joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021bb0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140063b04]
mov ecx, dword [0x1400614b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140021c00
mov esi, dword [0x140063b00]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002b660
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140063b04]
call fcn.14002a4ec
cmp dword [0x140063b04], 0xffffffff
jne 0x140021be5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x28]
mov dword [0x140063b00], eax
lea rcx, [0x140063b04]
call fcn.14002a48c
jmp 0x140021be5
Function at 0x140027220
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r9d
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov bpl, byte [rsp + 0x88]
mov r12d, dword [rsp + 0x80]
mov eax, dword [0x140061db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x1400272a4
cmp byte [0x140061db4], 1
jne 0x1400272a4
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x140027288
call fcn.14002ae28
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x10]
jmp 0x1400272a9
call fcn.140025bd0
mov qword [rsi], rax
lea rdi, [rsi + 8]
xor eax, eax
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
mov dword [rsi + 0x14], ebx
lea rcx, [rsi + 0x18]
mov qword [rsi + 0x20], rax
mov rdx, qword gs:[0x30]
mov edx, dword [rdx + 0x48]
mov dword [rsi + 0x28], edx
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
lea rbx, [rsi + 0x40]
movups xmm1, xmmword [r15]
movups xmmword [rsi + 0x40], xmm1
mov dword [r15], 0
mov qword [r15 + 8], rax
mov qword [rsi + 0x50], r14
movups xmmword [rsi + 0x60], xmm0
mov qword [rsi + 0x58], 8
mov dword [rsi + 0x70], r12d
mov byte [rsi + 0x74], bpl
call sub.ntdll.dll_RtlQueryPerformanceCounter
mov eax, dword [0x140061db0]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
jne 0x14002732d
mov rcx, rsi
call fcn.140023a40
jmp 0x140027388
cmp byte [0x140061db4], 1
je 0x14002734d
mov rax, qword gs:[0x30]
cmp qword [rax + 0x58], 0
je 0x1400273b8
mov byte [0x140061db4], 1
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 8], 0
jne 0x14002736e
call fcn.14002ae28
mov eax, dword [0x1400614b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 0x10], rsi
lea rcx, [0x140061060]
mov rax, qword [0x140061060]
mov rax, qword [rax + 0x40]
mov rdx, rdi
mov r8, rbx
call qword [0x140067010]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
mov dword [0x140061db0], eax
jmp 0x140027323
Function at 0x14002cef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x160], rax
test dl, dl
je 0x14002d0e0
lea rax, str.TargetNtMapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rdi, [0x1400540c0]
lea r8, [0x140055760]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.140009710
lea rax, str.TargetNtUnmapViewOfSection64
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, [0x14005574b]
mov rcx, rsi
mov rdx, rdi
mov r9d, 1
call fcn.140009710
mov rax, qword [rsi]
mov rdi, qword [rax]
mov dword [rsp + 0x20], 1
mov r13, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8d, 0x10000
mov rcx, rdi
xor edx, edx
mov r9d, 0x2000
call r13
mov r14, rax
mov r12, qword [rsi + 0x10]
shl r12, 6
lea rbx, [r12 + 0x60]
mov rcx, rbx
call fcn.14000a510
mov r15, rax
mov edx, r15d
and edx, 0xfffff000
add rdx, r14
and r15d, 0xfff
add r12, 0x105f
and r12, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, rdi
mov r8, r12
mov r9d, 0x1000
call r13
mov r14, rax
test rax, rax
je 0x14002d0ef
add r14, r15
lea r15, [rsp + 0x48]
mov qword [r15], rbx
mov dword [r15 + 0x18], 0
mov qword [r15 + 8], 0x20
lea rcx, [sym.firefox.exe_g_originals]
mov r8d, 0x158
xor edx, edx
call sub.ntdll.dll_memset
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9, r15
call fcn.14000bc00
test eax, eax
jne 0x14002d0b8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov r9d, 0x20
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, 0x2a
test eax, eax
je 0x14002d0ba
cmp qword [rsp + 0x40], 0x20
jne 0x14002d0ba
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8, rbx
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsi]
lea rdx, str.g_originals
lea r8, [sym.firefox.exe_g_originals]
mov r9d, 0x158
call fcn.14000b460
mov ebp, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14002b660
mov eax, ebp
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [rsi + 0x10], 0
