joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c9e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cb77
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
lea rax, [0x00a5a120]
call fcn.0042f7a0
mov qword [rsp + 0x18], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x20], rcx
nop
mov rax, rcx
nop dword [rax]
call fcn.0040b300
nop
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x20]
test rdx, rdx
je 0x45ca3e
cmp rdx, 1
jne 0x45cb65
nop
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x45ca52
cmp rdx, 1
jne 0x45cb52
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 8], rdx
mov byte [rcx + 0x30], 0
nop
nop
mov ebx, dword [rcx + 0x10]
jmp 0x45ca6c
nop
mov esi, dword [rcx + 0x10]
mov ebx, esi
bt ebx, 1
jae 0x45ca84
mov eax, ebx
xor ebx, 2
lock cmpxchg dword [rcx + 0x10], ebx
sete bl
xor ebx, 1
jmp 0x45ca86
xor ebx, ebx
test bl, bl
jne 0x45ca66
inc qword [rcx + 0x38]
nop
xor ebx, ebx
xchg qword [rcx + 0x18], rbx
mov qword [rcx + 0x88], 0
inc qword [rcx + 0x90]
nop
xor ebx, ebx
xchg qword [rcx + 0x20], rbx
mov qword [rcx + 0xe0], 0
mov qword [rcx + 0xe8], rcx
nop
movzx ebx, byte [rcx + 0x30]
nop
mov rsi, qword [rcx + 0x88]
mov edi, dword [rcx + 0x10]
mov r8d, ebx
or ebx, 4
test rsi, rsi
cmovl r8d, ebx
jmp 0x45cae5
nop
mov ebx, dword [rcx + 0x10]
mov edi, ebx
mov eax, edi
and edi, 2
or edi, r8d
lock cmpxchg dword [rcx + 0x10], edi
sete bl
test bl, bl
je 0x45cadf
nop
nop
mov rax, qword [rsp + 0x20]
call fcn.0040b520
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x18]
call fcn.0042f960
test eax, eax
je 0x45cb41
mov dword [rsp + 0x14], eax
lea rax, [0x00a5a120]
mov rbx, qword [rsp + 0x18]
call fcn.0042f020
mov ecx, dword [rsp + 0x14]
movsxd rbx, ecx
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, qword [rsp + 0x18]
xor ebx, ebx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00783bfa]
mov ebx, 0x26
nop
call fcn.00435e60
lea rax, [0x0078445e]
mov ebx, 0x27
call fcn.00435e60
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0045c9e0

Function at 0x45cba0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cc2b
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax + 0x30], 0
je 0x45cc19
nop
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x45cbce
cmp rcx, 1
jne 0x45cc08
nop
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x45cbde
cmp rcx, 1
jne 0x45cbf7
mov rbx, rax
lea rax, [0x00a5a120]
call fcn.0042f020
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007850eb]
mov ebx, 0x29
call fcn.00435e60
lea rax, [0x0078564b]
mov ebx, 0x2a
call fcn.00435e60
lea rax, [0x007826d0]
mov ebx, 0x23
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0045cba0
Function at 0x45d4e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d706
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
test byte [rax], al
lea rcx, [rax + 0x28]
mov qword [rsp + 0x20], rcx
nop
mov rax, rcx
call fcn.0040b300
mov rcx, qword [rsp + 0x38]
cmp byte [rcx + 0x30], 0
nop word [rax + rax]
jne 0x45d6ef
mov byte [rcx + 0x30], 1
inc qword [rcx + 0x38]
inc qword [rcx + 0x90]
nop
movzx edx, byte [rcx + 0x30]
nop
mov rbx, qword [rcx + 0x88]
mov rsi, qword [rcx + 0xe0]
mov edi, dword [rcx + 0x10]
mov r8d, edx
or edx, 4
test rbx, rbx
cmovl r8d, edx
mov edx, r8d
or r8d, 8
test rsi, rsi
cmovl edx, r8d
jmp 0x45d56f
nop
mov ebx, dword [rcx + 0x10]
mov edi, ebx
mov eax, edi
and edi, 2
or edi, edx
lock cmpxchg dword [rcx + 0x10], edi
sete bl
nop
test bl, bl
je 0x45d569
nop
mov rdx, qword [rcx + 0x18]
cmp rdx, 1
je 0x45d5b8
test rdx, rdx
je 0x45d5b2
mov rax, rdx
xor ebx, ebx
lock cmpxchg qword [rcx + 0x18], rbx
sete sil
test sil, sil
je 0x45d584
cmp rdx, 2
cmove rdx, rbx
jmp 0x45d5bc
xor ebx, ebx
xor edx, edx
jmp 0x45d5bc
xor ebx, ebx
xor edx, edx
nop
mov rsi, qword [rcx + 0x20]
cmp rsi, 1
je 0x45d5ec
test rsi, rsi
je 0x45d5e8
mov rax, rsi
lock cmpxchg qword [rcx + 0x20], rbx
sete dil
test dil, dil
je 0x45d5bc
cmp rsi, 2
cmove rsi, rbx
jmp 0x45d5ee
xor esi, esi
jmp 0x45d5ee
xor esi, esi
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rsi
cmp qword [rcx + 0x58], 0
je 0x45d63c
lea rax, [rcx + 0x40]
call fcn.004518c0
cmp dword [0x00a5a130], 0
jne 0x45d622
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x58], 0
nop
jmp 0x45d632
mov rcx, qword [rsp + 0x38]
lea rdi, [rcx + 0x58]
xor edx, edx
call fcn.00462dc0
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
cmp qword [rcx + 0xb0], 0
je 0x45d685
lea rax, [rcx + 0x98]
call fcn.004518c0
