joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476520
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476726
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov r8, qword [rax]
nop dword [rax + rax]
test r8, r8
je 0x47654f
cmp rax, r8
je 0x476565
jmp 0x476712
cmp dword [0x00a5a130], 0
jne 0x47655d
mov qword [rax], rax
jmp 0x476565
mov rdi, rax
call fcn.00462ca0
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], ebx
cmp ebx, 0x80
jae 0x4765e9
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 8]
mov rdi, qword [rax + 0x18]
lea rsi, [rcx + 1]
cmp rdi, rsi
jae 0x4765cb
lea rax, [0x0070f280]
mov rbx, rdx
call fcn.004493e0
mov rdx, qword [rsp + 0x68]
mov qword [rdx + 0x18], rcx
cmp dword [0x00a5a130], 0
jne 0x4765b2
mov qword [rdx + 8], rax
jmp 0x4765bb
lea rdi, [rdx + 8]
call fcn.00462ca0
mov rcx, rbx
mov ebx, dword [rsp + 0x70]
mov rsi, rax
mov rax, rdx
mov rdx, rsi
lea rsi, [rcx + 1]
mov qword [rax + 0x10], rsi
mov byte [rdx + rcx], bl
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x40], rsi
mov r8, qword [rax + 0x18]
mov r9, r8
sub r8, rsi
nop dword [rax]
cmp r8, 4
jge 0x476699
nop
lea rcx, [r9 + r9]
lea rcx, [rcx + 4]
mov qword [rsp + 0x48], rcx
lea rax, [0x0070f280]
mov rbx, rsi
call fcn.00449300
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx + 0x10]
mov rcx, qword [rsp + 0x40]
cmp rsi, rcx
mov rdi, rcx
cmovl rcx, rsi
mov rbx, qword [rdx + 8]
cmp rax, rbx
je 0x476661
mov qword [rsp + 0x50], rax
call fcn.00463ac0
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x40]
mov qword [rdx + 0x10], rdi
mov rsi, qword [rsp + 0x48]
mov qword [rdx + 0x18], rsi
cmp dword [0x00a5a130], 0
jne 0x47667d
mov qword [rdx + 8], rax
jmp 0x47668f
lea rsi, [rdx + 8]
mov rcx, rdi
mov rdi, rsi
call fcn.00462ca0
mov rdi, rcx
mov rax, rdx
mov ebx, dword [rsp + 0x70]
mov rsi, rdi
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 8]
lea rcx, [rsi + 4]
cmp rdx, rcx
jb 0x47670d
cmp rsi, rcx
ja 0x476705
sub rdx, rsi
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rdx, rsi
lea rax, [r8 + rdx]
mov edi, ebx
mov ebx, 4
call fcn.0046f420
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx + 0x18]
mov r8, qword [rsp + 0x40]
lea rcx, [r8 + rax]
cmp rsi, rcx
jb 0x4766f8
mov qword [rdx + 0x10], rcx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rdx, rsi
nop dword [rax + rax]
call fcn.004631c0
mov rax, rsi
call fcn.00463200
call fcn.004631c0
lea rax, [0x0070f0c0]
lea rbx, [0x00814000]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
nop dword [rax]
jmp fcn.00476520
Function at 0x47ac00
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x47ae4b
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
xor ecx, ecx
xor edx, edx
jmp 0x47ac37
inc rcx
cmp rbx, rcx
jle 0x47ac88
movzx r8d, byte [rax + rcx]
cmp r8b, 0x80
jae 0x47ac66
test dl, dl
je 0x47ac52
mov edx, 1
jmp 0x47ac34
cmp r8b, 0x41
jb 0x47ac62
cmp r8b, 0x5a
setbe dl
nop
jmp 0x47ac34
xor edx, edx
jmp 0x47ac34
mov rcx, rbx
mov rbx, rax
lea rax, fcn.004701a0
call fcn.0047a600
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
test dl, dl
je 0x47ad4f
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0x98], rax
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
nop
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x68], rdx
mov r8, qword [rsp + 0x78]
