joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009b80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x140009bb6
mov r8d, 0x6d4
lea rdx, str.C:Usersm4owDesktop_athenaoblivionimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140058a20]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14012c510]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x140009c30
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x140009c3f
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x1400169c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x14012c510]
mov edi, ecx
mov rbx, qword [rax + 0x1d18]
cmp dword [rbx + 0x108], 0
jg 0x140016a01
mov r8d, 0x6d4
lea rdx, str.C:Usersm4owDesktop_athenaoblivionimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x108]
lea r9, [0x140058a20]
mov rax, qword [rbx + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx eax, dil
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x31]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x32]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
movzx eax, byte [rsp + 0x33]
xor r8d, dword [r9 + rcx*4]
lea rcx, [rbx + 0x108]
movzx edx, r8b
xor rdx, rax
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
lea rdx, [rsp + 0x30]
not r8d
mov dword [rsp + 0x30], r8d
call fcn.14002d5c0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400182d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14012c510]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x140018330
cmp byte [rbx + 0x20d6], 0
jne 0x140018330
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140006990
test dil, 1
je 0x140018456
jmp 0x1400183bf
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140066300]
xor eax, eax
mulss xmm1, dword [0x1400662ec]
addss xmm0, dword [rbx + 0x120]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x14006623c]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140006990
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140018410
lea r11, [0x140058a20]
nop
cmp r9b, 0x23
jne 0x1400183f3
cmp byte [r8], r9b
jne 0x1400183f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400183e0
not ecx
call fcn.14000fae0
test rax, rax
je 0x140018456
cmp byte [rax + 0xcf], 0
je 0x140018456
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, 0x10
mov r9d, dword [rbx + 0x3178]
call fcn.140006990
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.1400123f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400558b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001de00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001dea7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001de5a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002d810
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400073e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14012c520]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001deaf
mov rcx, rbx
call fcn.1400073e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e400
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x14001e456
lea r11, [0x140058a20]
cmp r9b, 0x23
jne 0x14001e439
cmp byte [r8], r9b
jne 0x14001e439
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001e426
not ecx
call fcn.14001e310
test rax, rax
jne 0x14001e46f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14001e220
add rsp, 0x20
pop rbx
ret
Function at 0x140022d00
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x140022f3e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140058a20]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x140022f06
mov rcx, rbp
call fcn.140021fc0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140022dd1
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140022dc1
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140022db9
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x140022dbc
mov rdx, rcx
test rdx, rdx
jne 0x140022d90
cmp r8, r10
je 0x140022dd1
cmp dword [r8], r9d
jne 0x140022dd1
mov rcx, qword [r8 + 8]
jmp 0x140022dd3
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140022e67
cmp qword [rcx + 0x18], 0
jne 0x140022e5c
mov qword [rcx + 0x18], rbx
jmp 0x140022e67
cmp qword [rcx + 0x20], 0
jne 0x140022e67
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140022e9c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140022e90
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140006990
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140022ef8
cmp r9b, 0x23
jne 0x140022edb
cmp byte [r8], r9b
jne 0x140022edb
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140022ec8
