joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64e3e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x64e65e
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
movzx edx, word [rax + 0x30]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rsi, qword [rax + 0x28]
mov eax, edx
call fcn.0064c160
test rbx, rbx
jne 0x64e473
mov rdx, qword [rsp + 0xa0]
cmp qword [rdx + 8], 0
nop
je 0x64e45f
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsi + 8]
mov r8, qword [rsi]
test rdi, rdi
je 0x64e489
mov qword [rsp + 0x48], rdi
xor eax, eax
jmp 0x64e4c8
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x27
lea rcx, [0x0078423c]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
add r8, 0x18
mov rax, r9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x68], r8
mov r9, qword [r8]
mov rbx, qword [r8 + 8]
mov rcx, qword [r8 + 0x10]
mov r10, qword [rsi + 0x70]
test rax, rax
jne 0x64e4eb
test r10, r10
jne 0x64e51a
mov rax, r9
call fcn.006400a0
test rbx, rbx
jne 0x64e54e
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x68]
mov r10, rax
mov rax, qword [rsp + 0x28]
mov r9, qword [rdx + 8]
mov r11, qword [rdx]
test r9, r9
je 0x64e537
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x40], r9
xor ecx, ecx
jmp 0x64e5df
lea r9, [rax + 1]
nop dword [rax + rax]
cmp rdi, r9
jg 0x64e4c1
jmp 0x64e489
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rax, qword [rsp + 0x28]
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x64e592
mov rbx, qword [rcx + 8]
jmp 0x64e595
mov rbx, rcx
mov qword [rsp + 0x80], rbx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x88], rdx
lea rax, [0x00787354]
mov ebx, 0x30
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
add r11, 0x18
mov rcx, r12
mov rbx, qword [r11]
mov r12, qword [r10 + 0x68]
mov r13, qword [r10 + 0x60]
cmp qword [r11 + 8], r12
jne 0x64e63c
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x60], r11
mov rax, r13
mov rcx, r12
call fcn.004029c0
test al, al
jne 0x64e64a
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x48]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x60]
lea r12, [rcx + 1]
cmp r9, r12
jg 0x64e5d8
jmp 0x64e537
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0064e3e0
Function at 0x655ea0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6560e1
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
cmp word [rax + 0x40], 0x304
nop
jne 0x6560d1
mov qword [rsp + 0x70], rax
call fcn.00654920
test rcx, rcx
jne 0x6560c1
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x320]
inc rdx
mov qword [rcx + 0x320], rdx
cmp rdx, 0x10
jg 0x655fa7
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
test rax, rax
je 0x655f57
mov edx, dword [rax + 0x10]
cmp edx, 0x5aaf7484
jne 0x655f31
lea rdx, [0x00722ba0]
cmp rax, rdx
jne 0x655f57
mov rax, rcx
call fcn.00656100
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp edx, 0xcbf0569d
jne 0x655f57
lea rdx, [0x00722ca0]
cmp rax, rdx
jne 0x655f57
mov rax, rcx
call fcn.00660e80
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rcx
mov ebx, 0xa
nop
call fcn.006539a0
movups xmmword [rsp + 0x50], xmm15
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rcx
lea rax, [0x007888a7]
mov ebx, 0x35
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rcx
mov ebx, 0xa
call fcn.006539a0
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rsp + 0x38], rax
mov qword [rax + 8], 0x23
lea rcx, [0x007827a2]
mov qword [rax], rcx
lea rbx, [0x00815340]
mov rcx, rax
lea rax, [0x0072cea0]
call fcn.0040ade0
test rax, rax
jne 0x656038
lea rcx, [0x00815340]
mov rdx, qword [rsp + 0x70]
mov qword [rdx + 0x160], rcx
cmp dword [0x00a5a130], 0
jne 0x656025
mov rcx, qword [rsp + 0x38]
mov qword [rdx + 0x168], rcx
nop
jmp 0x6560a9
lea rdi, [rdx + 0x168]
mov rcx, qword [rsp + 0x38]
call fcn.00462da0
jmp 0x6560a9
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [0x0072c3a0]
call fcn.0040d400
mov rcx, qword [rsp + 0x28]
mov qword [rax], rcx
cmp dword [0x00a5a130], 0
jne 0x65606a
mov rcx, qword [rsp + 0x30]
mov qword [rax + 8], rcx
jmp 0x656078
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x30]
call fcn.00462da0
lea rcx, [0x00815200]
mov rdx, qword [rsp + 0x70]
mov qword [rdx + 0x160], rcx
cmp dword [0x00a5a130], 0
jne 0x65609d
mov qword [rdx + 0x168], rax
jmp 0x6560a9
lea rdi, [rdx + 0x168]
call fcn.00462ca0
mov rax, qword [rdx + 0x160]
mov rbx, qword [rdx + 0x168]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00655a80
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
nop
ret
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00655ea0
Function at 0x656aa0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x656bbf
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
jmp 0x656abd
mov rax, rbx
mov ecx, dword [rax + 0x328]
bt ecx, 0
jb 0x656ba7
mov edx, ecx
or ecx, 1
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x328], ecx
sete cl
test cl, cl
je 0x656aba
test edx, edx
jne 0x656b90
mov ecx, dword [rbx + 0x20]
cmp ecx, 1
je 0x656afc
xor eax, eax
xor ecx, ecx
jmp 0x656b53
mov qword [rsp + 0x38], rbx
mov rax, rbx
