joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b3b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, [0x180093020]
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.18004f380
cmp qword [rsi], 0
je 0x18001b57a
cmp qword [0x1800a6240], 0xffffffffffffffff
jne 0x18001b583
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.18001b0e0
cmp byte [rbx + 8], 0
jne 0x18001b58a
mov r15, qword [rsp + 0x40]
movzx eax, word [r15]
test ax, ax
je 0x18001b444
lea rcx, [r15 + 2]
lea edx, [rax - 0x41]
cmp dx, 0x19
jbe 0x18001b43b
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x18001b424
jmp 0x18001b444
add eax, 0x20
mov word [rcx - 2], ax
jmp 0x18001b42d
mov ecx, 0x12
call sym.mozglue.dll_goz_xmalloc
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov word [rax + 0x10], 0
xor ecx, ecx
mov rax, r15
mov r9d, ecx
movzx edx, word [rax]
rol ecx, 5
xor ecx, edx
imul ecx, ecx, 0x9e3779b9
add rax, 2
test edx, edx
jne 0x18001b462
mov rcx, rsi
call fcn.18004f2a0
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], 0
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call fcn.180091d40
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call fcn.18001b5b0
lea rdx, str.MozillaFirefoxSkeletonUILock_
mov r8d, 0x20
mov rcx, rbx
call fcn.18001b5b0
mov rcx, rsi
call fcn.180091d40
mov rcx, rbx
mov rdx, rsi
mov r8, rax
call fcn.18001b5b0
cmp qword [rsp + 0x58], 8
jb 0x18001b4ee
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1800a6240], rax
mov cl, 1
cmp rax, 0xffffffffffffffff
je 0x18001b598
mov byte [r14 + 5], cl
lea rcx, [rsp + 0x40]
call fcn.18001b070
mov rcx, rsi
call sym.mozglue.dll_galigned_free
mov rcx, r15
call sym.mozglue.dll_galigned_free
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0
test rcx, rcx
je 0x18001b55c
call fcn.18004f310
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004b970
mov rax, r14
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dword [r14], 0xb
jmp 0x18001b591
mov byte [r14 + 5], 1
jmp 0x18001b544
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov byte [r14 + 5], 0
jmp 0x18001b544
mov dword [r14], 0xa
xor ecx, ecx
jmp 0x18001b526
Function at 0x18001cfc0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rax], rcx
lea rcx, [0x180052540]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18001d14a
lea rsi, [rsp + 0x4c]
mov ebx, dword [rsi]
mov edi, ebx
and edi, 0xfffffff8
mov rcx, rdi
call sym.mozglue.dll_goz_xmalloc
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call fcn.180091cf0
mov rcx, 0xffffffffffffffff
mov rdx, r12
mov r8d, edi
mov r9, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18001d142
shr ebx, 3
mov eax, dword [rsp + 0x4c]
shr eax, 3
cmp eax, ebx
cmovae eax, ebx
test eax, eax
je 0x18001d142
mov r14d, eax
xor r15d, r15d
mov r13, qword [r12 + r15*8]
mov ecx, 0x104
xor ebp, ebp
mov ebx, ecx
mov edi, ecx
add rdi, rdi
mov rcx, rdi
call sym.mozglue.dll_goz_xmalloc
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call fcn.180091cf0
test rbp, rbp
jne 0x18001d16d
mov rcx, r13
mov rdx, rsi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001d12e
mov edi, eax
cmp eax, ebx
je 0x18001d17a
inc edi
lea rbp, [rdi + rdi]
mov rcx, rbp
call sym.mozglue.dll_goz_xmalloc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.180091cf0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [0x1800a3040]
test eax, eax
jne 0x18001d196
mov rcx, rsi
call sym.mozglue.dll_galigned_free
mov r8, qword [r12 + r15*8]
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rbx
call qword [case.0x18004a5de.0]
mov rsi, rbx
mov rcx, rsi
call sym.mozglue.dll_galigned_free
inc r15
cmp r15, r14
jne 0x18001d087
mov rcx, r12
call sym.mozglue.dll_galigned_free
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18004b970
mov rax, qword [rsp + 0x28]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbp
call sym.mozglue.dll_galigned_free
jmp 0x18001d0ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbx + rbx]
mov rbp, rsi
mov edi, ebx
cmp eax, 0x7a
je 0x18001d092
jmp 0x18001d0d7
mov rcx, rbx
call sym.mozglue.dll_galigned_free
jmp 0x18001d12e
Function at 0x18001d430
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001d480
mov esi, dword [0x1800a80a0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004b970
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1800a80a4]
call fcn.18004a330
cmp dword [0x1800a80a4], 0xffffffff
jne 0x18001d465
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a398
jmp 0x18001d465

