joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427f80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4280cb
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx + 0x10]
nop dword [rax]
cmp rax, rcx
jne 0x427ff1
cmp qword [rax], rbx
jne 0x427fb2
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x427fc0
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
nop dword [rax]
cmp qword [rax + 8], rbx
jne 0x427fd0
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x427fdb
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call fcn.00438580
lea rax, [0x007b51cf]
mov ebx, 0x2d
call fcn.00438e80
mov rax, qword [rsp + 0x18]
call fcn.00438b80
lea rax, [0x007a49b2]
mov ebx, 6
nop
call fcn.00438e80
mov rax, qword [rsp + 0x40]
call fcn.00438e40
lea rax, [0x007a49ac]
mov ebx, 6
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x10]
call fcn.00438e40
lea rax, [0x007a7e60]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x20]
call fcn.00438e40
lea rax, [0x007a4994]
mov ebx, 6
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438e40
call fcn.004387e0
call fcn.00438600
lea rax, [0x007aa3f5]
mov ebx, 0x10
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00427f80

Function at 0x428100
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4281e6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rcx
test rcx, rcx
jne 0x428161
cmp qword [rbx + 8], 0
jne 0x428161
cmp qword [rbx + 0x10], 0
jne 0x428161
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rcx, qword [rax]
nop dword [rax]
test rcx, rcx
je 0x42814b
mov qword [rcx + 8], rbx
jmp 0x42814f
mov qword [rax + 8], rbx
mov qword [rax], rbx
mov qword [rbx + 0x10], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov qword [rsp + 0x40], rbx
mov rax, qword [rbx + 8]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x10], rcx
call fcn.00438580
lea rax, [0x007b1956]
mov ebx, 0x21
call fcn.00438e80
mov rax, qword [rsp + 0x40]
call fcn.00438e40
call fcn.004387a0
mov rax, qword [rsp + 0x20]
call fcn.00438e40
call fcn.004387a0
mov rax, qword [rsp + 0x18]
call fcn.00438e40
call fcn.004387a0
mov rax, qword [rsp + 0x10]
call fcn.00438e40
call fcn.004387e0
call fcn.00438600
lea rax, [0x007aa3e5]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00428100
Function at 0x428220
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42842a
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
call fcn.00426000
test rax, rax
je 0x428418
mov qword [rsp + 0x18], rax
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x28], rcx
call fcn.00423bc0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x18]
sub rcx, qword [rdx + 0x18]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rbx + 0xa]
mov byte [rsp + 0x17], sil
lea rax, [rdx + 0x78]
mov qword [rsp + 0x30], rax
nop
call fcn.0040c2a0
mov rcx, qword [rsp + 0x18]
lea rdx, [rcx + 0x80]
movzx ebx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x20]
jmp 0x4282b9
mov rdx, rdi
mov rdi, qword [rdx]
nop dword [rax]
test rdi, rdi
je 0x42832b
movzx r8d, word [rdi + 8]
cmp r8, rsi
jne 0x4282d7
cmp byte [rdi + 0xa], bl
je 0x4282e7
cmp r8, rsi
ja 0x42832b
jne 0x4282b6
nop dword [rax + rax]
cmp byte [rdi + 0xa], bl
jbe 0x4282b6
jmp 0x42832b
nop
nop
mov rax, qword [rsp + 0x30]
call fcn.0040c4c0
nop
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x42831f
cmp byte [r14 + 0xb1], 0
je 0x42831f
mov qword [r14 + 0x10], 0xfffffffffffffade
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbx, qword [rsp + 0x50]
mov word [rbx + 8], si
mov rsi, qword [rdx]
mov qword [rbx], rsi
mov qword [rdx], rbx
nop
nop
mov rax, qword [rcx + 0x18]
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop word [rax + rax]
cmp rdx, 0x40
jae 0x42840b
lea rsi, [0x009b7db8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
shr rax, 0xd
mov rcx, rax
and rax, 0x1ff
shr rax, 3
cmp rax, 0x40
jae 0x428401
lea rdx, [rdx + rax]
lea rdx, [rdx + 0x21080]
and rcx, 7
mov ebx, 1
shl ebx, cl
lock or byte [rdx], bl
nop
nop
mov rax, qword [rsp + 0x30]
nop
call fcn.0040c4c0
nop
mov rdx, qword [rsp + 0x28]
mov ebx, dword [rdx + 0xd8]
lea esi, [rbx - 1]
mov dword [rdx + 0xd8], esi
cmp ebx, 1
jne 0x4283f1
cmp byte [r14 + 0xb1], 0
je 0x4283f1
mov qword [r14 + 0x10], 0xfffffffffffffade
mov eax, 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
mov ecx, 0x40
call fcn.00464640
mov rax, rdx
mov ecx, 0x40
call fcn.00464640
lea rax, [0x007afe63]
