joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf200
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf2f9
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
nop dword [rax]
cmp rbx, 0x40
jne 0x4bf2e5
xor ecx, ecx
jmp 0x4bf231
inc rcx
cmp rbx, rcx
jle 0x4bf253
movzx edx, byte [rax + rcx]
nop word [rax + rax]
cmp dl, 0xa
je 0x4bf2cf
cmp dl, 0xd
jne 0x4bf22e
jmp 0x4bf2cf
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x007547e0]
call fcn.0040d400
mov dword [rax + 0x140], 0x3d
mov rbx, qword [rsp + 0x30]
cmp rax, rbx
je 0x4bf296
mov qword [rsp + 0x18], rax
mov ecx, 0x40
call fcn.00463ac0
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
jmp 0x4bf2a2
mov byte [rax + rcx + 0x40], 0xff
inc rcx
cmp rcx, 0x100
jl 0x4bf29a
mov rcx, qword [rsp + 0x38]
xor edx, edx
jmp 0x4bf2c0
movzx esi, byte [rbx + rdx]
mov byte [rax + rsi + 0x40], dl
inc rdx
nop
cmp rcx, rdx
jg 0x4bf2b4
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008143c0]
nop dword [rax]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x008143b0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004bf200

Function at 0x4c4460
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c455c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
jmp 0x4c447d
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x4c44c4
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x4c4548
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x4c447a
mov qword [rsp + 0x18], rbx
jmp 0x4c44ef
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.0045e3a0
mov rcx, qword [rsp + 0x10]
lea rdx, [rcx - 0x800000]
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x4c44d0
nop
jmp 0x4c452a
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.0045e3a0
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x4c4502
mov eax, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004c4460
Function at 0x4c4580
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c46af
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test bl, bl
je 0x4c45b8
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x4c45d7
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x4c45f5
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x4c467c
nop
test rdi, rdx
jne 0x4c461d
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x4c462f
jmp 0x4c469b
lea r8, [rbx + rdi]
test rsi, r8
je 0x4c4688
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
nop
test dil, dil
je 0x4c45f2
test r8, rdx
je 0x4c466d
mov rax, rcx
call fcn.0045e280
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
jmp 0x4c45f2
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00460a60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004c4580
Function at 0x4c4da0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c4fd9
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x90], rdi
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov r8, qword [rsp + 0x48]
bt r8, 0x3f
jae 0x4c4e0d
mov r8, qword [rsp + 0x48]
shl r8, 1
shr r8, 0x1f
movabs r9, 0xdd7b17f80
add r8, r9
jmp 0x4c4e12
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rax
nop dword [rax]
test r8, r8
jne 0x4c4e3a
mov r8, qword [rsp + 0x48]
and r8d, 0x3fffffff
test r8d, r8d
jne 0x4c4e3a
xor ecx, ecx
jmp 0x4c4e63
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call fcn.0049a640
test rax, rax
mov rdx, 0xffffffffffffffff
cmove rax, rdx
mov rsi, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x78]
test byte [rax], al
jmp 0x4c4e6a
mov rax, rdx
mov rdi, qword [rax]
bt edi, 0
jb 0x4c4eab
lea r8, [rdi + 8]
nop word [rax + rax]
test r8, 0x7ffff8
je 0x4c4fa8
mov rdx, rax
mov rax, rdi
lock cmpxchg qword [rdx], r8
sete r8b
nop dword [rax]
test r8b, r8b
je 0x4c4e67
bt edi, 0
jmp 0x4c4eae
mov rdx, rax
jae 0x4c4ed9
cmp byte [rdx + 0x21f], 0
je 0x4c4ec9
mov rdi, qword [0x00a031c0]
mov r8, qword [0x00a031c8]
jmp 0x4c4ee0
lea rdi, [0x00815e00]
lea r8, [0x00a59f90]
jmp 0x4c4ee0
xor edi, edi
xor r8d, r8d
nop
test rdi, rdi
jne 0x4c4f8e
movups xmmword [rsp + 0x38], xmm15
lea rdi, [0x004c5020]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x1f], 1
mov rax, qword [rdx + 0x1b8]
test rax, rax
jne 0x4c4f56
mov rax, qword [0x00a031d0]