Function at 0x18001d4f0
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp dword [0x1800a82bc], edx
je 0x18001d5f6
mov ebp, edx
mov dword [0x1800a82bc], edx
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.18001b190
cmp byte [rdi + 8], 0
jne 0x18001d615
lea rdi, [rsp + 0x38]
mov r14, qword [rdi]
mov rcx, rdi
call fcn.18001b0e0
cmp byte [rdi + 8], 0
jne 0x18001d621
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], 0
mov rcx, rdi
mov rdx, rbx
call fcn.18001b240
lea rdx, str.Theme
mov r8d, 6
mov rcx, rdi
call fcn.18001b5b0
mov dword [rsp + 0x34], ebp
cmp qword [rsp + 0x50], 8
mov rdx, rdi
jb 0x18001d5a3
mov rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, r14
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rcx, rdi
call fcn.18001b070
mov al, 1
test ebp, ebp
jne 0x18001d640
mov byte [rsi + 5], al
test rbx, rbx
je 0x18001d5e7
mov rcx, rbx
call sym.mozglue.dll_galigned_free
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x18001d5fa
jmp 0x18001d634
mov byte [rsi + 5], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004b970
mov rax, rsi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
mov byte [rsi + 5], 0
jmp 0x18001d634
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
mov byte [rsi + 5], 0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1800a82bc], 0
jmp 0x18001d5fa
mov dword [rsi], 8
xor eax, eax
jmp 0x18001d5d7

Function at 0x18001fc60
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret

Function at 0x18001fc80
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x18001fcc2
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004b970
mov rax, rsi
add rsp, 0x30
pop rsi
ret
int3
Function at 0x18004a250
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov rax, rdx
and rax, 0xfffffffffffffff8
je 0x18004a322
dec rax
mov r9, rax
shr r9, 3
inc r9
cmp rax, 7
jne 0x18004a278
xor eax, eax
xor r8d, r8d
jmp 0x18004a2d9
mov r10, r9
and r10, 0xfffffffffffffffe
xor eax, eax
xor r8d, r8d
nop word cs:[rax + rax]
mov r11, qword [rcx + r8]
mov rsi, qword [rcx + r8 + 8]
rol eax, 5
xor eax, r11d
shr r11, 0x20
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, r11d
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, esi
shr rsi, 0x20
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, esi
imul eax, eax, 0x9e3779b9
add r8, 0x10
add r10, 0xfffffffffffffffe
jne 0x18004a290
test r9b, 1
je 0x18004a303
mov r9, qword [rcx + r8]
rol eax, 5
xor eax, r9d
imul eax, eax, 0x9e3779b9
rol eax, 5
shr r9, 0x20
xor eax, r9d
imul eax, eax, 0x9e3779b9
add r8, 8
cmp r8, rdx
jae 0x18004a320
movsx esi, byte [rcx + r8]
rol eax, 5
xor eax, esi
imul eax, eax, 0x9e3779b9
inc r8
cmp rdx, r8
jne 0x18004a308
pop rsi
ret
xor r8d, r8d
xor eax, eax
cmp r8, rdx
jb 0x18004a308
jmp 0x18004a320
Function at 0x18004f120
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov r14, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x1800a82d4], 0
je 0x18004f15b
mov eax, dword [0x1800a82d0]
add eax, 0xfffffffb
cmp eax, 1
jbe 0x18004f290
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.18001b190
cmp byte [rsi + 8], 0
jne 0x18004f269
lea rdi, [rsp + 0x40]
mov r15, qword [rdi]
mov rcx, rdi
call fcn.18001b0e0
cmp byte [rdi + 8], 0
jne 0x18004f277
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], 0
mov rcx, rdi
mov rdx, rsi
call fcn.18001b240
lea rdx, str.Enabled
mov r8d, 8
mov rcx, rdi
call fcn.18001b5b0
movzx eax, bl
mov dword [rsp + 0x3c], eax
cmp qword [rsp + 0x58], 8
mov rdx, rdi
jb 0x18004f1e1
mov rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, r15
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rcx, rdi
call fcn.18001b070
test ebp, ebp
jne 0x18004f285
cmp byte [0x1800a82b8], 0
jne 0x18004f22a
test bl, bl
je 0x18004f22a
lea rcx, [rsp + 0x40]
call fcn.18001b3b0
mov byte [0x1800a82b8], bl
mov al, 1
mov byte [r14 + 5], al
test rsi, rsi
je 0x18004f243
mov rcx, rsi
call sym.mozglue.dll_galigned_free
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004b970
mov rax, r14
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov byte [r14 + 5], 0
jmp 0x18004f24c
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov byte [r14 + 5], 0
jmp 0x18004f243
mov dword [r14], 8
xor eax, eax
jmp 0x18004f232
mov dword [r14], 2
jmp 0x18004f270

