joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444180
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44427c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x444198
cmp edx, ecx
jne 0x44426a
nop dword [rax]
test rsi, rsi
jne 0x44426a
mov qword [rsp + 0x20], rax
call fcn.00444080
mov rcx, qword [0x00a04068]
mov rdx, qword [0x00a04060]
mov rbx, qword [rsp + 0x20]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
nop dword [rax]
test edi, edi
jl 0x444265
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
nop dword [rax]
cmp rax, rsi
jbe 0x44425a
lea rax, [rdx + rsi*4]
lock or dword [rax], r9d
mov rax, qword [0x00a067f0]
mov qword [rbx + 8], rax
nop
mov qword [0x00a067f0], rbx
mov eax, 1
lea rcx, [0x00a067f8]
lock xadd dword [rcx], eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov rax, rsi
call fcn.00463140
call fcn.00434320
lea rax, [0x0078268a]
mov ebx, 0x23
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00444180
Function at 0x448b40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], r14
cmp dword [0x00a59cf4], 0
je 0x448b7f
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.004319e0
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov dword [0x00a59cf4], 1
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.00437600
lea rax, [0x007734ea]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00437f00
mov rax, qword [rsp + 0x38]
call fcn.00437d60
call fcn.00437820
mov rax, qword [rsp + 0x30]
call fcn.00437d60
nop
call fcn.00437820
mov rax, qword [rsp + 0x28]
call fcn.00437d60
call fcn.00437820
mov rax, qword [rsp + 0x20]
call fcn.00437d60
nop
call fcn.00437860
call fcn.00437680
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.00437600
lea rax, [0x00771807]
mov ebx, 3
call fcn.00437f00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437d60
call fcn.00437860
call fcn.00437680
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp byte [rcx + 0xe8], 0
nop
je 0x448ccd
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x448cd2
cmp qword [rcx + 0x90], 0
je 0x448cd2
cmp byte [0x00a59c42], 0
je 0x448cc0
nop
call fcn.00437600
lea rax, [0x00786ab8]
mov ebx, 0x2e
call fcn.00437f00
call fcn.00437680
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x90]
jmp 0x448cd5
mov rdx, qword [rsp + 0x70]
mov rcx, rdx
mov qword [rsp + 0x40], rcx
call fcn.00437600
nop
call fcn.00437860
call fcn.00437680
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 1
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x009a5608]
mov rdx, qword [r14 + 0x30]
movzx edx, byte [rdx + 0xf9]
shr eax, 2
test dl, dl
cmovne eax, edx
test eax, eax
jle 0x448d5e
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
call fcn.00457ee0
mov rax, qword [rsp + 0x40]
call fcn.00458e60
mov rax, qword [rsp + 0x68]
call fcn.004076e0
mov eax, 2
call fcn.004319e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x44ca80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0xb8]
cmp r12, qword [r14 + 0x10]
jbe 0x44cba6
sub rsp, 0x138
mov qword [rsp + 0x130], rbp
lea rbp, [rsp + 0x130]
lea rdi, [rsp + 0x20]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004633eb
mov rbp, qword [rbp]
lea rcx, [0x0074c780]
mov qword [rsp + 0x10], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + 0x17]
test dl, 0x40
jne 0x44cb90
lea rdx, [0x00a5a110]
lea rax, [0x009b1080]
jmp 0x44cb12
mov rax, qword [rax + 0x220]
test rax, rax
je 0x44cb34
nop word [rax + rax]
cmp qword [rax + 0x130], rdx
ja 0x44cb0b
cmp qword [rax + 0x100], rdx
jbe 0x44cb0b
jmp 0x44cb36
xor eax, eax
test rax, rax
je 0x44cb7f
mov rdx, qword [rcx]
lea rbx, [rdx + 7]
and rbx, 0xfffffffffffffff8
neg ebx
mov rsi, qword [rcx + 8]
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rax + 0x128]
mov dword [0x00a5a110], ebx
mov dword [0x00a5a114], edx
mov dword [0x00a5a118], esi
mov dword [0x00a5a11c], ecx
mov rbp, qword [rsp + 0x130]
add rsp, 0x138
ret
lea rax, [0x0078594b]
mov ebx, 0x2b
call fcn.00435e60
lea rax, [0x00789c4c]
mov ebx, 0x3d
nop dword [rax]
call fcn.00435e60
nop
call fcn.00460a60
jmp fcn.0044ca80
Function at 0x450980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450af8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x4509bc
test r8b, r8b
jne 0x4509bc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x4509cf
