joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c7c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40c9b3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x40c9a5
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.00413ac0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40c86f
mov qword [rsp + 0x20], rdx
movzx ecx, word [rcx + 0x60]
cmp rdx, rcx
jne 0x40c936
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x48]
movzx ebx, byte [rsp + 0x50]
nop dword [rax]
call fcn.00416880
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + rcx*8 + 0x28]
mov qword [rsp + 0x28], rax
call fcn.00413ac0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
jmp 0x40c872
mov rbx, rax
cmp qword [rcx + 0x38], rax
jbe 0x40c925
mov rsi, qword [rcx + 0x68]
imul rax, rsi
add rax, qword [rcx + 0x18]
movzx esi, word [rcx + 0x60]
inc esi
mov word [rcx + 0x60], si
movzx edi, si
mov r8, qword [rcx + 0x38]
cmp r8, rdi
jb 0x40c8b3
cmp rbx, rdx
sete dl
mov rbx, rcx
mov ecx, edx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 0x16], si
mov qword [rsp + 0x20], r8
nop dword [rax]
call fcn.00437600
lea rax, [0x00775c43]
mov ebx, 0xe
call fcn.00437f00
movzx eax, word [rsp + 0x16]
movzx eax, ax
nop
call fcn.00437c00
lea rax, [0x00773ae9]
mov ebx, 0xb
call fcn.00437f00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x0077bbb9]
mov ebx, 0x17
nop dword [rax + rax]
call fcn.00435e60
lea rax, [0x0077ac21]
mov ebx, 0x16
call fcn.00435e60
mov word [rsp + 0x16], cx
nop dword [rax + rax]
call fcn.00437600
lea rax, [0x0077bba2]
mov ebx, 0x17
call fcn.00437f00
movzx eax, word [rsp + 0x16]
nop dword [rax + rax]
call fcn.00437c00
lea rax, [0x00773ae9]
mov ebx, 0xb
call fcn.00437f00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x00787a89]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00435e60
mov rax, rdx
mov ecx, 0x88
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0040c7c0
Function at 0x40d460
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d4ed
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rbx, 1
je 0x40d4bc
mov rdx, qword [rax]
mov rcx, rax
mov rax, rbx
mul rdx
jo 0x40d4d9
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40d4d9
nop dword [rax + rax]
test rbx, rbx
jl 0x40d4d9
mov rbx, rcx
mov ecx, 1
call fcn.0040c9e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax]
mov rbx, rax
mov ecx, 1
mov rax, rdx
call fcn.0040c9e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00721a20]
lea rbx, [0x00814c90]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040d460

Function at 0x40d520
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40d5c6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, qword [rax + 0xa0]
nop
test rdx, rdx
je 0x40d54b
mov rdx, qword [rdx + 0x40]
jmp 0x40d552
mov rdx, qword [0x00a59ec8]
test rdx, rdx
je 0x40d5af
mov rax, qword [0x00a59e10]
nop
cmp rax, 1
jne 0x40d56a
xor eax, eax
jmp 0x40d593
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
call fcn.0040d600
movsxd rcx, eax
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, rcx
mov rcx, qword [rsp + 0x18]
mov qword [rdx], rax
mov rax, rbx
mov rbx, rcx
nop dword [rax]
call fcn.0042cb00
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x007892b6]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d520
Function at 0x40d880
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40db17
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40db05
test rbx, rbx
je 0x40d8ce
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40daf0
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40d8d3
jmp 0x40dadf
mov ebx, 8
cmp rax, 0x10000
jae 0x40d9a5
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40d91e
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40d91e
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40d947
nop
nop
lea rax, [0x00a5a180]
call fcn.0040b300
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x00a5a188]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40d979
cmp qword [rsi], 0
jne 0x40d9b7
mov eax, 0x40000
lea rbx, [0x00a5e580]
call fcn.00417960
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40da63
nop dword [rax]
jmp 0x40dab2
mov rbx, rcx
call fcn.00417960
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40d9f8
cmp byte [r14 + 0xb1], 0
je 0x40d9f8
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x00a5a188]
cmp rsi, rdi
jne 0x40da26
nop
nop
lea rax, [0x00a5a180]