jne 0x14002cf7f
xor ebp, ebp
jmp 0x14002d0ba
lea r12, [rsp + 0x50]
mov dword [r12 - 8], 3
mov rcx, r12
call fcn.140022f80
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_sandbox_win_src_interception.cc
mov qword [r12 + 0xf0], rax
mov dword [r12 + 0xf8], 0x188
lea rcx, [rsp + 0x158]
call fcn.14003b240
lea rcx, [rsp + 0x48]
call fcn.1400393c0
jmp 0x14002d007
Function at 0x14002d460
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14002d4a2
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.140022f80
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.14003b240
lea rcx, [rsp + 0x20]
call fcn.1400393c0
jmp 0x14002d488
Function at 0x14002ed10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov r15, qword [rcx]
mov r14, qword [r15 + 0x40]
lea rbx, [r14 + 2]
call fcn.140015580
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
jne 0x14002eda4
mov rcx, qword [rdi]
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x40]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140015200
mov rax, qword [r15]
mov rcx, qword [rax]
mov rdx, rbx
call fcn.140033a90
mov rcx, qword [rdi]
test al, al
jne 0x14002ed4f
mov rax, qword [rcx]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14002f450
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
je 0x14002f4ee
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14002f4a0
mov rcx, rdi
call fcn.140018970
mov rcx, rdi
call fcn.140050b00
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x14002f511
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x14002f4b8
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
jne 0x14002f555
lea rcx, [rsi + 0x28]
call fcn.140008b30
lea rcx, [rsi + 0x20]
call fcn.140008b30
lea rcx, [rsi + 0x18]
call fcn.140008b30
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140008ee0
test rcx, rcx
jne 0x14002f466
cmp dword [rsi + 0x14], 0
jne 0x14002f466
cmp qword [rsi + 8], 0
jne 0x14002f466
jmp 0x14002f47f
mov rdx, qword [rsi + 0x68]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14002f539
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14002f56a
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x58]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x14002f4a9
mov rcx, rdi
call fcn.140018970
mov rcx, rdi
call fcn.140050b00
jmp 0x14002f4c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140030c50
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140030ca2
call fcn.140030db0
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov rcx, rax
mov rax, rdx
call qword [0x140067010]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [0x1400522c0]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140063a80], 0
jne 0x140030ce0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140063a80], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140063ad0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140063a60]
mov qword [r8 + 8], rsi
lea rax, [0x140055eeb]
mov qword [r8 + 0x10], rax
lea rax, [0x140050a00]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140063ad8]
lea rdx, [0x140050060]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140030c76
cmp qword [rsp + 0x28], 0
je 0x140030c76
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140063ae0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x140055edb]
mov qword [r8 + 0x10], rax
lea rax, [0x140050a40]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140063ae8]
lea rdx, [0x140050060]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x140030c76
cmp qword [rsp + 0x28], 0
jne 0x140030c8e
jmp 0x140030c76

Function at 0x140031200
Capabilities:
Delete registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x20]
mov rdx, rbx
call fcn.140031300
cmp byte [rbx + 0x10], 0
jne 0x14003123a
cmp dword [rsp + 0x20], 2
je 0x1400312eb
mov rcx, rdi
call fcn.14001da20
cmp qword [rax + 0x18], 8
jb 0x14003124c
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x1400312b3
mov rcx, rdi
call fcn.14001d940
cmp qword [rax + 0x18], 8
jb 0x140031270
mov rax, qword [rax]
mov rcx, qword [rdi + 0x20]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, 2
jne 0x1400312b9
lea rax, [rdi + 0x10]
cmp byte [rdi + 0x18], 0
jne 0x1400312e5
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
xor eax, eax
mov byte [0x140061d34], al
mov byte [rsi + 0x10], al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