mov rcx, qword [0x00a031d8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbx, rcx
mov rcx, rsi
nop dword [rax]
call fcn.0045ce60
movups xmmword [rsp + 0x28], xmm15
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx]
call rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, r8
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
nop
nop dword [rax]
call fcn.00434b60
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004c4da0
Function at 0x4c7500
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c7648
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov r13, 0
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x17], 0
movups xmmword [rsp + 0x18], xmm15
test byte [rax], al
jmp 0x4c7536
mov rax, rsi
mov rcx, qword [rax]
bt ecx, 0
jb 0x4c756a
lea rdx, [rcx + 8]
test rdx, 0x7ffff8
je 0x4c761b
mov rsi, rax
mov rax, rcx
lock cmpxchg qword [rsi], rdx
sete dl
nop
test dl, dl
je 0x4c7533
bt ecx, 0
jmp 0x4c756d
mov rsi, rax
jae 0x4c7598
cmp byte [rsi + 0x21f], 0
je 0x4c7588
mov rcx, qword [0x00a031c0]
mov rdx, qword [0x00a031c8]
jmp 0x4c75a0
lea rcx, [0x00815e00]
lea rdx, [0x00a59f90]
jmp 0x4c75a0
xor ecx, ecx
xor edx, edx
nop dword [rax]
test rcx, rcx
je 0x4c75bf
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdx
mov rax, rcx
mov rbx, rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
movups xmmword [rsp + 0x28], xmm15
lea rcx, [0x004c7680]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x17], 1
mov rax, qword [rsi + 0x10]
call fcn.00484920
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx]
call rcx
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
nop
call fcn.00434b60
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004c7500
Function at 0x4c76e0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c784b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov r13, 0
mov qword [rsp + 0x38], r13
mov byte [rsp + 0x13], 0
mov dword [rsp + 0x14], 0
movups xmmword [rsp + 0x18], xmm15
test byte [rax], al
jmp 0x4c771e
mov rax, rcx
mov rdx, qword [rax]
bt edx, 0
jb 0x4c7752
lea rsi, [rdx + 8]
test rsi, 0x7ffff8
je 0x4c781a
mov rcx, rax
mov rax, rdx
lock cmpxchg qword [rcx], rsi
sete sil
test sil, sil
je 0x4c771b
bt edx, 0
jmp 0x4c7755
mov rcx, rax
jae 0x4c7782
cmp byte [rcx + 0x21f], 0
nop
je 0x4c7772
mov rdx, qword [0x00a031c0]
mov rsi, qword [0x00a031c8]
jmp 0x4c7786
lea rdx, [0x00815e00]
lea rsi, [0x00a59f90]
jmp 0x4c7786
xor edx, edx
xor esi, esi
test rdx, rdx
je 0x4c77b1
mov dword [rsp + 0x14], 0
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rsi
mov eax, dword [rsp + 0x14]
mov rbx, rdx
mov rcx, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
movups xmmword [rsp + 0x28], xmm15
lea rdx, [0x004c7860]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x38], rdx
mov byte [rsp + 0x13], 1
mov rax, qword [rcx + 0x10]
nop dword [rax + rax]
call fcn.00487800
mov dword [rsp + 0x14], eax
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
mov byte [rsp + 0x13], 0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rdx]
call rcx
mov eax, dword [rsp + 0x14]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
nop
call fcn.00434b60
mov eax, dword [rsp + 0x14]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004c76e0
Function at 0x4c7da0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c7f01
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov r13, 0
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x23], 0
movups xmmword [rsp + 0x28], xmm15
test byte [rax], al
jmp 0x4c7dd6
mov rax, rsi
mov rdx, qword [rax]
bt edx, 0
jb 0x4c7e0b
lea r8, [rdx + 8]
test r8, 0x7ffff8
je 0x4c7ed3
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], r8
sete r8b
nop
test r8b, r8b
je 0x4c7dd3
bt edx, 0
jmp 0x4c7e0e
mov rsi, rax
jae 0x4c7e39
cmp byte [rsi + 0x21f], 0
je 0x4c7e29
mov rdx, qword [0x00a031c0]
mov r8, qword [0x00a031c8]
jmp 0x4c7e40
lea rdx, [0x00815e00]
lea r8, [0x00a59f90]
jmp 0x4c7e40
xor edx, edx
xor r8d, r8d
nop
test rdx, rdx
je 0x4c7e5f
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rbx, r8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x004c7f40]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x23], 1
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x24], edi