call fcn.0040b520
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x00a5e580]
cmp rcx, rsi
je 0x40da56
mov rbx, rax
mov rax, rcx
call fcn.0042e920
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x00a5e580]
call fcn.0042e920
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x00a59ef8]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x00a59ef8]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40da63
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40d9b7
lea rdx, [0x00a5a188]
cmp rcx, rdx
je 0x40dacf
lea rax, [0x0078061c]
mov ebx, 0x1f
call fcn.00435e60
nop
nop
lea rax, [0x00a5a180]
call fcn.0040b520
jmp 0x40dabe
lea rax, [0x00782667]
mov ebx, 0x23
call fcn.00435e60
lea rax, [0x007855cd]
mov ebx, 0x2a
nop dword [rax]
call fcn.00435e60
lea rax, [0x0077d9c9]
mov ebx, 0x1a
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004651a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040d880
Function at 0x413c20
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413e0f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
call fcn.00437600
call fcn.00437600
lea rax, [0x00777945]
mov ebx, 0x11
call fcn.00437f00
mov rax, qword [rsp + 0x38]
call fcn.00437d60
call fcn.00437680
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x413d37
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x413dea
call fcn.00437600
lea rax, [0x007791a6]
mov ebx, 0x14
call fcn.00437f00
call fcn.00437680
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.00437600
lea rax, [0x00774c71]
mov ebx, 0xd
nop dword [rax]
call fcn.00437f00
mov rax, qword [rsp + 0x28]
call fcn.00437d60
lea rax, [0x007742e1]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437f00
mov rax, qword [rsp + 0x38]
call fcn.00437d60
lea rax, [0x007742ed]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.00437f00
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.00437c00
call fcn.00437680
call fcn.00437600
nop dword [rax]
call fcn.00437860
call fcn.00437680
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x413d70
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x00789df9]
mov ebx, 0x3e
call fcn.00435e60
call fcn.00437600
lea rax, [0x0077fea6]
mov ebx, 0x1e
call fcn.00437f00
mov rax, qword [rsp + 0x60]
call fcn.00437d60
lea rax, [0x007715af]
mov ebx, 1
nop dword [rax]
call fcn.00437f00
mov rax, qword [rsp + 0x30]
call fcn.00437d60
lea rax, [0x007715e8]
mov ebx, 2
nop dword [rax + rax]
call fcn.00437f00
call fcn.00437680
lea rax, [0x0077210b]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
call fcn.0041f660
jmp 0x413d54
call fcn.00437600
lea rax, [0x0077c684]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437f00
call fcn.00437680
jmp 0x413cb5
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00413c20
Function at 0x414660
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, rbx
or rbx, rax
or rbx, rcx
nop word [rax + rax]
test rbx, 7
jne 0x414845
cmp byte [0x00a5a134], 0
je 0x41472f
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
nop
movabs r8, 0x800000000000
add r8, rax
mov r9, r8
shr r8, 0x2a
nop dword [rax]
cmp r8, 0x40
jae 0x414835
lea r10, [0x00a2c090]
mov r8, qword [r10 + r8*8]
test byte [r8], al
shr r9, 0x16
mov r10, r9
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test r8, r8
je 0x414710
mov r11, rax
shr rax, 5
and eax, 0x1ffff
lea r12, [r8 + rax]
shr r11, 3
and r11d, 3
add r8, 0x1ffff
jmp 0x41471c
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rsi
xor eax, eax
jmp 0x414740
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rax, 8
mov r11d, r9d
cmp rcx, rax
jbe 0x41482b
mov qword [rsp + 0x20], rax
movzx r9d, byte [r12]
bt r9d, r11d
jae 0x4147d3
lea r9, [rax + rdx]
mov r13, qword [rsi + 0x1260]
mov r9, qword [r9]
mov qword [r13], 0
mov qword [r13 + 8], r9
mov r9, qword [rsi + 0x1260]
add r9, 0x10
mov qword [rsi + 0x1260], r9
cmp qword [rsi + 0x1268], r9
jne 0x4147d3
mov dword [rsp + 0x18], r11d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x1c], r10d
xor eax, eax
xor ebx, ebx
call fcn.0042ec20
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x18]
mov r12, qword [rsp + 0x38]
cmp r11d, 3
jae 0x4147e5
lea r9d, [r11 + 1]
nop dword [rax]
jmp 0x414739
cmp r8, r12
je 0x4147f5
inc r12
xor r9d, r9d
jmp 0x414739
mov rax, r12
mov ebx, r11d
mov ecx, r10d
mov rdi, r8
call fcn.00413fc0
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r10d, ecx
mov r9d, ebx
mov r8, rdi