mov r9, qword [rsp + 0x80]
mov r10, r9
sub r9, r8
cmp rbx, r9
jle 0x47ad4b
mov qword [rsp + 0x50], r8
nop
lea rcx, [rbx + r10*2]
mov qword [rsp + 0x58], rcx
lea rax, [0x0070f280]
mov rbx, r8
call fcn.00449300
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
cmp rdx, rcx
mov rsi, rcx
cmovl rcx, rdx
mov rbx, qword [rsp + 0x70]
cmp rax, rbx
je 0x47ad1f
mov qword [rsp + 0x60], rax
call fcn.00463ac0
mov rax, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x78], rsi
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x98]
lea rdx, [rsp + 0x68]
mov rbx, qword [rsp + 0xa0]
xor ecx, ecx
jmp 0x47ad6f
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea r11, [r9 + 1]
mov qword [rsp + 0x78], r11
mov byte [r10 + r9], r8b
inc rcx
cmp rbx, rcx
jle 0x47ae1d
movzx r8d, byte [rax + rcx]
lea r9d, [r8 - 0x41]
cmp r9b, 0x19
ja 0x47ad8b
add r8d, 0x20
nop
mov r9, qword [rsp + 0x68]
test r9, r9
je 0x47ada5
cmp r9, rdx
je 0x47adaa
nop dword [rax + rax]
jmp 0x47ae37
mov qword [rsp + 0x68], rdx
mov r9, qword [rsp + 0x78]
lea rsi, [r9 + 1]
mov r10, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x80]
cmp rdi, rsi
jae 0x47ad5f
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x47], r8b
lea rax, [0x0070f280]
mov rbx, r10
mov rcx, r9
nop dword [rax]
call fcn.004493e0
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x68]
movzx r8d, byte [rsp + 0x47]
mov r9, rbx
mov r10, rax
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
jmp 0x47ad5f
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814000]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047ac00
Function at 0x47dba0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dd2b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov ebx, 0xa
call fcn.0047d940
mov rdx, qword [0x00a02a78]
cmp qword [0x00a02a70], rdi
jne 0x47dc80
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], rcx
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.00403ce0
test al, al
je 0x47dc66
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x47dc45
mov rax, qword [rsp + 0x28]
movzx r9d, byte [rdx + rax - 1]
nop
cmp r9b, 0xd
jne 0x47dc4a
mov r9, qword [rsp + 0x50]
mov r10, qword [r9 + 0x28]
test r10, r10
je 0x47dd17
dec r10
mov qword [r9 + 0x28], r10
lea rbx, [rdx - 1]
jmp 0x47dc4d
mov rax, qword [rsp + 0x28]
mov rbx, rdx
mov rcx, qword [rsp + 0x18]
mov edi, 1
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
nop
test rbx, rbx
je 0x47dcd6
movzx r9d, byte [rbx + rax - 1]
cmp r9b, 0xa
jne 0x47dcc5
cmp rbx, 1
jle 0x47dcb8
lea r9, [rbx - 2]
nop dword [rax + rax]
cmp rbx, r9
jbe 0x47dd0c
movzx r9d, byte [rbx + rax - 2]
cmp r9b, 0xd
jne 0x47dcb8
mov edx, 2
jmp 0x47dcbd
mov edx, 1
sub rbx, rdx
cmp rcx, rbx
jb 0x47dd01
xor edi, edi
xor esi, esi
xor r8d, r8d
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test rdi, rdi
mov edx, 0
cmovne rbx, rdx
cmovne rcx, rdx
mov edx, 0
cmovne rax, rdx
mov r8, rsi
mov rsi, rdi
xor edi, edi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, rcx
mov rcx, rbx
call fcn.004631c0
mov rax, r9
mov rcx, rbx
call fcn.00463140
lea rax, [0x0070f0c0]
lea rbx, [0x00813ff0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0047dba0

Function at 0x4831e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x483232
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.00482fe0
