cl, byte [eax]
jne 0x416044
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x416036
xor ecx, ecx
lea ebx, [edi + esi*2]
movzx eax, byte [eax]
cmp cl, al
je 0x416067
movzx ecx, cl
cmp ecx, eax
lea eax, [ebx + 4]
cmovg edi, eax
mov esi, dword [ebp - 0x28]
cmovs esi, ebx
cmp edi, esi
jne 0x415ff5
xor eax, eax
jmp 0x41609f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x10], eax
mov edi, dword [ebp - 0x18]
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
push dword [ebp - 0x10]
call esi
sub ebx, dword [ebp - 0x1c]
sar ebx, 1
movzx edi, word [eax + ebx]
mov eax, dword [ebp - 0x14]
add di, word [eax + 0x10]
mov eax, dword [ebp + 8]
mov word [eax], di
mov al, 1
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
mov edi, dword [ebp - 0x10]
jmp 0x416044

Function at 0x41ca70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0041c653
push eax
push esi
push dword [ebp + 8]
call fcn.0041c608
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0041c643
mov ebp, 0x88c57afa
popfd
jl 0x41cac8
invalid
invalid
Function at 0x423ce0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, ecx
mov eax, dword [0x450010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x4508ac]
mov ecx, dword [0x4502e0]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x423d5a
mov eax, dword [esi + 8]
test eax, eax
je 0x423d41
mov ecx, dword [0x4508a8]
mov dword [ebp - 0x38], ecx
mov ebx, dword [esi + 4]
lea edi, [ebx + eax*8]
lea eax, [ebp - 0x34]
push eax
push dword [ebx]
push dword [ebp - 0x38]
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add ebx, 8
cmp ebx, edi
jne 0x423d28
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x4508ac
call fcn.00422a27
add esp, 4
cmp dword [0x4508ac], 0xffffffff
jne 0x423d12
lea edi, [ebp - 0x34]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [edi + 4]
mov dword [0x4508a8], eax
push 0x4508ac
call fcn.00422a79
add esp, 4
jmp 0x423d12

Function at 0x423da0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov eax, dword [0x450010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x20]
mov edx, ebx
call fcn.00423e80
cmp byte [ebx + 0xc], 0
jne 0x423dd1
cmp dword [ebp - 0x20], 2
je 0x423e6e
mov ecx, edi
call fcn.00408a40
cmp dword [eax + 0x14], 8
jb 0x423de0
mov eax, dword [eax]
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x423e3a
mov ecx, edi
call fcn.00408d20
cmp dword [eax + 0x14], 8
jb 0x423dfe
mov eax, dword [eax]
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x423e40
lea eax, [edi + 0x10]
cmp byte [edi + 0x18], 0
jne 0x423e68
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
xor eax, eax
mov byte [0x4508a4], al
mov byte [esi + 0xc], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
je 0x423def
jmp 0x423e44
test eax, eax
je 0x423e0d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x87
mov dword [esi + 8], ecx
jmp 0x423e26
mov byte [edi + 0x18], 0
jmp 0x423e16
mov byte [esi + 0xc], 0
jmp 0x423e26
Function at 0x424120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x450010]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 4
cmp dword [eax + 0x14], 8
jb 0x424148
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
lea edi, [ebp - 0x14]
lea ebx, [ebp - 0x1c]
push ecx
push edi
push ebx
push 0
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42418d
cmp dword [ebp - 0x1c], 4
jne 0x42419f
mov eax, dword [ebp - 0x14]
mov byte [esi + 0xc], 0
mov dword [esi], eax
mov dword [esi + 4], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 2
jne 0x4241b9
mov byte [esi + 0xc], 0
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
jmp 0x424179
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x43
mov dword [esi + 8], 0x8007065d
jmp 0x424179
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x3f
mov dword [esi + 8], ecx
jmp 0x424179

Function at 0x425430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ecx, dword [ecx + 0x34]
test ecx, ecx
je 0x4254b6
mov edi, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
and ecx, 0xfffffffc
call fcn.00423b60
test al, al
je 0x4254b6
mov dword [ebp - 0x10], ebx
push edi
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4254b6
mov edi, eax
mov ecx, eax
call fcn.00423b60
test al, al
je 0x4254b6
lea ecx, [esi + 0x18]
mov edx, edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0040f360
add esp, 8
mov ecx, eax
mov al, 1
test cl, cl
jne 0x4254b8
cmp byte [esi + 0x14], 0
jne 0x4254a6
mov dword [esi + 0x14], 1
mov dword [esi + 0x10], 0
mov ecx, esi
mov edx, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00404c10
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x426010
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
push 0x44560c
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x4260a1
push dword [edi]
mov dword [ebp - 0x18], eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [ebp - 0x14], eax
lea esi, [eax + 8]
push esi
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, eax
xor eax, eax
push esi
push eax
push ebx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [edi + 8]
mov dword [ebp - 0x10], eax
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
lea eax, [ebx + 8]
push dword [ebp - 0x14]
push dword [edi]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
push ebx
xor eax, eax
push eax
push esi
push eax
push eax
xor eax, eax
push dword [ebp - 0x10]
push eax
push 1
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x426a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov ebx, edx
mov esi, ecx
mov eax, dword [0x450010]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea eax, [ebp - 0x30]
mov dword [eax], edi
push eax
push edi
push edi
push 0x10002
push dword [ebp + 8]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x426a4e
cmp eax, 2
jne 0x426ad0
xor eax, eax
mov byte [esi + 0xc], al
mov byte [esi], al
jmp 0x426af2
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x30]
lea ecx, [eax + eax]
xor esi, esi
dec esi
test eax, eax
cmovns esi, ecx
push esi
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov dword [ebp - 0x40], ebx
mov ebx, eax
push esi
push edi
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x3c], ebx
push ebx
push edi
push 0x10002
push dword [ebp + 8]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x426b06
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, dword [ebp - 0x38]
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov dword [esi + 4], 0x68
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x426af2
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov dword [esi + 4], 0x5c
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [0x4456c2]
movsd qword [ebp - 0x1a], xmm0
movups xmm0, xmmword [str.RUNASADMIN]
movups xmmword [ebp - 0x28], xmm0
lea eax, [ebp - 0x2c]
mov dword [eax], 0x20
lea ecx, [ebp - 0x34]
mov dword [ecx], 0
push ecx
push eax
mov esi, dword [ebp - 0x3c]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
test eax, eax
je 0x426b76
lea esi, [ebp - 0x28]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
push 0xb
push esi
push eax
call edi
add esp, 0xc
test eax, eax
je 0x426b7f
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
call ebx
add esp, 0xc
test eax, eax
jne 0x426b52
xor eax, eax
jmp 0x426b81
mov ecx, esi
xor eax, eax
mov esi, dword [ebp - 0x38]
jmp 0x426b87
mov al, 1
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov byte [esi + 0xc], 0
mov byte [esi], al
jmp 0x426ac4
Function at 0x427040
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x450010]
xor ecx, ebp
mov dword [esp + 0xc], ecx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp], ebx
cmp dword [eax + 0x14], 8
jb 0x42706d
mov eax, dword [eax]
mov ecx, esp
push 8
push ecx
push 0xb
push ebx
push eax
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4270a2
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov dword [esi + 4], 0x79
mov dword [esi + 8], ecx
mov bl, 1
mov byte [esi + 0xc], bl
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.004230e0
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop ebx
pop ebp
ret

