joyce8/EMBER2024-capa huggingface dataset:
Function at 0x555c20
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x555d94
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rax
mov edi, 7
mov rax, rbx
mov rbx, rcx
lea rcx, [0x007725ca]
call fcn.004f8740
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rsp + 0x88]
mov rsi, qword [rdx + 0x10]
mov r8, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x20]
mov rax, rsi
mov rbx, r8
call fcn.0040abe0
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x00555dc0]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x40], rdx
mov rbx, rax
lea rcx, [rsp + 0x38]
lea rax, [0x0070c280]
call fcn.004a0ce0
mov rdx, qword [rsp + 0x88]
mov rax, qword [rdx + 0x10]
mov rbx, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x20]
call fcn.0040abe0
mov rbx, qword [rsp + 0x28]
lea rcx, [0x0070c280]
mov rdi, rax
mov rax, qword [rsp + 0x30]
call fcn.00556360
test rax, rax
je 0x555cfc
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx + 0x18]
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x48], rcx
lea rdx, [0x00814e10]
mov qword [rsp + 0x50], rdx
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x00782293]
mov ebx, 0x23
lea rcx, [rsp + 0x48]
mov edi, 3
mov rsi, rdi
call fcn.004f8280
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00555c20
Function at 0x555e20
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x555f44
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
mov edi, 8
mov rax, rbx
mov rbx, rcx
lea rcx, [0x00772b2a]
call fcn.004f8740
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rdx + 0x10]
mov r8, qword [rdx + 0x18]
mov rcx, qword [rdx + 0x20]
mov rax, rsi
mov rbx, r8
nop dword [rax]
call fcn.0040abe0
mov rbx, qword [rsp + 0x28]
lea rcx, [0x0070c240]
mov rdi, rax
mov rax, qword [rsp + 0x30]
call fcn.00556360
nop
test rax, rax
je 0x555eaf
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + 0x18]
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x38], rcx
lea rdx, [0x00814e10]
mov qword [rsp + 0x40], rdx
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x00782293]
mov ebx, 0x23
lea rcx, [rsp + 0x38]
mov edi, 3
mov rsi, rdi
call fcn.004f8280
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00555e20
Function at 0x555f80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5560a4
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
mov edi, 8
mov rax, rbx
mov rbx, rcx
lea rcx, [0x00772bd2]
call fcn.004f8740
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rsp + 0x78]
mov rsi, qword [rdx + 0x20]
mov r8, qword [rdx + 0x28]
mov rcx, qword [rdx + 0x30]
mov rax, rsi
mov rbx, r8
nop dword [rax]
call fcn.0040abe0
mov rbx, qword [rsp + 0x28]
lea rcx, [0x0070c2c0]
mov rdi, rax
mov rax, qword [rsp + 0x30]
call fcn.00556360
nop
test rax, rax
je 0x55600f
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + 0x28]
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x38], rcx
lea rdx, [0x00814e10]
mov qword [rsp + 0x40], rdx
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x00783097]
mov ebx, 0x25
lea rcx, [rsp + 0x38]
mov edi, 3
mov rsi, rdi
call fcn.004f8280
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00555f80

Function at 0x5560e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5561f7
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
mov edi, 6
mov rax, rbx
mov rbx, rcx
lea rcx, [0x00772099]
call fcn.004f8740
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rsp + 0x78]
mov rdi, qword [rdx + 0x10]
lea rcx, [0x0071f7c0]
call fcn.00556360
nop dword [rax + rax]
test rax, rax
jne 0x5561ed
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x55615c
mov rcx, qword [rcx]
jmp 0x55615e
xor ecx, ecx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x0070f0c0]
mov qword [rsp + 0x38], rdx
lea rbx, [0x00814e10]
mov qword [rsp + 0x40], rbx
mov rax, rcx
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x00782270]
mov ebx, 0x23
lea rcx, [rsp + 0x38]
mov edi, 3
mov rsi, rdi
call fcn.004f8280
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.005560e0
Function at 0x556220
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x556337
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rax
mov edi, 6
mov rax, rbx
mov rbx, rcx
lea rcx, [0x0077209f]
call fcn.004f8740
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rsp + 0x78]
mov rdi, qword [rdx + 0x10]
lea rcx, [0x0071f760]
call fcn.00556360
nop dword [rax + rax]
test rax, rax
jne 0x55632d
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x55629c
mov rcx, qword [rcx]
jmp 0x55629e
xor ecx, ecx
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x0070f0c0]
mov qword [rsp + 0x38], rdx
lea rbx, [0x00814e10]
mov qword [rsp + 0x40], rbx
mov rax, rcx
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
lea rax, [0x007846a8]
mov ebx, 0x28
lea rcx, [rsp + 0x38]
mov edi, 3
mov rsi, rdi
call fcn.004f8280
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00556220
Function at 0x5629a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x562a4e
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor ebx, ebx
xor ecx, ecx
nop dword [rax]
call fcn.00482ac0
test r8, r8
jne 0x562a34
cmp esi, 1
je 0x562a25