mov ebx, 0x1d
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00428220
Function at 0x428920
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4289aa
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x18], rax
nop
lea rax, [0x009be7c8]
call fcn.0040c2a0
lea rax, [0x009be738]
call fcn.00419d00
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x009be7c8]
call fcn.0040c4c0
mov rbx, qword [rsp + 0x10]
mov byte [rbx + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rax, qword [rsp + 0x18]
call fcn.00428220
test al, al
je 0x428998
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x007b3092]
mov ebx, 0x25
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00428920

Function at 0x428f40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x428fed
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [0x009e5ea8]
nop
test rax, rax
je 0x428f86
mov qword [rsp + 0x10], rax
mov rcx, qword [rax + 8]
mov qword [0x009e5ea8], rcx
mov ebx, 0x10000
call fcn.00464ce0
mov rax, qword [rsp + 0x10]
jmp 0x428fc2
nop
nop
lea rax, [0x009e5ea0]
call fcn.0040c4c0
mov eax, 0x10000
lea rbx, [0x009e82d8]
call fcn.004186c0
test rax, rax
je 0x428fdb
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x009e5ea0]
call fcn.0040c2a0
mov rax, qword [rsp + 0x18]
mov qword [rax + 8], 0
mov qword [rax], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x007b0d3f]
mov ebx, 0x1f
call fcn.00436e00
nop
call fcn.00461f00
jmp fcn.00428f40
Function at 0x429000
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x429146
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [0x0071dd80]
nop
cmp rdx, 0x15
ja 0x4290c3
mov qword [rsp + 0x30], rbx
test byte [rax], al
cmp dword [0x009e5e00], 0
jne 0x429043
mov qword [rax + 0x10110], rcx
jmp 0x42904f
lea rdi, [rax + 0x10110]
call fcn.00464280
mov qword [rsp + 0x28], rax
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.0042df60
mov rax, qword [rsp + 0x28]
call fcn.0042b2c0
mov rcx, qword [0x0071c478]
mov rdx, qword [rsp + 0x28]
mov qword [rdx + 0x10078], rcx
cmp dword [0x009e5e00], 0
jne 0x42909a
mov rax, qword [rsp + 0x30]
mov qword [rdx + 0x10108], rax
jmp 0x4290ab
lea rdi, [rdx + 0x10108]
mov rax, qword [rsp + 0x30]
call fcn.00464180
mov rax, qword [0x0071c478]
mov qword [rdx + 0x100f8], rax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rdx
call fcn.00438580
lea rax, [0x007b1315]
mov ebx, 0x20
call fcn.00438e80
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x40
sbb rax, rax
mov edx, 1
shl rdx, cl
and rax, rdx
call fcn.00438c80
call fcn.004387e0
nop
call fcn.00438600
call fcn.00438580
lea rax, [0x007b025a]
mov ebx, 0x1d
call fcn.00438e80
mov eax, 0x200000
call fcn.00438c80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007b4a3a]
mov ebx, 0x2b
nop dword [rax + rax]
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00429000
Function at 0x42b2c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42b3ee
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rdx, qword [0x0071ddc0]
mov qword [rsp + 0x38], rdx
movups xmm0, xmmword [0x0071ddc8]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x0071ddd8]
movups xmmword [rsp + 0x50], xmm0
xor ecx, ecx
jmp 0x42b30c
lea rcx, [r8 + 1]
mov rax, rsi
cmp rcx, 5
jge 0x42b3d2
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + rcx*8 + 0x38]
add rdx, 0xffffffffffffffd0
neg rdx
cmp rdx, 0x40
sbb rsi, rsi
mov rcx, rdx
mov edi, 1
shl rdi, cl
and rdi, rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [0x009e5ca0]
lea rdx, [rbx + rdi*8]
lea rdx, [rdx - 1]
neg rbx
and rbx, rdx
xor eax, eax
call fcn.00418cc0
nop dword [rax]
test rax, rax
je 0x42b3dc
movups xmmword [rsp + 0x20], xmm15
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x30], rdx
mov rsi, qword [rsp + 0x70]
test byte [rsi], al
mov r8, qword [rsp + 0x10]
lea r9, [r8 + r8*2]
mov r10, qword [rsp + 0x20]
mov qword [rsi + r9*8 + 8], 0
mov qword [rsi + r9*8 + 0x10], rdx
lea rdi, [rsi + r9*8]
cmp dword [0x009e5e00], 0
jne 0x42b3c5
mov qword [rsi + r9*8], r10
jmp 0x42b305
mov rdx, r10
call fcn.004642a0
jmp 0x42b305
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x007b2e8c]
mov ebx, 0x25
call fcn.00436e00
nop
mov qword [rsp + 8], rax
call fcn.00461f00
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.0042b2c0
Function at 0x42dd60
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42ddb1
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
cmp rax, rdx
setbe dl