not ecx
call fcn.14000fae0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140022d50
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400558b0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140052700
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
test r8, r8
je 0x1400527b2
test dword [rcx + 0x10], 0x100000
jne 0x140052735
mov r8d, 0x1cfe
lea rdx, str.C:Usersm4owDesktop_athenaoblivionimguiimgui_widgets.cpp
lea rcx, str.tab_bar__Flags__ImGuiTabBarFlags_DockNode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movzx r9d, byte [rsi]
lea r8, [rsi + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140052782
lea r11, [0x140058a20]
cmp r9b, 0x23
jne 0x140052765
cmp byte [r8], r9b
jne 0x140052765
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140052752
mov rcx, qword [0x14012c510]
not eax
cmp dword [rcx + 0x1d6c], eax
jne 0x140052799
mov dword [rcx + 0x1d70], eax
cmp dword [rcx + 0x1da8], eax
jne 0x140052838
mov byte [rcx + 0x1dac], 1
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14012c510]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbx + 0x1d18]
cmp dword [rdi + 0x108], 0
jg 0x1400527f4
mov r8d, 0x6d4
lea rdx, str.C:Usersm4owDesktop_athenaoblivionimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x14012c510]
movsxd rax, dword [rdi + 0x108]
xor edx, edx
mov r8, qword [rdi + 0x110]
mov rcx, rsi
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140006a10
mov rdi, qword [rsp + 0x38]
cmp dword [rbx + 0x1d6c], eax
jne 0x140052824
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x140052833
mov byte [rbx + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret

Function at 0x140056560
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400565aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400565aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400565aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400565aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400565aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400565ac
xor al, al
add rsp, 0x28
ret
Function at 0x404ea0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, rcx
shr rcx, 6
mov rsi, rcx
shl rcx, 6
nop
nop
sub rdx, rcx
add rdi, rdx
mov qword [rsp + 0x28], rdi
add rbx, rsi
add rcx, rax
mov qword [rsp + 0x30], rcx
xor eax, eax
xor esi, esi
jmp 0x404ee0
add rax, 8
nop
cmp rax, rdi
jae 0x404f4a
test rax, 0x3f
jne 0x404ef5
movzx esi, byte [rbx]
inc rbx
jmp 0x404ef7
shr esi, 1
test rdx, rdx
jbe 0x404f02
add rdx, 0xfffffffffffffff8
jmp 0x404eda
bt esi, 0
jae 0x404eda
mov qword [rsp + 0x18], rax
mov dword [rsp + 0x14], esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rcx + rax]
mov rax, rdx
call fcn.00404700
test al, al
jne 0x404f54
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
mov esi, dword [rsp + 0x14]
mov rdi, qword [rsp + 0x28]
jmp 0x404eda
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x00782a1e]
mov ebx, 0x24
call fcn.00435e60
nop
int3

Function at 0x4051c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x405368
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx]
nop
cmp rsi, 0x10000
jae 0x405356
cmp byte [rdx + 0x15], 8
ja 0x405345
mov qword [rsp + 0x20], rdx
mov rax, rbx
mul rsi
jo 0x405331
movabs rdx, 0xffffffffffa0
cmp rax, rdx
ja 0x405331
nop dword [rax + rax]
test rbx, rbx
jl 0x405331
mov qword [rsp + 0x48], rbx
test rax, rax
je 0x4052cc
mov rdx, qword [rsp + 0x20]
cmp qword [rdx + 8], 0
jne 0x405279
add rax, 0x60
xor ebx, ebx
mov ecx, 1
call fcn.0040c9e0
test byte [rax], al
lea rdx, [rax + 0x60]
cmp dword [0x00a5a130], 0
jne 0x40526b
mov qword [rax + 0x10], rdx
jmp 0x4052fa
lea rdi, [rax + 0x10]
call fcn.00462dc0
jmp 0x4052fa
mov qword [rsp + 0x18], rax
lea rax, [0x007601a0]
call fcn.0040d400
mov qword [rsp + 0x28], rax
mov rbx, qword [rsp + 0x20]
mov ecx, 1
mov rax, qword [rsp + 0x18]
nop
call fcn.0040c9e0
cmp dword [0x00a5a130], 0
jne 0x4052b9
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
jmp 0x4052c7
mov rcx, qword [rsp + 0x28]
lea rdi, [rcx + 0x10]
call fcn.00462ca0
mov rax, rcx
jmp 0x4052fa
mov eax, 0x60
xor ebx, ebx
mov ecx, 1
call fcn.0040c9e0
test byte [rax], al
lea rdi, [rax + 0x10]
cmp dword [0x00a5a130], 0
jne 0x4052f2
mov qword [rax + 0x10], rdi
jmp 0x4052fa
mov rcx, rdi
call fcn.00462da0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
mov word [rax + 0x18], dx
cmp dword [0x00a5a130], 0
jne 0x405315
mov qword [rax + 0x20], rcx
jmp 0x40531e
lea rdi, [rax + 0x20]
call fcn.00462da0