call fcn.00656be0
test rax, rax
je 0x656b47
movups xmmword [rsp + 0x40], xmm15
je 0x656b1a
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x0078b2f5]
mov ebx, 0x4c
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
nop dword [rax]
call fcn.004ced20
jmp 0x656b4b
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov rdx, qword [rbx]
mov rbx, qword [rbx + 8]
mov rdx, qword [rdx + 0x18]
mov rax, rbx
call rdx
test rax, rax
je 0x656b7c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call rcx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [0x009f50b0]
mov rbx, qword [0x009f50b8]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00656aa0
Function at 0x659d00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x659def
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
movzx edx, word [rbx + 0x18]
movzx r8d, word [rbx + 0x98]
mov word [rsp + 0x2e], 0
test r8w, r8w
cmovne dx, r8w
mov word [rsp + 0x2c], dx
mov word [rsp + 0x2e], dx
mov r8, qword [rax + 0x48]
mov ebx, 1
lea rcx, [rsp + 0x2e]
mov edi, 1
mov rsi, rdi
mov rax, r8
nop dword [rax]
call fcn.0064e1a0
test bl, bl
je 0x659d92
mov rcx, qword [rsp + 0x50]
mov word [rcx + 0x40], ax
mov byte [rcx + 0x42], 1
mov word [rcx + 0x170], ax
mov word [rcx + 0x200], ax
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rax, qword [rsp + 0x50]
mov ebx, 0x46
nop dword [rax]
call fcn.006539a0
movups xmmword [rsp + 0x30], xmm15
movzx eax, word [rsp + 0x2c]
call fcn.0040a9c0
lea rcx, [0x0070f1c0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x0078862d]
mov ebx, 0x34
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
nop
call fcn.004ced20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00659d00

Function at 0x65a3e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x65a4d2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x50]
mov rcx, qword [rcx + 0x58]
movzx edx, word [rdx + 0x50]
xor ebx, ebx
jmp 0x65a413
inc rbx
cmp rbx, rcx
jge 0x65a439
movzx r8d, word [rsi + rbx*2]
nop dword [rax]
cmp r8w, dx
jne 0x65a410
nop
mov rcx, qword [0x009f5510]
mov rdx, qword [0x009f5518]
xor ebx, ebx
jmp 0x65a4b2
xor ecx, ecx
cmp dword [0x00a5a130], 0
jne 0x65a44a
mov qword [rax + 0x28], rcx
jmp 0x65a453
lea rdi, [rax + 0x28]
call fcn.00462da0
test rcx, rcx
je 0x65a470
mov rdx, qword [rax]
movzx ecx, word [rcx]
mov word [rdx + 0x5a], cx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, qword [rax]
mov ebx, 0x28
call fcn.006539a0
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x2e
lea rcx, [0x00786c28]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
inc rbx
cmp rbx, rdx
jge 0x65a4c8
mov rsi, qword [rcx + rbx*8]
nop dword [rax + rax]
cmp word [rsi], r8w
jne 0x65a4af
jmp 0x65a4ca
xor esi, esi
mov rcx, rsi
jmp 0x65a43b
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0065a3e0
Function at 0x65c3a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0xc0]
cmp r12, qword [r14 + 0x10]
jbe 0x65c6a3
sub rsp, 0x140
mov qword [rsp + 0x138], rbp
lea rbp, [rsp + 0x138]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], rcx
mov rdx, qword [rax]
mov qword [rsp + 0x98], rdx
mov rax, rdx
mov ebx, 1
call fcn.00650c40
nop dword [rax]
test rax, rax
jne 0x65c59d
mov rax, qword [rsp + 0x98]
call fcn.00654920
test rcx, rcx
jne 0x65c587
lea rdx, [0x00722aa0]
cmp rax, rdx
jne 0x65c430
mov rcx, rbx
jmp 0x65c438
mov rcx, rbx
mov ebx, 0
mov qword [rsp + 0x90], rbx
jne 0x65c4de
mov rdx, qword [rsp + 0x148]
mov r8, qword [rdx + 0x30]
mov qword [rsp + 0xd0], r8
lea rsi, [rdx + 0x38]
lea rdi, [rsp + 0xd8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046378c
mov rbp, qword [rbp]
mov r8, qword [rsp + 0xd0]
mov rax, qword [rdx + 0x98]
mov rbx, qword [rdx + 0xa0]
mov rcx, qword [rdx + 0xa8]
mov qword [rsp], r8
lea rdi, [rsp + 8]
lea rsi, [rsp + 0xd8]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046378c
mov rbp, qword [rbp]
call fcn.00679660
mov rdx, qword [rsp + 0x90]
mov r8, qword [rdx + 0x18]
cmp qword [rdx + 0x20], rbx
jne 0x65c5ad
xor ecx, ecx
xor esi, esi
jmp 0x65c60e
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xa0], rcx
mov rax, qword [rsp + 0x98]
mov ebx, 0xa
nop dword [rax + rax]
call fcn.006539a0
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xb8], rcx
lea rcx, [0x00722aa0]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0xc8], rcx
lea rax, [0x0078b00e]
mov ebx, 0x49
lea rcx, [rsp + 0xb0]
mov edi, 2
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
mov rax, rcx
mov rbx, rdi
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
mov rax, qword [rsp + 0x98]
mov ebx, 0x28
call fcn.006539a0
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x2c
lea rcx, [0x00786070]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
lea rdi, [rcx + 1]
movzx r9d, byte [rcx + rax]
movzx r10d, byte [rcx + r8]
xor r9d, r10d
or esi, r9d
mov rcx, rdi
cmp rbx, rcx
jg 0x65c5f7
nop
movzx ecx, sil
dec ecx
shr ecx, 0x1f
nop dword [rax]
cmp rcx, 1
jne 0x65c5ad
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], rbx
mov rax, rdx
call fcn.00673b00
mov rdx, qword [rsp + 0x148]
add rdx, 0x30
