joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e3c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40e44d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rbx, 1
je 0x40e41c
mov rdx, qword [rax]
mov rcx, rax
mov rax, rbx
mul rdx
jo 0x40e439
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40e439
nop dword [rax + rax]
test rbx, rbx
jl 0x40e439
mov rbx, rcx
mov ecx, 1
call fcn.0040d980
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax]
mov rbx, rax
mov ecx, 1
mov rax, rdx
call fcn.0040d980
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0076f920]
lea rbx, [0x007f8d40]
call fcn.00436660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040e3c0

Function at 0x40e480
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40e526
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
test rdx, rdx
je 0x40e4ae
mov rdx, qword [rdx + 0x40]
jmp 0x40e4b5
mov rdx, qword [0x009e5c58]
test rdx, rdx
je 0x40e50f
mov rax, qword [0x009e5ba0]
cmp rax, 1
jne 0x40e4cb
xor eax, eax
jmp 0x40e4f4
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
call fcn.0040e560
movsxd rcx, eax
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, rcx
mov rcx, qword [rsp + 0x18]
mov qword [rdx], rax
mov rax, rbx
mov rbx, rcx
nop dword [rax]
call fcn.0042d2a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x007b710c]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040e480
Function at 0x40e7e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40ea77
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40ea65
test rbx, rbx
je 0x40e82e
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40ea50
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40e833
jmp 0x40ea3f
mov ebx, 8
cmp rax, 0x10000
jae 0x40e905
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40e87e
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40e87e
test byte [rsi], al
add rsi, 0x1650
jmp 0x40e8a7
nop
nop
lea rax, [0x009e5e30]
call fcn.0040c2a0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x009e5e38]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40e8d9
cmp qword [rsi], 0
jne 0x40e917
mov eax, 0x40000
lea rbx, [0x009e82e0]
call fcn.004186c0
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40e9c3
nop dword [rax]
jmp 0x40ea12
mov rbx, rcx
call fcn.004186c0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40e958
cmp byte [r14 + 0xb1], 0
je 0x40e958
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x009e5e38]
cmp rsi, rdi
jne 0x40e986
nop
nop
lea rax, [0x009e5e30]
call fcn.0040c4c0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x009e82e0]
cmp rcx, rsi
je 0x40e9b6
mov rbx, rax
mov rax, rcx
call fcn.0042f0e0
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x009e82e0]
call fcn.0042f0e0
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x009e5c88]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x009e5c88]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40e9c3
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40e917
lea rdx, [0x009e5e38]
cmp rcx, rdx
je 0x40ea2f
lea rax, [0x007b0d3f]
mov ebx, 0x1f
call fcn.00436e00
nop
nop
lea rax, [0x009e5e30]
call fcn.0040c4c0
jmp 0x40ea1e
lea rax, [0x007b23d7]
mov ebx, 0x23
call fcn.00436e00
lea rax, [0x007b46bb]
mov ebx, 0x2a
nop dword [rax]
call fcn.00436e00
lea rax, [0x007aefb2]
mov ebx, 0x1a
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00466620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040e7e0
Function at 0x40f560
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40f766
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rbx, rbx
je 0x40f642
cmp qword [rbx], 0
je 0x40f642
movzx esi, byte [rbx + 8]
nop word [rax + rax]
test sil, 4
jne 0x40f74f
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rcx
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov edi, dword [rbx + 0xc]
mov rax, rcx
mov rbx, rdi
call rsi
mov rcx, qword [rsp + 0x48]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x40]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x40f631
movzx r10d, byte [rdx + 8]
test r10b, 8
jne 0x40f614
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rsi, [r9 + r8]
movzx r8d, byte [r9 + r8]
add r8d, 0xfffffffe
cmp r8b, 3
jb 0x40f631
mov rcx, rsi
shr rax, 0x38
cmp al, 5
jae 0x40f63c
add eax, 5
mov byte [rsp + 0x17], al
jmp 0x40f680
mov esi, dword [rax + 0x54]
bt esi, 4
jae 0x40f659
mov rdx, qword [rax + 0x48]
mov rsi, qword [rdx]
mov rax, rcx
xor ebx, ebx
call rsi
lea rax, [0x009e6e60]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