Function at 0x1800516a0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
call fcn.18004c640
test al, al
je 0x18005172c
test rdi, rdi
mov r8d, 1
cmovne r8, rdi
cmp rsi, 9
mov edx, 8
cmovae rdx, rsi
cmp r8, 0x1f1
jb 0x1800516ea
mov rcx, qword [0x1800a66c8]
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.180007e00
mov eax, dword [0x1800a64f4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1800516df
mov rcx, qword [0x1800a66c8]
mov eax, dword [0x1800a64f4]
mov rdi, qword gs:[0x58]
mov rax, qword [rdi + rax*8]
mov qword [rax + 8], rcx
jmp 0x1800516df
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180051a80
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov r14, rdx
mov eax, dword [0x1800a6698]
test eax, eax
je 0x180051afe
mov rdi, rcx
lea rcx, [0x1800a66a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [0x1800a66e0]
test rsi, rsi
je 0x180051ae5
mov eax, 0xffffffff
xor ecx, ecx
cmp qword [rsi + 0x10], rdi
setb cl
cmova ecx, eax
cmp ecx, 0xffffffff
je 0x180051add
test ecx, ecx
je 0x180051b99
mov rsi, qword [rsi + 8]
and rsi, 0xfffffffffffffffe
jmp 0x180051ae0
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180051aba
lea rax, str.MOZ_RELEASE_ASSERT_result_
mov qword [sym.mozglue.dll_gMozCrashReason], rax
int3
xor esi, esi
call fcn.18004c640
test al, al
je 0x180051b39
test rbx, rbx
mov r8d, 1
cmovne r8, rbx
cmp r14, 9
mov edx, 8
cmovae rdx, r14
test rsi, rsi
je 0x180051b45
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.180007e00
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp r8, 0x1f1
jb 0x180051b57
mov rsi, qword [0x1800a66c8]
jmp 0x180051b28
mov eax, dword [0x1800a64f4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 8]
test rsi, rsi
jne 0x180051b28
mov rsi, qword [0x1800a66c8]
mov eax, dword [0x1800a64f4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], rsi
jmp 0x180051b28
lea rcx, [0x1800a66a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180051b00

Function at 0x180052300
Capabilities:
Encode data using base64
Get system information on windows
Query environment variable

Disassembly:
test dl, 8
jne 0x18005230d
mov rcx, r8
jmp sym.mozglue.dll_galloc_1
mov ecx, 1
mov rdx, r8
jmp sym.mozglue.dll_galloc

Function at 0x180052320
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
test dl, 0x18
je 0x180052328
xor eax, eax
ret
mov rcx, r8
mov rdx, r9
jmp sym.mozglue.dll_gealloc
Function at 0x180071d30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp byte [rcx + 0x48], 0
je 0x180071d39
ret
cmp qword [rcx + 0x10], 0
je 0x180071de7
cmp qword [rcx + 0x18], 0x10
mov rax, rcx
jb 0x180071d51
mov rax, qword [rcx]
xor edx, edx
mov r8d, edx
movzx r9d, byte [rax]
rol edx, 5
xor edx, r9d
imul edx, edx, 0x9e3779b9
inc rax
test r9d, r9d
jne 0x180071d53
imul eax, r8d, 0x9e3779b9
movzx edx, byte [rcx + 0x20]
rol eax, 5
xor eax, edx
imul eax, eax, 0x9e3779b9
mov rdx, qword [rcx + 0x28]
rol eax, 5
xor eax, edx
imul eax, eax, 0x9e3779b9
rol eax, 5
shr rdx, 0x20
xor eax, edx
imul eax, eax, 0x9e3779b9
mov edx, eax
rol edx, 5
xor edx, dword [rcx + 0x30]
imul edx, edx, 0x9e3779b9
cmp byte [rcx + 0x34], 0
cmove edx, eax
mov eax, edx
rol eax, 5
xor eax, dword [rcx + 0x38]
imul eax, eax, 0x9e3779b9
cmp byte [rcx + 0x3c], 0
cmove eax, edx
cmp byte [rcx + 0x44], 0
je 0x180071d38
rol eax, 5
xor eax, dword [rcx + 0x40]
imul eax, eax, 0x9e3779b9
jmp 0x180071d38
xor eax, eax
jmp 0x180071d75

Function at 0x1800735a0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180073644
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x180073620
mov rdi, qword [rsi + 8]
shl rbx, 4
add rbx, rdi
mov r15d, dword [0x1800a80a0]
lea r14, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rdi]
mov rcx, qword [rdi + 8]
mov rdx, r15
mov r9, r14
call r12
add rdi, 0x10
cmp rdi, rbx
jne 0x180073607
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18004b970
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1800a80a4]
call fcn.18004a330
cmp dword [0x1800a80a4], 0xffffffff
jne 0x1800735e0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a398
jmp 0x1800735e0