nop
test rdi, rdi
jne 0x48321e
test rbx, rbx
jbe 0x483214
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
mov rcx, rbx
call fcn.00463140
lea rax, [0x0070f0c0]
lea rbx, [0x00814e00]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004831e0
Function at 0x484b20
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484c29
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov dword [rsp + 0x1c], eax
mov qword [rsp + 0x20], 0
mov ebx, eax
xor ecx, ecx
lea rdi, [rsp + 0x20]
xor eax, eax
call fcn.00488080
test rax, rax
je 0x484bd8
lea rdx, [0x007303a0]
cmp qword [rax + 8], rdx
je 0x484b6c
test rax, rax
jmp 0x484bd8
cmp qword [rbx], 0x7a
je 0x484b77
test rax, rax
jmp 0x484bd8
mov rcx, qword [rsp + 0x20]
lea rax, [0x0070f280]
mov rbx, rcx
call fcn.00449300
mov rcx, qword [rsp + 0x20]
test rcx, rcx
jbe 0x484c21
mov qword [rsp + 0x28], rax
mov ebx, dword [rsp + 0x1c]
xor ecx, ecx
lea rdi, [rsp + 0x20]
call fcn.00488080
test rax, rax
je 0x484bc5
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x28]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
je 0x484bec
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x42
lea rcx, [0x0078a573]
mov qword [rax], rcx
lea rbx, [0x00815340]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
nop
ret
xor eax, eax
call fcn.00463140
nop
mov dword [rsp + 8], eax
call fcn.00460a60
mov eax, dword [rsp + 8]
jmp fcn.00484b20

Function at 0x499200
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499246
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x49922f
add rax, 8
nop
call fcn.0045f9c0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814e70]
nop dword [rax]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00499200

Function at 0x499340
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49939a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax + 0x20], 0
je 0x499386
mov qword [rsp + 0x20], rax
mov rax, rbx
call fcn.00499180
mov rcx, qword [rsp + 0x20]
add rcx, 8
mov rbx, rax
mov rax, rcx
call fcn.0045fa00
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814e80]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00499340
Function at 0x4ab000
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab26c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rdi, rdi
jl 0x4ab258
cmp rdi, 9
jg 0x4ab245
test ebx, ebx
jne 0x4ab046
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edx, ebx
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
bsr rdx, rdx
cmp rdx, 0x19
jge 0x4ab07b
lea rsi, [rdx - 0x19]
neg rsi
cmp rsi, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rsi
shl ebx, cl
and ebx, r8d
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x19]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x48], rax
imul rdx, rcx, 0x13441
add rdx, 0x1ce618
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x30], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x1b
jg 0x4ab0b2
test rdx, rdx
setge r8b
jmp 0x4ab0b5
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x23], r8b
mov dword [rsp + 0x24], ebx
mov eax, ebx
mov rbx, rcx
mov rcx, rdx
call fcn.004ac240
test rbx, rbx
jge 0x4ab22f
mov rdx, qword [rsp + 0x30]
lea r8, [rdx + 9]
cmp r8, 0xa
jae 0x4ab108
mov r8d, dword [rsp + 0x24]
mov r8d, r8d
test r8, r8
je 0x4ab1e7
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x4ab201