cmp dword [0x00a5a130], 0
jne 0x45d66d
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0xb0], 0
jmp 0x45d685
mov rcx, qword [rsp + 0x38]
lea rdi, [rcx + 0xb0]
xor ecx, ecx
nop dword [rax + rax]
call fcn.00462da0
nop
nop
mov rax, qword [rsp + 0x20]
call fcn.0040b520
mov rax, qword [rsp + 0x18]
test rax, rax
je 0x45d6b6
nop
mov ecx, 0xffffffff
lea rdx, [0x00a59ce8]
lock xadd dword [rdx], ecx
mov ebx, 4
call fcn.004388e0
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
test rax, rax
je 0x45d6e5
nop
mov ecx, 0xffffffff
lea rdx, [0x00a59ce8]
lock xadd dword [rdx], ecx
mov ebx, 4
nop dword [rax + rax]
call fcn.004388e0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00782e9e]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0045d4e0
Function at 0x45d7c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x30]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x45d9ee
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.00440200
test al, al
jne 0x45d845
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x00a0be30], 0
je 0x45d92f
mov rax, qword [rsp + 0x18]
jmp 0x45d9ab
cmp byte [0x00a0be30], 0
je 0x45d8a2
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x45d873
mov edx, dword [rdx + 0x26c]
cmp dword [rsi + 0x14], edx
je 0x45d8a7
lea rax, fcn.00454ea0
mov qword [rsp], rax
nop
call fcn.00460920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x45d8a7
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.0043a1c0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x45d8ef
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x45d8fd
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x00a06818], 0
je 0x45d925
mov ebx, 1
call fcn.004592a0
test al, al
jne 0x45d925
nop dword [rax + rax]
call fcn.00438760
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x007a8330]
call fcn.004608a0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x007a8588]
mov qword [rsp], rax
nop dword [rax]
call fcn.00460920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x45d9bf
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x45d971
nop
call fcn.00462b20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
jmp 0x45d92f
lea rax, [0x0078625b]
mov ebx, 0x2d
call fcn.00435e60
nop
Function at 0x45e840
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e8cb
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp rax, 0x20
jne 0x45e868
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 0x20], rax
call fcn.00437600
lea rax, [0x00782da2]
mov ebx, 0x24
nop
call fcn.00437f00
mov rax, qword [rsp + 0x20]
call fcn.00437c00
lea rax, [0x00772d67]
mov ebx, 9
nop dword [rax + rax]
call fcn.00437f00
mov eax, 0x20
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x00778c01]
mov ebx, 0x13
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0045e840
Function at 0x45f680
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
cmp rcx, 4
jge 0x45f710
lea rdx, [rsp + 0x38]
cmp rbx, rdx
je 0x45f704
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
shl rcx, 3
mov rax, rdx
call fcn.00463ac0
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov edx, 4
lea rbx, [rsp + 0x38]
jmp 0x45f71d
cmp rcx, 0x2a
jg 0x45f7df
mov rdx, rcx
mov rsi, qword [r14 + 0x30]
nop
inc dword [rsi + 0x23c]
mov rsi, qword [r14 + 0x30]
nop
mov rdi, r14
mov qword [rsi + 0x130], rdi
mov rsi, qword [r14 + 0x30]
mov qword [r14 + 0xe8], rsi
lea rsi, fcn.00441620
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x1f], 1
mov rsi, qword [r14 + 0x30]
mov qword [rsi + 0x2c0], rax
mov qword [rsi + 0x2c8], rcx
test rdx, rdx
jbe 0x45f7d5
mov qword [rsp + 0x58], rsi
mov qword [rsi + 0x2d0], rbx
lea rbx, [rsi + 0x2c0]
mov rax, qword [0x00a02388]
call fcn.00403f20
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + 0x2d8]
mov rsi, qword [rcx + 0x2e0]
mov rcx, qword [rcx + 0x2e8]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
call fcn.00441620
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov rcx, rdx
call fcn.00463140
lea rax, [0x0070f0c0]
lea rbx, [0x00814c40]
call fcn.004356e0
nop
call fcn.00434b60
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
Function at 0x462b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40312f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409aa0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403100
cmp byte [0x00a59c47], 0
je 0x462b95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45fb60
jmp 0x403100

