joyce8/EMBER2024-capa huggingface dataset:
Function at 0x618f00
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x619030
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
movups xmmword [rsp + 0x3b], xmm15
lea rdi, [rsp + 0x40]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463422
mov rbp, qword [rbp]
lea rbx, [rsp + 0x3b]
call fcn.0060cc40
nop dword [rax]
cmp rbx, 1
jne 0x618fa6
cmp byte [rax], 0
jne 0x618fa6
lea rax, [0x00736680]
call fcn.0040d400
mov qword [rsp + 0xc8], rax
lea rax, [0x00736680]
call fcn.0040d400
mov rbx, rax
mov rax, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
nop
mov edx, dword [0x00a59fe8]
test edx, edx
jne 0x618fe8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x00a59fe8]
lea rbx, [0x007a7850]
call fcn.0046bf60
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdx, qword [0x009ff018]
mov rdi, rbx
mov rsi, rcx
mov rbx, rdx
mov rcx, rax
lea rax, [0x00818500]
call fcn.00612620
test rax, rax
je 0x61901c
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814270]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
nop
jmp fcn.00618f00

Function at 0x619060
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6190dc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop
mov edx, dword [0x00a59fe8]
test edx, edx
jne 0x619092
lea rax, [0x00a59fe8]
lea rbx, [0x007a7850]
call fcn.0046bf60
mov rcx, qword [0x00a02bd0]
mov rdi, qword [0x00a02bd8]
mov rbx, qword [0x009ff018]
lea rax, [0x00818500]
call fcn.006121c0
test r8, r8
jne 0x6190c8
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814280]
call fcn.004356e0
nop
nop dword [rax]
call fcn.00460a60
jmp fcn.00619060

Function at 0x619ba0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x619bed
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret
Function at 0x619c80
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x619cc5
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x61e800
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61e978
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov dword [rsp + 0x2c], 0
bswap ebx
mov dword [rsp + 0x2c], ebx
cmp qword [rax], 0
jne 0x61e95a
cmp qword [rax + 0x30], 0
jne 0x61e964
mov qword [rsp + 0x50], rax
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp rdx, 4
jge 0x61e896
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov rdx, qword [rsp + 0x50]
mov qword [rdx], rcx
cmp dword [0x00a5a130], 0
jne 0x61e88a
mov qword [rdx + 8], rax
jmp 0x61e893
lea rdi, [rdx + 8]
call fcn.00462ca0
mov rax, rdx
cmp byte [rax + 0x28], 0
je 0x61e8f3
mov rdx, qword [rax + 0x18]
add rdx, 4
cmp qword [rax + 0x20], rdx
jge 0x61e8f3
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov rdx, qword [rsp + 0x50]
mov qword [rdx], rcx
cmp dword [0x00a5a130], 0
nop
jne 0x61e8e8
mov qword [rdx + 8], rax
jmp 0x61e95a
lea rdi, [rdx + 8]
call fcn.00462ca0
jmp 0x61e95a
mov rcx, qword [rax + 0x18]
lea rsi, [rcx + 4]
mov rdi, qword [rax + 0x20]
mov rbx, qword [rax + 0x10]
cmp rdi, rsi
jae 0x61e933
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 0x2c]
mov dword [rbx + rcx], edx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmp dword [0x00a5a130], 0
jne 0x61e951
mov qword [rax + 0x10], rbx
jmp 0x61e95a
lea rdi, [rax + 0x10]
call fcn.00462de0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0061e800
Function at 0x6212c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x621352
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
cmp rcx, 0x20
jne 0x62133e
mov rcx, qword [rbx]
movabs rdx, 0x7ffffffffffff
and rcx, rdx
mov qword [rax], rcx
mov rcx, qword [rbx + 6]
shr rcx, 3
and rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rbx + 0xc]
shr rcx, 6
and rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0x13]
shr rcx, 1
and rcx, rdx
mov qword [rax + 0x18], rcx
mov rcx, qword [rbx + 0x18]
shr rcx, 0xc
and rcx, rdx
mov qword [rax + 0x20], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814fc0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.006212c0

Function at 0x6213a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6214f4
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.006207c0
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x621444
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x621495
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x6214c0
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x62143e
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x62143e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x6214ac
mov rax, rsi
mov ecx, 0x20
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006213a0
Function at 0x6226a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x622946
sub rsp, 0x140
mov qword [rsp + 0x138], rbp
lea rbp, [rsp + 0x138]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x130], rax
xor ecx, ecx
jmp 0x62270a
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x150]
cmp rcx, 1
jge 0x6227a5
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + rcx*8 + 0x130]
mov qword [rsp + 0x128], rax
movups xmmword [rsp + 0x100], xmm15
movups xmmword [rsp + 0x108], xmm15
movups xmmword [rsp + 0x118], xmm15
test byte [rax], al
lea rbx, [rsp + 0x100]
mov ecx, 0x28
call fcn.004029c0
test al, al
je 0x6226f1
movups xmmword [rsp + 0xd8], xmm15
movups xmmword [rsp + 0xe0], xmm15
movups xmmword [rsp + 0xf0], xmm15
mov rdx, qword [rsp + 0x128]
lea rax, [rdx + 0x28]
lea rbx, [rsp + 0xd8]
mov ecx, 0x28
call fcn.004029c0
test al, al
je 0x6226f1
nop dword [rax]
jmp 0x62292e
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc8], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
test byte [rax], al
lea rbx, [rax + 0x50]
lea rax, [rsp + 0x60]
call fcn.00620a20
lea rcx, [rsp + 0xb0]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x148]
mov qword [rsp + 8], rdx
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x10], rsi
call fcn.006222c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
lea rcx, [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x148]
add rdx, 0x28
mov qword [rsp + 8], rdx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x10], rdx
call fcn.006222c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x150]
test byte [rcx], al
nop
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
lea rax, [rsp + 0x88]
lea rbx, [rsp + 0x40]
nop dword [rax]
call fcn.006213a0
cmp rbx, 0x20
mov ecx, 0x20
cmovl rcx, rbx
mov rdx, qword [rsp + 0x150]
cmp rax, rdx
je 0x6228ca
mov rbx, rax
mov rax, rdx
call fcn.00463ac0
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rax, [rsp + 0xb0]
lea rbx, [rsp + 0x20]
call fcn.006213a0
test rbx, rbx
jbe 0x622924
mov rdx, qword [rsp + 0x150]
movzx esi, byte [rdx + 0x1f]
movzx edi, byte [rax]
and edi, 1
shl rdi, 7
or esi, edi
mov byte [rdx + 0x1f], sil
mov rax, rdx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
xor eax, eax
mov rcx, rbx
call fcn.00463140
lea rax, [0x0070f0c0]
lea rbx, [0x00814210]
nop dword [rax]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.006226a0
Function at 0x623360
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x158]
cmp r12, qword [r14 + 0x10]
jbe 0x6234fc
sub rsp, 0x1d8
mov qword [rsp + 0x1d0], rbp
lea rbp, [rsp + 0x1d0]
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], rcx
movups xmmword [rsp + 0x1c0], xmm15
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rcx
xor edx, edx
jmp 0x6233e0
mov rsi, qword [rsp + 0x18]
lea rdx, [rsi + 1]
mov rax, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x1e8]
nop
cmp rdx, 2
jge 0x62345e
mov qword [rsp + 0x18], rdx
mov rax, qword [rsp + rdx*8 + 0x1c0]
mov qword [rsp + 0x1b0], rax
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
test byte [rax], al
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.004029c0
nop
test al, al
je 0x6233be
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rdx, qword [rsp + 0x1b0]
lea rax, [rdx + 0x28]
lea rbx, [rsp + 0x20]
mov ecx, 0x28
call fcn.004029c0
test al, al
je 0x6233be
jmp 0x6234e8
lea rdi, [rsp + 0x110]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463414
mov rbp, qword [rbp]
lea rax, [rsp + 0x110]
mov rbx, rcx
call fcn.006230e0
lea rdi, [rsp + 0x70]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463414
mov rbp, qword [rbp]
mov rbx, qword [rsp + 0x1e8]
mov rcx, rax
lea rax, [rsp + 0x70]
call fcn.00623540
mov rbx, rax
mov rax, qword [rsp + 0x1b8]
call fcn.00622e40
mov rbp, qword [rsp + 0x1d0]
add rsp, 0x1d8
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814210]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop
jmp fcn.00623360
Function at 0x6242e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x624451
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x78], rbx
xor ecx, ecx
jmp 0x624341
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx + 1]
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
cmp rcx, 1
jge 0x6243b4
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + rcx*8 + 0x78]
mov qword [rsp + 0x70], rax
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
test byte [rax], al
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.004029c0
test al, al
je 0x624328
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rdx, qword [rsp + 0x70]
lea rax, [rdx + 0x28]
lea rbx, [rsp + 0x20]
mov ecx, 0x28
call fcn.004029c0
test al, al
je 0x624328
jmp 0x62443d
test byte [rax], al
test byte [rbx], al
mov rdx, qword [0x009f46f0]
mov rcx, rbx
mov rbx, rdx
call fcn.00620960
nop
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rdx + 0x28]
mov rdi, qword [rsp + 0x90]
mov qword [rdi + 0x28], rsi
movups xmm0, xmmword [rdx + 0x30]
movups xmmword [rdi + 0x30], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rdi + 0x40], xmm0
nop
mov rsi, qword [rdx + 0x50]
mov qword [rdi + 0x50], rsi
movups xmm0, xmmword [rdx + 0x58]
movups xmmword [rdi + 0x58], xmm0
movups xmm0, xmmword [rdx + 0x68]
movups xmmword [rdi + 0x68], xmm0
lea rax, [rdi + 0x78]
lea rcx, [rdx + 0x78]
mov rbx, qword [0x009f46f0]
nop dword [rax + rax]
call fcn.00620960
mov rax, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814210]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006242e0

Function at 0x624480
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x624511
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
nop dword [rax]
cmp rcx, 0x40
jne 0x6244fd
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [rsp + 0x18]
cmp rbx, rdx
je 0x6244e4
mov rax, rdx
mov ecx, 0x40
call fcn.00463ac0
mov rax, qword [rsp + 0x68]
lea rdx, [rsp + 0x18]
test byte [rax], al
mov rbx, rdx
call fcn.006246a0
mov rax, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814230]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.00624480
Function at 0x625440
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x6256bf
sub rsp, 0x140
mov qword [rsp + 0x138], rbp
lea rbp, [rsp + 0x138]
lea rdi, [rsp + 0x148]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004633f4
mov rbp, qword [rbp]
cmp byte [rax + 0x1f], 0x7f
ja 0x6256ab
nop dword [rax]
cmp rbx, 2
jb 0x625698
cmp rbx, 8
ja 0x625685
lea rdi, [rsp + 0x38]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004633f4
mov rbp, qword [rbp]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
xor ecx, ecx
jmp 0x6254f6
mov r8, qword [rax + rcx]
mov qword [rsp + rdx*8 + 0x10], r8
lea rcx, [rdx + 1]
cmp rcx, 4
jge 0x62552b
mov rdx, rcx
shl rcx, 3
cmp rcx, 0x20
ja 0x625676
lea r8, [rcx - 0x20]
mov r9, r8
sar r8, 0x3f
and rcx, r8
neg r9
nop
cmp r9, 7
ja 0x6254e9
jmp 0x625669
mov rcx, rbx
mov edx, 1
shl rdx, cl
lea r8, [rdx - 1]
xor eax, eax
xor esi, esi
nop
jmp 0x62554e
mov rcx, rbx
mov rdx, r11
mov rsi, rax
mov rax, r9
cmp rax, 0x100
jae 0x625618
mov r9, rax
shr rax, 6
mov r10, r9
and r9d, 0x3f
lea r11, [rcx - 0x40]
neg r11
cmp r11, r9
jbe 0x62558b
cmp rax, 5
jae 0x62565f
mov r9, qword [rsp + rax*8 + 0x10]
mov rcx, r10
shr r9, cl
jmp 0x6255d0
cmp rax, 5
jae 0x625655
mov r11, qword [rsp + rax*8 + 0x10]
mov rcx, r10
shr r11, cl
lea r12, [rax + 1]
cmp r12, 5
jae 0x625648
lea r12, [r9 - 0x40]
neg r12
cmp r12, 0x40
sbb r9, r9
mov r12, qword [rsp + rax*8 + 0x18]
neg rcx
shl r12, cl
and r9, r12
or r9, r11
mov rcx, r10
and r9, r8
add r9, rsi
bt r9d, 0
jb 0x6255ec
lea r9, [rcx + 1]
mov r11, rdx
mov rax, rsi
jmp 0x625542
mov r11, rdx
shr rdx, 1
cmp rdx, r9
jbe 0x625602
mov byte [rsp + rcx + 0x38], r9b
xor eax, eax
nop
jmp 0x62560f
sub r9d, r11d
mov byte [rsp + rcx + 0x38], r9b
mov eax, 1
lea r9, [rcx + rbx]
jmp 0x625542
lea rdi, [rsp + 0x148]
lea rsi, [rsp + 0x38]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463700
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
mov rax, r12
mov ecx, 5
call fcn.00463160
mov ecx, 5
call fcn.00463160
mov ecx, 5
call fcn.00463160
mov eax, 7
mov rcx, r9
call fcn.00463140
mov rax, rcx
mov ecx, 0x20
nop
call fcn.00463200
lea rax, [0x0070f0c0]
lea rbx, [0x00814220]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814250]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814240]
call fcn.004356e0
nop
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
call fcn.00460a60
mov rax, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
jmp fcn.00625440
Function at 0x627c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x627e00
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x00711b60]
call fcn.0040d400
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x627c8b
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x627db9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x627de0
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x627c7d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x627c7d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x627c7d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x627c7d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x627d48
cmp r9, r10
jle 0x627d48
ja 0x627dc3
mov rax, r10
mov rcx, r9
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00627c20
Function at 0x63b3e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63b50f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
mov rbx, rax
mov ecx, 0x30
call fcn.0061dc20
nop
test al, al
jne 0x63b456
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x27
lea rcx, [0x00784659]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp qword [rsp + 0x58], 0
nop dword [rax]
je 0x63b501
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov byte [rsp + 0x27], 0
lea rax, [rsp + 0x50]
lea rbx, [rsp + 0x28]
lea rcx, [rsp + 0x27]
mov edi, 1
call fcn.0061e520
test al, al
je 0x63b4cf
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rdx]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
movzx r8d, byte [rsp + 0x27]
xor r8d, 0xffffff80
movzx eax, r8b
call rsi
nop
test rax, rax
je 0x63b456
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x26
lea rcx, [0x00783e0e]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0063b3e0