movzx esi, byte [rsp + 0x23]
neg rbx
cmp rbx, 0x20
sbb r8d, r8d
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9d, cl
and r9d, r8d
dec r9d
mov r10d, eax
shr eax, cl
and eax, r8d
and r9d, r10d
test sil, sil
je 0x4ab182
dec rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r10d, 1
shl r10d, cl
and r10d, r8d
cmp r10d, r9d
jb 0x4ab171
jne 0x4ab178
test dil, dil
je 0x4ab171
nop dword [rax]
cmp r10d, r9d
jne 0x4ab178
test dil, dil
je 0x4ab178
mov ebx, eax
and eax, 1
jmp 0x4ab17c
mov ecx, 1
jmp 0x4ab1a0
mov ebx, eax
xor eax, eax
mov ecx, eax
mov eax, ebx
jmp 0x4ab1a0
dec rcx
cmp rcx, 0x20
sbb r8d, r8d
mov r10d, r9d
shr r9d, cl
and r9d, r8d
cmp r9d, 1
sete cl
mov r9d, r10d
nop
test r9d, r9d
je 0x4ab1a7
xor edi, edi
xor edi, 1
mov ebx, eax
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov edx, ecx
mov ecx, edi
mov edi, edx
nop dword [rax]
call fcn.004ab540
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x30]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov esi, 1
mov ecx, 1
jmp 0x4ab10d
inc rsi
mov eax, edi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x4ab1e7
mov edi, eax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x4ab1f6
mov eax, edi
mov rdx, r10
jmp 0x4ab108
lea rax, [0x0070f0c0]
lea rbx, [0x00814d30]
nop dword [rax]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814d20]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814d10]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004ab000
Function at 0x4ab2a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab4f9
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop dword [rax + rax]
cmp rdi, 0x12
jg 0x4ab4e5
test rbx, rbx
jne 0x4ab2de
movups xmmword [rax + 0x18], xmm15
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
bsr rdx, rbx
mov rsi, 0xffffffffffffffff
cmove rdx, rsi
lea rsi, [rdx + 1]
cmp rsi, 0x37
jge 0x4ab319
lea rsi, [rdx - 0x36]
neg rsi
cmp rsi, 0x40
sbb r8, r8
mov r9, rcx
mov rcx, rsi
shl rbx, cl
and rbx, r8
lea rcx, [rdx + r9]
lea rcx, [rcx - 0x36]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
imul rdx, rcx, 0x13441
add rdx, 0x4105b6
sar rdx, 0x12
sub rdi, rdx
mov qword [rsp + 0x38], rdi
lea rdx, [rdi - 1]
cmp rdx, 0x37
jg 0x4ab350
test rdx, rdx
setge r8b
jmp 0x4ab353
xor r8d, r8d
mov qword [rsp + 0x28], rdx
mov byte [rsp + 0x27], r8b
mov qword [rsp + 0x30], rbx
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.004ac320
test rbx, rbx
jge 0x4ab4d2
mov rdx, qword [rsp + 0x38]
lea r8, [rdx + 0x15]
cmp r8, 0x16
jae 0x4ab3a5
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x4ab487
mov r9, qword [rsp + 0x28]
neg r9
xor esi, esi
jmp 0x4ab4a2
movzx esi, byte [rsp + 0x27]
neg rbx
cmp rbx, 0x40
sbb r8, r8
mov edi, ecx
mov rcx, rbx
mov r9d, 1
shl r9, cl
and r9, r8
dec r9
mov r10, rax
shr rax, cl
and rax, r8
and r9, r10
test sil, sil
je 0x4ab425
dec rcx
cmp rcx, 0x40
sbb r8, r8
mov r10d, 1
shl r10, cl
and r10, r8
cmp r10, r9
jb 0x4ab412
jne 0x4ab419
test dil, dil
je 0x4ab412
nop dword [rax + rax]
cmp r10, r9
jne 0x4ab419
test dil, dil
je 0x4ab419
mov rbx, rax
and eax, 1
jmp 0x4ab41e
mov ecx, 1
jmp 0x4ab442
mov rbx, rax
xor eax, eax
mov ecx, eax
mov rax, rbx
jmp 0x4ab442
dec rcx
cmp rcx, 0x40
sbb r8, r8
mov r10, r9
shr r9, cl
and r9, r8
cmp r9, 1
sete cl
mov r9, r10
test r9, r9
je 0x4ab449
