joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180014ed0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 8], 0
je 0x180015025
mov rsi, rcx
lea ecx, [rdx + r8]
dec ecx
mov eax, dword [rsi + 0x14]
cmp ecx, eax
jb 0x180014f9e
cmp eax, dword [rsi + 0x10]
jae 0x180015025
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180014fa3
mov edx, dword [0x1800a80a0]
mov ecx, dword [rsi + 0x14]
add rcx, qword [rsi + 8]
mov r8d, 0x1000
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x180014f80
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180014fe4
mov eax, dword [0x1800a80a0]
add dword [rsi + 0x14], eax
test rdi, rdi
setne sil
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004bde0
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov sil, 1
jmp 0x180014f87
lea rcx, [0x1800a80a4]
call fcn.18004a800
cmp dword [0x1800a80a4], 0xffffffff
jne 0x180014f2f
lea rdi, [rsp + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a7a0
jmp 0x180014f2f
lea rcx, [0x1800a80a4]
call fcn.18004a800
cmp dword [0x1800a80a4], 0xffffffff
jne 0x180014f77
lea rbx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a7a0
jmp 0x180014f77
xor esi, esi
jmp 0x180014f87
Function at 0x1800151d0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebp, r9d
mov r15, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [rcx + 1]
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001531d
mov ebx, dword [0x1800a80b0]
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov r8d, ebx
mov r9, r15
call fcn.180015490
mov eax, dword [0x1800a80c8]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800152d4
lea rcx, [0x1800a80d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x1800a80a8]
lea rdx, [rsp + 0x30]
call fcn.180015670
test rax, rax
je 0x18001535e
mov rdi, rax
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, ebx
call fcn.180015380
test eax, eax
je 0x18001535e
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov byte [rsi + 0x10], 1
lea rcx, [0x1800a80d0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004bde0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1800a80c8]
call fcn.18004a800
cmp dword [0x1800a80c8], 0xffffffff
jne 0x18001525e
lea rcx, [0x1800a80d0]
mov edx, 0xfa0
mov r8d, 0x1000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x1800a80c4], 1
lea rcx, [0x1800a80c8]
call fcn.18004a7a0
jmp 0x18001525e
lea rcx, [0x1800a80b4]
call fcn.18004a800
cmp dword [0x1800a80b4], 0xffffffff
jne 0x180015220
lea rbx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbx + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a7a0
jmp 0x180015220
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x1800152aa
Function at 0x180015380
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x70], rax
test edx, edx
je 0x18001547e
mov rsi, rcx
cmp qword [rcx + 8], 0
jne 0x180015422
mov r14, r8
mov ebx, edx
lea r15, [rsi + 1]
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180015441
mov edi, dword [0x1800a80b0]
xor ebp, ebp
mov eax, ebx
xor edx, edx
div edi
sub edi, edx
test edx, edx
cmove edi, edx
add edi, ebx
mov dword [rsi + 0x10], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov rcx, r15
mov rdx, rax
mov r8d, edi
call fcn.180015cc0
mov qword [rsi + 8], rax
test rax, rax
je 0x180015425
mov ebp, dword [rsi + 0x10]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18004bde0
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1800a80b4]
call fcn.18004a800
cmp dword [0x1800a80b4], 0xffffffff
jne 0x1800153d7
lea rbp, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a7a0
jmp 0x1800153d7
xor ebp, ebp
jmp 0x180015425
Function at 0x180015490
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov r12, rdx
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x58], rax
test r9, r9
je 0x1800155ff
mov esi, dword [rsp + 0xc0]
test esi, esi
je 0x1800155ff
mov rbx, r9