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x450ab8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x450aa6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x450a9c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x450a23
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x450a66
mov eax, 1
cmp rax, rbx
ja 0x450a55
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00463200
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x450a94
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x450a5d
mov r8d, eax
mov eax, r10d
jmp 0x450a28
mov rcx, rbx
call fcn.00463140
xor eax, eax
mov rcx, rbx
call fcn.00463140
mov eax, r8d
mov rcx, rbx
call fcn.00463200
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x450aee
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x450ab1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4509d5
mov eax, edx
mov rcx, rbx
call fcn.00463140
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00463140
nop
int3
Function at 0x4515c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4516ef
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp qword [rax + 8], 0
nop dword [rax]
jle 0x4516dd
cmp qword [rax + 0x10], 0
jl 0x4516cc
cmp dword [rax + 0x40], 0
jne 0x4516bb
mov qword [rsp + 0x48], rax
mov dword [rax + 0x40], 1
mov qword [rsp + 0x28], r14
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x10], rdx
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp + 0x30], rcx
test byte [rcx], al
lea rbx, [rcx + 0x2278]
mov qword [rsp + 0x20], rbx
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi + 0x30]
mov qword [rsp + 0x18], rsi
nop
mov rax, rbx
call fcn.0040b300
mov rax, qword [rsp + 0x30]
call fcn.00452460
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
call fcn.00451720
nop
nop
mov rax, qword [rsp + 0x20]
call fcn.0040b520
mov rax, qword [rsp + 0x10]
nop
call fcn.0043e260
nop
mov rcx, qword [rsp + 0x18]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x4516b1
cmp byte [r14 + 0xb1], 0
je 0x4516b1
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x0078386a]
mov ebx, 0x26
call fcn.00435e60
lea rax, [0x00781865]
mov ebx, 0x21
call fcn.00435e60
lea rax, [0x0077e40a]
mov ebx, 0x1b
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
nop
jmp fcn.004515c0
Function at 0x451720
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45188a
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
cmp dword [0x00a59ce4], 0
jne 0x45175a
call fcn.0042efa0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x451878
nop
mov rdx, rax
mov qword [rbx], rax
test byte [rdx], al
mov rdi, qword [rdx + 0x2288]
mov r8, qword [rdx + 0x2280]
mov r9, qword [rdx + 0x2290]
lea rsi, [rdi + 1]
cmp r9, rsi
jb 0x451792
mov rax, rdi
jmp 0x4517e7
mov qword [rsp + 0x40], rdi
lea rax, [0x00707f00]
mov rbx, r8
mov rcx, rdi
mov rdi, r9
call fcn.004493e0
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x2290], rcx
cmp dword [0x00a5a130], 0
nop
jne 0x4517cb
mov qword [rdx + 0x2280], rax
jmp 0x4517d7
lea rdi, [rdx + 0x2280]
call fcn.00462ca0
mov rdi, rbx
mov r8, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
lea rsi, [rdi + 1]
mov qword [rdx + 0x2288], rsi
lea rsi, [r8 + rdi*8]
cmp dword [0x00a5a130], 0
jne 0x451805
mov qword [r8 + rdi*8], rbx
jmp 0x45180d
mov rdi, rsi
call fcn.00462de0
mov rsi, qword [rdx + 0x2280]
mov rbx, qword [rdx + 0x2288]
mov rcx, qword [rdx + 0x2290]
mov rdi, rax
mov rax, rsi
call fcn.004536a0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 0x2288]
mov rsi, qword [rdx + 0x2280]
test rcx, rcx
jbe 0x451871
mov rax, qword [rsp + 0x60]
cmp qword [rsi], rax
jne 0x45185a
mov rax, qword [rax + 8]
xchg qword [rdx + 0x1208], rax
mov eax, 1
lock xadd dword [rdx + 0x2298], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
call fcn.00463140
lea rax, [0x00781cfd]
mov ebx, 0x22
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00451720
Function at 0x458760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45881b
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00458860]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00460920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00458760
Function at 0x459a80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459ce6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x459aa9
mov dword [rsp + 0x60], ebx
lea rcx, [0x009b1080]
jmp 0x459ac0
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x220]
nop dword [rax]
test rcx, rcx