add rcx, rbx
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x42dd9f
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007b780a]
mov ebx, 0x3c
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042dd60
Function at 0x42f360
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42f3c6
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rcx, [rax + 0x10]
mov qword [rax], rcx
cmp byte [0x009e5e05], 0
je 0x42f38e
lea rcx, [rax + 0x20]
mov qword [rax + 8], rcx
jmp 0x42f399
add rcx, 0x1000
mov qword [rax + 8], rcx
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xf
jne 0x42f3b3
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007b09db]
mov ebx, 0x1f
nop
call fcn.00436e00
nop
mov qword [rsp + 8], rax
call fcn.00461f00
mov rax, qword [rsp + 8]
jmp fcn.0042f360
Function at 0x42f4a0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42f746
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42f73a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x009e5961], 0
jne 0x42f502
xor edx, edx
xor ebx, ebx
nop
jmp 0x42f54b
xor edx, edx
jmp 0x42f52e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.0041fa40
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42f506
add rax, 0x16c0
call fcn.0042f360
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42f6d2
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42f548
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00414780
test rax, rax
jne 0x42f5a2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42f548
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42f5e5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42f548
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42f72d
lea r10, [0x009b7db8]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42f66c
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42f6a5
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42f548
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42f725
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42f548
cmp rbx, 0x200
ja 0x42f717
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00425100
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042f360
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.004646a0
mov rax, r8
call fcn.00464620
mov rax, r8
mov ecx, 0x40
call fcn.00464640
mov edx, 0x200
nop
call fcn.00464680
nop
mov qword [rsp + 8], rax
call fcn.00466620
mov rax, qword [rsp + 8]
jmp fcn.0042f4a0
Function at 0x42ffa0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43007d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [0x00735bf0]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.004334a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x0071c460], rax
test rax, rax
je 0x430014
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438580
lea rax, [0x007b5933]
mov ebx, 0x2f
call fcn.00438e80
mov rax, qword [rsp + 0x30]
call fcn.00438b80
lea rax, [0x007a35eb]
mov ebx, 3
call fcn.00438e80
call fcn.00438600
lea rax, [0x007af5dc]
mov ebx, 0x1b
call fcn.00436e00
nop
nop dword [rax]
call fcn.00461f00
jmp fcn.0042ffa0

Function at 0x430160
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43024d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x009e59b8]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
je 0x4301d8
mov rax, qword [0x0071c460]
mov rcx, qword [0x00735c78]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.004334a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x4301e2
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438580
lea rax, [0x007b7936]
mov ebx, 0x3c
call fcn.00438e80
mov rax, qword [rsp + 0x30]
nop
call fcn.00438b80
lea rax, [0x007a35eb]
mov ebx, 3
call fcn.00438e80
call fcn.00438600
lea rax, [0x007b64d9]
mov ebx, 0x33
call fcn.00436e00
nop
call fcn.00461f00
jmp fcn.00430160
Function at 0x430600
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430687
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov edx, dword [rbx + 0x28]
nop dword [rax + rax]
cmp edx, 0x72
je 0x43062a
cmp edx, 0x77
jne 0x430645
mov dword [rbx + 0x2c], ecx
mov dword [rbx + 0x30], edi
mov rbx, qword [rbx + 0x20]
mov ecx, edx
call fcn.0042f860
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov dword [rsp + 0x1c], edx
call fcn.00438580
lea rax, [0x007b78fa]
mov ebx, 0x3c
call fcn.00438e80
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00438c80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007adbc3]
