joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400119e0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov ebx, edx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r13, qword [rcx + 0x10]
mov eax, edx
cmp r13, rax
ja 0x140011baa
mov rsi, rcx
lea rdi, [rcx + 8]
cmp rax, 0x21
mov r14d, 0x20
cmovae r14, rax
mov rbx, r14
sub rbx, r13
jbe 0x140011a7d
mov rcx, qword [rsi + 0x18]
sub rcx, r13
mov rax, r13
cmp rcx, rbx
jb 0x140011bd0
test rbx, rbx
jle 0x140011a77
mov rdx, qword [rsi + 8]
lea rcx, [rdx + rax]
add r14, rcx
sub r14, r13
add rax, rdx
inc rax
cmp r14, rax
cmovbe r14, rax
sub r14, rcx
xor edx, edx
mov r8, r14
call sub.ntdll.dll_memset
mov rax, qword [rsi + 0x10]
add rax, rbx
mov r14, rax
mov qword [rsi + 0x10], r14
mov r12, qword [rsi]
cmp qword [r12], 0
mov qword [rsp + 0x48], rdi
je 0x140011c3e
mov r14, qword [rsi + 0x40]
add r14, r13
mov r8, qword [rsi + 8]
add r8, r13
mov eax, dword [0x140064af4]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140011bec
add rbx, r14
cmp rbx, r14
jbe 0x140011c3e
mov eax, dword [0x140064af0]
mov qword [rsp + 0x40], rax
lea edi, [rax - 1]
mov qword [rsp + 0x38], rdi
not rdi
mov qword [rsp + 0x30], rdi
lea rbp, [rsp + 0x50]
mov r15, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x50], 0
mov r9, rbx
sub r9, r14
mov rcx, qword [r12]
mov qword [rsp + 0x20], rbp
mov rdx, r14
mov rdi, r8
call r15
test eax, eax
je 0x140011c45
mov rax, qword [rsp + 0x50]
lea rbx, [rax + r13]
add rax, r13
inc rax
mov rdi, qword [rsi + 0x10]
mov r14, rax
sub r14, rdi
jbe 0x140011b9e
mov rcx, qword [rsi + 0x18]
sub rcx, rdi
mov rax, rdi
cmp rcx, r14
jae 0x140011b66
mov rcx, qword [rsp + 0x48]
mov rdx, r14
call fcn.140011c90
test al, al
je 0x140011c73
mov rax, qword [rsi + 0x10]
test r14, r14
jle 0x140011b9b
mov rdx, qword [rsi + 8]
lea rcx, [rdx + rax]
lea r8, [rbx + rax]
add r8, rdx
sub r8, rdi
inc r8
add rax, rdx
inc rax
cmp r8, rax
cmovbe r8, rax
sub r8, rcx
xor edx, edx
call sub.ntdll.dll_memset
mov rax, qword [rsi + 0x10]
add rax, r14
mov qword [rsi + 0x10], rax
mov rax, qword [rsi + 8]
mov byte [rax + rbx], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14002c610
mov eax, ebx
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
mov rdx, rbx
call fcn.140011c90
test al, al
je 0x140011c7e
mov rax, qword [rsi + 0x10]
jmp 0x140011a46
lea rcx, [0x140064af4]
mov rbp, r12
mov r15, r8
call fcn.14002b4a4
mov r8, r15
cmp dword [0x140064af4], 0xffffffff
jne 0x140011ac7
lea r12, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r12 + 4]
mov dword [0x140064af0], eax
lea rcx, [0x140064af4]
call fcn.14002b444
mov r8, r15
mov r12, rbp
jmp 0x140011ac7
xor eax, eax
jmp 0x140011b28
mov rax, rbx
and rax, qword [rsp + 0x30]
mov rcx, rbx
sub rcx, qword [rsp + 0x40]
test dword [rsp + 0x38], ebx
cmovne rcx, rax
xor eax, eax
mov rbx, rcx
cmp rcx, r14
mov r8, rdi
ja 0x140011afa
jmp 0x140011b28
int3
int3
Function at 0x1400151c0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140064af4]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140015276
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x140015250
mov r14, qword [rsi + 8]
mov edi, dword [0x140064af0]
shl rbx, 4
xor r15d, r15d
lea r12, [rsp + 0x28]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rsi]
mov rcx, qword [rax]
test rcx, rcx
je 0x140015247
mov rdx, qword [r14 + r15 + 8]
mov r9d, dword [r14 + r15]
mov qword [rsp + 0x20], r12
mov r8, rdi
call r13
add r15, 0x10
cmp rbx, r15
jne 0x140015228
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140064af4]
call fcn.14002b4a4
cmp dword [0x140064af4], 0xffffffff
jne 0x140015202
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140064af0], eax
lea rcx, [0x140064af4]
call fcn.14002b444
jmp 0x140015202
Function at 0x140015350
Capabilities:
Access peb ldr_data
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rcx], rdx
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 2
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [0x140064af4]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140015486
mov ebx, dword [0x140064af0]
lea rax, [r14 + r15]
dec rax
xor edx, edx
div rbx
mov rcx, rax
mov rax, r14
xor edx, edx
div rbx
inc rcx
sub rcx, rax
je 0x140015465
mov r14, rax
lea rax, [rsi + 8]
mov qword [rsp + 0x28], rax
imul r14, rbx
cmp rcx, 2
mov r12d, 1
cmovae r12, rcx