mov r15d, r8d
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180015612
mov edi, esi
xor esi, esi
mov rax, rbx
sub rax, rdi
cmovae rsi, rax
cmp rsi, 0x100001
mov eax, 0x100000
cmovb rsi, rax
cmp rbx, rdi
mov ebp, dword [0x1800a80b0]
cmovb rsi, rax
mov eax, dword [0x1800a80c0]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x180015579
lea rcx, [0x1800a80c0]
call fcn.18004a800
cmp dword [0x1800a80c0], 0xffffffff
jne 0x180015579
lea r14, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [r14 + 0x10]
mov qword [0x1800a80b8], rax
lea rcx, [0x1800a80c0]
call fcn.18004a7a0
mov rax, qword [0x1800a80b8]
lea rcx, [rbx + rdi]
cmp rax, rcx
cmovb rcx, rax
add rbx, rdi
cmovb rcx, rax
mov edx, r15d
cmp rcx, rdx
jb 0x1800155ff
mov rdi, rsi
neg rdi
lea rax, [rbp - 1]
and rax, rdi
add rax, rsi
xor ebx, ebx
sub rcx, rdx
cmovae rbx, rcx
neg rbp
and rbp, rbx
sub rbp, rax
jbe 0x1800155ff
test rax, rax
je 0x180015654
cmp rbp, 0xffffffffffffffff
je 0x180015654
mov qword [r12], rbp
mov qword [r12 + 8], rax
mov byte [r12 + 0x10], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004bde0
mov rax, r12
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], 0
jmp 0x1800155e0
lea rcx, [0x1800a80b4]
call fcn.18004a800
cmp dword [0x1800a80b4], 0xffffffff
jne 0x1800154f3
lea r14, [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a7a0
jmp 0x1800154f3
lea rax, str.MOZ_RELEASE_ASSERT___elements__extentSize__0____elements__extentSize___dynamic_extent__
mov qword [sym.mozglue.dll_gMozCrashReason], rax
int3
Function at 0x180016090
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, r9
mov r15, r8
mov r13, rdx
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, dword [0x1800a80b4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001620a
xor ebx, ebx
test r15, r15
je 0x1800161e3
mov rbp, qword [rsp + 0x100]
cmp rbp, rsi
jbe 0x1800161e3
mov ebx, dword [0x1800a80b0]
lea rdi, [rsp + 0x54]
mov dword [rdi], 0
mov rcx, rdi
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand_s
mov rax, rbp
sub rax, rsi
sub rax, r15
xor edx, edx
div rbx
mov rcx, rax
mov eax, dword [rdi]
inc rcx
xor edx, edx
div rcx
mov r12, rdx
imul r12, rbx
mov qword [rsp + 0x38], rsi
add r12, rsi
sub rbp, r15
cmp r12, rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
ja 0x18001626c
lea rsi, [rsp + 0x58]
lea rdi, [rsp + 0x60]
lea r14, [rbx - 1]
mov rdx, r12
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x30
mov rcx, r13
xor r8d, r8d
mov r9, rdi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x18001631c
cmp qword [rsp + 0x58], 0x30
jne 0x18001632a
mov r9, rdi
mov r8, rsi
cmp dword [rsp + 0x80], 0x10000
jne 0x18001624b
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rdx
neg rcx
and rcx, r14
lea rsi, [rcx + rdx]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rsi
cmp rdi, rcx
jb 0x180016255
test rbx, rbx
je 0x180016255
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18004bde0
mov rax, rbx
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1800a80b4]
call fcn.18004a800
cmp dword [0x1800a80b4], 0xffffffff
jne 0x1800160e3
lea rdi, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 0x28]
mov dword [0x1800a80b0], eax
lea rcx, [0x1800a80b4]
call fcn.18004a7a0
jmp 0x1800160e3
mov rdx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rdx, rdi
cmp rdx, rbp
mov r13, qword [rsp + 0x48]
mov rsi, r8
mov rdi, r9
jbe 0x180016169
cmp r12, qword [rsp + 0x38]
jbe 0x18001632a
dec qword [rsp + 0x40]
lea r14, [rsp + 0x58]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 0x30
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
mov r9, rsi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x18001631c
cmp qword [rsp + 0x58], 0x30
jne 0x18001632a
cmp dword [rsp + 0x80], 0x10000
jne 0x1800162ff
mov rax, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
mov rcx, rax
neg rcx
and rcx, qword [rsp + 0x40]