movups xmmword [rsp + 0x28], xmm15
mov eax, esi
call fcn.0040aa40
lea rcx, [0x0070f200]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00785233]
mov ebx, 0x29
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
xor ecx, ecx
xor edi, edi
mov rsi, rax
mov r8, rbx
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rcx, rax
mov rdi, rbx
mov rsi, r8
mov r8, r9
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.005629a0
Function at 0x563d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x563f73
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rsi, qword [rax + 0x50]
test rsi, rsi
jle 0x563e50
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x563f65
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x10]
cmp rbx, rsi
je 0x563dc2
mov rax, rsi
mov rcx, r8
call fcn.00463ac0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x50]
add rsi, r8
mov qword [rax + 0x50], rsi
cmp rsi, 0x40
jne 0x563e2c
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00564240
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x563f5c
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x563e60
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x563f00
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x563f54
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.00564240
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x563f4f
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
je 0x563f3e
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x563f3a
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.00463ac0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x50], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00463200
mov rdx, r9
call fcn.004631c0
mov rax, r8
nop
call fcn.00463200
mov rax, rsi
mov ecx, 0x40
call fcn.00463200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00563d20
Function at 0x565c40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x565d66
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
lea rdx, [rcx + 2]
cmp rdx, 0xb
ja 0x565d14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x28], rax
lea rax, [0x0075abe0]
call fcn.0040d400
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
cmp dword [0x00a5a130], 0
jne 0x565cbb
mov rdx, qword [rsp + 0x58]
mov qword [rax + 8], rdx
jmp 0x565cc9
lea rdi, [rax + 8]
mov rdx, qword [rsp + 0x58]
call fcn.00462dc0
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x10], rdx
mov rdx, qword [rsp + 0x70]
mov qword [rax + 0x20], rdx
mov rdx, qword [rsp + 0x78]
mov qword [rax + 0x28], rdx
cmp dword [0x00a5a130], 0
jne 0x565cf8
mov rdx, qword [rsp + 0x68]
mov qword [rax + 0x18], rdx
jmp 0x565d06
lea rdi, [rax + 0x18]
mov rdx, qword [rsp + 0x68]
call fcn.00462dc0
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
movups xmmword [rsp + 0x30], xmm15
mov rax, rcx
nop dword [rax]
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x00782923]
mov ebx, 0x23
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00565c40
Function at 0x5686a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x568766
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x70], r8
sub rdi, rbx
sub rsi, rcx
test rax, rax
jl 0x5686d2
test rdi, rdi
jl 0x5686d2
test rsi, rsi
jge 0x5686db
mov rax, 0xffffffffffffffff
jmp 0x56871a
mov rcx, rax
mov rax, rdi
mul rcx
test rdx, rdx
je 0x5686f2
mov rax, 0xffffffffffffffff
jmp 0x56871a
mov rcx, rax
mov rax, rsi
mul rcx
nop dword [rax + rax]
test rdx, rdx
je 0x56870e
mov rax, 0xffffffffffffffff
jmp 0x56871a
test rax, rax
jge 0x56871a
mov rax, 0xffffffffffffffff
test rax, rax
jl 0x568729
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
lea rbx, [0x0077390e]
mov ecx, 0xa
mov rdi, r8
mov rsi, r9
lea r8, [0x00785285]
mov r9d, 0x2a
call fcn.0044cf00
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
nop
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005686a0
Function at 0x5aafc0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ab012
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.005aaec0
nop
test rdi, rdi
jne 0x5aaffe
test rbx, rbx
jbe 0x5aaff4
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
mov rcx, rbx
call fcn.00463140
lea rax, [0x0070f0c0]
lea rbx, [0x008144b0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005aafc0

Function at 0x5c42e0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5c42f8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5c42f8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5c4300
xor eax, eax
ret
cmp rbx, 3
je 0x5c430c
cmp rbx, 4
jne 0x5c4339
cmp al, 0x2c
ja 0x5c4326
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5c4336
cmp al, 0x24
je 0x5c4336
nop dword [rax]
cmp al, 0x26
jae 0x5c4336
jmp 0x5c4339
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5c4336
cmp al, 0x5b
je 0x5c4336
cmp al, 0x5d
jne 0x5c4339
xor eax, eax
ret
cmp al, 0x2f
ja 0x5c4372
nop dword [rax]
cmp al, 0x26
ja 0x5c4351
cmp al, 0x24
je 0x5c4391
cmp al, 0x26
je 0x5c4391
jmp 0x5c440b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5c4391
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5c4408
cmp al, 0x2f
je 0x5c4391
jmp 0x5c440b
cmp al, 0x3d
ja 0x5c4389
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5c4391
nop
cmp al, 0x3d
