joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c840
Capabilities:
Encode data using base64

Disassembly:
push rsi
sub rsp, 0x20
cmp byte [rcx + 0x6c], 0
je 0x14000c881
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
jne 0x14000c86b
mov rcx, rsi
mov r8, rax
add rsp, 0x20
pop rsi
jmp fcn.14000c890
mov r8d, 0x44
mov rcx, rdx
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [rsi + 8], 0x44
add rsp, 0x20
pop rsi
ret

Function at 0x14000c890
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov r13, qword [rsi + 8]
sub r13, rcx
sar r13, 2
movabs r9, 0xf0f0f0f0f0f0f0f1
mov rax, rdx
sub rax, rcx
movabs rdx, 0x7878787878787879
imul rdx
mov r15, rdx
imul r13, r9
inc r13
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
sar rdx, 2
imul rdx, r9
mov rax, rdx
shr rax, 1
movabs rcx, 0x3c3c3c3c3c3c3c3
mov r9, rcx
sub r9, rax
add rax, rdx
cmp rax, r13
cmovbe rax, r13
cmp rdx, r9
cmova rax, rcx
cmp rax, rcx
ja 0x14000c9f8
mov r12, r8
mov rcx, r15
shr rcx, 0x3f
sar r15, 5
add r15, rcx
mov rcx, rax
shl rcx, 6
lea rbx, [rcx + rax*4]
cmp rax, 0x3d
jae 0x14000c9fd
test rax, rax
je 0x14000ca17
mov rcx, rbx
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r14, rax
mov rax, r15
shl rax, 6
lea rbp, [rax + r15*4]
lea rcx, [r14 + rbp]
mov r8d, 0x44
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov r15, qword [rsi]
mov r12, qword [rsi + 8]
cmp r12, rdi
jne 0x14000ca1f
cmp r15, rdi
je 0x14000c9aa
mov r12, r14
mov r8d, 0x44
mov rcx, r12
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
add r12, 0x44
add r15, 0x44
cmp r15, rdi
jne 0x14000c989
mov rdi, qword [rsi]
test rdi, rdi
je 0x14000c9cb
mov rdx, qword [rsi + 0x10]
sub rdx, rdi
cmp rdx, 0x1000
jae 0x14000ca7d
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
mov qword [rsi], r14
mov rax, r13
shl rax, 6
lea rax, [rax + r13*4]
add rax, r14
mov qword [rsi + 8], rax
add rbx, r14
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14001ebf0
lea rcx, [rbx + 0x27]
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000c954
xor r14d, r14d
jmp 0x14000c954
cmp r15, rdi
je 0x14000ca49
mov r12, r14
mov r8d, 0x44
mov rcx, r12
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
add r12, 0x44
add r15, 0x44
cmp r15, rdi
jne 0x14000ca27
mov r12, qword [rsi + 8]
cmp r12, rdi
je 0x14000c9a7
lea r15, [r14 + rbp]
add r15, 0x44
mov r8d, 0x44
mov rcx, r15
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, 0x44
add r15, 0x44
cmp rdi, r12
jne 0x14000ca5a
jmp 0x14000c9a7
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x14000ca9a
add rdx, 0x27
mov rdi, rax
jmp 0x14000c9c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000d790
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140042038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14000d7ce
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14000d7c7
call fcn.14000a410
jmp 0x14000d7ae
Function at 0x14000e8c0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x14000eabe
mov rdi, rcx
mov ebp, dword [rcx + 0x18]
shl ebp, 7
mov edx, ebp
or edx, 0x7f
mov ecx, dword [rcx + 0x14]
cmp edx, ecx
jb 0x14000e988
cmp ecx, dword [rdi + 0x10]
jae 0x14000eabe
mov eax, dword [0x140043f34]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000ea3c
mov edx, dword [0x140043f30]
mov ecx, dword [rdi + 0x14]
add rcx, qword [rdi + 8]
mov r8d, 0x1000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000eabe
mov eax, dword [0x140043f34]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000ea7d
mov eax, dword [0x140043f30]
add dword [rdi + 0x14], eax
mov rax, qword [rdi + 8]
mov ecx, ebp
add rcx, rax
lea r9, [rsp + 0x30]
mov qword [r9 - 8], rdi
mov dword [r9], 0
mov qword [r9 + 8], rcx
mov qword [r9 + 0x10], rcx
xorps xmm0, xmm0
movups xmmword [r9 + 0x18], xmm0
mov dword [r9 + 0x28], 0x80
mov byte [r9 + 0x2c], 1
mov edx, 0x80
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000e9d3
mov eax, dword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov cl, byte [rsp + 0x5c]
test r8, r8
je 0x14000e9fd
test rdx, rdx
je 0x14000ea00
test r9, r9
je 0x14000ea00
test eax, eax
je 0x14000ea00
test cl, cl
je 0x14000ea00
inc dword [rdi + 0x18]
mov qword [rsi], r8
mov dword [rsi + 8], eax
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], r9
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi + 0x20], xmm0
mov eax, dword [rsp + 0x58]
mov dword [rsi + 0x30], eax
mov byte [rsi + 0x34], cl
mov byte [rsi + 0x38], 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001bf90
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x140043f34]
call fcn.14001ace8
cmp dword [0x140043f34], 0xffffffff
jne 0x14000e92e
lea rbx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x140043f30], eax
lea rcx, [0x140043f34]
call fcn.14001ac88
jmp 0x14000e92e
lea rcx, [0x140043f34]
call fcn.14001ace8
cmp dword [0x140043f34], 0xffffffff
jne 0x14000e97b
lea rbx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x140043f30], eax
lea rcx, [0x140043f34]
call fcn.14001ac88
jmp 0x14000e97b
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
jmp 0x14000ea25
Function at 0x1400110f0
Capabilities:
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rbx, r9
mov r14, r8
mov rsi, rcx
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rcx], rdx
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 2
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [0x140043f34]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011205
lea rcx, [0x140043f34]
call fcn.14001ace8