mov rbp, rax
lea rdx, [rcx + rax]
mov rax, rdi
sub rax, rcx
cmp rax, r15
mov ebx, 0
cmovae rbx, rdx
cmp rdi, rcx
jb 0x180016309
test rbx, rbx
je 0x180016309
jmp 0x1800161e3
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rbp, rdi
mov qword [rsp + 0x38], rbp
cmp rbp, r12
jb 0x180016286
jmp 0x18001632a
mov ecx, eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov ecx, eax
call sub.ntdll.dll_RtlSetLastWin32Error
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
jmp 0x1800161e3
Function at 0x1800189e0
Capabilities:
Access peb ldr_data
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbp, r9
mov rbx, r8
mov rsi, rcx
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [rcx], rdx
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 2
lea rax, [rcx + 0x20]
mov qword [rcx + 8], rax
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x180018b06
mov edi, dword [0x1800a80a0]
lea rax, [rbx + rbp]
dec rax
xor edx, edx
div rdi
mov rcx, rax
mov rax, rbx
xor edx, edx
div rdi
inc rcx
sub rcx, rax
je 0x180018ae5
mov rbx, rax
mov r15d, dword [rsp + 0xd0]
lea rax, [rsi + 8]
mov qword [rsp + 0x28], rax
imul rbx, rdi
cmp rcx, 2
mov ebp, 1
cmovae rbp, rcx
lea r12, [rsp + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbx
mov rdx, rdi
mov r8d, r15d
mov r9, r12
call r13
test eax, eax
je 0x180018b47
mov r14d, dword [rsp + 0x30]
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 0x18]
je 0x180018b59
mov rcx, qword [rsi + 8]
shl rax, 4
mov dword [rcx + rax], r14d
mov qword [rcx + rax + 8], rbx
inc qword [rsi + 0x10]
add rbx, rdi
dec rbp
jne 0x180018a9e
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004bde0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1800a80a4]
call fcn.18004a800
cmp dword [0x1800a80a4], 0xffffffff
jne 0x180018a48
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a7a0
jmp 0x180018a48
mov dword [rsp + 0x30], 0
mov rcx, rsi
call fcn.180073ba0
jmp 0x180018ae5
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.180073c90
test al, al
je 0x180018b4f
mov rax, qword [rsi + 0x10]
jmp 0x180018ac8
Function at 0x18001bb10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov r14, rcx
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdx, [0x180093020]
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.18004f840
cmp qword [rsi], 0
je 0x18001bcda
cmp qword [0x1800a6240], 0xffffffffffffffff
jne 0x18001bce3
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.18001b840
cmp byte [rbx + 8], 0
jne 0x18001bcea
mov r15, qword [rsp + 0x40]
movzx eax, word [r15]
test ax, ax
je 0x18001bba4
lea rcx, [r15 + 2]
lea edx, [rax - 0x41]
cmp dx, 0x19
jbe 0x18001bb9b
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x18001bb84
jmp 0x18001bba4
add eax, 0x20
mov word [rcx - 2], ax
jmp 0x18001bb8d
mov ecx, 0x12
call sym.mozglue.dll_moz_xmalloc
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov word [rax + 0x10], 0
xor ecx, ecx
mov rax, r15
mov r9d, ecx
movzx edx, word [rax]
rol ecx, 5
xor ecx, edx
imul ecx, ecx, 0x9e3779b9
add rax, 2
test edx, edx
jne 0x18001bbc2
mov rcx, rsi
call fcn.18004f760
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], 0
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call fcn.18001bd10
lea rdx, str.MozillaFirefoxSkeletonUILock_
mov r8d, 0x20
mov rcx, rbx
call fcn.18001bd10
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, rsi
mov r8, rax
call fcn.18001bd10
cmp qword [rsp + 0x58], 8
jb 0x18001bc4e
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1800a6240], rax
mov cl, 1
cmp rax, 0xffffffffffffffff
je 0x18001bcf8
mov byte [r14 + 5], cl
lea rcx, [rsp + 0x40]
call fcn.18001b7d0
mov rcx, rsi
call sym.mozglue.dll__aligned_free
mov rcx, r15
call sym.mozglue.dll__aligned_free
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0
test rcx, rcx
je 0x18001bcbc
call fcn.18004f7d0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004bde0