movzx esi, word [rdi + 0x52]
lea rsi, [rcx + rsi]
lea rsi, [rsi - 8]
mov rcx, qword [rsi]
nop dword [rax + rax]
test rcx, rcx
je 0x40f68e
mov qword [rsp + 0x20], rcx
xor edx, edx
jmp 0x40f6a4
lea rax, [0x009e6e60]
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
inc rdx
cmp rdx, 8
jae 0x40f66c
movzx esi, byte [rdx + rcx]
cmp al, sil
je 0x40f6ba
test sil, sil
jne 0x40f6a1
jmp 0x40f68e
mov qword [rsp + 0x18], rdx
movzx esi, byte [rdi + 0x50]
imul rsi, rdx
lea rcx, [rsi + rcx]
lea rcx, [rcx + 8]
mov esi, dword [rdi + 0x54]
bt esi, 0
jae 0x40f6db
mov rcx, qword [rcx]
mov rsi, qword [rdi + 0x30]
mov rdx, qword [rsi + 0x18]
mov rsi, qword [rdx]
mov rax, qword [rsp + 0x28]
mov rbx, rcx
call rsi
test al, al
jne 0x40f70a
movzx eax, byte [rsp + 0x17]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x40]
jmp 0x40f6a1
mov rcx, qword [rsp + 0x40]
movzx edx, byte [rcx + 0x50]
movzx esi, byte [rcx + 0x51]
mov rdi, qword [rsp + 0x18]
imul rsi, rdi
lea rdx, [rsi + rdx*8]
mov rsi, qword [rsp + 0x20]
lea rdx, [rsi + rdx]
lea rdx, [rdx + 8]
mov ecx, dword [rcx + 0x54]
bt ecx, 1
jae 0x40f73d
mov rdx, qword [rdx]
mov rax, rdx
mov ebx, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x007b1680]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040f560
Function at 0x411380
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4114ea
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x41145d
cmp qword [rbx], 0
je 0x41145d
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x4114d8
cmp byte [rbx + 9], 0
jne 0x4113d8
mov rcx, qword [rbx + 0x10]
jmp 0x411480
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x411458
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x41143d
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx ebx, byte [r9 + r8]
add ebx, 0xfffffffe
cmp bl, 3
jb 0x411458
mov rcx, rdx
mov rax, rdi
jmp 0x411480
lea rax, [0x009e6e60]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
nop
test rcx, rcx
je 0x41148e
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x4114a6
lea rax, [0x009e6e60]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x41146e
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x41149f
movzx esi, byte [rbx + rcx]
cmp sil, 1
jbe 0x41149f
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007b1680]
mov ebx, 0x21
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.00411380
Function at 0x411520
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411697
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x30], ecx
nop dword [rax]
test rbx, rbx
je 0x4115fe
cmp qword [rbx], 0
je 0x4115fe
movzx ecx, byte [rbx + 8]
nop word [rax + rax]
test cl, 4
jne 0x411685
cmp byte [rbx + 9], 0
jne 0x411578
mov rcx, qword [rbx + 0x10]
jmp 0x411622
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rdx, qword [rax + 0x48]
mov rcx, qword [rdx]
mov esi, dword [rbx + 0xc]
lea rax, [rsp + 0x30]
mov rbx, rsi
call rcx
mov rcx, qword [rsp + 0x28]
movzx esi, byte [rcx + 9]
mov rdx, rcx
mov ecx, esi
mov edi, 1
shl rdi, cl
lea rcx, [rdi - 1]
mov rsi, rcx
and rcx, rax
mov rdi, qword [rsp + 0x20]
movzx r8d, word [rdi + 0x52]
imul rcx, r8
mov r9, qword [rdx + 0x18]
add rcx, qword [rdx + 0x10]
test r9, r9
je 0x4115f9
movzx edx, byte [rdx + 8]
test dl, 8
jne 0x4115dd
shr rsi, 1
and rsi, rax
imul r8, rsi
lea rdx, [r9 + r8]
movzx esi, byte [r9 + r8]
add esi, 0xfffffffe
cmp sil, 3
jb 0x4115f9
mov rcx, rdx
mov rax, rdi
jmp 0x411622
lea rax, [0x009e6e60]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx edx, word [rax + 0x52]
lea rdx, [rcx + rdx]
lea rdx, [rdx - 8]
test byte [rax], al
mov rcx, qword [rdx]
test rcx, rcx
je 0x411630
nop
lea rdx, [rcx + 8]
xor ebx, ebx
jmp 0x41164a
lea rax, [0x009e6e60]
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
add rdx, 4
cmp rbx, 8
jae 0x411611
mov esi, dword [rdx]
cmp dword [rsp + 0x30], esi
jne 0x411643
movzx esi, byte [rbx + rcx]
nop dword [rax]
cmp sil, 1
jbe 0x411643
movzx edx, byte [rax + 0x51]
imul rbx, rdx
lea rax, [rbx + rcx]
lea rax, [rax + 0x28]
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007b1680]
mov ebx, 0x21
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
jmp fcn.00411520
Function at 0x414540
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41472f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
call fcn.00438580
call fcn.00438580
lea rax, [0x007aac64]
mov ebx, 0x11
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438ce0
call fcn.00438600
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x414657