Function at 0x180078600
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize
xor esi, esi
mov rcx, 0xffffffff80000001
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180078693
mov rdi, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
lea r8, str.AppsUseLightTheme
mov rcx, rdi
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
or eax, dword [rsi]
sete sil
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18004b970
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x180079060
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r14, rdx
mov r15, rcx
mov r13d, dword [rsp + 0x90]
lea eax, [r13 + r13]
cdqe
mov ecx, 8
mul rcx
mov rbx, 0xffffffffffffffff
cmovno rbx, rax
mov rcx, rbx
call sym.mozglue.dll_goz_xmalloc
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call fcn.180091cf0
test r13d, r13d
jle 0x1800790e2
mov eax, r13d
shl rax, 4
xor ecx, ecx
movsd xmm0, qword [rsi + rcx]
movsd qword [rdi + rcx], xmm0
movsd xmm0, qword [rsi + rcx + 8]
movsd qword [rdi + rcx + 8], xmm0
add rcx, 0x10
cmp rax, rcx
jne 0x1800790c3
shl r13d, 4
cmp qword [r12 + 0x18], 8
jb 0x1800790f2
mov r12, qword [r12]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, r12
xor r8d, r8d
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x18007913d
mov dword [r15], 8
xor eax, eax
mov byte [r15 + 5], al
mov rcx, rdi
call sym.mozglue.dll_galigned_free
mov rax, r15
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 1
jmp 0x18007911e

Function at 0x180079150
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp byte [0x1800a82b8], 0
je 0x18007918e
lea rcx, str.MOZ_SKELETON_UI_RESTARTING
lea rdx, [0x18009b37a]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [0x1800a6240]
mov dil, 1
cmp rcx, 0xffffffffffffffff
je 0x180079196
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180079196
mov dword [rsi], 2
xor edi, edi
mov byte [rsi + 5], dil
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1800791b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x1800791e1
mov r8, qword [r8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdx
xor edx, edx
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, 8
test eax, eax
jne 0x18007921c
mov ecx, dword [rsp + 0x44]
setne byte [rsi + 4]
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18004b970
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x180079240
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rbx, r8
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x1800a6010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x54], 0
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x180079287
mov rdx, qword [rbx]
lea r12, [rsp + 0x54]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1800792e4
mov byte [r15 + 0x18], 1
mov dword [r15], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004b970
mov rax, r15
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, dword [rsp + 0x54]
test sil, 0xf
je 0x1800792fc
mov byte [r15 + 0x18], 1
mov dword [r15], 0xe
jmp 0x1800792b9
add rsi, rsi
mov rcx, rsi
call sym.mozglue.dll_galloc_1
test rax, rax
je 0x18007936a
mov r14, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.180091cf0
cmp qword [rbx + 0x18], 8
jb 0x180079326
mov rbx, qword [rbx]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8, rbx
mov r9d, 8
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x18007937b
mov byte [r15 + 0x18], 1
mov dword [r15], 8
mov rcx, r14
call sym.mozglue.dll_galigned_free
jmp 0x1800792b9
mov byte [r15 + 0x18], 1
mov dword [r15], 4
jmp 0x1800792b9
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], 0x10
mov ecx, dword [rsp + 0x54]
cmp ecx, 0x10
jae 0x1800793a8
movups xmmword [r15 + 8], xmm0
mov byte [r15 + 0x18], 0
mov qword [r15], 0x10
jmp 0x18007935d
mov eax, 0x10
xor edx, edx
lea r12, [rsp + 0x38]
xor esi, esi
mov rbx, r14
movsd xmm6, qword [rbx]
movsd xmm7, qword [rbx + 8]
cmp rdx, qword [rsp + 0x48]
je 0x1800793f8
shl rdx, 4
movsd qword [rax + rdx], xmm6
movsd qword [rax + rdx + 8], xmm7
mov rdx, qword [rsp + 0x40]
inc rdx
mov qword [rsp + 0x40], rdx
inc rsi
mov edi, ecx
shr edi, 4
add rbx, 0x10
cmp rsi, rdi
jb 0x1800793b9
jmp 0x180079414
mov rcx, r12
call fcn.180079b80
test al, al
je 0x180079438
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x54]
jmp 0x1800793c9
mov rcx, qword [rsp + 0x48]
mov byte [r15 + 0x18], 0
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], rcx
cmp rax, 0x10
je 0x18007939f
mov qword [r15], rax
jmp 0x18007935d
mov byte [r15 + 0x18], 1
mov dword [r15], 4
mov rcx, qword [rsp + 0x38]
cmp rcx, 0x10
je 0x18007935d
call qword [0x1800a3070]
jmp 0x18007935d