mov rax, r14
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dword [r14], 0xb
jmp 0x18001bcf1
mov byte [r14 + 5], 1
jmp 0x18001bca4
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov byte [r14 + 5], 0
jmp 0x18001bca4
mov dword [r14], 0xa
xor ecx, ecx
jmp 0x18001bc86
Function at 0x18001d6e0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rax], rcx
lea rcx, [0x180052b40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x4c]
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18001d86a
lea rsi, [rsp + 0x4c]
mov ebx, dword [rsi]
mov edi, ebx
and edi, 0xfffffff8
mov rcx, rdi
call sym.mozglue.dll_moz_xmalloc
mov r12, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov rcx, 0xffffffffffffffff
mov rdx, r12
mov r8d, edi
mov r9, rsi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x18001d862
shr ebx, 3
mov eax, dword [rsp + 0x4c]
shr eax, 3
cmp eax, ebx
cmovae eax, ebx
test eax, eax
je 0x18001d862
mov r14d, eax
xor r15d, r15d
mov r13, qword [r12 + r15*8]
mov ecx, 0x104
xor ebp, ebp
mov ebx, ecx
mov edi, ecx
add rdi, rdi
mov rcx, rdi
call sym.mozglue.dll_moz_xmalloc
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
test rbp, rbp
jne 0x18001d88d
mov rcx, r13
mov rdx, rsi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001d84e
mov edi, eax
cmp eax, ebx
je 0x18001d89a
inc edi
lea rbp, [rdi + rdi]
mov rcx, rbp
call sym.mozglue.dll_moz_xmalloc
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
jne 0x18001d8b6
mov rcx, rsi
call sym.mozglue.dll__aligned_free
mov r8, qword [r12 + r15*8]
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rdx, rbx
call qword [case.0x18004aa4e.0]
mov rsi, rbx
mov rcx, rsi
call sym.mozglue.dll__aligned_free
inc r15
cmp r15, r14
jne 0x18001d7a7
mov rcx, r12
call sym.mozglue.dll__aligned_free
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18004bde0
mov rax, qword [rsp + 0x28]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbp
call sym.mozglue.dll__aligned_free
jmp 0x18001d7da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbx + rbx]
mov rbp, rsi
mov edi, ebx
cmp eax, 0x7a
je 0x18001d7b2
jmp 0x18001d7f7
mov rcx, rbx
call sym.mozglue.dll__aligned_free
jmp 0x18001d84e
Function at 0x18001dc70
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1800a80a4]
mov ecx, dword [0x1800a64f4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x18001dcc0
mov esi, dword [0x1800a80a0]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004bde0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1800a80a4]
call fcn.18004a800
cmp dword [0x1800a80a4], 0xffffffff
jne 0x18001dca5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x1800a80a0], eax
lea rcx, [0x1800a80a4]
call fcn.18004a7a0
jmp 0x18001dca5

Function at 0x18001dd30
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp dword [0x1800a82bc], edx
je 0x18001de36
mov ebp, edx
mov dword [0x1800a82bc], edx
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.18001b8f0
cmp byte [rdi + 8], 0
jne 0x18001de55
lea rdi, [rsp + 0x38]
mov r14, qword [rdi]
mov rcx, rdi
call fcn.18001b840
cmp byte [rdi + 8], 0
jne 0x18001de61
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], 0
mov rcx, rdi
mov rdx, rbx
call fcn.18001b9a0
lea rdx, str.Theme
mov r8d, 6
mov rcx, rdi
call fcn.18001bd10
mov dword [rsp + 0x34], ebp
cmp qword [rsp + 0x50], 8
mov rdx, rdi
jb 0x18001dde3
mov rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, r14
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rcx, rdi
call fcn.18001b7d0
mov al, 1
test ebp, ebp
jne 0x18001de80
mov byte [rsi + 5], al
test rbx, rbx
je 0x18001de27
mov rcx, rbx
call sym.mozglue.dll__aligned_free
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x18001de3a
jmp 0x18001de74
mov byte [rsi + 5], 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004bde0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