test eax, eax
je 0x14003125e
jmp 0x1400312bd
test eax, eax
je 0x140031282
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x87
mov dword [rsi + 0xc], ecx
jmp 0x14003129d
mov byte [rdi + 0x18], 0
jmp 0x14003128c
mov byte [rsi + 0x10], 0
jmp 0x14003129d
Function at 0x140032980
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x10048
call fcn.14002b600
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x10040], rax
lea r8, [rsp + 0x38]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140032a0c
lea rdi, [rsp + 0x40]
lea rbx, [rsp + 0x34]
mov r14, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x10000
mov r9, rbx
call r14
test eax, eax
je 0x1400329f8
cmp dword [rsp + 0x34], 0x10000
je 0x1400329cf
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x10048
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140033ea0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x228
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x220], rax
lea rbx, [rsp + 0x38]
mov rcx, rbx
call fcn.14001d4f0
lea rdx, [rsp + 0x138]
mov rcx, rbx
call fcn.140034040
lea rbx, [rsp + 0x138]
mov rcx, rbx
call fcn.14001d4f0
lea r14, [rsp + 0x120]
mov rcx, rbx
mov rdx, r14
call fcn.1400340c0
cmp byte [r14 + 0x10], 0
jne 0x140033fc5
cmp byte [rsp + 0x120], 0
je 0x140033fc5
lea rcx, str.MOZ_DISABLE_POISON_IO_INTERPOSER1
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov ecx, 0x38
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
xor r12d, r12d
mov ecx, 8
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbx + 0x10], rax
lea r14, [rbx + 0x18]
test rdi, rdi
lea r15, [0x140056e6a]
cmovne r15, rdi
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x28], r12
mov qword [rbx + 0x30], 0xf
mov byte [rbx + 0x18], 0
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.140001080
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x10000
lea r8, [0x140034170]
xor ecx, ecx
xor edx, edx
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
jne 0x140034006
lea rcx, [rsp + 0x30]
call fcn.140035ff0
lea rcx, [rsp + 0x138]
call fcn.14001eb10
mov rcx, rsi
call fcn.140036080
lea rcx, [rsp + 0x38]
call fcn.14001eb10
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x228
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rsi, [rsp + 0x30]
mov qword [rsi], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140035ff0
lea rcx, [rsp + 0x138]
call fcn.14001eb10
jmp 0x140033fda
Function at 0x140036080
Capabilities:
Access the windows event log

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
lea rdx, str.Firefox_Launcher
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test rax, rax
je 0x140036140
mov rsi, rax
mov rcx, qword [rdi]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r15, rax
lea r14, [rax + 8]
mov rcx, r14
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rbx, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.ntdll.dll_memset
mov ebp, dword [rdi + 0xc]
mov dword [rbx], ebp
mov eax, dword [rdi + 8]
mov dword [rbx + 4], eax
lea rcx, [rbx + 8]
mov rdx, qword [rdi]
mov r8, r15
call sub.ntdll.dll_memcpy
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r12
mov word [rsp + 0x28], 0
mov rcx, rsi
mov dx, 1
xor r8d, r8d
mov r9d, ebp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400363d0
Capabilities:
Get token membership
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdi, [rsp + 0x3c]
mov dword [rdi], 0x44
lea r8, [rsp + 0x40]
mov ecx, 0x1a
xor edx, edx
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x1400364a8
lea rbx, [rsp + 0x40]
lea r8, [rsp + 0x38]
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x1400364f1
cmp dword [rsp + 0x38], 0
je 0x14003650c
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea r8, str.EnableLUA
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140036515
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x26
jmp 0x1400364d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x14
mov byte [rsi + 0x10], 1
lea rdx, str._builds_worker_checkouts_gecko_toolkit_xre_WinTokenUtils.cpp
mov qword [rsi], rdx
mov dword [rsi + 8], eax
mov dword [rsi + 0xc], ecx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x19
jmp 0x1400364c1
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
jmp 0x1400364d5
cmp dword [rsp + 0x3c], 0