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x41470a
call fcn.00438580
lea rax, [0x007abd62]
mov ebx, 0x14
call fcn.00438e80
call fcn.00438600
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.00438580
lea rax, [0x007a8c5a]
mov ebx, 0xd
nop dword [rax]
call fcn.00438e80
mov rax, qword [rsp + 0x28]
call fcn.00438ce0
lea rax, [0x007a85bc]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438ce0
lea rax, [0x007a85c8]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00438e80
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.00438b80
call fcn.00438600
call fcn.00438580
nop dword [rax]
call fcn.004387e0
call fcn.00438600
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x414690
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x007b7aa3]
mov ebx, 0x3e
call fcn.00436e00
call fcn.00438580
lea rax, [0x007b0797]
mov ebx, 0x1e
call fcn.00438e80
mov rax, qword [rsp + 0x60]
call fcn.00438ce0
lea rax, [0x007a34a7]
mov ebx, 1
nop dword [rax]
call fcn.00438e80
mov rax, qword [rsp + 0x30]
call fcn.00438ce0
lea rax, [0x007a34e7]
mov ebx, 2
nop dword [rax + rax]
call fcn.00438e80
call fcn.00438600
lea rax, [0x007a5360]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
call fcn.0041fde0
jmp 0x414674
call fcn.00438580
lea rax, [0x007ae34b]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438e80
call fcn.00438600
jmp 0x4145d5
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00414540
Function at 0x414f80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, rbx
or rbx, rax
or rbx, rcx
nop word [rax + rax]
test rbx, 7
jne 0x415165
cmp byte [0x009e5e04], 0
je 0x415050
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
nop
movabs r8, 0x800000000000
add r8, rax
mov r9, r8
shr r8, 0x2a
nop dword [rax]
cmp r8, 0x40
jae 0x415155
lea r10, [0x009b7db8]
mov r8, qword [r10 + r8*8]
test byte [r8], al
shr r9, 0x16
mov r10, r9
and r9, 0xfffff
mov r8, qword [r8 + r9*8]
test r8, r8
je 0x415031
mov r11, rax
shr rax, 5
and rax, 0x1ffff
lea r12, [r8 + rax]
shr r11, 3
and r11, 3
add r8, 0x1ffff
jmp 0x41503d
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rsi
xor eax, eax
jmp 0x415061
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rax, 8
mov r11d, r9d
cmp rcx, rax
jbe 0x41514b
mov qword [rsp + 0x20], rax
movzx r9d, byte [r12]
bt r9d, r11d
jae 0x4150f4
lea r9, [rax + rdx]
mov r13, qword [rsi + 0x16c0]
mov r9, qword [r9]
mov qword [r13], 0
mov qword [r13 + 8], r9
mov r9, qword [rsi + 0x16c0]
add r9, 0x10
mov qword [rsi + 0x16c0], r9
cmp qword [rsi + 0x16c8], r9
jne 0x4150f4
mov dword [rsp + 0x18], r11d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x1c], r10d
xor eax, eax
xor ebx, ebx
call fcn.0042f3e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x18]
mov r12, qword [rsp + 0x38]
cmp r11d, 3
jae 0x415105
lea r9d, [r11 + 1]
nop
jmp 0x41505a
cmp r8, r12
je 0x415115
inc r12
xor r9d, r9d
jmp 0x41505a
mov rax, r12
mov ebx, r11d
mov ecx, r10d
mov rdi, r8
call fcn.004148e0
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r10d, ecx
mov r9d, ebx
mov r8, rdi
mov r12, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
jmp 0x41505a
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, r8
mov ecx, 0x40
nop dword [rax]
call fcn.00464640
lea rax, [0x007b3c28]
mov ebx, 0x28
call fcn.00436e00
nop
int3
Function at 0x4171a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41740d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x4173ff
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x4173ee
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x58], bl
mov qword [rsp + 0x38], rdx
lea rsi, [0x009e6280]
nop
cmp rcx, rsi
je 0x417237
mov esi, dword [0x009b7d48]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x4173dd
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x009b8060]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.004180a0
mov rdx, qword [rsp + 0x38]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x009b8060]
lea rax, [rcx + rbx]
call fcn.004179a0
test rax, rax
je 0x4173cc
movzx ecx, word [rax + 0x60]
nop dword [rax]
cmp qword [rax + 0x38], rcx
je 0x4173bb
mov qword [rsp + 0x28], rax
mov ecx, dword [0x009b7d48]
add ecx, 3
mov dword [rax + 0x58], ecx
lea rax, [0x009e9988]
call fcn.0042f1a0
test byte [rax], al
movzx ecx, byte [rsp + 0x58]
mov edx, ecx
shr cl, 1
movsx rcx, cl
nop word [rax + rax]
nop
cmp rcx, 0x44
jae 0x4173ae
lea rcx, [rax + rcx*8]
lea rcx, [rcx + 0x48]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rbx + 0x38]
movzx edi, word [rbx + 0x60]
sub rsi, rdi