je 0x5c4391
jmp 0x5c440b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5c4400
cmp rbx, 2
jg 0x5c43c7
cmp rbx, 1
je 0x5c43c1
nop dword [rax]
cmp rbx, 2
jne 0x5c440b
cmp al, 0x2f
je 0x5c43b2
cmp al, 0x3b
je 0x5c43b2
cmp al, 0x2c
jne 0x5c43b9
mov ecx, 1
jmp 0x5c43be
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5c43ea
cmp al, 0x40
je 0x5c43d9
cmp al, 0x2f
je 0x5c43d9
cmp al, 0x3f
jne 0x5c43e2
mov ecx, 1
nop
jmp 0x5c43e7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5c43f9
cmp rbx, 7
jne 0x5c440b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5c4408
cmp al, 0x7e
jne 0x5c440b
xor eax, eax
ret
cmp rbx, 7
jne 0x5c4421
cmp al, 0x21
je 0x5c441d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5c4421
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5ce780
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5ce913
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
lea rax, [0x007561c0]
mov ebx, 0x808
mov rcx, rbx
call fcn.00449300
mov qword [rsp + 0x48], rax
lea rax, [0x0070f200]
call fcn.0040d400
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x50], rax
lea rax, [0x00711bc0]
call fcn.0040d400
mov qword [rax], 8
mov rdx, qword [rsp + 0x38]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], 0x18180
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x18], rdx
mov rdx, qword [0x00a00f40]
mov rbx, rax
mov ecx, 4
mov rdi, rcx
mov rax, rdx
call fcn.005aa860
test rax, rax
jne 0x5ce86e
mov r8, qword [rsp + 0x58]
mov ecx, dword [r8]
mov ebx, 0xaaaaaaab
imul rcx, rbx
shr rcx, 0x25
cmp rcx, 0x808
ja 0x5ce908
mov rax, qword [rsp + 0x48]
mov rbx, rcx
mov ecx, 0x808
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx + 0x18]
mov rax, rdi
call rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rax, qword [rsp + 0x28]
call fcn.0040aac0
lea rcx, [0x0070f2c0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x00788695]
mov ebx, 0x35
lea rcx, [rsp + 0x60]
mov edi, 2
mov rsi, rdi
call fcn.004ced20
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov edx, 0x808
call fcn.004631c0
nop
call fcn.00460a60
jmp fcn.005ce780
Function at 0x5d8180
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5d831b
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xb0], rsi
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov edi, 1
call fcn.004b89c0
lea rdx, [0x0070a2c0]
cmp rax, rdx
jne 0x5d820a
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rbx]
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x90]
xor esi, esi
jmp 0x5d8246
xor eax, eax
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rdi, qword [rsp + 0x58]
lea r8, [rdi + rcx]
test rax, rax
setne byte [r8]
lea rsi, [rcx + 1]
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x90]
mov rcx, rdx
mov rdx, rdi
cmp rax, rsi
jle 0x5d8277
mov rdi, qword [rbx + 8]
mov r8, qword [rdi + 0x18]
cmp qword [rdi + 8], r8
je 0x5d8297
mov qword [rsp + 0x30], rsi
mov rax, rbx
call fcn.005db820
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
cmp rcx, rdx
jb 0x5d821c
jmp 0x5d828c
mov eax, 1
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rax, rcx
mov rcx, rdx
call fcn.00463140
movups xmmword [rsp + 0x60], xmm15
nop dword [rax]
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x38]
lea rbx, [0x00771d48]
mov ecx, 5
lea rdi, [0x0078a89e]
mov esi, 0x45
call fcn.0044ce60
lea rcx, [rsp + 0x60]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
movups xmmword [rsp + 0x70], xmm15
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
lea rax, [0x0072c620]
lea rbx, [rsp + 0x70]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005d8180
Function at 0x5d8900
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5d8abe
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xb8], rsi
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov edi, 1
call fcn.004b89c0
lea rdx, [0x0070a3c0]
cmp rax, rdx
jne 0x5d898a
mov rcx, qword [rbx]
mov qword [rsp + 0x60], rcx
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x98]
xor esi, esi
jmp 0x5d89d3
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rdi, rcx
shl rcx, 4
mov r8, qword [rsp + 0x28]
bswap r8
mov r9, qword [rsp + 0x60]
mov qword [r9 + rcx], r8
bswap rax
mov qword [r9 + rcx + 8], rax
lea rsi, [rdi + 1]
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x98]
mov rcx, r9
cmp rax, rsi
jle 0x5d8a16
mov rdi, qword [rbx + 8]
mov r8, qword [rdi + 0x18]
cmp qword [rdi + 8], r8
je 0x5d8a36
mov qword [rsp + 0x38], rsi
mov rax, rbx
call fcn.005db820
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
call fcn.005db820
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
cmp rcx, rdx
jb 0x5d899c
jmp 0x5d8a2b
mov eax, 1
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rax, rcx
mov rcx, rdx
call fcn.00463140
movups xmmword [rsp + 0x68], xmm15
nop dword [rax]
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x40]
lea rbx, [0x00771d48]
mov ecx, 5
lea rdi, [0x0078b25f]
mov esi, 0x4b
call fcn.0044ce60
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
movups xmmword [rsp + 0x78], xmm15
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
lea rax, [0x0072c620]
lea rbx, [rsp + 0x78]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005d8900