joyce8/EMBER2024-capa huggingface dataset:
Function at 0x688de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x688f8f
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x688e07
inc rcx
cmp rbx, rcx
jle 0x688f81
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x688e04
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0057f800
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x009f4f70]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00684e80
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x688f70
test rdx, rdx
je 0x688f61
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x688f2b
xor eax, eax
lea rbx, [0x00813d30]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x0077168a]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044cfe0
jmp 0x688f52
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007715b5]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044cf00
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00688de0
Function at 0x68b8e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x68ba5d
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
cmp byte [rax + 0x98], 0
nop
jne 0x68b90c
cmp dword [rax + 0x30], 0
ja 0x68ba03
mov qword [rsp + 0x58], rax
mov rbx, qword [rax + 0x58]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rax + 0x68]
mov eax, 5
call fcn.0068ba80
test rsi, rsi
jne 0x68b9f3
mov rdx, qword [rsp + 0x58]
mov esi, dword [rdx + 0x38]
cmp rax, rsi
ja 0x68b99f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
nop
mov dword [rdx + 0x34], eax
mov rax, rdx
call fcn.0068abe0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x58]
mov qword [rdx + 0x60], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rdx + 0x68], rcx
cmp dword [0x00a5a130], 0
jne 0x68b983
mov rcx, qword [rsp + 0x30]
mov qword [rdx + 0x58], rcx
jmp 0x68b991
lea rdi, [rdx + 0x58]
mov rcx, qword [rsp + 0x30]
call fcn.00462da0
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x23
lea rcx, [0x00782414]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00733680]
lea rbx, [rsp + 0x38]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x00816320]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
mov rbx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x47
lea rcx, [0x0078ad42]
mov qword [rax], rcx
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00815340]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00733680]
lea rbx, [rsp + 0x38]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x00816320]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0068b8e0
Function at 0x68ea00
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x68eaf1
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rdx, qword [rbx]
mov rsi, qword [rbx + 8]
nop
cmp rsi, 5
jne 0x68ea40
cmp dword [rdx], 0x70747468
jne 0x68ea40
cmp byte [rdx + 4], 0x73
jne 0x68ea40
mov rdx, qword [rax + 0x38]
jmp 0x68ea93
cmp rsi, 4
jne 0x68ea91
cmp dword [rdx], 0x70747468
jne 0x68ea91
mov rdx, qword [rax + 0x40]
test rdx, rdx
je 0x68ea93
cmp byte [rax + 0x30], 0
je 0x68ea93
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x52
lea rcx, [0x0078b6a0]
mov qword [rax], rcx
lea rbx, [0x00815340]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor edx, edx
test rdx, rdx
je 0x68eae1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x18], rdx
mov rax, rbx
call fcn.0068f660
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x30]
call fcn.0068ece0
test al, al
je 0x68ead1
mov rax, qword [rsp + 0x18]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0068ea00
Function at 0x695ae0
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x695d16