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, rdx
call fcn.006792e0
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x158]
cmp rcx, rdx
cmovl rdx, rcx
mov rbx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x150]
cmp rbx, rax
je 0x65c68f
mov rcx, rdx
call fcn.00463ac0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x138]
add rsp, 0x140
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0065c3a0
Function at 0x661b00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x661d67
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x661b49
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 1
cmp qword [rsp + 0x50], 0
jne 0x661c94
cmp qword [rsp + 0x80], 0
jne 0x661d53
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x661bde
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x661c32
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x661c32
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x661c94
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x661c7d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00661d80]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x661d45
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x661d3f
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x661d24
mov qword [rdi], rax
jmp 0x661d29
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x661d4b
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00661b00
Function at 0x667100
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x6672c0
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0xa0], rbx
mov rdx, qword [rax + 0x1e0]
mov rsi, qword [rax + 0x1d8]
nop dword [rax]
cmp rcx, rdx
jne 0x6672ac
xor r8d, r8d
jmp 0x667151
inc r8
cmp r8, rdx
jge 0x66716e
lea r9, [r8 + r8*2]
mov r10, qword [rbx + r9*8 + 8]
mov r9, qword [rsi + r9*8 + 8]
cmp r9, r10
je 0x66714e
jmp 0x667299
mov qword [rax + 0x1e0], rcx
mov qword [rax + 0x1e8], rdi
cmp dword [0x00a5a130], 0
jne 0x66718e
mov qword [rax + 0x1d8], rbx
jmp 0x66719a
lea rdi, [rax + 0x1d8]
call fcn.00462de0
cmp qword [rax], 0
nop
je 0x667269
mov qword [rsp + 0x98], rax
call fcn.00667060
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx + 0x10]
mov rsi, qword [rcx]
cmp rbx, rdx
ja 0x667291
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdx
mov byte [rsp + 0x58], 1
movups xmmword [rsp + 0x20], xmm15
lea rdx, [0x00667300]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rcx
lea rax, [rsp + 0x30]
mov ebx, 2
lea rdi, [rsp + 0x20]
xor ecx, ecx
call fcn.0061eb20
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x667242
xor ecx, ecx
jmp 0x667256
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
cmp rax, rcx
ja 0x66728c
sub rcx, rax
xor edx, edx
test rdx, rdx
jne 0x667279
mov rdx, qword [rsp + 0x98]
cmp qword [rdx + 8], rcx
jne 0x667279
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008142d0]
call fcn.004356e0
call fcn.00463200
mov rcx, rbx
call fcn.004631c0
lea rax, [0x0070f0c0]
lea rbx, [0x008142c0]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x008142c0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00667100
Function at 0x669120
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x669387
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x669169
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 2
cmp qword [rsp + 0x50], 0
jne 0x6692b4
cmp qword [rsp + 0x80], 0
jne 0x669373
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x6691fe
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x669252
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x669252
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x6692b4
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x66929d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x006693a0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x669365
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x66935f
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x669344
mov qword [rdi], rax
jmp 0x669349
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x66936b
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00669120
Function at 0x66d580
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x66d7e7
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x66d5c9
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 8
cmp qword [rsp + 0x50], 0
jne 0x66d714
cmp qword [rsp + 0x80], 0
jne 0x66d7d3
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x66d65e
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x66d6b2
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x66d6b2
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x66d714
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x66d6fd
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0066d800]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x66d7c5
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x66d7bf
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x66d7a4
mov qword [rdi], rax
jmp 0x66d7a9
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x66d7cb
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0066d580