lea rdi, [rsp + 0x24]
mov esi, 4
nop
call fcn.0048a980
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x23], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
nop
call fcn.00434b60
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004c7da0
Function at 0x4c7fa0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c80e9
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov r13, 0
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x50], xmm15
test byte [rax], al
jmp 0x4c7fd6
mov rax, r13
mov rdx, qword [rax]
bt edx, 0
jb 0x4c800b
lea r12, [rdx + 8]
test r12, 0x7ffff8
je 0x4c80bc
mov r13, rax
mov rax, rdx
lock cmpxchg qword [r13], r12
sete r12b
test r12b, r12b
je 0x4c7fd3
bt edx, 0
jmp 0x4c800e
mov r13, rax
jae 0x4c803a
cmp byte [r13 + 0x21f], 0
je 0x4c802a
mov rdx, qword [0x00a031c0]
mov r12, qword [0x00a031c8]
jmp 0x4c8040
lea rdx, [0x00815e00]
lea r12, [0x00a59f90]
jmp 0x4c8040
xor edx, edx
xor r12d, r12d
nop
test rdx, rdx
je 0x4c805f
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r12
mov rax, rdx
mov rbx, r12
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x004c8160]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x4f], 1
mov rax, qword [r13 + 0x10]
call fcn.00489ac0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x4f], 0
mov rdx, qword [rsp + 0x70]
mov r12, qword [rdx]
call r12
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008145f0]
call fcn.004356e0
nop
call fcn.00434b60
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004c7fa0
Function at 0x4ccec0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ccf16
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
test rax, rax
jne 0x4ccef3
mov qword [rsp + 0x20], rax
nop
call fcn.004c23a0
test al, al
jne 0x4ccf02
call fcn.0045d760
mov rax, qword [rsp + 0x20]
call fcn.0045db40
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008147f0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
nop dword [rax + rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004ccec0

Function at 0x4d9700
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d986a
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rax + 0x20]
cmp rdx, 1
je 0x4d97a5
cmp rdx, 2
jne 0x4d976a
test rdi, rdi
je 0x4d9754
nop
call fcn.004da700
test rax, rax
je 0x4d9759
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.004d92e0
mov rax, qword [rsp + 0x70]
nop
call fcn.004d93c0
jmp 0x4d9835
cmp rdx, 6
jne 0x4d9856
test rdi, rdi
je 0x4d978f
call fcn.004d9e80
nop
test rax, rax
je 0x4d9794
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.004d92e0
mov rax, qword [rsp + 0x70]
call fcn.004d93c0
nop
jmp 0x4d9835
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rcx
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rcx
nop
call fcn.004d9560
mov r9, qword [rsp + 0x48]
test r9, r9
je 0x4d9835
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x10]
mov r11, qword [rax]
mov rcx, qword [rax + 0x18]
lea r12, [rcx - 1]
cmp rdx, r12
jb 0x4d984e
mov r13, qword [rsp + 0x40]
lea r15, [r13 - 1]
cmp r12, r15
jb 0x4d9843
sub rcx, r13
sub rdx, r13
lea rdi, [rdx + 1]
mov rdx, rdi
neg rdi
sar rdi, 0x3f
and r15, rdi
lea rbx, [r11 + r15]
mov rdi, rdx
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
xor r10d, r10d
call fcn.004dc400
test rax, rax
je 0x4d9835
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, r15
mov rcx, r12
call fcn.00463200
mov rcx, r12
call fcn.004631c0
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004d9700
Function at 0x4d98a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d993d
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 1
je 0x4d98e8
cmp rcx, 2
je 0x4d98d2
cmp rcx, 6
jne 0x4d9929
mov qword [rsp + 0x20], rax
call fcn.004d92e0
mov rax, qword [rsp + 0x20]
call fcn.004d93c0
jmp 0x4d9907
call fcn.004de8e0
test rax, rax
je 0x4d991f
cmp dword [rax + 0x10], 0xe0ff5cb4
jne 0x4d9907
lea rcx, [0x0070f0c0]
cmp rax, rcx
je 0x4d991f
lea rax, [0x00720ee0]
lea rbx, [0x00a59f90]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004d98a0
Function at 0x4de400
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de4a7
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rax + 0x20]
nop dword [rax]
cmp rcx, 1
je 0x4de484
mov qword [rsp + 0x38], rax