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xa8], rbx
xor edx, edx
jmp 0x695b63
mov r8, qword [rsp + 0x50]
lea rdx, [r8 + 1]
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xb8]
cmp rsi, rdx
jle 0x695c33
mov qword [rsp + 0x50], rdx
mov rbx, qword [rcx]
movzx eax, byte [rdi + rdx]
mov rdx, rcx
call rbx
nop dword [rax]
test al, al
jne 0x695b32
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0xb8]
movzx ecx, byte [rdx + rcx]
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rsi, [0x0070f280]
mov qword [rsp + 0x70], rsi
lea rdi, [0x009bba60]
lea rcx, [rdi + rcx*8]
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [0x00788ecd]
mov ebx, 0x37
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.005cd520
lea rax, [0x0070f280]
xor ebx, ebx
mov rcx, qword [rsp + 0xc0]
nop dword [rax + rax]
call fcn.00449300
xor ecx, ecx
xor edx, edx
mov rbx, qword [rsp + 0xc0]
jmp 0x695c58
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov r8, qword [rsp + 0x48]
lea rcx, [r8 + 1]
mov rdx, rsi
mov rbx, rdi
mov rsi, qword [rsp + 0xc0]
cmp rsi, rcx
jle 0x695cf9
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0xb8]
movzx eax, byte [rbx + rcx]
mov byte [rsp + 0x47], al
mov rdx, qword [rsp + 0xb0]
mov rsi, qword [rdx]
call rsi
test al, al
je 0x695ce5
mov rcx, qword [rsp + 0x58]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x60]
cmp rdi, rsi
jb 0x695cb8
mov rax, qword [rsp + 0x68]
jmp 0x695cd5
lea rax, [0x0070f280]
mov rbx, qword [rsp + 0x68]
call fcn.004493e0
lea rsi, [rbx + 1]
mov rdi, rcx
mov rcx, qword [rsp + 0x58]
movzx r8d, byte [rsp + 0x47]
mov byte [rax + rcx], r8b
nop
jmp 0x695c49
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
jmp 0x695c49
mov rbx, rax
mov rcx, rdx
xor eax, eax
call fcn.0044d200
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.00695ae0
Function at 0x698080
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x6981d6
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0x2c], ebx
nop word [rax + rax]
test rcx, rcx
je 0x69816c
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
call fcn.0040aa40
lea rcx, [0x0070f200]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040aa40
lea rcx, [0x00721720]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x30]
nop dword [rax]
test rcx, rcx
je 0x698129
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x80], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x88], rdx
lea rax, [0x007820d7]
mov ebx, 0x22
lea rcx, [rsp + 0x60]
mov edi, 3
mov rsi, rdi
call fcn.004d1ba0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
call fcn.0040aa40
lea rcx, [0x0070f200]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x2c]
call fcn.0040aa40
lea rcx, [0x00721720]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x0077ff00]
mov ebx, 0x1e
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.004d1ba0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov dword [rsp + 8], eax
mov dword [rsp + 0xc], ebx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
call fcn.00460a60
mov eax, dword [rsp + 8]
mov ebx, dword [rsp + 0xc]
mov rcx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
nop
jmp fcn.00698080
Function at 0x698d20
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x698f3b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
cmp qword [rax + 0xb8], 0
jne 0x698ddd
lea rax, [0x0073eec0]
call fcn.0040d400
cmp dword [0x00a5a130], 0
nop
jne 0x698d70
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0xc0], rax
jmp 0x698d85
mov rdx, qword [rsp + 0x50]
lea rdi, [rdx + 0xc0]
nop dword [rax]
call fcn.00462ca0
xor ebx, ebx
lea rcx, [0x00815120]