Function at 0x140014ae0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
je 0x140014c1d
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x140014b31
mov rcx, rdi
call fcn.140014ca0
mov rcx, rdi
call fcn.140038470
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x140014c40
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x140014b4d
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
jne 0x140014c84
mov rdi, qword [rsi + 0x28]
lea rax, [rdi + 1]
cmp rax, 2
jae 0x140014b93
mov rdi, qword [rsi + 0x20]
lea rax, [rdi + 1]
cmp rax, 2
jae 0x140014bc0
mov rdi, qword [rsi + 0x18]
lea rax, [rdi + 1]
cmp rax, 2
jae 0x140014bed
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400092e0
lea rbx, [rsi + 0x28]
call fcn.140008550
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
mov r9, rax
call fcn.140001040
mov rcx, qword [rbx]
call fcn.140001550
mov qword [rbx], 0
jmp 0x140014b68
lea rbx, [rsi + 0x20]
call fcn.140008550
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
mov r9, rax
call fcn.140001040
mov rcx, qword [rbx]
call fcn.140001550
mov qword [rbx], 0
jmp 0x140014b76
lea rbx, [rsi + 0x18]
call fcn.140008550
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rbx
mov r9, rax
call fcn.140001040
mov rcx, qword [rbx]
call fcn.140001550
mov qword [rbx], 0
jmp 0x140014b84
test rcx, rcx
jne 0x140014af7
cmp dword [rsi + 0x14], 0
jne 0x140014af7
cmp qword [rsi + 8], 0
jne 0x140014af7
jmp 0x140014b10
mov rdx, qword [rsi + 0x68]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140014c68
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140014c99
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x58]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x140014b3e
mov rcx, rdi
call fcn.140014ca0
mov rcx, rdi
call fcn.140038470
jmp 0x140014b5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400173c0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140017406
mov r15, qword [r14 + 0x20]
lea rcx, [0x14003bc50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140017406
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14000d950
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140037456
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.140037470
test al, al
je 0x140037456
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037456
mov r14, rax
mov rcx, rax
call fcn.140037470
test al, al
je 0x140037456
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400173c0
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140017430
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140043f34]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140017480
mov esi, dword [0x140043f30]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bf90
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140043f34]
call fcn.14001ace8
cmp dword [0x140043f34], 0xffffffff
jne 0x140017465
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x140043f30], eax
lea rcx, [0x140043f34]
call fcn.14001ac88
jmp 0x140017465