lock xadd qword [rcx], rsi
cmp dl, 5
jne 0x4172e3
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x20]
lock xadd qword [rax + 0x30], rdx
mov qword [rcx + 0x20], 0
lea rax, [0x009e9988]
call fcn.0042f2a0
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0x60]
mov rbx, qword [rcx + 0x68]
imul rdx, rbx
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
sub rbx, rdx
lea rdx, [0x009e6490]
lock xadd qword [rdx], rbx
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rdx + 8]
lea rsi, [0x009e6498]
lock xadd qword [rsi], rbx
mov qword [rdx + 8], 0
cmp byte [0x00997b50], 0
je 0x41737b
nop
mov qword [rsp + 0x30], 0
mov rdx, qword [0x009e6490]
mov qword [rsp + 0x30], rdx
mov eax, 0x21
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
call fcn.00454880
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
cmp dword [0x009e599c], 0
je 0x41739a
lea rax, [0x009e6460]
call fcn.00420720
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov qword [rdx + rax*8 + 0x28], rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, rcx
mov ecx, 0x44
call fcn.00464620
lea rax, [0x007ad2eb]
mov ebx, 0x16
call fcn.00436e00
lea rax, [0x007a9050]
mov ebx, 0xd
call fcn.00436e00
lea rax, [0x007acf65]
mov ebx, 0x16
call fcn.00436e00
lea rax, [0x007b3cc8]
mov ebx, 0x28
call fcn.00436e00
mov rax, rdx
mov ecx, 0x88
call fcn.00464620
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00461f00
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004171a0
Function at 0x4178c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41798a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [0x009b7d48]
mov edx, dword [rax + 0x488]
cmp edx, ecx
je 0x417921
lea ebx, [rcx - 2]
cmp edx, ebx
jne 0x41792b
mov qword [rsp + 0x28], rax
call fcn.004176e0
mov rax, qword [rsp + 0x28]
nop
call fcn.0044b000
mov ecx, dword [0x009b7d48]
mov rdx, qword [rsp + 0x28]
xchg dword [rdx + 0x488], ecx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rsp + 0x10], ecx
mov dword [rsp + 0x14], edx
call fcn.00438580
lea rax, [0x007a8f25]
mov ebx, 0xd
call fcn.00438e80
mov eax, dword [rsp + 0x14]
call fcn.00438b80
lea rax, [0x007b037d]
mov ebx, 0x1e
nop
call fcn.00438e80
mov eax, dword [rsp + 0x10]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007a88c8]
mov ebx, 0xc
call fcn.00436e00
nop
mov qword [rsp + 8], rax
call fcn.00461f00
mov rax, qword [rsp + 8]
jmp fcn.004178c0
Function at 0x4180a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418166
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x418153
mov ecx, dword [0x009b7d48]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x4180e2
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x4180e9
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x41812f
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x418115
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042eb40
jmp 0x418149
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042eb40
jmp 0x418149
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
call fcn.00423f60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x007b2b85]
mov ebx, 0x24
nop
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004180a0
Function at 0x4184c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418666
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x41857c
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x41856f
lea rsi, [0x009b7db8]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and rbx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x210c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and rcx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x41855f
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00464640
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.00438580
call fcn.00438580
lea rax, [0x007b7379]
mov ebx, 0x39
call fcn.00438e80
mov rax, qword [rsp + 0x40]
call fcn.00438ce0
call fcn.004387e0
call fcn.00438600
call fcn.00438580
lea rax, [0x007ae25a]
mov ebx, 0x18
call fcn.00438e80
mov rax, qword [rsp + 0x28]
call fcn.00438ce0
lea rax, [0x007a34a7]
mov ebx, 1
call fcn.00438e80
mov rax, qword [rsp + 0x20]
call fcn.00438ce0
lea rax, [0x007a34e7]
mov ebx, 2
call fcn.00438e80
call fcn.00438600
lea rax, [0x007a3b31]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041fde0
lea rax, [0x007a3834]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop
call fcn.0041fde0
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x007b0a57]
mov ebx, 0x1f
nop dword [rax]
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004184c0