cmp rcx, 2
je 0x4de462
cmp rcx, 6
jne 0x4de493
call fcn.004de4c0
nop dword [rax]
call fcn.0040abe0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x38]
call fcn.004d93c0
lea rax, [0x0070b300]
mov rbx, qword [rsp + 0x20]
jmp 0x4de489
call fcn.004de680
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
call fcn.004d93c0
lea rax, [0x0071fa60]
mov rbx, qword [rsp + 0x18]
jmp 0x4de489
call fcn.004de8e0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004de400

Function at 0x4de4c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4de65e
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x90], rax
xor ebx, ebx
mov rcx, rbx
lea rax, [0x00718680]
call fcn.00449300
xor ecx, ecx
xor edx, edx
jmp 0x4de50e
mov rcx, rsi
mov rax, rdx
mov rdx, rdi
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rdx
mov ebx, 9
mov rax, qword [rsp + 0x90]
call fcn.004d9460
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 8
nop dword [rax]
je 0x4de622
call fcn.004de400
mov rcx, qword [rsp + 0x40]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x48]
cmp rdi, rsi
jb 0x4de565
mov rdx, qword [rsp + 0x60]
jmp 0x4de59e
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rax
lea rax, [0x00718680]
mov rbx, qword [rsp + 0x60]
nop dword [rax + rax]
call fcn.004493e0
lea rsi, [rbx + 1]
mov rbx, qword [rsp + 0x78]
mov rdx, rax
mov rdi, rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
shl rcx, 4
mov qword [rdx + rcx], rax
lea r8, [rdx + rcx]
lea r8, [r8 + 8]
cmp dword [0x00a5a130], 0
jne 0x4de5be
mov qword [rdx + rcx + 8], rbx
jmp 0x4de5cc
mov rax, rdi
mov rdi, r8
call fcn.00462de0
mov rdi, rax
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0x20], 9
jne 0x4de60b
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rdi
mov ebx, 9
call fcn.004d9460
mov rax, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rax + 0x20]
cmp r8, 8
je 0x4de631
cmp r8, 7
je 0x4de505
nop
jmp 0x4de64a
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
mov rbx, rsi
mov rcx, rdi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004de4c0
Function at 0x4de680
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de8af
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x68], rax
nop dword [rax]
call fcn.0040df40
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov ebx, 9
call fcn.004d9460
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
cmp rcx, 5
je 0x4de842
cmp rcx, 1
jne 0x4de89b
nop
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rcx
call fcn.004d9560
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x18]
lea rdi, [rsi - 1]
nop dword [rax]
cmp rdx, rdi
jb 0x4de893
mov r8, qword [rsp + 0x30]
lea rax, [r8 - 1]
cmp rdi, rax
jb 0x4de88b
sub rdx, r8
lea rcx, [rdx + 1]
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rax, rcx
sub rsi, r8
add rax, rbx
nop
mov rbx, rsi
mov rcx, rdx
nop dword [rax]
call fcn.004deb80
mov byte [rsp + 0x27], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044d200
movzx edx, byte [rsp + 0x27]
nop dword [rax]
test dl, dl
je 0x4de878
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x68]
cmp qword [rcx + 0x20], 9
jne 0x4de79a
mov rax, rcx
mov ebx, 9
call fcn.004d9460
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x28]
cmp qword [rcx + 0x20], 3
nop
jne 0x4de865
mov rax, rcx
mov ebx, 9
call fcn.004d9460
mov rax, qword [rsp + 0x68]
call fcn.004de400
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
lea rax, [0x0071fa60]
mov rbx, qword [rsp + 0x40]
nop dword [rax]
call fcn.00412b20
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
cmp dword [0x00a5a130], 0
jne 0x4de802
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
nop
jmp 0x4de810
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.00462da0
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x20], 9
jne 0x4de82b
mov ebx, 9
call fcn.004d9460
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x20]
cmp rcx, 5
je 0x4de842
cmp rcx, 4
je 0x4de6aa
nop
jmp 0x4de851
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
nop
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
mov rcx, rdi
call fcn.00463200
mov rcx, rdi
call fcn.004631c0
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
nop
jmp fcn.004de680