je 0x459af7
mov rdx, qword [rcx + 0x118]
cmp rax, rdx
jb 0x459ab5
mov rsi, qword [rcx + 0x120]
cmp rax, rsi
jae 0x459ab5
movsxd rcx, ebx
lea rax, [rdx + rcx]
cmp rsi, rax
jb 0x459c56
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
nop
nop
nop
lea rax, [0x00a04180]
call fcn.0040b300
mov rbx, qword [0x00a04190]
lea rax, [0x0071e740]
mov ecx, dword [rsp + 0x60]
nop dword [rax]
call fcn.004105c0
mov byte [rsp + 0x1f], bl
mov rcx, qword [rax]
mov qword [rsp + 0x38], rcx
nop
nop
nop
lea rax, [0x00a04180]
nop dword [rax + rax]
call fcn.0040b520
movzx ecx, byte [rsp + 0x1f]
test cl, cl
jne 0x459bb6
call fcn.00437600
lea rax, [0x00777934]
mov ebx, 0x11
nop
call fcn.00437f00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00437d60
lea rax, [0x00771e41]
mov ebx, 6
nop dword [rax]
call fcn.00437f00
mov rax, qword [rsp + 0x20]
call fcn.00437d60
lea rax, [0x0077669e]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00437f00
call fcn.00437680
lea rax, [0x009b1080]
jmp 0x459c40
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x40], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x30], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x28], rdx
call fcn.00437600
lea rax, [0x00772514]
mov ebx, 7
call fcn.00437f00
mov rax, qword [rsp + 0x30]
nop dword [rax]
call fcn.00437d60
lea rax, [0x007726ba]
mov ebx, 8
call fcn.00437f00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00437d60
call fcn.00437860
call fcn.00437680
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x220]
nop dword [rax + rax]
test rax, rax
jne 0x459bc5
lea rax, [0x00786a00]
mov ebx, 0x2e
call fcn.00435e60
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
call fcn.00437600
lea rax, [0x00777934]
mov ebx, 0x11
call fcn.00437f00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
nop dword [rax]
call fcn.00437d60
lea rax, [0x00775439]
mov ebx, 0xe
call fcn.00437f00
mov rax, qword [rsp + 0x30]
nop dword [rax + rax]
call fcn.00437d60
lea rax, [0x007716c0]
mov ebx, 3
call fcn.00437f00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00437d60
call fcn.00437860
call fcn.00437680
lea rax, [0x0078171b]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.00459a80
Function at 0x459d20
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459fab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test ebx, ebx
je 0x459d4e
nop dword [rax]
cmp ebx, 0xffffffff
je 0x459d4e
lea rcx, [0x009b1080]
jmp 0x459d61
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, qword [rcx + 0x220]
test rcx, rcx
je 0x459d7a
cmp qword [rcx + 0x118], rax
ja 0x459d5a
cmp qword [rcx + 0x120], rax
jbe 0x459d5a
jmp 0x459d7c
xor ecx, ecx
mov dword [rsp + 0x60], ebx
test rcx, rcx
je 0x459de8
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx + 0x210]
lea rax, [0x0071f220]
mov esi, ebx
mov rbx, rdx
mov ecx, esi
nop
call fcn.00410420
mov rax, qword [rax]
test rax, rax
jne 0x459dde
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x118]
mov ebx, dword [rsp + 0x60]
movsxd rsi, ebx
lea rax, [rdx + rsi]
mov rcx, qword [rcx + 0x120]
cmp rcx, rax
jb 0x459f25
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x18], rax
nop
nop
nop
lea rax, [0x00a04180]
call fcn.0040b300
mov rbx, qword [0x00a04190]
lea rax, [0x0071e740]
mov ecx, dword [rsp + 0x60]
call fcn.00410420
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x00a04180]
call fcn.0040b520
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x459e93
call fcn.00437600
lea rax, [0x00777978]
mov ebx, 0x11
call fcn.00437f00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00437d60
lea rax, [0x00771e41]
mov ebx, 6
call fcn.00437f00
mov rax, qword [rsp + 0x18]
call fcn.00437d60
lea rax, [0x0077669e]
mov ebx, 0x10
nop dword [rax]
call fcn.00437f00
call fcn.00437680
lea rax, [0x009b1080]
jmp 0x459f0b
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x20], rdx
call fcn.00437600
lea rax, [0x00772514]
mov ebx, 7
call fcn.00437f00
mov rax, qword [rsp + 0x28]
call fcn.00437d60
lea rax, [0x007726ba]
mov ebx, 8
call fcn.00437f00
mov rax, qword [rsp + 0x20]
call fcn.00437d60
call fcn.00437860
call fcn.00437680
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x220]
test rax, rax
jne 0x459e9d
lea rax, [0x00786a8a]
mov ebx, 0x2e
nop dword [rax]
call fcn.00435e60
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
call fcn.00437600
lea rax, [0x00777978]
mov ebx, 0x11
call fcn.00437f00