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00721a20]
lea rbx, [0x00814c50]
nop
call fcn.004356e0
lea rax, [0x0077b9bf]
mov ebx, 0x17
call fcn.00435e60
lea rax, [0x00783b62]
mov ebx, 0x26
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004051c0
Function at 0x40a0c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a1e6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rdx, qword [r14 + 0x30]
cmp dword [rdx + 0xc0], 0
jne 0x40a1d0
mov rdx, qword [0x009f47c8]
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
mov r8, rdi
shr rdi, 2
lea rdi, [rdi + rdi*2]
cmp rsi, rdi
jb 0x40a1aa
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x28], rax
lea rax, [r8 + r8]
lea rax, [rax + 2]
shl rax, 3
xor ebx, ebx
mov ecx, 1
call fcn.0040c9e0
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x18]
mov rsi, qword [rdx]
shl rsi, 1
mov qword [rax], rsi
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x00465440]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
nop dword [rax]
call fcn.0040afe0
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
mov rsi, qword [rsp + 0x18]
cmp qword [rsi + 8], rdx
jne 0x40a1bf
nop
cmp byte [0x00a5a130], 0
je 0x40a194
lea rax, [0x009f47c8]
call fcn.00403e80
mov rbx, qword [rsp + 0x20]
lea rcx, [0x009f47c8]
xchg qword [rcx], rbx
mov rdx, qword [0x009f47c8]
mov rax, qword [rsp + 0x28]
mov rbx, rax
mov rax, rdx
call fcn.0040a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0078434d]
mov ebx, 0x27
call fcn.00435e60
lea rax, [0x007764da]
mov ebx, 0xf
nop dword [rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0040a0c0

Function at 0x40b0a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b1c6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [rbx + 8]
inc rcx
mov qword [rbx + 8], rcx
nop
mov rdx, rbx
shl rbx, 0x10
mov rsi, rcx
and ecx, 0x7ffff
or rbx, rcx
mov rcx, rbx
sar rbx, 0x13
shl rbx, 3
cmp rdx, rbx
je 0x40b0ec
jmp 0x40b10e
mov rax, rsi
mov rbx, qword [rax]
mov qword [rdx], rbx
mov rsi, rax
mov rax, rbx
lock cmpxchg qword [rsi], rcx
sete bl
test bl, bl
je 0x40b0e9
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
call fcn.00437600
lea rax, [0x00786018]
mov ebx, 0x2c
call fcn.00437f00
mov rax, qword [rsp + 0x28]
nop dword [rax]
call fcn.00437e80
lea rax, [0x00771b4a]
mov ebx, 5
call fcn.00437f00
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00437d60
lea rax, [0x0077270a]
mov ebx, 8
call fcn.00437f00
mov rax, qword [rsp + 0x10]
nop dword [rax + rax]
call fcn.00437d60
lea rax, [0x00772cfb]
mov ebx, 9
call fcn.00437f00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437e80
call fcn.00437860
call fcn.00437680
lea rax, [0x00774a0d]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0040b0a0
Function at 0x40b7c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
mov rdx, rax
xor eax, eax
lock cmpxchg qword [rdx], rcx
sete cl
nop
test cl, cl
je 0x40b851
mov qword [rsp + 0x28], r14
test rbx, rbx
jge 0x40b81b
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xe5], 1
mov rcx, qword [0x009f47c0]
cmp qword [rcx], 0
jne 0x40ba3f
mov rax, 0xffffffffffffffff
call fcn.00432040
jmp 0x40b9f0
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x48], rbx
call fcn.00464a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rbx, qword [rsp + 0x48]
add rax, rbx
mov qword [rsp + 0x18], rax
jmp 0x40b87d
cmp qword [rdx], 1
jne 0x40b866
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0077fd5c]
mov ebx, 0x1e
call fcn.00435e60
mov rax, rdx
mov rbx, rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov byte [rdx + 0xe5], 1
mov rdx, qword [0x009f47c0]
cmp qword [rdx], 0
je 0x40b8ae
nop word [rax + rax]
cmp rbx, 0x989680
jle 0x40b8ae
mov ebx, 0x989680
mov rax, rbx
call fcn.00432040
test eax, eax
jge 0x40b942
mov rax, qword [0x009f47c0]
mov rax, qword [rax]
test rax, rax
je 0x40b8f3
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00462880
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe5], 0
call fcn.00464a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x18]
mov rdx, rcx
sub rcx, rax
test rcx, rcx
jg 0x40b877
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop
jmp 0x40b961
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rsi, qword [rcx]
mov rdi, qword [rdx + 0x30]
mov r8, rdi
cmp rsi, rdi
jne 0x40b991
mov rax, rsi
xor esi, esi
lock cmpxchg qword [rcx], rsi
sete dil
nop
test dil, dil
je 0x40b961
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
cmp rsi, 1
jne 0x40b9df
mov byte [r8 + 0xe5], 1
mov rax, 0xffffffffffffffff
call fcn.00432040
test eax, eax
jl 0x40b9ce