mov rdi, rax
xor eax, eax
call fcn.00698f80
cmp dword [0x00a5a130], 0
nop
jne 0x698db0
mov rdx, qword [rsp + 0x50]
mov qword [rdx + 0xb8], rax
jmp 0x698dc5
mov rdx, qword [rsp + 0x50]
lea rdi, [rdx + 0xb8]
nop dword [rax]
call fcn.00462ca0
mov byte [rax + 0xb4], 0
mov rsi, qword [rdx + 0xb8]
mov byte [rsi + 0xa1], 1
mov rax, rdx
mov rdx, qword [rax + 0xc0]
mov rbx, qword [rax + 0x88]
mov rcx, qword [rax + 0x90]
mov rdi, qword [rax + 0x98]
mov rax, rdx
nop dword [rax]
call fcn.00474280
mov rdx, qword [rsp + 0x50]
mov rax, qword [rdx + 0xb8]
call fcn.006991c0
test rcx, rcx
je 0x698e81
lea rax, [0x00710780]
call fcn.0040d400
lea rcx, [0x00766080]
mov qword [rax], rcx
cmp dword [0x00a5a130], 0
jne 0x698e45
mov r8, qword [rsp + 0x50]
mov qword [rax + 8], r8
jmp 0x698e53
lea rdi, [rax + 8]
mov r8, qword [rsp + 0x50]
call fcn.00462e20
mov rdx, qword [r8 + 0xd0]
mov r8, qword [rdx]
mov ebx, 0x35
mov rcx, rax
mov edi, 1
mov rsi, rdi
lea rax, [0x00788734]
call r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.0069dd40
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x007112c0]
call fcn.0040d400
mov qword [rsp + 0x30], rax
lea rcx, [0x00766080]
mov qword [rax], rcx
cmp dword [0x00a5a130], 0
jne 0x698ebf
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
jmp 0x698ecd
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x50]
call fcn.00462da0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov rdx, qword [rsp + 0x30]
mov qword [rdx + 0x10], rcx
cmp dword [0x00a5a130], 0
jne 0x698efb
mov qword [rdx + 0x18], rax
jmp 0x698f05
lea rdi, [rdx + 0x18]
nop
call fcn.00462ca0
mov r8, qword [rsp + 0x50]
mov r8, qword [r8 + 0xd0]
mov r9, qword [r8]
lea rax, [0x0077d829]
mov ebx, 0x1a
mov rcx, rdx
mov edi, 2
mov rsi, rdi
mov rdx, r8
call r9
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00698d20
Function at 0x69a480
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x69a5ac
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [rax], 0
nop dword [rax + rax]
je 0x69a598
xor ecx, ecx
jmp 0x69a4b0
inc rcx
mov rax, r8
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
mov r8, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov r9, rdx
imul rdi
add rdi, rdx
sar rdi, 2
cmp rcx, rdi
jge 0x69a564
lea rax, [rcx + rcx*2]
lea rdi, [rax + rax]
lea rdi, [rdi + 2]
cmp r9, rdi
jb 0x69a58d
mov r10, rax
shl rax, 1
nop word [rax + rax]
cmp rdi, rax
jb 0x69a585
mov rdx, r9
sub r9, rax
mov r11, r9
neg r9
sar r9, 0x3f
and rax, r9
lea r9, [r10 + r10]
lea r9, [r9 + 6]
movzx r10d, word [rsi + rax]
cmp rdx, r9
jb 0x69a57d
cmp r9, rdi
jb 0x69a572
lea r9, [r11 - 2]
neg r9
sar r9, 0x3f
and rdi, r9
rol r10w, 8
mov eax, dword [rsi + rdi]
cmp bx, r10w
jne 0x69a4aa
bswap eax
mov ebx, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdi
mov rcx, r9
call fcn.00463200
mov rcx, r9
call fcn.004631c0
mov rcx, rdi
call fcn.00463200
mov rcx, rdi
mov rdx, r9
call fcn.004631c0
lea rax, [0x0070f0c0]
lea rbx, [0x008147e0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov word [rsp + 0x10], bx
call fcn.00460a60
mov rax, qword [rsp + 8]
movzx ebx, word [rsp + 0x10]
jmp fcn.0069a480

Function at 0x69a5e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x69a726
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp byte [rax], 0
nop dword [rax + rax]
je 0x69a712
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
xor ecx, ecx
jmp 0x69a627
mov rsi, qword [rsp + 0x10]
lea rcx, [rsi + 1]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rax + 0x20]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
movabs rax, 0xaaaaaaaaaaaaaaab
mov r9, rdx
imul rdi
add rdi, rdx
sar rdi, 2
cmp rcx, rdi
jge 0x69a6de
lea rax, [rcx + rcx*2]
lea rdi, [rax + rax]
lea rdi, [rdi + 2]
nop
cmp r9, rdi
jb 0x69a707
mov r10, rax
shl rax, 1
cmp rdi, rax
jb 0x69a6ff
mov rdx, r9
sub r9, rax
mov r11, r9
neg r9
sar r9, 0x3f
and rax, r9
lea r9, [r10 + r10]
lea r9, [r9 + 6]
movzx eax, word [rsi + rax]
cmp rdx, r9
jb 0x69a6f7
nop dword [rax]
cmp r9, rdi
jb 0x69a6ec
mov qword [rsp + 0x10], rcx
mov rcx, qword [rbx]
lea r8, [r11 - 2]
neg r8
sar r8, 0x3f
and rdi, r8
rol ax, 8
mov esi, dword [rsi + rdi]
bswap esi
mov rdx, rbx
mov ebx, esi
call rcx
test rax, rax
je 0x69a614
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rdi
mov rcx, r9
call fcn.00463200
mov rcx, r9
call fcn.004631c0
mov rcx, rdi
call fcn.00463200
mov rcx, rdi
mov rdx, r9
call fcn.004631c0
lea rax, [0x0070f0c0]
lea rbx, [0x008147e0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0069a5e0
Function at 0x6a2a40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x6a2c55
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov r13, 0
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov byte [rsp + 0x1b], 0
mov rcx, rax
xor eax, eax
mov edx, 1
lock cmpxchg dword [rcx + 0x50], edx
sete dl
lea rax, [rcx + 0x50]
test dl, dl
jne 0x6a2ac3
mov qword [rsp + 0x28], rax
call fcn.0046bb80
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
movups xmmword [rsp + 0x30], xmm15
lea rdx, [0x006a2c80]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0xa0], rdx
mov byte [rsp + 0x1b], 1
mov rdx, qword [rcx + 0x88]
cmp dword [0x00a5a130], 0
jne 0x6a2b05
mov qword [rcx + 0x88], rbx
jmp 0x6a2b11
lea rdi, [rcx + 0x88]
call fcn.00462de0
cmp qword [rcx + 0x98], 0
jne 0x6a2b7a
cmp byte [rbx], 0
nop
je 0x6a2c2c
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x20]
xor eax, eax
mov rbx, rdx
call fcn.0044d200
mov rdx, qword [rsp + 0xb8]
mov qword [rdx + 0x98], rbx
cmp dword [0x00a5a130], 0
jne 0x6a2b5e
mov qword [rdx + 0x90], rax
jmp 0x6a2b6a
lea rdi, [rdx + 0x90]
call fcn.00462ca0
mov rcx, rdx
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0xc0]
test rdx, rdx
je 0x6a2b90
mov edx, dword [rdx + 0x10]
test edx, edx
je 0x6a2b90
mov rsi, qword [rcx + 0x88]
mov dword [rsi + 0x10], edx
mov edx, dword [rbx + 0xc]
mov dword [rsp + 0x1c], edx
mov rbx, qword [rcx + 0xa0]
lea rdi, [rsp + 0x40]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046342b
mov rbp, qword [rbp]
lea rax, [0x0071fee0]
lea rcx, [rsp + 0x40]
call fcn.0040f360
jmp 0x6a2bd7
lea rax, [rsp + 0x40]
call fcn.0040f5e0
mov rsi, qword [rsp + 0x40]
nop dword [rax]
test rsi, rsi
je 0x6a2c0a
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx]
mov edx, dword [rsp + 0x1c]
cmp dword [rsi], edx
jbe 0x6a2bcd
mov rbx, qword [0x00a036a0]
mov rcx, qword [0x00a036a8]
call fcn.006a0460
jmp 0x6a2bcd
mov byte [rsp + 0x1b], 0
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rdx]
call rax
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008147e0]
call fcn.004356e0
nop
call fcn.00434b60
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006a2a40
Function at 0x6a31a0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6a3314
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rcx, rax
xor eax, eax
mov edx, 1
lock cmpxchg dword [rcx + 0x50], edx
sete dl
lea rax, [rcx + 0x50]
test dl, dl
jne 0x6a31ef
mov qword [rsp + 0x30], rax
nop dword [rax]
call fcn.0046bb80
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx + 0xa0]
test rdx, rdx
je 0x6a3202
mov rdx, qword [rdx]
nop
jmp 0x6a3204
xor edx, edx
test rdx, rdx
jg 0x6a3213
cmp qword [rcx + 0xa8], 0
jle 0x6a3234
nop
mov edx, 0xffffffff
lock xadd dword [rcx + 0x50], edx