Function at 0x4270c0
Capabilities:
Get token membership
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x450010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x58]
mov dword [edi], 0x44
lea ebx, [ebp - 0x54]
push edi
push ebx
push 0
push 0x1a
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x42715b
lea eax, [ebp - 0x5c]
push eax
push ebx
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x427198
cmp dword [ebp - 0x5c], 0
je 0x4271b3
mov dword [ebp - 0x54], 4
push ebx
push edi
push 0
push 0x18
push str.EnableLUA
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x4271bc
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov dword [esi + 4], 0x26
jmp 0x427181
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x14
mov byte [esi + 0xc], 1
mov dword [esi], str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
mov eax, esi
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x19
jmp 0x427174
xor eax, eax
mov byte [esi + 0xc], al
mov byte [esi], al
jmp 0x427184
cmp dword [ebp - 0x58], 0
mov byte [esi + 0xc], 0
sete byte [esi]
jmp 0x427184
Function at 0x429530
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [ecx + 5], 0
je 0x429592
mov eax, dword [esi + 0x20]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x42954e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x1c]
cmp ecx, 8
jb 0x42957b
mov eax, dword [esi + 8]
inc ecx
test ecx, 0x7ffff800
je 0x429571
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x4295c5
mov eax, ecx
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 7
mov word [esi + 8], 0
pop esi
pop ebp
ret
mov eax, dword [esi + 0x20]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4295a4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
cmp dword [esi + 0x1c], 8
jb 0x4295b6
mov eax, dword [esi + 8]
jmp 0x4295b9
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x42953c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x436010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov ebx, ecx
mov eax, dword [0x450010]
xor eax, ebp
mov dword [esp + 0xd0], eax
test edx, edx
je 0x436187
xor edi, edi
inc edi
mov esi, 0x446ae4
mov ecx, ebx
push 0
push str._TargetNtMapViewOfSection_44
push edi
push 0x447ebc
push esi
call fcn.004197f0
mov ecx, ebx
push edi
push str._TargetNtUnmapViewOfSection_12
push edi
push 0x447ea7
push esi
call fcn.004197f0
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [esp + 4], eax
sub esp, 0x14
movaps xmm0, xmmword [0x446ad0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, ebx
mov ebx, eax
mov dword [esp + 0xc], ecx
mov edi, dword [ecx + 8]
shl edi, 6
lea ecx, [edi + 0x50]
mov dword [esp + 8], ecx
call fcn.00419410
mov esi, eax
and eax, 0xf000
add eax, ebx
and esi, 0xfff
add edi, 0x104f
and edi, 0xfffff000
push 0x40
push 0x1000
push edi
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
test eax, eax
je 0x436195
add ebx, esi
lea edi, [esp + 0x18]
mov esi, dword [esp + 8]
mov dword [edi], esi
xor eax, eax
mov dword [edi + 0xc], eax
mov dword [edi + 4], 0x10
push 0xac
push eax
push sym.firefox.exe_g_originals
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, ebx
push edi
push esi
call fcn.0041a160
add esp, 8
test eax, eax
jne 0x43616d
lea eax, [esp + 0x14]
push eax
push 0x10
push edi
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, 0x2a
test eax, eax
je 0x43616f
cmp dword [esp + 0x14], 0x10
mov ecx, dword [esp + 8]
jne 0x43616f
lea eax, [esp + 0x10]
push eax
push 0x20
push ecx
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 0xac
push sym.firefox.exe_g_originals
push str.g_originals
call fcn.004208f0
mov esi, eax
mov ecx, dword [esp + 0xd0]
xor ecx, ebp
call fcn.004230e0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [ebx + 8], 0
jne 0x436068
xor esi, esi
jmp 0x43616f
lea edi, [esp + 0x18]
mov ecx, edi
push str.thunk_base
push 0x188
push str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
call fcn.0042b4e0
mov ecx, edi
call fcn.0042b5b0
jmp 0x4360da
Function at 0x436dd0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 8]
mov ecx, dword [0x450010]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
mov esi, 5
cmp eax, 3
jne 0x436e63
mov edx, dword [ebp + 0x28]
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x14], 8
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
jb 0x436e14
mov esi, dword [esi]
mov ebx, dword [ebx]
push 0
push edx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x436e77
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
lea ecx, [ebp - 0x14]
push 3
push edi
push edi
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb edi, edi
lea eax, [ebp - 0x14]
or edi, dword [eax]
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
dec edi
jmp 0x436e53

Function at 0x439250
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
movaps xmm0, xmmword [0x446f20]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.0040a5b0
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x43929e
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b780
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x450010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx - 7]
mov edi, 5
cmp eax, 0xfffffffe
jae 0x43b7b7
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004230e0
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x40], xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x54], 0x44
cmp dword [eax + 0x14], 8
jb 0x43b7df
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
push eax
call dword [sym.imp.mozglue.dll__wcsdup]
add esp, 4
mov edx, dword [edi + 0x10]
cmp dword [edi + 0x14], 8
jb 0x43b7f7
mov edi, dword [edi]
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
test edx, edx
cmove edi, edx
cmp dword [esi + 0x14], 8
jb 0x43b80a
mov esi, dword [esi]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
sub esp, 0x28
mov dword [esp + 0x24], ebx
lea ecx, [ebp - 0x54]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edi
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
mov dword [ebp - 0x58], eax
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x43b8b7
mov eax, dword [ebp + 8]
cmp eax, 6
mov eax, 0x1fffff
mov esi, 0x101c01
cmove esi, eax
mov eax, dword [ebx]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push ebx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43b8d1
cmp dword [ebp + 8], 6
mov edi, 0x100c43
mov eax, 0x1fffff
cmove edi, eax
mov esi, dword [ebx + 4]
add ebx, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push edi
push ebx
push dword [ebp - 0x5c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x43b7a3
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x43b7a3
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43b8b7

Function at 0x43b8e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [edi], edx
mov ecx, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], eax
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x43b93f
mov esi, eax
mov ebx, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
xor ecx, ecx
push ecx
push ecx
push edi
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]