mov byte [rsi + 5], 0
jmp 0x18001de74
mov eax, dword [rsp + 0x38]
mov dword [rsi], eax
mov byte [rsi + 5], 0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x1800a82bc], 0
jmp 0x18001de3a
mov dword [rsi], 8
xor eax, eax
jmp 0x18001de17
Function at 0x18001fc10
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.MOZ_CRASHREPORTER_DISABLE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x18001fcc6
cmp word [0x1800a82e0], 0
jne 0x18001fcc1
lea rdx, [0x1800a82e0]
xor ecx, ecx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18001fcc1
cmp eax, 0x105
je 0x18001fcc1
lea rcx, [0x1800a82e0]
mov dx, 0x5c
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
je 0x18001fcc1
mov word [rax + 2], 0
lea rcx, [0x1800a82e0]
lea r8, str.mozwer.dll
mov edx, 0x105
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
jne 0x18001fcc1
mov eax, dword [sym.mozglue.dll_enum_GeckoProcessType_mozilla::startup::sChildProcessType]
mov dword [0x1800a84f0], eax
lea rdx, [0x1800a84f0]
lea rax, [sym.mozglue.dll_unsigned_long_long_unsigned___int64__gOOMAllocationSize]
mov qword [0x1800a84f8], rax
lea rcx, [0x1800a82e0]
call sub.KERNEL32.dll_WerRegisterRuntimeExceptionModule
test eax, eax
js 0x18001fcd1
add rsp, 0x28
ret
cmp byte [rax], 0
je 0x18001fc2a
jmp 0x18001fcc1
mov word [0x1800a82e0], 0
jmp 0x18001fcc1

Function at 0x180020450
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
call sub.ADVAPI32.dll_SystemFunction036
test al, al
setne al
add rsp, 0x28
ret

Function at 0x180020470
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1800204b2
mov rsi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004bde0
mov rax, rsi
add rsp, 0x30
pop rsi
ret
int3
Function at 0x18004f5e0
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov r14, rcx
mov rax, qword [str.LoadLibraryA]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [0x1800a82d4], 0
je 0x18004f61b
mov eax, dword [0x1800a82d0]
add eax, 0xfffffffb
cmp eax, 1
jbe 0x18004f750
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.18001b8f0
cmp byte [rsi + 8], 0
jne 0x18004f729
lea rdi, [rsp + 0x40]
mov r15, qword [rdi]
mov rcx, rdi
call fcn.18001b840
cmp byte [rdi + 8], 0
jne 0x18004f737
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], 0
mov rcx, rdi
mov rdx, rsi
call fcn.18001b9a0
lea rdx, str.Enabled
mov r8d, 8
mov rcx, rdi
call fcn.18001bd10
movzx eax, bl
mov dword [rsp + 0x3c], eax
cmp qword [rsp + 0x58], 8
mov rdx, rdi
jb 0x18004f6a1
mov rdx, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rcx, r15
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, eax
mov rcx, rdi
call fcn.18001b7d0
test ebp, ebp
jne 0x18004f745
cmp byte [0x1800a82b8], 0
jne 0x18004f6ea
test bl, bl
je 0x18004f6ea
lea rcx, [rsp + 0x40]
call fcn.18001bb10
mov byte [0x1800a82b8], bl
mov al, 1
mov byte [r14 + 5], al
test rsi, rsi
je 0x18004f703
mov rcx, rsi
call sym.mozglue.dll__aligned_free
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18004bde0
mov rax, r14
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov byte [r14 + 5], 0
jmp 0x18004f70c
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov byte [r14 + 5], 0
jmp 0x18004f703
mov dword [r14], 8
xor eax, eax
jmp 0x18004f6f2
mov dword [r14], 2
jmp 0x18004f730

Function at 0x180051ca0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
call fcn.18004c9d0
test al, al
je 0x180051d2c
test rdi, rdi
mov r8d, 1
cmovne r8, rdi
cmp rsi, 9
mov edx, 8
cmovae rdx, rsi
cmp r8, 0x1f1
jb 0x180051cea
mov rcx, qword [0x1800a66c8]
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.180007d50
mov eax, dword [0x1800a64f4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x180051cdf
mov rcx, qword [0x1800a66c8]
mov eax, dword [0x1800a64f4]
mov rdi, qword gs:[0x58]
mov rax, qword [rdi + rax*8]
mov qword [rax + 8], rcx
jmp 0x180051cdf
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret