joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445240
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x3b8]
cmp r12, qword [r14 + 0x10]
jbe 0x4453f7
sub rsp, 0x438
mov qword [rsp + 0x430], rbp
lea rbp, [rsp + 0x430]
mov qword [rsp + 0x28], 0
mov edx, edi
lea rdi, [rsp + 0x30]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004647c0
mov rbp, qword [rbp]
sub edx, ecx
shr edx, 1
nop word [rax + rax]
cmp edx, 0x80
jne 0x4453e5
xor esi, esi
jmp 0x4452c8
test byte [rax], al
lea edi, [rsi + rcx]
movzx edi, dil
mov rdi, qword [rax + rdi*8 + 0x5f8]
mov qword [rsp + rsi*8 + 0x28], rdi
inc esi
cmp esi, edx
jb 0x4452b0
lea esi, [rdx + rcx]
mov rdi, rax
mov eax, ecx
lock cmpxchg dword [rdi + 0x5f0], esi
sete sil
test sil, sil
je 0x4452ee
mov qword [rsp + rdx*8 + 0x28], rbx
xor eax, eax
jmp 0x44530d
xor eax, eax
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
nop
ret
mov rsi, qword [rsp + rax*8 + 0x28]
mov qword [rbx + 0xa0], rsi
cmp eax, edx
jae 0x44532d
mov rbx, qword [rsp + rax*8 + 0x28]
test byte [rbx], al
inc eax
nop word [rax + rax]
cmp rax, 0x81
jb 0x445301
jmp 0x4453db
mov dword [rsp + 0x14], edx
movups xmmword [rsp + 0x18], xmm15
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + rdx*8 + 0x28]
mov qword [rsp + 0x20], rcx
nop
nop
lea rax, [0x00992498]
call fcn.0040c2a0
nop
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
test rcx, rcx
je 0x44539c
mov rbx, rcx
mov qword [rcx + 0xa0], 0
mov rcx, qword [0x009924e8]
nop
test rcx, rcx
je 0x44538e
mov qword [rcx + 0xa0], rdx
jmp 0x445395
mov qword [0x009924e0], rdx
mov qword [0x009924e8], rbx
mov ecx, dword [0x009924f0]
mov edx, dword [rsp + 0x14]
lea ecx, [rcx + rdx]
lea ecx, [rcx + 1]
mov dword [0x009924f0], ecx
movups xmmword [rsp + 0x18], xmm15
nop
nop
lea rax, [0x00992498]
call fcn.0040c4c0
mov eax, 1
mov rbp, qword [rsp + 0x430]
add rsp, 0x438
ret
mov ecx, 0x81
call fcn.00464620
lea rax, [0x007b073d]
mov ebx, 0x1e
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
jmp fcn.00445240
Function at 0x449940
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x48], r14
cmp dword [0x009e59c0], 0
je 0x44997f
mov qword [rsp + 0x60], rax
mov eax, 2
call fcn.00432020
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov dword [0x009e59c0], 1
mov rcx, qword [rsp + 0x48]
mov qword [rcx], 0
mov qword [rcx + 0x10], 0x13a0
mov qword [rcx + 0x18], 0x13a0
mov edx, dword [rax]
mov qword [rsp + 0x38], rdx
mov rsi, qword [rax + 0x20]
mov qword [rsp + 0x30], rsi
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 0xf8]
mov qword [rsp + 0x20], rdi
call fcn.00438580
lea rax, [0x007a78e4]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438ce0
call fcn.004387a0
mov rax, qword [rsp + 0x30]
call fcn.00438ce0
nop
call fcn.004387a0
mov rax, qword [rsp + 0x28]
call fcn.00438ce0
call fcn.004387a0
mov rax, qword [rsp + 0x20]
call fcn.00438ce0
nop
call fcn.004387e0
call fcn.00438600
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xf8]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
call fcn.00438580
lea rax, [0x007a3732]
mov ebx, 3
call fcn.00438e80
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438ce0
call fcn.004387e0
call fcn.00438600
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x138], 0
je 0x449ad4
cmp dword [rcx + 0x108], 0
jle 0x449acd
mov rdx, qword [rsp + 0x70]
cmp qword [rcx], rdx
jne 0x449ad9
cmp byte [0x0071c044], 0
je 0x449ac0
nop
call fcn.00438580
lea rax, [0x007b561a]
mov ebx, 0x2e
call fcn.00438e80
call fcn.00438600
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rdx + 0x138]
jmp 0x449adc
mov rdx, qword [rsp + 0x70]
jmp 0x449ad9
mov rdx, qword [rsp + 0x70]
mov rcx, rdx
mov qword [rsp + 0x40], rcx
call fcn.00438580
call fcn.004387e0
call fcn.00438600
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0xc4], 1
mov rax, qword [rax + 0x30]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
mov qword [rax + 0x98], rdi
mov eax, dword [0x0071c0cc]
mov rdx, qword [r14 + 0x30]
movzx edx, byte [rdx + 0xf9]
shr eax, 2
test dl, dl
cmovne eax, edx
test eax, eax
jle 0x449b65
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx + 0xf8]
mov rbx, qword [rdx + 0x98]
mov rdi, rcx
xor ecx, ecx
call fcn.00458720
mov rax, qword [rsp + 0x40]
call fcn.00459680
mov rax, qword [rsp + 0x68]
nop
call fcn.00408520
mov eax, 2
call fcn.00432020
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x449dc0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x449e53
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
xor eax, eax
jmp 0x449df0
lea r8, [0x009e6060]
mov byte [r8 + rax], sil
inc dword [0x009e5980]
mov rax, rdi
cmp rax, 0x36
jge 0x449e3e
lea rdx, [0x007b6b6f]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x449e0f
lea rdi, [rax + 1]
jmp 0x449e36
mov qword [rsp + 0x18], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
nop
call fcn.0045c180
lea rdx, [0x007b6b6f]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x18]
cmp rax, 0x64
jb 0x449ddc
jmp 0x449e48
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov ecx, 0x64
call fcn.00464620
nop
call fcn.00461f00
jmp fcn.00449dc0

Function at 0x44ac00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44ad73
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rsi, rdx
shr rdx, 0x2a
cmp rdx, 0x40
jae 0x44ad65
lea rdi, [0x009b7db8]
mov rdx, qword [rdi + rdx*8]
shr rsi, 0x16
and rsi, 0xfffff
mov rsi, qword [rdx + rsi*8]
mov rdi, rax
shr rax, 0xd
and rax, 0x1ff
mov r8, qword [rsi + rax*8 + 0x20000]
test byte [rdx], al
test byte [rsi], al
mov dl, byte [r8 + 0x63]
cmp dl, 2
jne 0x44ad4f
mov qword [rsp + 0x18], r8
mov rdx, qword [r8 + 0x28]
test rdx, rdx
jne 0x44acc5
movzx eax, bl
cmp rax, 2
jae 0x44ad45
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdi
shl rax, 6
lea rcx, [0x009e6160]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00428100
movzx ebx, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x18]
mov rdx, rdi
mov rsi, qword [r8 + 0x28]
mov qword [rdi], rsi
mov qword [r8 + 0x28], rdx
movzx edx, word [r8 + 0x60]
lea esi, [rdx - 1]
mov word [r8 + 0x60], si
cmp dword [0x009e59a4], 0
jne 0x44ad31
cmp dx, 1
jne 0x44ad31
movzx eax, bl
cmp rax, 2
jae 0x44ad3b
shl rax, 6
lea rcx, [0x009e6160]
lea rax, [rcx + rax]
lea rax, [rax + 8]
mov rbx, r8
call fcn.00427f80
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 0x28], 0
lea rax, [0x009a7c20]
mov ecx, 1
call fcn.00427b60
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov ecx, 2
call fcn.00464620
mov ecx, 2
call fcn.00464620
lea rax, [0x007b1746]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436e00
mov rax, rdx
mov ecx, 0x40
call fcn.00464640
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.00461f00
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0044ac00
Function at 0x44ce80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44d009
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp qword [rax], 0
nop dword [rax]
je 0x44cff7
mov ecx, dword [rax + 0x90]
bt ecx, 0xc
jb 0x44cede
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop dword [rax]
cmp rax, rdx
jne 0x44cfe6
mov rsi, r14
cmp rsi, rdx
je 0x44cfe6
cmp ecx, 2
jne 0x44cfe6
cmp qword [rax + 0x70], 0
jne 0x44ceff
cmp byte [rax + 0xb4], 0
je 0x44cef2
xor ecx, ecx
jmp 0x44cf01
mov cl, byte [rax + 0xb9]
test cl, cl
sete cl
jmp 0x44cf01
xor ecx, ecx
test cl, cl
je 0x44cfd5
mov rcx, qword [r14 + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x44cf28
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x2d0], 0
jne 0x44cfc4
cmp dword [0x009e6014], 0
jg 0x44cfba
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x138]
mov rax, rcx
call fcn.004506e0
test rax, rax
je 0x44cf5e
cmp byte [rax + 0x28], 6
jne 0x44cf5e
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rsp + 0x20]
mov rbx, qword [rax + 8]
mov rcx, qword [rax]
mov rdx, rbx
sub rbx, rcx
mov rcx, rbx
shr rbx, 1
cmp rbx, 0x2000
jb 0x44cfb0
mov rsi, qword [rax + 0x38]
sub rdx, rsi
add rdx, 0x320
shr rcx, 2
cmp rcx, rdx
ja 0x44cfa1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
nop
ret
call fcn.0044bf20
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007af04e]
mov ebx, 0x1a
call fcn.00436e00
lea rax, [0x007adc1f]
mov ebx, 0x17
call fcn.00436e00
lea rax, [0x007ae684]
mov ebx, 0x19
call fcn.00436e00
lea rax, [0x007afa9f]
mov ebx, 0x1c
call fcn.00436e00
nop
mov qword [rsp + 8], rax
call fcn.00461f00
mov rax, qword [rsp + 8]
jmp fcn.0044ce80
Function at 0x44da00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44dc57
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
test rcx, rcx
jle 0x44da37
mov rdx, rbx
xor esi, esi
xor edi, edi
xor r8d, r8d
xor r9d, r9d
jmp 0x44dc08
xor edx, edx
xor esi, esi
xor edi, edi
nop dword [rax]
test rdx, rdx
je 0x44db05
cmp rdx, 1
jne 0x44daa2
test rax, rax
je 0x44da60
mov rdx, rsi
mov esi, 1
jmp 0x44daa7
cmp rcx, rsi
jbe 0x44dbf0
mov rdx, rsi
shl rsi, 4
mov r8, qword [rbx + rsi]
mov rsi, qword [rbx + rsi + 8]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x58]
mov r8, qword [r14 + 8]
cmp qword [r14], rsi
ja 0x44da9a
cmp rsi, r8
setb sil
jmp 0x44da9c
xor esi, esi
xor esi, 1
nop
jmp 0x44daa7
mov rdx, rsi
xor esi, esi
test sil, sil
jne 0x44dae9
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
mov rbx, rdi
nop
call fcn.0044e160
mov rdx, qword [rsp + 0x88]
test rdx, rdx
jle 0x44db1b
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbx
mov r8, qword [rsp + 0x80]
xor r9d, r9d
jmp 0x44db35
cmp rcx, rdx
jbe 0x44db13
shl rdx, 4
mov rax, qword [rbx + rdx]
mov rbx, qword [rbx + rdx + 8]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rdx
call fcn.00464620
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
add r8, 0x10
mov rcx, rsi
mov rsi, r9
mov r9, rdi
mov rdi, r11
mov r10, qword [r8 + 8]
cmp rdi, r10
mov r11, rdi
cmovg rdi, r10
mov r12, qword [r8]
cmp rcx, r12
jne 0x44db50
cmp r11, r10
jmp 0x44dbb5
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x18], r10
mov rax, rcx
mov rbx, r12
mov rcx, rdi
call fcn.00464fa0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x18]
cmp rcx, rax
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
mov r10, rax
mov r11, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jb 0x44dbe5
lea rdi, [r9 + 1]
sub rsi, r10
sub r11, r10
mov r9, rsi
neg rsi
sar rsi, 0x3f
and r10, rsi
lea rsi, [rcx + r10]
cmp rdx, rdi
jg 0x44db25
nop dword [rax + rax]
jmp 0x44db1b
mov rax, r10
mov rcx, r11
call fcn.004646e0
mov rax, rsi
call fcn.00464620
add rbx, 0x10
mov r10, rsi
mov rsi, r9
mov r9, r8
mov r8, r10
mov r10, qword [rbx + 8]
test r10, r10
jne 0x44dc1f
mov r10, r9
mov r9, rsi
mov rsi, r8
mov r8, r10
jmp 0x44dc2e
lea r8, [r9 + r10]
cmp r9, r8
jg 0x44dc45
inc rdi
mov r9, rsi
inc r9
cmp rcx, r9
jg 0x44dbf8
mov rbx, rdx
mov rdx, rdi
mov rdi, r8
nop
jmp 0x44da40
lea rax, [0x007b02b1]
mov ebx, 0x1d
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044da00
Function at 0x4506e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rcx, [0x007247a0]
jmp 0x450700
mov rcx, qword [rcx + 0x210]
nop
test rcx, rcx
je 0x450719
cmp qword [rcx + 0xa0], rax
ja 0x4506f7
cmp qword [rcx + 0xa8], rax
jbe 0x4506f7
jmp 0x450720
xor ecx, ecx
nop dword [rax + rax]
test rcx, rcx
je 0x4507ab
mov rdx, qword [rcx + 0xa0]
mov rsi, rax
sub rax, rdx
mov rdx, rax
shr rax, 0xc
lea rdi, [rax + rax*4]
shl rdi, 2
add rdi, qword [rcx + 0x98]
and rdx, 0xfff
shr rdx, 8
mov r8d, dword [rdi]
nop word [rax + rax]
cmp rdx, 0x10
jae 0x450875
movzx edx, byte [rdi + rdx + 4]
add edx, r8d
mov rdi, qword [rcx + 0x88]
mov r8, qword [rcx + 0x80]
cmp edi, edx
ja 0x450788
lea rdx, [rdi - 1]
mov eax, edx
cmp rdi, rax
jbe 0x45086d
shl rax, 4
mov r9, qword [r8 + rax]
nop dword [rax + rax]
cmp r9, rsi
ja 0x450830
jmp 0x4507bc
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov edx, r9d
lea eax, [rdx + 1]
nop
cmp rdi, rax
jbe 0x450826
mov r9d, eax
shl rax, 4
mov r10, qword [rax + r8]
cmp r10, rsi
jbe 0x4507b9
mov eax, edx
cmp rdi, rax
jbe 0x45081e
shl rax, 4
mov rax, qword [r8 + rax + 8]
cmp rax, 0xffffffffffffffff
je 0x450808
mov rdx, qword [rcx + 0x70]
mov rsi, qword [rcx + 0x68]
cmp rdx, rax
jbe 0x450816
add rax, rsi
mov rbx, rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rdx
call fcn.00464640
mov rcx, rdi
call fcn.00464620
mov rcx, rdi
call fcn.00464620
dec edx
mov eax, edx
cmp rdi, rax
jbe 0x450865
shl rax, 4
mov r9, qword [r8 + rax]
nop
cmp r9, rsi
jbe 0x45084b
test edx, edx
ja 0x45082e
jmp 0x45084f
test edx, edx
jne 0x4507d5
lea rax, [0x007b22e2]
mov ebx, 0x23
nop dword [rax + rax]
call fcn.00436e00
mov rcx, rdi
call fcn.00464620
mov rcx, rdi
call fcn.00464620
mov rax, rdx
mov ecx, 0x10
nop dword [rax]
call fcn.00464640
nop
int3
Function at 0x4516a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x451818
movzx edx, byte [rax]
nop
test edx, edx
jne 0x4516dc
test r8b, r8b
jne 0x4516dc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x4516ef
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4517d8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x4517c6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x4517bc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x451743
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x451786
mov eax, 1
cmp rax, rbx
ja 0x451775
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.004646e0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x4517b4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x45177d
mov r8d, eax
mov eax, r10d
jmp 0x451748
mov rcx, rbx
call fcn.00464620
xor eax, eax
mov rcx, rbx
call fcn.00464620
mov eax, r8d
mov rcx, rbx
call fcn.004646e0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45180e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x4517d1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4516f5
mov eax, edx
mov rcx, rbx
call fcn.00464620
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00464620
nop
int3
Function at 0x452340
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4524aa
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
cmp dword [0x009e59b0], 0
jne 0x45237a
call fcn.0042f760
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
cmp qword [rbx], 0
nop
jne 0x452498
nop
mov rdx, rax
mov qword [rbx], rax
test byte [rdx], al
mov rdi, qword [rdx + 0x26e8]
mov r8, qword [rdx + 0x26e0]
mov r9, qword [rdx + 0x26f0]
lea rsi, [rdi + 1]
cmp r9, rsi
jb 0x4523b2
mov rax, rdi
jmp 0x452407
mov qword [rsp + 0x40], rdi
lea rax, [0x00758ee0]
mov rbx, r8
mov rcx, rdi
mov rdi, r9
call fcn.0044a260
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x26f0], rcx
cmp dword [0x009e5e00], 0
nop
jne 0x4523eb
mov qword [rdx + 0x26e0], rax
jmp 0x4523f7
lea rdi, [rdx + 0x26e0]
call fcn.00464180
mov rdi, rbx
mov r8, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
lea rsi, [rdi + 1]
mov qword [rdx + 0x26e8], rsi
lea rsi, [r8 + rdi*8]
cmp dword [0x009e5e00], 0
jne 0x452425
mov qword [r8 + rdi*8], rbx
jmp 0x45242d
mov rdi, rsi
call fcn.004642c0
mov rsi, qword [rdx + 0x26e0]
mov rbx, qword [rdx + 0x26e8]
mov rcx, qword [rdx + 0x26f0]
mov rdi, rax
mov rax, rsi
call fcn.004542c0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdx + 0x26e8]
mov rsi, qword [rdx + 0x26e0]
test rcx, rcx
jbe 0x452491
mov rax, qword [rsp + 0x60]
cmp qword [rsi], rax