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x00787fc5]
mov ebx, 0x32
call fcn.00435e60
lea rax, [0x00787a58]
mov ebx, 0x31
call fcn.00435e60
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov byte [rcx + 0xe5], 0
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [0x009f47c0]
mov rax, qword [rax]
mov qword [rsp], rax
mov qword [rsp + 8], 0
call fcn.00462880
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, 0x989680
call fcn.00432040
test eax, eax
jl 0x40ba0f
jmp 0x40b9f0
Function at 0x40bca0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40bf9e
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [0x009ac644], 0x10
jne 0x40bf8c
xor eax, eax
jmp 0x40bce7
lea rdx, [rax + rax*2]
lea rsi, [0x009ac640]
movzx edi, word [rsi + rax*2]
lea r8, [0x00a5f5b0]
mov dword [r8 + rdx*8], edi
inc rax
cmp rax, 0x44
jl 0x40bcca
mov rdx, qword [0x00a59f10]
test rdx, rdx
je 0x40bf7b
nop dword [rax]
cmp rdx, 0x80000
ja 0x40bf0c
cmp rdx, 0x1000
jb 0x40bea0
lea rbx, [rdx - 1]
nop
test rdx, rbx
jne 0x40be4e
mov rdx, qword [0x00a59f08]
lea rbx, [rdx - 1]
test rdx, rbx
jne 0x40be05
nop dword [rax]
cmp rdx, 0x400000
jbe 0x40bd54
mov qword [0x00a59f08], 0
cmp qword [0x00a59f08], 0
jne 0x40bdda
lea rax, [0x00a1bf00]
call fcn.00425e80
call fcn.00416600
mov qword [0x00a59ec8], rax
mov eax, 0x7f
jmp 0x40bdc0
mov qword [rsp + 0x10], rax
lea rax, [0x00a32aa8]
call fcn.004190a0
mov rcx, qword [rsp + 0x10]
mov rdx, rcx
shl rcx, 0x28
movabs rbx, 0xc000000000
or rcx, rbx
mov qword [rax], rcx
mov rcx, qword [0x00a2c2b0]
mov qword [rax + 0x10], rcx
mov qword [0x00a2c2b0], rax
lea rax, [rdx - 1]
test rax, rax
jge 0x40bd7d
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rdx, [rcx + 1]
mov qword [0x00a59f00], rdx
mov rcx, qword [0x00a59f00]
cmp rcx, 0x40
sbb rdx, rdx
mov ebx, 1
shl rbx, cl
and rbx, rdx
cmp qword [0x00a59f08], rbx
jne 0x40bdcf
nop dword [rax]
jmp 0x40bd5e
call fcn.00437600
lea rax, [0x0077bc71]
mov ebx, 0x17
call fcn.00437f00
mov rax, qword [0x00a59f08]
call fcn.00437c00
lea rax, [0x0077b136]
mov ebx, 0x17
call fcn.00437f00
call fcn.00437680
lea rax, [0x0077cb1b]
mov ebx, 0x19
call fcn.00435e60
call fcn.00437600
lea rax, [0x0077842b]
mov ebx, 0x12
nop
call fcn.00437f00
mov rax, qword [0x00a59f10]
call fcn.00437c00
lea rax, [0x0077b136]
mov ebx, 0x17
nop dword [rax]
call fcn.00437f00
call fcn.00437680
lea rax, [0x00779732]
mov ebx, 0x14
call fcn.00435e60
nop dword [rax + rax]
call fcn.00437600
lea rax, [0x0077842b]
mov ebx, 0x12
call fcn.00437f00
mov rax, qword [0x00a59f10]
nop dword [rax]
call fcn.00437c00
lea rax, [0x007830e1]
mov ebx, 0x25
call fcn.00437f00
mov eax, 0x1000
nop dword [rax + rax]
call fcn.00437d00
lea rax, [0x007715e8]
mov ebx, 2
call fcn.00437f00
call fcn.00437680
lea rax, [0x00779732]
mov ebx, 0x14
call fcn.00435e60
call fcn.00437600
lea rax, [0x0077842b]
mov ebx, 0x12
nop dword [rax]
call fcn.00437f00
mov rax, qword [0x00a59f10]
call fcn.00437c00
lea rax, [0x0078296a]
mov ebx, 0x24
nop dword [rax]
call fcn.00437f00
mov eax, 0x80000
call fcn.00437d00
lea rax, [0x007715e8]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437f00
call fcn.00437680
lea rax, [0x00779732]
mov ebx, 0x14
call fcn.00435e60
lea rax, [0x0077fb7c]
mov ebx, 0x1e
call fcn.00435e60
lea rax, [0x00777637]
mov ebx, 0x11
call fcn.00435e60
nop
nop
call fcn.00460a60
jmp fcn.0040bca0
Function at 0x40c660
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c77e
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
xor edx, edx
jmp 0x40c69d
inc rdx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
lea rsi, [rcx + rbx]
mov qword [rsp + 0x28], rsi
mov rbx, rsi
call fcn.00417f60
mov rcx, rax
test rax, rax
je 0x40c75e
mov rdx, qword [rsp + 0x58]
lea rsi, [rdx - 1]
test rax, rsi
je 0x40c74c
mov qword [rsp + 0x20], rax
mov rax, rcx
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
nop dword [rax]
call fcn.00417e20
nop
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x58]
lea rdx, [rax + rdx]
lea rdx, [rdx - 1]
neg rax
and rax, rdx
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x50]
call fcn.00417f60
mov rdx, rax
mov rsi, qword [rsp + 0x20]
cmp rax, rsi
je 0x40c73a
mov rax, rdx
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
call fcn.00417e20
mov rdx, qword [rsp + 0x18]
cmp rdx, 0x63
jne 0x40c68b
jmp 0x40c76c
mov rax, rdx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rcx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x00789166]
mov ebx, 0x38
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040c660