lea ebx, [rdx - 1]
test ebx, ebx
je 0x6a322a
call fcn.0046be80
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov byte [rcx + 0x82], 1
mov edx, dword [rcx + 0xb0]
nop
mov esi, 0xffffffff
lock xadd dword [rcx + 0x50], esi
lea ebx, [rsi - 1]
test ebx, ebx
je 0x6a3265
mov dword [rsp + 0x2c], edx
call fcn.0046be80
mov rcx, qword [rsp + 0x78]
mov edx, dword [rsp + 0x2c]
cmp byte [0x00a59c35], 0
je 0x6a32fc
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
lea rbx, [0x00768380]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
movzx ebx, byte [rcx + 0x24]
lea rsi, [0x0070ce00]
mov qword [rsp + 0x48], rsi
lea rsi, [0x009bba60]
lea rbx, [rsi + rbx*8]
mov qword [rsp + 0x50], rbx
lea eax, [rdx - 2]
call fcn.0040aa40
lea rcx, [0x0070f200]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
nop
cmp byte [0x00a59c35], 0
je 0x6a32f7
nop
lea rax, [0x0078a96d]
mov ebx, 0x45
lea rcx, [rsp + 0x38]
mov edi, 3
mov rsi, rdi
call fcn.005cd520
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rdx + 0x18]
call rcx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.006a31a0
Function at 0x6a3a40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6a3cf4
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rdx, qword [rax + 0x38]
lea rbx, [0x007724f8]
mov ecx, 7
mov rax, rdx
call fcn.005e72e0
test rbx, rbx
jne 0x6a3b91
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x0075c9c0]
lea rcx, [0x007775d1]
mov edi, 0x11
call fcn.00412320
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
je 0x6a3b29
cmp rbx, 1
jg 0x6a3ae2
mov rsi, qword [rdx]
mov r8, qword [rdx + 8]
nop dword [rax]
test r8, r8
je 0x6a3b29
cmp r8, 7
jne 0x6a3ae2
cmp dword [rsi], 0x6e756863
jne 0x6a3ae2
cmp word [rsi + 4], 0x656b
jne 0x6a3ae2
cmp byte [rsi + 6], 0x64
nop
je 0x6a3b29
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
call fcn.0040abe0
lea rdx, [0x0070bf40]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x007881bd]
mov ebx, 0x33
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x0075c9c0]
lea rcx, [0x00773454]
mov edi, 0xa
call fcn.00412320
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
je 0x6a3c04
nop
cmp rbx, 1
jg 0x6a3c12
mov rsi, qword [rdx + 8]
mov rdi, qword [rdx]
test rsi, rsi
je 0x6a3c04
nop word [rax + rax]
cmp rsi, 5
jne 0x6a3c98
xor eax, eax
jmp 0x6a3c61
movups xmmword [rsp + 0x28], xmm15
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rdx + 0x38]
lea rax, [0x0075c9c0]
lea rcx, [0x007724f8]
mov edi, 7
call fcn.00412320
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.0040abe0
lea rdx, [0x0070bf40]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x00784f51]
mov ebx, 0x29
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
mov rax, rdx
nop dword [rax + rax]
call fcn.0040abe0
lea rdx, [0x0070bf40]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
lea rax, [0x00785e8c]
mov ebx, 0x2c
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rax
cmp rax, rsi
jge 0x6a3c04
movzx r8d, byte [rax + rdi]
lea r9d, [r8 - 0x41]
cmp r9b, 0x19
ja 0x6a3c79
add r8d, 0x20
lea r9, [0x00771d20]
movzx r9d, byte [r9 + rax]
lea r10d, [r9 - 0x41]
cmp r10b, 0x19
ja 0x6a3c93
add r9d, 0x20
cmp r8b, r9b
je 0x6a3c5e
nop dword [rax + rax]
cmp rsi, 0xa
jne 0x6a3c12
xor eax, eax
jmp 0x6a3cb1
inc rax
cmp rax, rsi
jge 0x6a3c04
movzx r8d, byte [rax + rdi]
lea r9d, [r8 - 0x41]
cmp r9b, 0x19
ja 0x6a3ccd
add r8d, 0x20
lea r9, [0x0077392c]
movzx r9d, byte [r9 + rax]
lea r10d, [r9 - 0x41]
nop dword [rax]
cmp r10b, 0x19
ja 0x6a3cea
add r9d, 0x20
cmp r8b, r9b
je 0x6a3cae
jmp 0x6a3c12
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.006a3a40