mov r12, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
jmp 0x414739
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, r8
mov ecx, 0x40
nop dword [rax]
call fcn.00463160
lea rax, [0x007847e8]
mov ebx, 0x28
call fcn.00435e60
nop
int3
Function at 0x414a00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x414c25
mov qword [rsp + 0x58], rax
nop dword [rax]
cmp qword [rax], rdi
jne 0x414b7b
movzx edx, byte [rax + 0x17]
test dl, 0x40
jne 0x414b1d
cmp byte [0x00a5a134], 0
je 0x414a66
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
mov qword [rsp + 0x40], rdx
test byte [rdx], al
mov rsi, qword [rax + 0x20]
xor edi, edi
xor r8d, r8d
jmp 0x414a74
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rdi, 8
cmp qword [rax + 8], rdi
jbe 0x414b13
nop
test rdi, 0x3f
jne 0x414a92
movzx r8d, byte [rsi]
inc rsi
jmp 0x414a95
shr r8d, 1
bt r8d, 0
jae 0x414a70
lea r9, [rdi + rbx]
lea r10, [rdi + rcx]
mov r11, qword [rdx + 0x1260]
mov r9, qword [r9]
mov r10, qword [r10]
mov qword [r11], r9
mov qword [r11 + 8], r10
mov r9, qword [rdx + 0x1260]
add r9, 0x10
mov qword [rdx + 0x1260], r9
cmp qword [rdx + 0x1268], r9
jne 0x414a70
mov qword [rsp + 0x18], rdi
mov dword [rsp + 0x14], r8d
mov qword [rsp + 0x30], rsi
xor eax, eax
xor ebx, ebx
call fcn.0042ec20
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x18]
mov r8d, dword [rsp + 0x14]
jmp 0x414a70
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
nop dword [rax]
call fcn.00459800
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
call fcn.00437600
lea rax, [0x00784ba8]
mov ebx, 0x28
call fcn.00437f00
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.00437f00
lea rax, [0x00775d69]
mov ebx, 0xf
call fcn.00437f00
call fcn.00437680
lea rax, [0x00782e0e]
mov ebx, 0x24
call fcn.00435e60
mov qword [rsp + 0x70], rdi
call fcn.00459800
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
nop dword [rax]
call fcn.00437600
lea rax, [0x00784ba8]
mov ebx, 0x28
call fcn.00437f00
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.00437f00
lea rax, [0x00773a44]
mov ebx, 0xb
call fcn.00437f00
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00437c00
lea rax, [0x00777a77]
mov ebx, 0x12
call fcn.00437f00
mov rax, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x00782e0e]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00435e60
lea rax, [0x00785114]
mov ebx, 0x29
call fcn.00435e60
nop
int3
Function at 0x416880
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416a8a
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x416a7c
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x416a6b
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x20], rdx
lea rsi, [0x00a5a700]
nop
cmp rcx, rsi
je 0x416917
mov esi, dword [0x00a2c030]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x416a5a
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x00a2c338]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00417340
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x00a2c338]
lea rax, [rcx + rbx]
call fcn.00416fc0
test rax, rax
je 0x416a49
movzx ecx, word [rax + 0x60]
nop dword [rax]
cmp qword [rax + 0x38], rcx
je 0x416a38
mov qword [rsp + 0x18], rax
mov ecx, dword [0x00a2c030]
add ecx, 3
mov dword [rax + 0x58], ecx
lea rax, [0x00a5fc28]
call fcn.0042e9e0
test byte [rax], al
movzx ecx, byte [rsp + 0x40]
mov edx, ecx
shr cl, 1
movsx rcx, cl
nop word [rax + rax]
nop
cmp rcx, 0x44
jae 0x416a2b
lea rcx, [rax + rcx*8]
lea rcx, [rcx + 0x48]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rbx + 0x38]
movzx edi, word [rbx + 0x60]
sub rsi, rdi
lock xadd qword [rcx], rsi
cmp dl, 5
jne 0x4169c3
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x20]
lock xadd qword [rax + 0x30], rdx
mov qword [rcx + 0x20], 0
lea rax, [0x00a5fc28]
call fcn.0042eac0
mov rcx, qword [rsp + 0x18]
movzx edx, word [rcx + 0x60]
mov rbx, qword [rcx + 0x68]
imul rdx, rbx
mov rbx, qword [rcx + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rdx + 8]
lea rax, [0x00a5ab20]
mov rcx, rsi
nop
call fcn.00420a40
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 8], 0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov qword [rcx + rdx*8 + 0x28], rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov ecx, 0x44
call fcn.00463140
lea rax, [0x0077afbd]
mov ebx, 0x16
call fcn.00435e60
lea rax, [0x00775318]
mov ebx, 0xd
call fcn.00435e60
lea rax, [0x0077ab19]
mov ebx, 0x16
call fcn.00435e60