jne 0x45247a
mov rax, qword [rax + 8]
xchg qword [rdx + 0x1668], rax
mov eax, 1
lock xadd dword [rdx + 0x26f8], eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
call fcn.00464620
lea rax, [0x007b1d20]
mov ebx, 0x22
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00452340
Function at 0x456000
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4561e6
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 0
lea rdi, [rsp + 0x50]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00464910
mov rbp, qword [rbp]
mov rsi, qword [rax + 0x28]
jmp 0x456074
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rdi + 0x28]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0xb8]
test rsi, rsi
je 0x456188
mov qword [rsp + 0x38], rsi
mov rdi, qword [rsi + 0x18]
test rdi, rdi
jne 0x4560b4
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x88], xmm15
mov qword [rsp + 0x98], 0
jmp 0x456156
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
call fcn.004506e0
test rax, rax
je 0x456198
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov r8, qword [rsp + 0x38]
cmp dword [r8], 0
jne 0x4560e9
xor r9d, r9d
jmp 0x4560ee
nop
lea r9, [r8 + 0x48]
mov qword [rsp + 0x88], r9
mov r9d, dword [rax + 0xc]
movsxd r10, r9d
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x98], 0
cmp r9d, 0x80000000
jne 0x456149
mov rcx, rbx
mov edi, 1
mov rsi, qword [rsp + 0x30]
mov rbx, rax
lea rax, [rsp + 0x48]
call fcn.00458020
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x60], rsi
mov rsi, qword [rbx]
lea rax, [rsp + 0x48]
mov rdx, rbx
mov rbx, rcx
call rsi
test al, al
jne 0x45605e
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
call fcn.00438580
lea rax, [0x007b0277]
mov ebx, 0x1d
call fcn.00438e80
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00438ce0
call fcn.004387e0
call fcn.00438600
lea rax, [0x007a7d9e]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00456000
Function at 0x458ae0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458c4f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
call fcn.00438580
lea rax, [0x007af8df]
mov ebx, 0x1c
call fcn.00438e80
mov rax, qword [rsp + 0x30]
call fcn.00438c80
lea rax, [0x007a3789]
mov ebx, 3
call fcn.00438e80
call fcn.00438600
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
xor edx, edx
jmp 0x458b7a
mov rbx, qword [rsp + 0x20]
lea rdx, [rbx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
cmp rdx, rcx
jge 0x458bcf
mov qword [rsp + 0x20], rdx
mov rcx, qword [rax + rdx*8]
mov qword [rsp + 0x18], rcx
mov rax, rcx
call fcn.004506e0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x20]
test rcx, rcx
sete dl
xor edi, edi
mov esi, edi
mov ecx, edx
call fcn.00459260
test al, al
je 0x458b67
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x18]
call fcn.00458ca0
jmp 0x458b67
cmp qword [rsp + 0x68], 0x64
jne 0x458bf2
call fcn.00438580
lea rax, [0x007b08c4]
mov ebx, 0x1f
call fcn.00438e80
call fcn.00438600
mov rax, qword [rsp + 0x80]
call fcn.004506e0
nop
test rax, rax
jne 0x458c09
xor ecx, ecx
jmp 0x458c2a
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edi, edi
mov esi, edi
call fcn.00459260
mov rbx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x40]
test cl, cl
je 0x458c45
cmp qword [rsp + 0x78], 1
je 0x458c45
mov rcx, qword [rsp + 0x80]
nop
call fcn.00458520
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00458ae0
Function at 0x458f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45904a
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x28]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x38]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x48]
movups xmmword [rdx], xmm15
lea rdx, [0x00459080]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00461dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00458f80