xor edi, edi
xor edi, 1
mov rbx, rax
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov edx, ecx
mov ecx, edi
mov edi, edx
nop
call fcn.004ab540
mov rdx, qword [rsp + 0x50]
mov r8, qword [rdx + 0x20]
mov r9, qword [rsp + 0x38]
sub r8, r9
inc r8
mov qword [rdx + 0x20], r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov esi, 1
mov ecx, 1
jmp 0x4ab3aa
inc rsi
mov rax, rdi
mov r8, rdx
mov rdx, r10
cmp rsi, r9
jge 0x4ab487
mov rdi, rax
movabs rax, 0xcccccccccccccccd
mov r10, rdx
mul r8
shr rdx, 2
lea r11, [rdx + rdx*4]
cmp r8, r11
je 0x4ab496
mov rax, rdi
mov rdx, r10
jmp 0x4ab3a5
lea rax, [0x0070f0c0]
lea rbx, [0x00814d50]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814d40]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004ab2a0
Function at 0x4ac240
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac2f2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rcx, rcx
je 0x4ac2c8
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x4ac2de
shl rdx, 4
lea rsi, [0x009c86e0]
mov rdx, qword [rsi + rdx + 8]
lea rsi, [rdx + 1]
test rcx, rcx
cmovl rdx, rsi
mov eax, eax
mul rdx
mov rsi, rax
shl rax, 7
test rax, rax
sete dil
imul r8, rcx, 0x1a935
sar r8, 0xf
lea rbx, [r8 + rbx]
lea rbx, [rbx - 6]
shl rdx, 7
shr rsi, 0x39
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
shl eax, 6
add rbx, 0xfffffffffffffffa
mov ecx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814d60]
call fcn.004356e0
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ac240

Function at 0x4ac320
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac415
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
test rcx, rcx
je 0x4ac3ea
lea rdx, [rcx + 0x15c]
cmp rdx, 0x2b7
ja 0x4ac401
shl rdx, 4
lea rsi, [0x009c86e0]
add rdx, rsi
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x10], xmm0
test rcx, rcx
jge 0x4ac37d
inc qword [rsp + 0x10]
mov rdx, qword [rsp + 0x10]
mov rsi, rax
mov rax, rdx
mul rsi
mov rdi, qword [rsp + 0x18]
mov r8, rax
mov rax, rdi
mov rdi, rdx
mul rsi
add rax, rdi
sbb rsi, rsi
imul rdi, rcx, 0x1a935
sar rdi, 0xf
lea rbx, [rdi + rbx]
lea rbx, [rbx - 8]
sub rdx, rsi
mov rsi, rax
shl rax, 9
nop
test rax, rax
jne 0x4ac3ce
test r8, r8
sete dil
jmp 0x4ac3d0
xor edi, edi
shl rdx, 9
shr rsi, 0x37
or rdx, rsi
mov rax, rdx
mov ecx, edi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
shl rax, 8
add rbx, 0xfffffffffffffff8
mov ecx, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814d70]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ac320
Function at 0x4ac440
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac506
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x4ac4c6
nop
cmp rbx, 0xa
jne 0x4ac4c6
cmp rax, 0xa
jge 0x4ac48a
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x4ac500
lea rcx, [0x007829d6]
add rcx, rax
mov eax, 1
jmp 0x4ac4b6
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x4ac4f3
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x4ac4ee
lea rsi, [0x0078c633]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r8d, r8d
mov r9d, r8d
xor eax, eax
mov rbx, rcx
call fcn.004ac980
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00463200
mov edx, 0xc8
call fcn.00463180
nop dword [rax]
call fcn.00463200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004ac440

Function at 0x4ac540