mov eax, dword [rsp + 0x60]
movsxd rax, eax
call fcn.00437d60
lea rax, [0x00775439]
mov ebx, 0xe
nop dword [rax]
call fcn.00437f00
mov rax, qword [rsp + 0x28]
call fcn.00437d60
lea rax, [0x007716c0]
mov ebx, 3
nop dword [rax + rax]
call fcn.00437f00
mov rax, qword [rsp + 0x20]
call fcn.00437d60
call fcn.00437860
call fcn.00437680
lea rax, [0x0078175d]
mov ebx, 0x21
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.00459d20
Function at 0x459fe0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a1bb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp ebx, 0xffffffff
je 0x45a006
lea rcx, [0x009b1080]
jmp 0x45a020
lea rax, [0x0040b060]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [rcx + 0x220]
nop
test rcx, rcx
je 0x45a039
cmp qword [rcx + 0x118], rax
ja 0x45a017
cmp qword [rcx + 0x120], rax
jbe 0x45a017
jmp 0x45a040
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
jne 0x45a111
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x58], ebx
nop
nop
nop
lea rax, [0x00a04180]
nop dword [rax]
call fcn.0040b300
mov rbx, qword [0x00a04190]
lea rax, [0x0071e740]
mov ecx, dword [rsp + 0x58]
call fcn.00410420
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
nop
nop
nop
lea rax, [0x00a04180]
call fcn.0040b520
mov rax, qword [rsp + 0x30]
test rax, rax
jne 0x45a107
nop dword [rax]
call fcn.00437600
lea rax, [0x00777967]
mov ebx, 0x11
call fcn.00437f00
mov eax, dword [rsp + 0x58]
movsxd rax, eax
nop dword [rax]
call fcn.00437d60
lea rax, [0x00771e41]
mov ebx, 6
call fcn.00437f00
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00437d60
lea rax, [0x0077669e]
mov ebx, 0x10
call fcn.00437f00
call fcn.00437680
lea rax, [0x009b1080]
jmp 0x45a1a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
call fcn.0044f500
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 0x38], rax
mov rcx, qword [rax + 0x118]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x120]
mov qword [rsp + 0x20], rdx
call fcn.00437600
lea rax, [0x00772514]
mov ebx, 7
call fcn.00437f00
mov rax, qword [rsp + 0x28]
nop dword [rax + rax]
call fcn.00437d60
lea rax, [0x007726ba]
mov ebx, 8
call fcn.00437f00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437d60
call fcn.00437860
call fcn.00437680
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x220]
nop dword [rax + rax]
test rax, rax
jne 0x45a123
lea rax, [0x00786a5c]
mov ebx, 0x2e
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.00459fe0
Function at 0x45c020
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c21b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax + 0x30]
cmp qword [rdx + 0x18], 0
je 0x45c209
mov rsi, qword [rdx]
cmp rsi, 0x80
jbe 0x45c079
mov edi, dword [rax + 0x54]
bt edi, 0
nop word [rax + rax]
jae 0x45c1f8
cmp byte [rax + 0x50], 8
jne 0x45c1f8
cmp rsi, 0x80
ja 0x45c090
mov edi, dword [rax + 0x54]
bt edi, 0
jb 0x45c1f8
cmp byte [rax + 0x50], sil
jne 0x45c1f8
mov rdi, qword [rax + 0x38]
mov r8, qword [rdi]
nop word [rax + rax]
cmp r8, 0x80
jbe 0x45c0cf
mov r9d, dword [rax + 0x54]
bt r9d, 1
jae 0x45c1e7
cmp byte [rax + 0x51], 8
nop dword [rax]
jne 0x45c1e7
cmp r8, 0x80
ja 0x45c0ea
mov r9d, dword [rax + 0x54]
bt r9d, 1
jb 0x45c1e7
nop
cmp byte [rax + 0x51], r8b
jne 0x45c1e7
movzx edx, byte [rdx + 0x15]
cmp dl, 8
ja 0x45c1d6
movzx edi, byte [rdi + 0x15]
nop dword [rax + rax]
cmp dil, 8
ja 0x45c1c5
test rdx, rdx
je 0x45c1c0
mov rcx, rax
mov rax, rsi
mov r9d, edx
xor edx, edx
div r9
test rdx, rdx
jne 0x45c1ac
test rdi, rdi
je 0x45c1a7
mov rax, r8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45c196
mov eax, 8
xor edx, edx
div r9
test rdx, rdx
jne 0x45c185
mov eax, 8
xor edx, edx
div rdi
test rdx, rdx
jne 0x45c16f
mov rax, rcx
xor ecx, ecx
nop
call fcn.0040dfc0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0077f38a]
mov ebx, 0x1d
nop dword [rax + rax]
call fcn.00435e60
lea rax, [0x0077eb3b]
mov ebx, 0x1c
call fcn.00435e60
lea rax, [0x007839c0]
mov ebx, 0x26
call fcn.00435e60
call fcn.00434380
lea rax, [0x00782ca6]
mov ebx, 0x24
call fcn.00435e60
nop dword [rax]
call fcn.00434380
lea rax, [0x007781c7]
mov ebx, 0x12
call fcn.00435e60
lea rax, [0x007777cf]
mov ebx, 0x11
call fcn.00435e60
lea rax, [0x00776471]
mov ebx, 0xf
call fcn.00435e60
lea rax, [0x00775b8d]
mov ebx, 0xe
call fcn.00435e60
lea rax, [0x00787a27]
mov ebx, 0x31
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045c020