Function at 0x462ba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00a5a1c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00a59c47], 0
je 0x462bd5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00a5a4c0]
aesenc xmm0, xmmword [0x00a5a4d0]
aesenc xmm0, xmmword [0x00a5a4e0]
movq rax, xmm0
ret
jmp 0x409ca0

Function at 0x462be0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00a5a1c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00a59c47], 0
je 0x462c16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00a5a4c0]
aesenc xmm0, xmmword [0x00a5a4d0]
aesenc xmm0, xmmword [0x00a5a4e0]
movq rax, xmm0
ret
jmp 0x409d00

Function at 0x464580
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00a5a440]
mov qword [rsp + 8], rdx
lea r8d, [0x00a59cb4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00462ac0
add rsp, 0x30
ret
Function at 0x464d60
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431258
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x00a5a130], 0
nop
jne 0x431112
lea rdx, [0x00464500]
mov qword [0x00a02388], rdx
jmp 0x431125
lea rdi, [0x00a02388]
lea rdx, [0x00464500]
call fcn.00462dc0
xor eax, eax
jmp 0x431140
lea r8, [0x00a5a440]
mov byte [r8 + rax], sil
inc dword [0x00a59cb4]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x431190
lea rdx, [0x00788b63]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x43115f
lea rdi, [rax + 1]
jmp 0x431185
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.0045b840
lea rdx, [0x00788b63]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x431129
jmp 0x43124d
call fcn.00430260
call fcn.004486a0
call fcn.00448740
nop
call fcn.00430d60
xor eax, eax
call fcn.00430ca0
mov dword [0x00a59d00], eax
call fcn.00430e20
call fcn.00430b80
mov dword [0x00a59ce0], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [sym.imp.kernel32.dll_GetSystemInfo]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432f00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x00a59f10], rax
mov rax, qword [sym.imp.kernel32.dll_SetProcessPriorityBoost]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.00432f80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.00463140
nop
call fcn.00460a60
nop dword [rax]
jmp 0x4310e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x4310e0
Function at 0x464f40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x439737
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x38], r14
mov dword [0x00a067d8], 0x2710
lea rax, [0x009b1080]
jmp 0x4394c6
mov qword [rsp + 0x30], rax
call fcn.0044ece0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + 0x220]
test rax, rax
jne 0x4394b0
xor eax, eax
jmp 0x4394f3
mov rcx, rax
shl rax, 6
lea rdx, [0x00a5a540]
mov qword [rdx + rax + 8], 0
mov qword [rdx + rax + 0x10], 0
lea rax, [rcx + 1]
cmp rax, 2
jl 0x4394cf
xor eax, eax
jmp 0x439520
mov rcx, rax
shl rax, 4
lea rdx, [0x00a5b0a8]
mov qword [rdx + rax], 0
mov qword [rdx + rax + 8], 0
lea rax, [rcx + 1]
cmp rax, 0x23
jl 0x4394fd
call fcn.0040bca0
call fcn.00439420
call fcn.00403dc0
nop
lea rax, [0x00a59e80]
mov ebx, 8
mov rcx, rbx
call fcn.004316e0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
call fcn.00439860
call fcn.0044ea80
call fcn.0045a5a0
call fcn.0040a620
call fcn.0044ca80
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00431780
call fcn.004457c0
call fcn.004191e0
nop
nop
lea rax, [0x00a067b8]
nop dword [rax]
call fcn.0040b300
call fcn.00464a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [0x00a067a8], rax
mov eax, dword [0x00a59ce0]
mov dword [rsp + 0x1c], eax
mov ebx, 0xa
lea rax, [0x00773512]
nop
call fcn.00407c20
call fcn.0044dd20
movsxd rcx, eax
cmp rax, rcx
mov ecx, 0
cmove ecx, eax
sete al
and eax, ebx
nop dword [rax]
test al, al
je 0x439608
test ecx, ecx
jg 0x43960c
mov ecx, dword [rsp + 0x1c]
mov eax, ecx
call fcn.00441c80
test rax, rax
jne 0x439725
nop
nop
lea rax, [0x00a067b8]
call fcn.0040b520
cmp dword [0x00a5a3e0], 1
jle 0x439665
mov byte [0x00a5a135], 1
mov byte [0x00a5a130], 1
mov rcx, qword [0x00a04000]
mov qword [rsp + 0x40], rcx
mov rdx, qword [0x00a04008]
mov qword [rsp + 0x28], rdx
xor eax, eax
nop dword [rax + rax]
jmp 0x439718
cmp qword [0x009f51b8], 0
jne 0x4396a6
mov qword [0x009f51b8], 7
cmp dword [0x00a5a130], 0
jne 0x439693
lea rax, [0x00772679]
mov qword [str.go1.18.10], rax
jmp 0x4396a6
lea rdi, str.go1.18.10
lea rax, [0x00772679]
call fcn.00462ca0
cmp qword [0x009f5208], 1
jne 0x4396df
mov qword [0x009f5208], 0
cmp dword [0x00a5a130], 0