mov ebx, 0x17
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00430600
Function at 0x430780
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43096f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
cmp qword [0x009e5cf0], 0
jne 0x43081f
mov rax, qword [0x00735c50]
lea rcx, [0x009e6540]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x104
call fcn.004333a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x43095d
cmp rax, 0x104
ja 0x43095d
lea rbx, [0x009e6540]
mov byte [rbx + rax], 0x5c
lea r8, [rax + 1]
mov qword [0x009e5cf0], r8
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
cmp byte [0x009e5962], 0
je 0x43087b
test rbx, rbx
jbe 0x430953
mov rcx, qword [0x0098f390]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x800
call fcn.00433420
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [0x009e5cf0]
cmp rcx, 0x105
ja 0x430949
lea rsi, [rcx + rbx]
mov qword [rsp + 0x28], rsi
nop dword [rax + rax]
cmp rsi, 0x105
ja 0x4308b2
lea rdx, [0x009e6540]
jmp 0x4308e1
mov qword [rsp + 0x30], rcx
lea rax, [0x0075f100]
lea rbx, [0x009e6540]
mov edi, 0x105
call fcn.0044a260
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov rdx, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rdx
lea rsi, [rdx + rcx]
mov rcx, rbx
mov rbx, rax
mov rax, rsi
call fcn.00464fa0
mov rcx, qword [rsp + 0x28]
nop dword [rax]
test rcx, rcx
jbe 0x430942
mov rax, qword [0x00735c68]
mov rcx, qword [rsp + 0x38]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433320
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
call fcn.00464620
mov edx, 0x105
call fcn.00464680
xor eax, eax
mov rcx, rbx
call fcn.00464620
lea rax, [0x007b2705]
mov ebx, 0x24
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00430780
Function at 0x431a40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x431cf9
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x30], rax
movabs rdx, 0x6574737953746547
mov qword [rsp + 0x56], rdx
movabs rdx, 0x467341656d69546d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x656d6954656c69
mov qword [rsp + 0x66], rdx
lea rbx, [rsp + 0x56]
mov ecx, 0x18
mov rdi, rcx
call fcn.004306c0
cmp dword [0x009e5e00], 0
jne 0x431abc
mov qword [0x0098f388], rax
jmp 0x431ac8
lea rdi, [0x0098f388]
call fcn.00464180
test rax, rax
je 0x431ce7
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x3e], rdx
movabs rsi, 0x65636e616d726f66
mov qword [rsp + 0x46], rsi
movabs r8, 0x7265746e756f43
mov qword [rsp + 0x4e], r8
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x3e]
mov ecx, 0x18
mov rdi, rcx
call fcn.004306c0
cmp dword [0x009e5e00], 0
jne 0x431b27
mov qword [0x0098f3a8], rax
jmp 0x431b33
lea rdi, [0x0098f3a8]
call fcn.00464180
movabs rdx, 0x7265507972657551
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x65636e616d726f66
mov qword [rsp + 0x76], rdx
movabs rdx, 0x724665636e616d72
mov qword [rsp + 0x78], rdx
movabs rdx, 0x79636e65757165
mov qword [rsp + 0x80], rdx
mov rax, qword [rsp + 0x30]
lea rbx, [rsp + 0x6e]
mov ecx, 0x1a
mov rdi, rcx
call fcn.004306c0
cmp dword [0x009e5e00], 0
jne 0x431b9b
mov qword [0x0098f3b0], rax
jmp 0x431ba7
lea rdi, [0x0098f3b0]
call fcn.00464180
cmp qword [0x0098f3a8], 0
je 0x431cd6
test rax, rax
je 0x431cd6
mov qword [rsp + 0x20], 0
mov rax, qword [0x0098f3b0]
lea rcx, [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
nop dword [rax]
call fcn.00433320
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x431cc5
cmp rax, 0x7fffffff
jg 0x431cb1
mov qword [rsp + 0x28], rax
mov rax, qword [0x0098f3a8]
lea rcx, [0x009e5cc8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00433320
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
xor ecx, ecx
mov edx, 0x1e
mov ebx, 0x3b9aca00
jmp 0x431c63
lea rdx, [rcx - 1]
mov ecx, edi
test rdx, rdx
jl 0x431c82
movsxd rsi, eax
mov edi, ecx
mov rcx, rdx
shl rsi, cl
cmp rbx, rsi
jl 0x431c5d
sub rbx, rsi
bts edi, ecx
nop
jmp 0x431c5d
movsxd rax, eax
cmp rbx, rax
mov eax, 0x7fffffff
cmovge ecx, eax
movsxd rax, ecx
mov qword [0x009e5cc0], rax
mov byte [0x009e5963], 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x007b84fa]
mov ebx, 0x56
nop dword [rax]
call fcn.00436e00
lea rax, [0x007b830b]
mov ebx, 0x50
call fcn.00436e00
lea rax, [0x007af339]
mov ebx, 0x1b
call fcn.00436e00
lea rax, [0x007b5c30]
mov ebx, 0x30
call fcn.00436e00
nop
mov qword [rsp + 8], rax
nop
call fcn.00461f00
mov rax, qword [rsp + 8]
jmp fcn.00431a40