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac60b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
cmp rax, 0x64
jae 0x4ac5c6
nop
cmp rbx, 0xa
jne 0x4ac5c6
cmp rax, 0xa
jge 0x4ac58a
lea rcx, [rax + 1]
cmp rax, rcx
ja 0x4ac605
lea rcx, [0x007829d6]
add rcx, rax
mov eax, 1
jmp 0x4ac5b6
lea rcx, [rax + rax]
lea rcx, [rcx + 2]
cmp rcx, 0xc8
ja 0x4ac5fa
mov rdx, rax
shl rax, 1
cmp rcx, rax
jb 0x4ac5f5
lea rsi, [0x0078c633]
lea rcx, [rsi + rdx*2]
mov eax, 2
mov rbx, rax
mov rax, rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
test rax, rax
setl r8b
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor r9d, r9d
xor eax, eax
mov rbx, rcx
nop dword [rax]
call fcn.004ac980
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00463200
mov edx, 0xc8
nop
call fcn.00463180
call fcn.00463200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ac540
Function at 0x4ac640
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac789
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
nop dword [rax]
cmp rdi, 0x64
jae 0x4ac749
cmp rsi, 0xa
jne 0x4ac749
cmp rdi, 0xa
jge 0x4ac69a
lea rdx, [rdi + 1]
nop
cmp rdi, rdx
ja 0x4ac77d
lea rdx, [0x007829d6]
add rdx, rdi
mov esi, 1
jmp 0x4ac6ce
lea r8, [rdi + rdi]
lea r8, [r8 + 2]
cmp r8, 0xc8
ja 0x4ac770
mov rdx, rdi
shl rdi, 1
cmp r8, rdi
jb 0x4ac765
lea r8, [0x0078c633]
lea rdx, [r8 + rdx*2]
mov esi, 2
lea r8, [rbx + rsi]
mov qword [rsp + 0x40], r8
cmp rcx, r8
jae 0x4ac714
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x70], rbx
mov rdi, rcx
mov rsi, r8
mov rcx, rbx
mov rbx, rax
lea rax, [0x0070f280]
nop
call fcn.004493e0
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x50], rax
lea rdi, [rax + rbx]
mov rbx, rdx
mov rax, rdi
mov rcx, rsi
call fcn.00463ac0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
test rdi, rdi
setl r8b
mov r9d, 1
call fcn.004ac980
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, rdi
mov rcx, r8
call fcn.00463200
mov rcx, r8
mov edx, 0xc8
call fcn.00463180
mov rax, rdi
mov rcx, rdx
call fcn.00463200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004ac640
Function at 0x4ac7e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac926
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
nop dword [rax]
cmp rdi, 0x64
jae 0x4ac8e9
cmp rsi, 0xa
jne 0x4ac8e9
cmp rdi, 0xa
jge 0x4ac83a
lea rdx, [rdi + 1]
nop
cmp rdi, rdx
ja 0x4ac919
lea rdx, [0x007829d6]
add rdx, rdi
mov esi, 1
jmp 0x4ac86e
lea r8, [rdi + rdi]
lea r8, [r8 + 2]
cmp r8, 0xc8
ja 0x4ac90c
mov rdx, rdi
shl rdi, 1
cmp r8, rdi
jb 0x4ac901
lea r8, [0x0078c633]
lea rdx, [r8 + rdx*2]
mov esi, 2
lea r8, [rbx + rsi]
mov qword [rsp + 0x40], r8
cmp rcx, r8
jae 0x4ac8b4
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x48], rdx
mov rdi, rcx
mov rsi, r8
mov rcx, rbx
mov rbx, rax
lea rax, [0x0070f280]
nop
call fcn.004493e0
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x50], rax
lea rdi, [rax + rbx]
mov rbx, rdx
mov rax, rdi
mov rcx, rsi
call fcn.00463ac0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
xor r8d, r8d
mov r9d, 1
call fcn.004ac980
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rax, rdi
mov rcx, r8
call fcn.00463200
mov rcx, r8
mov edx, 0xc8
call fcn.00463180
mov rax, rdi
mov rcx, rdx
nop
call fcn.00463200
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.004ac7e0