lea r13, [rsp + 0x30]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400154cf
mov qword [rsp + 0x20], r13
mov rdx, r14
mov r8, rbx
mov r9d, 0x40
call rbp
test eax, eax
je 0x1400154c7
mov r15d, dword [rsp + 0x30]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
je 0x1400154d9
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], r15d
mov qword [rcx + rax + 8], r14
inc qword [rsi + 0x10]
add r14, rbx
dec r12
jne 0x14001540e
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002c610
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140064af4]
call fcn.14002b4a4
cmp dword [0x140064af4], 0xffffffff
jne 0x1400153bb
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x140064af0], eax
lea rcx, [0x140064af4]
call fcn.14002b444
jmp 0x1400153bb
mov dword [rsp + 0x30], 0
mov rcx, rsi
call fcn.1400151c0
jmp 0x140015465
mov rcx, qword [rsp + 0x28]
call fcn.140034790
test al, al
je 0x1400154cf
mov rax, qword [rsi + 0x10]
jmp 0x140015448

Function at 0x1400159a0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140064af4]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400159f0
mov esi, dword [0x140064af0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002c610
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140064af4]
call fcn.14002b4a4
cmp dword [0x140064af4], 0xffffffff
jne 0x1400159d5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x140064af0], eax
lea rcx, [0x140064af4]
call fcn.14002b444
jmp 0x1400159d5
Function at 0x14001ce30
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x3c], 8
cmp qword [r8 + 0x18], 8
jb 0x14001ce59
mov r8, qword [r8]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ce9e
cmp dword [rsp + 0x38], 0xb
jne 0x14001cec1
mov rax, qword [rsp + 0x40]
mov byte [rsi + 0x10], 0
mov qword [rsi], rax
mov byte [rsi + 8], 1
jmp 0x14001cead
cmp eax, 2
jne 0x14001cedf
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov byte [rsi + 0x10], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x50
pop rsi
ret
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000043
mov qword [rsi + 8], rax
jmp 0x14001cead
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3f
mov dword [rsi + 0xc], ecx
jmp 0x14001cead
Function at 0x14001d870
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp byte [0x140062d44], 1
je 0x14001d9f3
cmp qword [rdi + 0x20], 0
je 0x14001d973
cmp byte [rdi + 8], 0
je 0x14001d8fe
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.14001db60
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x18], 8
jb 0x14001d8c4
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 8
mov rdx, rax
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001da23
cmp byte [rdi + 8], 0
je 0x14001d8fe
mov byte [rdi + 8], 0
cmp byte [rdi + 0x18], 0
je 0x14001d959
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14001da80
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x18], 8
jb 0x14001d91f
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 8
mov rdx, rax
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001da23
cmp byte [rdi + 0x18], 0
je 0x14001d959
mov byte [rdi + 0x18], 0
mov byte [rsi + 0x10], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMozillaFirefoxLauncher
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001da4e
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x20]
test rcx, rcx
jne 0x14001da74
mov qword [rdi + 0x20], rbx
mov eax, dword [rsp + 0x54]
dec eax
cmp eax, 1
jbe 0x14001d8a4
mov eax, 0xb4
mov ecx, 0x80070507
jmp 0x14001da61
cmp byte [rdi + 0x18], 0
je 0x14001d9fd
mov byte [rdi + 0x18], 0
mov rax, qword [rdi + 0x10]
mov qword [rdi], rax
mov al, byte [rdi + 0x18]
mov byte [rdi + 8], al
mov eax, dword [rdi + 0x19]
mov dword [rdi + 9], eax
movzx eax, word [rdi + 0x1d]
mov word [rdi + 0xd], ax
mov al, byte [rdi + 0x1f]
mov byte [rdi + 0xf], al
jmp 0x14001d959
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x79
mov dword [rsi + 0xc], ecx
jmp 0x14001d95d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0xa5
mov byte [rsi + 0x10], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
jmp 0x14001da46
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001d9d4
Function at 0x14001f390
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdi, [rsp + 0x40]
mov dword [rdi], 4
mov qword [rsp + 0x30], rdi
lea r14, [rsp + 0x4c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000002
mov r8, rsi
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [r14], 1
sete bl
test eax, eax
je 0x14001f4cf
mov dword [rsp + 0x4c], 8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000002
mov r8, rsi
mov r9d, 0x48
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp qword [rsp + 0x40], 1
sete bl
test eax, eax
je 0x14001f4cf
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000001
mov r8, rsi
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp dword [rsp + 0x4c], 1
sete bl
test eax, eax
je 0x14001f4cf
mov dword [rsp + 0x4c], 8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
mov rcx, 0xffffffff80000001
mov r8, rsi
mov r9d, 0x48
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
sete al
cmp qword [rsp + 0x40], 1
sete bl
and bl, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002c610
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14001f4f0
Capabilities:
Map section object

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dword [rdx], 0
je 0x14001f5a7
mov ebx, r8d
mov rdi, rdx
mov rcx, qword [0x140062d88]
xor eax, eax
lea r8, [rsp + 0x50]
mov qword [r8], rax
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov rdx, 0xffffffffffffffff
xor r9d, r9d
call sub.ntdll.dll_NtMapViewOfSection
test eax, eax
jns 0x14001f579
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov r14, qword [rsp + 0x50]
test r14, r14
je 0x14001f5b0
cmp dword [r14 + 0x2c], 0
je 0x14001f5dd
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007139f000000d6
jmp 0x14001f633
mov byte [rsi + 0x10], 0
jmp 0x14001f65f
call sub.ntdll.dll_RtlGetLastWin32Error
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0xcf
mov dword [rsi + 0xc], ecx
jmp 0x14001f637
movzx eax, bl
mov dword [r14 + 0x28], eax
mov r8d, dword [rdi]
cmp r8, 0xfc8
ja 0x14001f61b
lea rcx, [r14 + 0x38]
mov rdx, qword [rdi + 8]
call sub.ntdll.dll_memcpy
mov eax, dword [rdi]
test eax, eax
je 0x14001f61b
cmp eax, 0x21
mov ecx, 0x20
cmovae ecx, eax
add ecx, 0x38
mov dword [r14 + 0x2c], ecx
mov byte [rsi + 0x10], 0
jmp 0x14001f637
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_freestanding_SharedSection.cpp
mov qword [rsi], rax
movabs rax, 0x8007007a000000df
mov qword [rsi + 8], rax
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14001f65f
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtUnmapViewOfSection
test eax, eax
jns 0x14001f65f
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140022470
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140064a50]
test rax, rax
je 0x1400224b3
mov rax, qword [0x140064a50]
test rax, rax
je 0x140022500
mov rcx, qword [0x140064a50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
je 0x140022503
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140055af0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x140022506
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x140022506
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x140022506
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x140022506
xor eax, eax
lock cmpxchg qword [0x140064a50], rcx
jmp 0x140022488
int3
int3
int3

Function at 0x140022c20
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140064b04]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140022c70
mov esi, dword [0x140064b00]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002c610
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140064b04]
call fcn.14002b4a4
cmp dword [0x140064b04], 0xffffffff
jne 0x140022c55
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x28]
mov dword [0x140064b00], eax
lea rcx, [0x140064b04]
call fcn.14002b444
jmp 0x140022c55

Function at 0x140023f70
Capabilities:
Check for software breakpoints
Get system information on windows
Parse credit card information

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140023fb6
mov r15, qword [r14 + 0x20]
lea rcx, [0x1400596f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140023fb6
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140004150
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140051226
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.140051240
test al, al
je 0x140051226
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140051226
mov r14, rax
mov rcx, rax
call fcn.140051240
test al, al
je 0x140051226
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140023f70
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400283d0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov bpl, byte [rsp + 0x88]
mov r12d, dword [rsp + 0x80]
mov eax, dword [0x140062db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x140028454
cmp byte [0x140062db4], 1
jne 0x140028454
mov eax, dword [0x1400624b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x140028438
call fcn.14002bdd8
mov eax, dword [0x1400624b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x10]
jmp 0x140028459
call fcn.140026e40
mov qword [rsi], rax
lea rdi, [rsi + 8]
xor eax, eax
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
mov dword [rsi + 0x14], ebx
lea rcx, [rsi + 0x18]
mov qword [rsi + 0x20], rax
mov rdx, qword gs:[0x30]
mov edx, dword [rdx + 0x48]
mov dword [rsi + 0x28], edx
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
lea rbx, [rsi + 0x40]
movups xmm1, xmmword [r15]
movups xmmword [rsi + 0x40], xmm1
mov dword [r15], 0
mov qword [r15 + 8], rax
mov qword [rsi + 0x50], r14
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x58], 8
mov dword [rsi + 0x70], r12d
mov byte [rsi + 0x74], bpl
call sub.ntdll.dll_RtlQueryPerformanceCounter
mov eax, dword [0x140062db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
jne 0x1400284dd
mov rcx, rsi
call fcn.140024d10
jmp 0x140028538
cmp byte [0x140062db4], 1
je 0x1400284fd
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je 0x140028568
mov byte [0x140062db4], 1
mov eax, dword [0x1400624b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x14002851e
call fcn.14002bdd8
mov eax, dword [0x1400624b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x10], rsi
lea rcx, [0x140062060]
mov rax, qword [0x140062060]
mov rax, qword [rax + 0x40]
mov rdx, rdi
mov r8, rbx
call qword [0x140068010]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [0x140062db0], eax
jmp 0x1400284d3
Function at 0x14002de30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x160], rax
test dl, dl
je 0x14002e020
lea rax, str.TargetNtMapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x140055090]
lea r8, [0x1400564d8]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.140009e10
lea rax, str.TargetNtUnmapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, [0x1400564c3]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.140009e10
mov rax, qword [rsi]
mov rdi, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, rdi
xor edx, edx
mov r9d, 0x2000
call r13
mov r14, rax
mov r12, qword [rsi + 0x10]
shl r12, 6
lea rbx, [r12 + 0x60]
mov rcx, rbx
call fcn.14000ac10
mov r15, rax
mov edx, r15d
and edx, 0xfffff000
add rdx, r14
and r15d, 0xfff
add r12, 0x105f
and r12, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, rdi
mov r8, r12
mov r9d, 0x1000
call r13
mov r14, rax
test rax, rax
je 0x14002e02f
add r14, r15
lea r15, [rsp + 0x48]
mov qword [r15], rbx
mov dword [r15 + 0x18], 0
mov qword [r15 + 8], 0x20
lea rcx, [sym.firefox.exe_g_originals]
mov r8d, 0x158
xor edx, edx
call sub.ntdll.dll_memset
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9, r15
call fcn.14000b840
test eax, eax
jne 0x14002dff8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov r9d, 0x20
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, 0x2a
test eax, eax
je 0x14002dffa
cmp qword [rsp + 0x40], 0x20
jne 0x14002dffa
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8, rbx
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsi]
lea rdx, str.g_originals
lea r8, [sym.firefox.exe_g_originals]
mov r9d, 0x158
call fcn.14000b0a0
mov ebp, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14002c610
mov eax, ebp
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [rsi + 0x10], 0
jne 0x14002debf
xor ebp, ebp
jmp 0x14002dffa
lea r12, [rsp + 0x50]
mov dword [r12 - 8], 3
mov rcx, r12
call fcn.140024150
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
mov qword [r12 + 0xf0], rax
mov dword [r12 + 0xf8], 0x188
lea rcx, [rsp + 0x158]
call fcn.14003c230
lea rcx, [rsp + 0x48]
call fcn.14003a460
jmp 0x14002df47
Function at 0x14002e3a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14002e3e2
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14002c610
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.140024150
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.14003c230
lea rcx, [rsp + 0x20]
call fcn.14003a460
jmp 0x14002e3c8