jne 0x4396d1
mov qword [0x009f5200], 0
jmp 0x4396df
lea rdi, [0x009f5200]
xor eax, eax
call fcn.00462ca0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx + rax*8]
test byte [rdx], al
add rdx, 0x1260
mov rax, rdx
nop
call fcn.0042eb60
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + 1]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
cmp rax, rdx
jl 0x4396e9
nop dword [rax]
jmp 0x439665
lea rax, [0x00785c26]
mov ebx, 0x2b
call fcn.00435e60
nop
call fcn.00460a60
nop dword [rax]
jmp 0x439480
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x439480
Function at 0x4651a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x00787ca5]
mov ebx, 0x32
call fcn.00435e60
nop
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x45e940

Function at 0x4688a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46898e
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
test rbx, rbx
je 0x46897a
mov qword [rsp + 0x28], rax
mov rcx, qword [rax]
test rcx, rcx
je 0x4688e7
lea rdx, [0x00a59c4e]
nop
cmp rcx, rdx
je 0x4688d0
jmp 0x468917
call fcn.0045da40
mov rax, qword [rsp + 0x28]
xor ebx, ebx
lea rcx, [0x00a59c4e]
call fcn.0045bdc0
nop
test al, al
jne 0x468936
call fcn.0045da60
mov rax, qword [rsp + 0x28]
lea rdx, [0x00a59c4e]
jmp 0x4688d0
cmp qword [rsp + 0x30], rcx
jne 0x468967
add rax, 8
mov rbx, qword [rsp + 0x38]
call fcn.0045bd60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + 8]
mov rbx, qword [rsp + 0x38]
call fcn.0045bd60
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
call fcn.0045bd60
call fcn.0045da60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814df0]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814de0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004688a0
Function at 0x469cc0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x469e06
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x10], rcx
cmp rcx, 0x12
ja 0x469d48
cmp rcx, 0x11
je 0x469d3a
nop dword [rax]
cmp rcx, 0x12
jne 0x469da8
cmp qword [rax], 8
jne 0x469df1
cmp qword [rax + 8], 0
je 0x469df1
bt edx, 7
jae 0x469d28
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045be40
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x15
jne 0x469d80
cmp qword [rax], 8
jne 0x469dde
cmp qword [rax + 8], 0
je 0x469dde
bt edx, 7
jae 0x469d68
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045c600
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
je 0x469d9a
cmp rcx, 0x18
jne 0x469da8
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00736180]
call fcn.0040d400
mov qword [rax + 8], 0x11
lea rcx, [0x007778ce]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x0071b080]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814930]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814930]
nop
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00469cc0

Function at 0x46d3c0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d49b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, rbx
shl rbx, 0x20
mov rsi, rbx
lock xadd qword [rax], rbx
add rsi, rbx
mov rdi, rsi
shr rsi, 0x20
test esi, esi
jl 0x46d487
test edi, edi
je 0x46d411
nop dword [rax]
test rdx, rdx
jle 0x46d40d
cmp edx, esi
je 0x46d474
test esi, esi
jmp 0x46d413
test esi, esi
jmp 0x46d413
test esi, esi
jg 0x46d430
test edi, edi
je 0x46d430
cmp qword [rax], rdi
jne 0x46d461
mov qword [rax], 0
add rax, 8
mov qword [rsp + 0x20], rax
jmp 0x46d453
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov dword [rsp + 0x1c], edi
xor ebx, ebx
xor ecx, ecx
call fcn.0045e2e0
mov edx, dword [rsp + 0x1c]
lea edi, [rdx - 1]
mov rax, qword [rsp + 0x20]
test edi, edi
jne 0x46d43a
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814dc0]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814dc0]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814db0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0046d3c0
Function at 0x46d520
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d5a6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test byte [rax], al
nop
jmp 0x46d540
mov rax, rbx
mov rcx, qword [rax]
mov rdx, rcx
shr rcx, 0x20
test ecx, ecx
je 0x46d587
lea rcx, [rdx + 1]
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x46d53d
mov qword [rsp + 0x10], rbx
lea rax, [rbx + 8]
call fcn.0045e220
mov rcx, qword [rsp + 0x10]
cmp qword [rcx], 0
jne 0x46d591
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814dd0]
nop
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0046d520