Function at 0x1400174c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140043f44]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140017510
mov esi, dword [0x140043f40]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bf90
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140043f44]
call fcn.14001ace8
cmp dword [0x140043f44], 0xffffffff
jne 0x1400174f5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x28]
mov dword [0x140043f40], eax
lea rcx, [0x140043f44]
call fcn.14001ac88
jmp 0x1400174f5
Function at 0x14001e790
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001e7e2
call fcn.14001e8f0
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov rcx, rax
mov rax, rdx
call qword [0x140047010]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bf90
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [str.kernel32_]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140043ec0], 0
jne 0x14001e820
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140043ec0], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140043f10]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140043ea0]
mov qword [r8 + 8], rsi
lea rax, [0x14003ab4e]
mov qword [r8 + 0x10], rax
lea rax, [0x140038360]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140043f18]
lea rdx, [0x1400373b0]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14001e7b6
cmp qword [rsp + 0x28], 0
je 0x14001e7b6
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140043f20]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x14003ab3e]
mov qword [r8 + 0x10], rax
lea rax, [0x1400383a0]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140043f28]
lea rdx, [0x1400373b0]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14001e7b6
cmp qword [rsp + 0x28], 0
jne 0x14001e7ce
jmp 0x14001e7b6
Function at 0x140021ec0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140021f02
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14001bf90
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.1400178c0
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.140021f50
lea rcx, [rsp + 0x20]
call fcn.14001fd80
jmp 0x140021ee8

Function at 0x140023460
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140042038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140023490
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140023490
mov rax, qword [rax + rcx]
jmp 0x140023492
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140023820
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x140023852
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x140023852
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x140023852
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x140023851

Function at 0x14002ad30
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x14002ae14
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x14002ad96
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x14002ae2f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
lea rbx, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001bf90
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x14002ae05
Function at 0x14002cbb0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.140008440
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14002cc1a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14002f9b0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 7]
mov ebp, 5
cmp eax, 0xfffffffe
jae 0x14002fa0a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001bf90
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, r8
mov r15, rdx
mov r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r13d, r13d
mov qword [rsp + 0xb0], r13
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 8
jb 0x14002fa5f
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov rsi, rax
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x14002fa7c
mov r12, qword [r12]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove r12, rax
cmp qword [r14 + 0x18], 8
jb 0x14002fa95
mov r14, qword [r14]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x14002fb6b
cmp edi, 6
mov r12d, 0x1fffff
mov r13d, 0x101c01
cmove r13d, r12d
mov r14, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r14
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14002fb82
cmp edi, 6
mov ebp, 0x100c43
cmove ebp, r12d
mov rdi, qword [rbx + 8]
add rbx, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rdi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test rsi, rsi
je 0x14002f9e4
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
jmp 0x14002f9e4
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002fb6b
Function at 0x14002fb90
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14002fc1c
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140036c30
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140043e90]
test rax, rax
je 0x140036c73
mov rax, qword [0x140043e90]
test rax, rax
je 0x140036cc0
mov rcx, qword [0x140043e90]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
je 0x140036cc3
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140039fb0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x140036cc6
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x140036cc6
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x140036cc6
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x140036cc6
xor eax, eax
lock cmpxchg qword [0x140043e90], rcx
jmp 0x140036c48
int3
int3
int3

Function at 0x1400373f0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140017406
mov r15, qword [r14 + 0x20]
lea rcx, [0x14003bc50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140017406
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14000d950
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140037456
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.140037470
test al, al
je 0x140037456
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037456
mov r14, rax
mov rcx, rax
call fcn.140037470
test al, al
je 0x140037456
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400173c0
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret