joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007cf0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x10007d90
mov ecx, dword [eax + 8]
rol ecx, 1
mov edx, dword [eax + 0xc]
rol edx, 7
add edx, ecx
mov esi, dword [eax + 0x10]
rol esi, 0xc
mov ecx, dword [eax + 0x14]
rol ecx, 0x12
add ecx, esi
add ecx, edx
add ecx, dword [eax]
mov edx, dword [eax + 0x28]
add eax, 0x18
and edx, 0xf
cmp edx, 4
jb 0x10007d4b
imul esi, dword [eax], 0xc2b2ae3d
add esi, ecx
rol esi, 0x11
add eax, 4
imul ecx, esi, 0x27d4eb2f
add edx, 0xfffffffc
cmp edx, 3
ja 0x10007d2f
test edx, edx
je 0x10007d6b
xor esi, esi
movzx edi, byte [eax + esi]
imul edi, edi, 0x165667b1
add edi, ecx
rol edi, 0xb
imul ecx, edi, 0x9e3779b1
inc esi
cmp edx, esi
jne 0x10007d51
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul eax, eax, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop esi
pop edi
pop ebp
ret
mov ecx, 0x165667b1
add ecx, dword [eax + 0x10]
jmp 0x10007d1f

Function at 0x10008be0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test eax, eax
je 0x10008c79
mov edx, dword [ebp + 0xc]
cmp edx, 0x10
jae 0x10008c83
add edi, 0x165667b1
mov esi, edx
mov ecx, edi
add ecx, edx
cmp esi, 4
jb 0x10008c30
imul edx, dword [eax], 0xc2b2ae3d
add edx, ecx
rol edx, 0x11
add eax, 4
imul ecx, edx, 0x27d4eb2f
add esi, 0xfffffffc
cmp esi, 3
ja 0x10008c14
test esi, esi
je 0x10008c50
xor edx, edx
movzx edi, byte [eax + edx]
imul edi, edi, 0x165667b1
add edi, ecx
rol edi, 0xb
imul ecx, edi, 0x9e3779b1
inc edx
cmp esi, edx
jne 0x10008c36
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul eax, eax, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add edi, 0x165667b1
mov ecx, edi
jmp 0x10008c50
lea ecx, [eax + edx]
add ecx, 0xfffffff1
mov dword [ebp - 0x18], ecx
lea ecx, [edi + 0x24234428]
mov dword [ebp - 0x10], ecx
lea ecx, [edi - 0x7a143589]
mov dword [ebp - 0x14], ecx
lea ecx, [edi + 0x61c8864f]
imul esi, dword [eax], 0x85ebca77
add esi, dword [ebp - 0x10]
mov dword [ebp - 0x10], esi
imul esi, dword [eax + 4], 0x85ebca77
add esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], esi
imul ebx, dword [eax + 8], 0x85ebca77
imul esi, dword [eax + 0xc], 0x85ebca77
add ebx, edi
add esi, ecx
mov ecx, dword [ebp - 0x10]
rol ecx, 0xd
imul ecx, ecx, 0x9e3779b1
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
rol ecx, 0xd
imul ecx, ecx, 0x9e3779b1
mov dword [ebp - 0x14], ecx
rol ebx, 0xd
rol esi, 0xd
imul edi, ebx, 0x9e3779b1
imul ecx, esi, 0x9e3779b1
add eax, 0x10
cmp eax, dword [ebp - 0x18]
jb 0x10008ca4
mov ebx, dword [ebp - 0x10]
rol ebx, 1
mov esi, dword [ebp - 0x14]
rol esi, 7
add esi, ebx
rol edi, 0xc
rol ecx, 0x12
add ecx, edi
add ecx, esi
mov esi, edx
and esi, 0xf
jmp 0x10008c0d
Function at 0x10013b10
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ecx], edx
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 2
lea eax, [ecx + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [0x100a53c8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x100a6a5c]
cmp ecx, dword [eax + 4]
jg 0x10013bd7
mov ebx, dword [0x100a6a58]
mov eax, dword [ebp + 0xc]
add eax, edi
dec eax
xor edx, edx
div ebx
mov ecx, eax
mov eax, edi
xor edx, edx
div ebx
mov edi, eax
inc ecx
sub ecx, eax
je 0x10013bc3
mov eax, ebx
lea edx, [esi + 4]
mov dword [ebp - 0x3c], edx
imul edi, ebx
xor ebx, ebx
inc ebx
cmp ecx, 2
cmovae ebx, ecx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x34]
push ecx
push 0x40
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x10013c15
mov edx, dword [ebp - 0x34]
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
je 0x10013c25
mov ecx, dword [esi + 4]
mov dword [ecx + eax*8], edx
mov dword [ecx + eax*8 + 4], edi
inc dword [esi + 8]
mov eax, dword [ebp - 0x40]
add edi, eax
dec ebx
jne 0x10013b91
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004fb50
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a5c], 0xffffffff
jne 0x10013b5b
lea ebx, [ebp - 0x34]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x100a6a58], eax
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
jmp 0x10013b5b
mov dword [ebp - 0x34], 0
mov ecx, esi
call fcn.100814e0
jmp 0x10013bc3
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x3c]
call fcn.100815a0
test al, al
je 0x10013c1c
mov eax, dword [esi + 8]
mov edx, dword [ebp - 0x38]
jmp 0x10013bae
Function at 0x100172b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov byte [eax + 0xc], 0
test ecx, ecx
je 0x10017323
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x10017323
mov esi, dword [ecx + 0x3c]
lea edx, [ecx + esi]
mov dword [eax + 4], edx
cmp dword [ecx + esi], 0x4550
jne 0x10017323
movzx esi, word [edx + 0x18]
cmp esi, 0x10b
jne 0x10017323
mov esi, dword [edx + 0x50]
cmp esi, 0x138
jb 0x10017323
add ecx, esi
dec ecx
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0x74]
cmp ecx, 0x10
mov edi, 0x10
cmovb edi, ecx
cmp edi, 2
jb 0x10017323
cmp dword [edx + 0x80], esi
setae byte [eax + 0xc]
pop esi
pop edi
pop ebp
ret 4
Function at 0x1001d140
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ebp + 8]
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea ecx, [ebp - 0x18]
mov dword [ecx], edx
mov dword [ebp - 0x20], 0x10057320
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x1001d2c6
mov esi, dword [ebp - 0x14]
mov ebx, esi
and ebx, 0xfffffffc
push ebx
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov edi, eax
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push ebx
mov ebx, edi
push edi
push 0xffffffffffffffff
call sub.kernel32.dll_K32EnumProcessModules
test eax, eax
je 0x1001d2bd
shr esi, 2
mov eax, dword [ebp - 0x14]
shr eax, 2
cmp eax, esi
cmovae eax, esi
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001d2bd
xor edi, edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], edi
mov eax, dword [ebx + edi*4]
mov dword [ebp - 0x3c], eax
mov esi, 0x104
mov dword [ebp - 0x28], 0
mov ebx, esi
lea eax, [esi + esi]
test esi, esi
mov edi, 0xffffffff
mov dword [ebp - 0x38], eax
cmovns edi, eax
push edi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001d2db
push ebx
push esi
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001d310
mov dword [ebp - 0x2c], esi
cmp eax, ebx
mov esi, dword [ebp - 0x38]
je 0x1001d2e9
mov edi, eax
inc edi
lea esi, [eax + eax + 2]
mov eax, 0xffffffff
cmovs esi, eax
push esi
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov ebx, eax
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, dword [ebp - 0x2c]
push esi
push edi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x1001d307
push esi
call sym.mozglue.dll__aligned_free
add esp, 4
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov esi, dword [eax + edi*4]
mov ecx, dword [ebp - 0x20]
call dword [section..00cfg]
push esi
push ebx
lea eax, [ebp - 0x1c]
push eax
call ecx
add esp, 0xc
mov esi, ebx
push esi
call sym.mozglue.dll__aligned_free
add esp, 4
inc edi
cmp edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x30]
jne 0x1001d1d8
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004fb50
mov eax, dword [ebp + 8]
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x1001d221
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov eax, ebx
cmp ecx, 0x7a
je 0x1001d1ed
jmp 0x1001d242
push ebx
call sym.mozglue.dll__aligned_free
add esp, 4
mov edi, dword [ebp - 0x24]
jmp 0x1001d2a7
Function at 0x1001d870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 0xc]
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x100a6614], esi
je 0x1001d943
mov dword [0x100a6614], esi
lea edi, [ebp - 0x28]
mov ecx, edi
call fcn.10016df0
cmp byte [edi + 4], 0
jne 0x1001d95e
lea ebx, [ebp - 0x28]
mov eax, dword [ebx]
mov dword [ebp - 0x30], eax
mov ecx, ebx
call fcn.10016e80
cmp byte [ebx + 4], 0
jne 0x1001d96c
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov edx, edi
push str.Theme
call fcn.10016f30
add esp, 4
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x14], 8
jb 0x1001d8e5
mov ebx, dword [ebp - 0x28]
mov eax, 4
lea ecx, [ebp - 0x2c]
push eax
push ecx
push eax
push 0
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
mov esi, dword [ebp + 8]
jbe 0x1001d91e
mov eax, dword [ebp - 0x28]
inc ecx
test ecx, 0x7ffff800
jne 0x1001d98d
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
test ebx, ebx
jne 0x1001d9a1
xor eax, eax
mov byte [esi + 4], al
test edi, edi
je 0x1001d934
push edi
call sym.mozglue.dll__aligned_free
add esp, 4
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1001d94a
jmp 0x1001d981
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004fb50
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 1
mov dword [esi], eax
jmp 0x1001d981
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 1
mov dword [esi], eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x100a6614], 0
jmp 0x1001d94a
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1001d9ae
mov eax, ecx
jmp 0x1001d915
mov dword [esi], 7
mov al, 1
jmp 0x1001d924
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1001dfd0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x100a6a68]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x1001e033
push 0x100a6a68
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a68], 0xffffffff
jne 0x1001e033
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x100a6a64], eax
push 0x100a6a68
call fcn.1004fb5e
add esp, 4
mov esi, dword [0x100a6a64]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004fb50
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x1001f390
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push str.MOZ_CRASHREPORTER_DISABLE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1001f42e
cmp word [0x100a662c], 0
jne 0x1001f42c
push 0x105
push 0x100a662c
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001f42c
cmp eax, 0x105
je 0x1001f42c
push 0x5c
push 0x100a662c
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
test eax, eax
je 0x1001f42c
mov word [eax + 2], 0
push str.mozwer.dll
push 0x105
push 0x100a662c
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
test eax, eax
jne 0x1001f42c
mov eax, dword [sym.mozglue.dll_enum_GeckoProcessType_mozilla::startup::sChildProcessType]
mov dword [0x100a6838], eax
mov dword [0x100a683c], 0x100a585c
push 0x100a6838
push 0x100a662c
call sub.kernel32.dll_WerRegisterRuntimeExceptionModule
test eax, eax
js 0x1001f439
pop ebp
ret
cmp byte [eax], 0
je 0x1001f3a9
jmp 0x1001f42c
mov word [0x100a662c], 0
jmp 0x1001f42c

Function at 0x1001f9a0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push 2
push 0x20
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
setns bl
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1004fb50
mov eax, ebx
add esp, 0x24
pop ebx
pop ebp
ret

Function at 0x1001fb20
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [esp + 0xc], eax
mov eax, esp
push 8
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1001fb61
mov esi, dword [esp]
mov edi, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor ecx, ebp
call fcn.1004fb50
mov eax, esi
mov edx, edi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
int3
Function at 0x1004f300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, edi
and eax, 0xfffffffc
je 0x1004f3bf
lea esi, [eax - 1]
mov edi, esi
shr edi, 2
inc edi
mov ecx, edi
and ecx, 3
cmp eax, 0xd
jae 0x1004f330
xor eax, eax
xor ebx, ebx
jmp 0x1004f37b
and edi, 0xfffffffc
xor eax, eax
xor ebx, ebx
nop word [eax + eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 0xfffffffc
jne 0x1004f340
test ecx, ecx
je 0x1004f399
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1004f386
and esi, 0xfffffffc
add esi, 4
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1004f3ba
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc esi
cmp edi, esi
jne 0x1004f3a6
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
xor eax, eax
cmp esi, edi
jb 0x1004f3a6
jmp 0x1004f3ba

Function at 0x1004fb5e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1004fb6d
pop dword [ebp - 0x50]
mov eax, 0xf6bd6e3
sub eax, 0xff66db76
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x37c4c
push 0
mov eax, 0xaf5e81dd
add eax, 0x60aba85f
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4a02
mov esi, eax
mov edx, 0x100afc00
add edx, dword [ebp - 0x50]
mov edi, 0x9d5c3139
mov dword [ebp - 0x10], 0xa108942d
mov ebx, dword [edx]
xor dword [ebp - 0x18], edi
add ebx, edi
mov dword [esi], ebx
add esi, 4
add edx, 0x58a4fb77
add edx, 0xa75b048d
loop 0x1004fbba
add eax, 0x61935713
add eax, 0x9e6dc3c8
mov ebx, eax
add eax, 0x711a6d29
sub eax, 0x711a6d24
mov ecx, 0xdbb41750
sub ecx, 0xcbb41750
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x10051028
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov dword [0], ecx
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 3
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
Function at 0x10052670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x100a500c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 4
cmp dword [eax + 0x14], 8
jb 0x1005269d
mov eax, dword [eax]
lea edi, [ebp - 0x18]
lea ebx, [ebp - 0x14]
push edi
push ebx
push ecx
push 0x10
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, 7
test eax, eax
jne 0x100526bd
mov ecx, dword [ebp - 0x14]
setne byte [esi + 4]
mov dword [esi], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004fb50
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100532d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [0x100a6624], 0
je 0x1005330b
mov eax, dword [0x100a6620]
and eax, 0xfffffffe
cmp eax, 4
jne 0x1005330b
mov byte [ebx + 4], 1
mov dword [ebx], 1
jmp 0x100533cb
lea edi, [ebp - 0x28]
mov ecx, edi
call fcn.10016df0
cmp byte [edi + 4], 0
jne 0x100533df
lea ebx, [ebp - 0x28]
mov esi, dword [ebx]
mov ecx, ebx
call fcn.10016e80
cmp byte [ebx + 4], 0
jne 0x100533ea
mov edi, dword [ebp - 0x28]
mov ecx, ebx
mov edx, edi
push str.Enabled
call fcn.10016f30
add esp, 4
movzx eax, byte [ebp + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x14], 8
jb 0x10053359
mov ebx, dword [ebp - 0x28]
mov eax, 4
lea ecx, [ebp - 0x2c]
push eax
push ecx
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x1005338d
mov eax, dword [ebp - 0x28]
inc ecx
test ecx, 0x7ffff800
jne 0x100533f8
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
test ebx, ebx
jne 0x1005340c
cmp byte [0x100a6610], 0
mov ebx, dword [ebp + 8]
jne 0x100533ab
cmp byte [ebp + 0xc], 0
je 0x100533ab
lea ecx, [ebp - 0x28]
call fcn.100174e0
mov al, byte [ebp + 0xc]
mov byte [0x100a6610], al
mov byte [ebx + 4], 0
test edi, edi
je 0x100533c4
push edi
call sym.mozglue.dll__aligned_free
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004fb50
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov byte [ebx + 4], 1
mov dword [ebx], eax
jmp 0x100533cb
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 1
mov dword [ebx], eax
jmp 0x100533c4
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1005341b
mov eax, ecx
jmp 0x10053384
mov ebx, dword [ebp + 8]
mov byte [ebx + 4], 1
mov dword [ebx], 7
jmp 0x100533b7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x100557f0
Capabilities:
Get system information on windows
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.mozglue.dll_malloc
Function at 0x1005c3d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [0x100a6430]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x1005c457
push 0x100a6430
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6430], 0xffffffff
jne 0x1005c457
push str.MOZ_BASE_PROFILER_VERBOSE_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1005c463
push str.MOZ_BASE_PROFILER_DEBUG_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x1005c46a
push str.MOZ_BASE_PROFILER_LOGGING
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
lea eax, [ecx + ecx*2]
mov dword [0x100a642c], eax
push 0x100a6430
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a642c], esi
setge al
pop esi
pop ebp
ret
mov eax, 5
jmp 0x1005c445
mov eax, 4
jmp 0x1005c445
Function at 0x1005fdf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, ecx
mov dword [ecx + 4], edx
mulsd xmm0, qword [0x10093230]
addsd xmm0, qword [0x100932b8]
sub esp, 8
movsd qword [esp], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
add esp, 8
fstp qword [esp]
cvttsd2si ecx, qword [esp]
xor eax, eax
inc eax
cmp ecx, 2
cmovge eax, ecx
mov dword [esi + 8], eax
mov ecx, 0x8000
and ecx, dword [ebp + 8]
mov edx, ecx
shr edx, 0xf
mov byte [esi + 0x10], dl
test ecx, ecx
jne 0x1005fe64
cmp eax, 0x270f
ja 0x1005fe64
movzx eax, ax
shr eax, 3
imul eax, eax, 0x20c5
shr eax, 0x14
push eax
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
xor eax, eax
push eax
push eax
push esi
push 0x1005fea0
push eax
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x1005fe88
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_CRASH__beginthreadex_failed_
int3
Function at 0x1006c9a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xe4
mov edi, ecx
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, edx
sub eax, ecx
cmp eax, 0x1a4c
jge 0x1006cae9
cmp edi, edx
je 0x1006cad4
lea ebx, [edi + 0xcc]
cmp ebx, edx
je 0x1006cad4
mov eax, 0xffffff34
lea esi, [ebp - 0xdc]
mov ecx, edi
mov dword [ebp - 0xe0], edi
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], eax
mov ecx, esi
push ebx
call fcn.10051800
mov eax, dword [ebp - 0xdc]
cmp eax, dword [edi]
jae 0x1006ca5d
mov ecx, edi
cmp ebx, edi
je 0x1006ca96
xor edi, edi
mov esi, dword [ebp - 0xe8]
mov dword [ebp - 0xe4], ebx
mov ebx, dword [ebp - 0xec]
lea edx, [ebx + edi]
mov eax, dword [ebp - 0xe4]
lea ecx, [eax + edi]
call fcn.1006d140
add edi, 0xffffff34
cmp esi, edi
jne 0x1006ca2e
mov ecx, dword [ebp - 0xe0]
lea esi, [ebp - 0xdc]
mov ebx, dword [ebp - 0xe4]
jmp 0x1006ca96
mov ecx, ebx
cmp eax, dword [ebx - 0xcc]
jae 0x1006ca96
lea ecx, [ebx - 0xcc]
mov edi, ecx
add ecx, 0xcc
mov edx, edi
call fcn.1006d140
lea ecx, [edi - 0xcc]
mov eax, dword [ebp - 0xdc]
cmp eax, dword [edi - 0xcc]
jb 0x1006ca6d
add ecx, 0xcc
mov edx, esi
call fcn.1006d140
mov ecx, esi
call fcn.10051580
mov ecx, 0xcc
add ebx, ecx
mov eax, dword [ebp - 0xe8]
add eax, 0xffffff34
mov edx, dword [ebp - 0xec]
add edx, ecx
mov ecx, edx
mov edx, dword [ebp - 0xf0]
cmp ebx, edx
mov edi, dword [ebp - 0xe0]
jne 0x1006c9f6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004fb50
add esp, 0xe4
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
test esi, esi
mov ebx, edx
mov ecx, edi
jle 0x1006cb80
call fcn.1006cd60
mov dword [ebp - 0xe8], edx
mov ecx, esi
shr ecx, 1
shr esi, 2
add esi, ecx
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], edi
sub eax, edi
mov edi, dword [ebp - 0xe8]
sar eax, 2
imul eax, eax, 0xfafafafb
mov ecx, ebx
sub ecx, edi
sar ecx, 2
imul ecx, ecx, 0xfafafafb
cmp eax, ecx
jge 0x1006cb53
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xe4]
push esi
call fcn.1006c9a0
mov edx, ebx
add esp, 4
jmp 0x1006cb6c
mov edx, ebx
mov ecx, edi
push esi
call fcn.1006c9a0
add esp, 4
mov edx, dword [ebp - 0xe4]
mov edi, dword [ebp - 0xe0]
mov eax, edx
sub eax, edi
cmp eax, 0x1a4c
jge 0x1006caec
jmp 0x1006c9c7
call fcn.1006cbc0
mov esi, ebx
sub esi, edi
cmp esi, 0xcd
jl 0x1006cad4
mov ecx, edi
mov edx, ebx
call fcn.1006d470
mov eax, 0xffffff34
add ebx, eax
add esi, eax
cmp esi, 0xcc
jg 0x1006cb95
jmp 0x1006cad4