lea rax, [0x00784a68]
mov ebx, 0x28
call fcn.00435e60
mov rax, rdx
mov ecx, 0x88
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00460a60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00416880
Function at 0x417340
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417406
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x4173ef
mov ecx, dword [0x00a2c030]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x417382
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x417389
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x4173cf
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x4173b5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.0042e380
jmp 0x4173e5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.0042e380
jmp 0x4173e5
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
nop dword [rax + rax]
call fcn.00423ca0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00782f9a]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00417340

Function at 0x4175c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4176cd
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rdx, qword [0x00a2c2d8]
mov qword [rsp + 0x30], rdx
mov rsi, qword [0x00a2c2e0]
mov qword [rsp + 0x28], rsi
xor eax, eax
jmp 0x417607
mov rdi, qword [rsp + 0x20]
lea rax, [rdi + 1]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
cmp rax, rsi
jge 0x417687
mov rdi, qword [rdx + rax*8]
mov r8, rdi
shr rdi, 0x14
nop word [rax + rax]
cmp rdi, 0x40
jae 0x4176bf
mov qword [rsp + 0x20], rax
lea r9, [0x00a2c090]
mov rdi, qword [r9 + rdi*8]
test byte [rdi], al
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x210c0]
test r8, r8
je 0x417659
xor ecx, ecx
jmp 0x4176b1
mov qword [rsp + 0x18], rdi
mov eax, 0x10000
xor ebx, ebx
lea rcx, [0x00a5e578]
call fcn.0040d760
test rax, rax
je 0x417698
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x210c0], rax
jmp 0x4175f4
mov byte [0x00a59c48], 1
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x007855a3]
mov ebx, 0x2a
call fcn.00435e60
mov byte [r8 + rcx], 0
inc rcx
cmp rcx, 0x10000
jl 0x4176a9
jmp 0x4175f4
mov rax, rdi
mov ecx, 0x40
call fcn.00463160
nop
call fcn.00460a60
jmp fcn.004175c0
Function at 0x417760
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417906
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x41781a
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x41780d
lea rsi, [0x00a2c090]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x210c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x4177fd
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00463160
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.00437600
call fcn.00437600
lea rax, [0x007894b2]
mov ebx, 0x39
nop
call fcn.00437f00
mov rax, qword [rsp + 0x40]
call fcn.00437d60
call fcn.00437860
call fcn.00437680
call fcn.00437600
lea rax, [0x0077c54b]
mov ebx, 0x18
call fcn.00437f00
mov rax, qword [rsp + 0x28]
call fcn.00437d60
lea rax, [0x007715af]
mov ebx, 1
call fcn.00437f00
mov rax, qword [rsp + 0x20]
call fcn.00437d60
lea rax, [0x007715e8]
mov ebx, 2
call fcn.00437f00
call fcn.00437680
lea rax, [0x00771a1b]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.0041f660
lea rax, [0x00771891]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.0041f660
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x00780334]
mov ebx, 0x1f
nop dword [rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00417760
Function at 0x4179e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417b8b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x417a4e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417a61
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x417a85
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417a99
cmp rbx, 0x1000
jae 0x417a58
nop
jmp 0x417b09
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x417aad
xor edx, edx
jmp 0x417b00
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x417a8f
jmp 0x417a75
call fcn.00464600
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437600
lea rax, [0x0077c533]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00437f00
mov rax, qword [rsp + 0x38]
call fcn.00437c00
lea rax, [0x0077c66b]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437f00
mov rax, qword [rsp + 0x30]
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x007816b8]
mov ebx, 0x21
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004179e0