mov byte [rsi + 0x10], 0
sete byte [rsi]
jmp 0x1400364d5
Function at 0x140036940
Capabilities:
Delete file

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp byte [rcx + 9], 0
je 0x1400369b8
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140036962
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x28]
cmp rax, 8
jb 0x14003699c
mov rcx, qword [rsi + 0x10]
inc rax
movabs rdx, 0x7ffffffffffff800
test rax, rdx
je 0x140036996
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400369f0
mov rcx, rax
call qword [sym.imp.mozglue.dll_free]
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x28], 7
mov word [rsi + 0x10], 0
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsi + 0x30]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400369cc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x30], 0
cmp qword [rsi + 0x28], 8
jb 0x1400369e1
mov rcx, qword [rsi + 0x10]
jmp 0x1400369e5
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14003694e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140037250
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 4
cmp qword [r8 + 0x18], 8
jb 0x140037279
mov r8, qword [r8]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400372d0
cmp dword [rsp + 0x3c], 4
jne 0x1400372e2
mov eax, dword [rsp + 0x44]
mov byte [rsi + 0x10], 0
bts rax, 0x20
mov qword [rsi], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x50
pop rsi
ret
cmp eax, 2
jne 0x140037300
mov byte [rsi + 0x10], 0
mov qword [rsi], 0
jmp 0x1400372bc
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
movabs rax, 0x8007065d00000043
mov qword [rsi + 8], rax
jmp 0x1400372bc
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x3f
mov dword [rsi + 0xc], ecx
jmp 0x1400372bc

Function at 0x140037330
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
cmp qword [r8 + 0x18], 8
jb 0x14003735b
mov r8, qword [r8]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 8
xor edi, edi
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
mov r9d, 0xb
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400373ad
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea rax, str._builds_worker_checkouts_gecko_toolkit_xre_LauncherRegistryInfo.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x79
mov dword [rsi + 0xc], ecx
mov dil, 1
mov byte [rsi + 0x10], dil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140037fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x140061030]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea r12, [rsp + 0x48]
mov dword [r12], 0
mov qword [rsp + 0x30], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, r14
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140038021
cmp eax, 2
jne 0x1400380a3
xor eax, eax
mov byte [rsi + 0x10], al
mov byte [rsi], al
jmp 0x1400380c9
mov r15d, dword [rsp + 0x48]
add r15, r15
mov rcx, r15
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.ntdll.dll_memset
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, r14
mov r8, rbx
mov r9d, 0x10002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400380e8
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x68
mov dword [rsi + 0xc], ecx
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
jmp 0x1400380c9
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov byte [rsi + 0x10], 1
lea rax, str._builds_worker_checkouts_gecko_browser_app_winlauncher_LaunchUnelevated.cpp
mov qword [rsi], rax
mov dword [rsi + 8], 0x5c
mov dword [rsi + 0xc], ecx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14002b660
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movaps xmm0, xmmword [str.RUNASADMIN]
movaps xmmword [rsp + 0x50], xmm0
movabs rax, 0x4e0049004d
mov qword [rsp + 0x5e], rax
lea rdx, [rsp + 0x4c]
mov dword [rdx], 0x20
lea r8, [rsp + 0x40]
mov qword [r8], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
test rax, rax
je 0x14003816c
lea rbx, [rsp + 0x50]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
lea r14, [rsp + 0x4c]
lea r15, [rsp + 0x40]
mov r13, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov r8d, 0xb
mov rcx, rax
mov rdx, rbx
call r12
test eax, eax
je 0x14003817a
xor ebp, ebp
xor ecx, ecx
mov rdx, r14
mov r8, r15
call r13
test rax, rax
jne 0x140038145
jmp 0x14003816e
xor ebp, ebp
mov byte [rsi + 0x10], 0
mov byte [rsi], bpl
jmp 0x140038098
mov bpl, 1
jmp 0x14003816e