joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417dea
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417c3b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417c4e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x417c70
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417c84
cmp rbx, 0x1000
jae 0x417c45
jmp 0x417d0e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417c96
xor esi, esi
jmp 0x417d00
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00433080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x417c7a
jmp 0x417c62
call fcn.00464600
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417d89
call fcn.00437600
lea rax, [0x0077cf1c]
mov ebx, 0x19
call fcn.00437f00
mov rax, qword [rsp + 0x68]
call fcn.00437c00
lea rax, [0x0077c66b]
mov ebx, 0x19
nop
call fcn.00437f00
mov eax, dword [rsp + 0x34]
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x00775318]
mov ebx, 0xd
call fcn.00435e60
cmp eax, 0x5af
je 0x417d33
call fcn.00437600
lea rax, [0x0077cf1c]
mov ebx, 0x19
call fcn.00437f00
mov rax, qword [rsp + 0x38]
call fcn.00437c00
lea rax, [0x0077c66b]
mov ebx, 0x19
nop dword [rax]
call fcn.00437f00
mov eax, dword [rsp + 0x34]
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x0078063b]
mov ebx, 0x1f
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417bc0
Function at 0x4190a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4191ae
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x419181
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x419108
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x4190fb
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00463800
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x419138
mov edx, dword [rax + 0x2c]
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov rax, rdx
call fcn.0040d760
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov esi, dword [rdx + 0x2c]
mov dword [rdx + 0x28], esi
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x419160
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00437600
lea rax, [0x00788591]
mov ebx, 0x34
call fcn.00437f00
call fcn.00437680
lea rax, [0x0077bb5d]
mov ebx, 0x17
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.004190a0
Function at 0x41bd40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x41bee6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x00a59cd8], 0
nop
jne 0x41becf
mov qword [rsp + 0x28], rax
nop
nop
lea rax, [0x00a1bf00]
call fcn.0040b300
add dword [0x00a2c030], 2
nop
nop
xor ecx, ecx
lea rdx, [0x00a0471c]
xchg dword [rdx], ecx
nop
xor ecx, ecx
lea rdx, [0x00a2c058]
xchg qword [rdx], rcx
mov rcx, qword [0x00a2c2d8]
mov rdx, qword [0x00a2c2e0]
mov rbx, qword [0x00a2c2e8]
mov qword [0x00a2c2f8], rdx
mov qword [0x00a2c300], rbx
cmp dword [0x00a5a130], 0
jne 0x41bdcf
mov qword [0x00a2c2f0], rcx
jmp 0x41bddb
lea rdi, [0x00a2c2f0]
call fcn.00462da0
nop
xor ecx, ecx
lea rdx, [0x00a2c080]
xchg qword [rdx], rcx
nop
xor ecx, ecx
lea rdx, [0x00a2c088]
xchg qword [rdx], rcx
nop
nop
lea rax, [0x00a1bf00]
nop
call fcn.0040b520
nop
xor ecx, ecx
lea rdx, [0x00a04720]
xchg dword [rdx], ecx
mov rcx, qword [rsp + 0x28]
cmp rcx, 2
jne 0x41be47
nop
nop
lea rax, [0x00a1bf00]
call fcn.0040b300
xorps xmm0, xmm0
movsd qword [0x00a2c070], xmm0
nop
nop
lea rax, [0x00a1bf00]
nop
call fcn.0040b520
jmp 0x41be96
nop
nop
lea rax, [0x00a04700]
call fcn.0040b300
cmp byte [0x00a04710], 0
je 0x41be78
mov byte [0x00a04710], 0
mov rax, qword [0x00a04708]
xor ebx, ebx
mov ecx, 1
call fcn.00439a60
nop
nop
lea rax, [0x00a04700]
call fcn.0040b520
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
inc dword [0x00a04718]
call fcn.004238e0
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x41be90
call fcn.004258e0
xor eax, eax
call fcn.004259e0
test al, al
jne 0x41beab
call fcn.0042c940
nop dword [rax + rax]
call fcn.0042c9c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00784eff]
mov ebx, 0x29
nop dword [rax + rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.004651a0
mov rax, qword [rsp + 8]
jmp fcn.0041bd40
Function at 0x41cf40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d1d0
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov edx, dword [0x00a2c030]
mov rcx, qword [0x00a2c310]
mov rsi, qword [0x00a2c308]
cmp rbx, rcx
jae 0x41d1c7
mov rbx, qword [rsi + rbx*8]
mov rsi, rbx
shr rbx, 0x14
cmp rbx, 0x40
jae 0x41d1ba
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x68], rax
lea rdi, [0x00a2c090]
mov rbx, qword [rdi + rbx*8]
test byte [rbx], al
and esi, 0xfffff
mov rbx, qword [rbx + rsi*8]
mov qword [rsp + 0x50], rbx
test byte [rbx], al
xor ecx, ecx
jmp 0x41cfb8
inc rcx
cmp rcx, 0x40
jge 0x41cfdf
lea rsi, [rbx + rcx]
lea rsi, [rsi + 0x21080]
mov sil, byte [rsi]
test sil, sil
je 0x41cfb5
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x2e], sil
xor edi, edi
jmp 0x41cff0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rdi, [rcx + 1]
mov rcx, r8
cmp rdi, 8
jae 0x41cfb5
mov r8, rcx
mov rcx, rdi
mov r9d, 1
shl r9d, cl
test sil, r9b
je 0x41cfe9
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41d1ad
mov r9, qword [rbx + r9*8 + 0x20000]
mov r10b, byte [r9 + 0x63]
cmp r10b, 1
jne 0x41d169
mov qword [rsp + 0x58], rcx
cmp byte [0x00a59c48], 0
jne 0x41d055
mov r10d, dword [r9 + 0x58]
cmp r10d, edx
je 0x41d055
lea r11d, [rdx + 3]
cmp r10d, r11d
jne 0x41d117
mov qword [rsp + 0x40], r9
lea rax, [r9 + 0x78]
mov qword [rsp + 0x60], rax
nop
call fcn.0040b300
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x80]
jmp 0x41d0ad
nop
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.0040b520
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rsp + 0x2e]
mov rdi, rcx
mov r8, qword [rsp + 0x48]
jmp 0x41cfe9
mov rdx, qword [rdx]
test rdx, rdx
je 0x41d077
cmp byte [rdx + 0xa], 1
jne 0x41d0aa
movzx eax, word [rdx + 8]
mov rsi, qword [rcx + 0x68]
mov rdi, qword [rcx + 0x18]
test rsi, rsi
je 0x41d112
mov qword [rsp + 0x38], rdx
xor edx, edx
div rsi
imul rax, rsi
add rax, rdi
mov rbx, qword [rsp + 0x68]
nop
call fcn.0041ed00
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + 0x10]
mov ebx, 8
mov rdi, qword [rsp + 0x68]
xor esi, esi
lea rcx, [0x009a55e7]
call fcn.0041eb60
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41d0aa
call fcn.00434380
mov dword [rsp + 0x34], r10d
nop dword [rax]
call fcn.00437600
lea rax, [0x00772183]
mov ebx, 6
call fcn.00437f00
mov eax, dword [rsp + 0x34]
call fcn.00437c00
nop
call fcn.00437820
mov eax, dword [rsp + 0x30]
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x00776ede]
mov ebx, 0x10
call fcn.00435e60
mov byte [rsp + 0x2f], r10b
call fcn.00437600
lea rax, [0x00773986]
mov ebx, 0xa
nop
call fcn.00437f00
movzx eax, byte [rsp + 0x2f]
movzx eax, al
call fcn.00437c00
call fcn.00437860
call fcn.00437680
lea rax, [0x007859f7]
mov ebx, 0x2b
call fcn.00435e60
mov rax, r9
mov ecx, 0x200
call fcn.00463160
mov rax, rbx
mov ecx, 0x40
call fcn.00463160
mov rax, rbx
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041cf40
Function at 0x41faa0
Capabilities:
Gather firefox profile information
Hash data using murmur3
Reference sql statements

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00a59c48], 0
jne 0x41fb8f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41fb85
lea rbx, [0x00a2c090]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41fb67
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1248], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00463160
lea rax, [0x00785e34]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00435e60
nop
int3
Function at 0x420660
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4208bd
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
cmp dword [0x00a59cd0], 0
nop
je 0x4208ab
test rbx, rbx
je 0x4206b3
mov rdx, qword [rbx + 0x1238]
test rdx, rdx
je 0x4206b3
cmp qword [rdx + 0x10], 0
jne 0x4206ac
mov rdx, qword [rbx + 0x1240]
cmp qword [rdx + 0x10], 0
je 0x4206b3
mov ecx, 1
jmp 0x4206e0
mov rdx, qword [0x00a04fa0]
test rdx, rdx
jne 0x4206d8
mov edx, dword [0x00a05028]
cmp dword [0x00a0502c], edx
jbe 0x4206d4
mov ecx, 1
jmp 0x4206e0
xor ecx, ecx
jmp 0x4206e0
mov ecx, 1
nop dword [rax]
test cl, cl
je 0x4206e6
jmp 0x4206f5
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov rdx, qword [0x00a59ea0]
nop dword [rax]
test rdx, rdx
je 0x420731
mov rsi, rdx
sar rdx, 0x13
shl rdx, 3
nop
mov rdi, qword [rdx]
mov rcx, rax
mov rax, rsi
lea r8, [0x00a59ea0]
lock cmpxchg qword [r8], rdi
sete sil
test sil, sil
je 0x4206f2
jmp 0x420740
mov rcx, rax
lea r8, [0x00a59ea0]
xor edx, edx
nop dword [rax]
test rdx, rdx
je 0x420749
test byte [rcx], al
jmp 0x420755
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rsi, qword [rcx + 0xf8]
nop dword [rax]
test rsi, rsi
jle 0x420783
lea rdi, [rsi - 1]
mov rax, rsi
lock cmpxchg qword [rcx + 0xf8], rdi
sete dil
test dil, dil
je 0x420755
nop
test rsi, rsi
jg 0x420862
movsd xmm0, qword [rcx + 0x110]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x4207a6
nop word [rax + rax]
jnp 0x42084b
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x10], rdx
call fcn.00464a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x20]
sub rax, qword [rcx + 0xf0]
nop
test rax, rax
jle 0x420832
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov rsi, qword [rdx + 0x1220]
xorps xmm0, xmm0
cvtsi2sd xmm0, rsi
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm1, qword [rcx + 0x110]
ucomisd xmm0, xmm1
jbe 0x420837
lea rax, [0x00a59ea0]
mov rbx, qword [rsp + 0x10]
call fcn.0040b0a0
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov qword [rdx + 0x1228], 2
mov rdx, qword [rsp + 0x10]
jmp 0x42086f
mov rax, r8
mov rbx, rdx
call fcn.0040b0a0
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test byte [rbx], al
mov qword [rbx + 0x1228], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x18], rax
mov ebx, 4
mov ecx, 1
call fcn.0043a1c0
cmp byte [0x00a0be30], 0
je 0x42089c
mov rax, qword [rsp + 0x18]
xor ebx, ebx
call fcn.004550e0
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x007889e9]
mov ebx, 0x36
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00420660
Function at 0x421e40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x4220c6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x800000000000
lea r8, [rdx + rbx]
lea r9, [rdx + rcx]
cmp r9, r8
jbe 0x421e78
nop
mov r8, rcx
sub rcx, rbx
jmp 0x421e80
mov r8, rcx
xor ecx, ecx
nop dword [rax]
test rcx, rcx
je 0x421f2d
test rbx, 0x3fffff
jne 0x4220b0
mov qword [rsp + 0x80], rax
mov rdx, qword [0x00a59f10]
shr rdx, 0xd
cmp rdx, 1
mov r9d, 1
cmovb rdx, r9
mov qword [rsp + 0x30], rdx
mov rsi, rdi
shr rsi, 0xd
lea r9, [rsi + 1]
test rdi, 0x1fff
cmovne rsi, r9
mov qword [rsp + 0x38], rsi
mov rcx, r8
mov rdi, rdx
nop dword [rax]
call fcn.00422280
test rax, rax
jne 0x421f23
mov qword [rsp + 0x50], rbx
movups xmmword [rsp + 0x58], xmm15
mov qword [rsp + 0x68], 0
lea rsi, [0x00422100]
mov qword [rsp + 0x58], rsi
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x60], rsi
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x68], rdi
jmp 0x421f7a
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor eax, eax
mov rcx, r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx + 0x10110]
nop
call fcn.0040b520
nop
mov rcx, qword [rsp + 0x40]
shl rcx, 0x16
movabs rdx, 0xffff800000000000
add rcx, rdx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x30]
movabs r8, 0x800000000000
lea r9, [r8 + rbx]
lea r10, [rcx + r8]
cmp r10, r9
jbe 0x421f9a
nop
mov r9, rcx
sub rcx, rbx
jmp 0x421fa0
mov r9, rcx
xor ecx, ecx
nop
test rcx, rcx
je 0x422097
mov rcx, qword [rsp + 0x58]
mov rax, rbx
mov rbx, r9
lea rdx, [rsp + 0x58]
call rcx
nop dword [rax + rax]
test bl, bl
je 0x42208f
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x80]
test byte [rcx], al
mov rax, qword [rcx + 0x10110]
nop
nop
call fcn.0040b300
nop
mov rax, qword [rsp + 0x40]
mov rcx, rax
shr rax, 0xd
cmp rax, 0x2000
jae 0x4220a6
mov rdx, qword [rsp + 0x80]
mov rsi, qword [rdx + rax*8 + 0x78]
test byte [rsi], al
and ecx, 0x1fff
shl rcx, 7
lea rax, [rsi + rcx]
mov ebx, 0x1ff
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
call fcn.00422960
test rbx, rbx
jbe 0x421f3c
mov qword [rsp + 0x28], rbx
mov rcx, rax
mov rdi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x40]
call fcn.00422460
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x10110]
nop
mov rax, rdx
call fcn.0040b520
mov rax, qword [rsp + 0x28]
shl rax, 0xd
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rbx, qword [rsp + 0x50]
mov r9, rbx
xor eax, eax
mov rcx, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov ecx, 0x2000
call fcn.00463160
lea rax, [0x007864a4]
mov ebx, 0x2d
nop dword [rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004651a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00421e40
Function at 0x422f20
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42307a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x422f85
call fcn.00425440
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x423008
mov rdi, qword [rax + 0x100]
mov r8, rbx
sub rbx, rdi
lea rdi, [rsi - 1]
nop
cmp rdi, 0x3f
jae 0x42306c
shl rdi, 5
mov r9d, dword [rdx + rdi + 0x20]
add r9d, dword [rdx + rdi + 0x24]
nop dword [rax + rax]
cmp r9d, ebx
ja 0x42305b
cmp rsi, 0x3f
jne 0x42300b
mov qword [rsp + 0x10], rdx
call fcn.00425440
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x42300b
mov r8, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x42304e
lea rsi, [rbx + 1]
mov qword [rdx + 0x10], rsi
shl rbx, 5
mov rsi, qword [rax + 0x100]
sub r8, rsi
mov dword [rdx + rbx + 0x20], r8d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00463140
lea rax, [0x00785070]
mov ebx, 0x29
call fcn.00435e60
mov rax, rdi
mov ecx, 0x3f
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00422f20
Function at 0x4233a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423526
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
cmp dword [0x00a2c030], ebx
je 0x4233d0
jmp 0x42350f
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
nop word [rax + rax]
cmp ecx, 0x80000000
jae 0x4234fe
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x4233cd
nop
cmp edx, 0x80000000
jne 0x4234f4
cmp dword [0x00a5a3f0], 0
jle 0x4234ea
mov rax, qword [0x00a2c058]
mov qword [rsp + 0x10], rax
mov rcx, qword [0x00a5ab98]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x00a2c068]
mov qword [rsp + 0x20], rdx
movsd xmm0, qword [0x00a2c070]
movsd qword [rsp + 0x18], xmm0
call fcn.00437600
lea rax, [0x00780562]
mov ebx, 0x1f
nop dword [rax]
call fcn.00437f00
mov rax, qword [rsp + 0x28]
shr rax, 0x14
call fcn.00437c00
lea rax, [0x00775829]
mov ebx, 0xe
nop
call fcn.00437f00
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rax, rcx
shr rax, 0x14
call fcn.00437c00
lea rax, [0x0077b3e8]
mov ebx, 0x17
call fcn.00437f00
mov rax, qword [rsp + 0x10]
call fcn.00437c00
lea rax, [0x00773314]
mov ebx, 0xa
call fcn.00437f00
movsd xmm0, qword [rsp + 0x18]
call fcn.00437900
lea rax, [0x007742b1]
mov ebx, 0xc
nop
call fcn.00437f00
call fcn.00437680
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x007825fe]
mov ebx, 0x23
call fcn.00435e60
lea rax, [0x00787b4d]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00435e60
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.00460a60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.004233a0

Function at 0x423560
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42365a
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
jmp 0x423580
inc dword [0x00a04718]
call fcn.004238e0
cmp rax, 0xffffffffffffffff
jne 0x42357a
mov edx, dword [0x00a0471c]
btr edx, 0x1f
test edx, edx
jne 0x423648
mov edx, dword [0x00a2c030]
mov dword [rsp + 0x14], edx
xor eax, eax
jmp 0x42360b
mov qword [rsp + 0x18], rax
shl rbx, 6
mov qword [rsp + 0x28], rbx
lea rcx, [0x00a2c338]
lea rsi, [rcx + rbx]
lea rdx, [rdx + rdx*4]
mov qword [rsp + 0x20], rdx
lea rax, [rsi + rdx*8]
lea rax, [rax + 8]
call fcn.0042e660
mov rcx, qword [rsp + 0x28]
lea rdx, [0x00a2c338]
lea rcx, [rdx + rcx]
lea rcx, [rcx + 0x58]
mov rdx, qword [rsp + 0x20]
lea rax, [rcx + rdx*8]
call fcn.0042e660
mov rcx, qword [rsp + 0x18]
lea rax, [rcx + 1]
mov ecx, dword [rsp + 0x14]
mov edx, ecx
cmp rax, 0x88
jge 0x423628
lea rbx, [rax + rax*2]
shr edx, 1
and edx, 1
dec edx
neg edx
cmp rdx, 2
jb 0x4235ab
jmp 0x42363c
call fcn.004210e0
call fcn.004288a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, edx
mov ecx, 2
call fcn.00463140
lea rax, [0x00785d00]
mov ebx, 0x2c
call fcn.00435e60
nop
call fcn.00460a60
nop
jmp fcn.00423560
Function at 0x423b40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x423c89
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x423b7a
cmp dword [rcx + 0xc0], 0
jne 0x423b7a
mov rdx, r14
cmp qword [rcx], rdx
jne 0x423c77
jmp 0x423b7f
mov rax, rbx
nop
mov ecx, dword [0x00a0471c]
mov edx, ecx
and ecx, 0x80000000
test ecx, ecx
jne 0x423bb6
lea esi, [rdx + 1]
mov rbx, rax
mov eax, edx
lea rdi, [0x00a0471c]
lock cmpxchg dword [rdi], esi
sete dl
test dl, dl
je 0x423b7c
mov edx, dword [0x00a2c030]
test ecx, ecx
jmp 0x423bbf
mov edx, dword [0x00a2c030]
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
sete byte [rsp + 0x14]
jne 0x423c5b
lea rax, [rsp + 0x10]
call fcn.004237e0
mov qword [rsp + 0x18], rax
test bl, bl
jne 0x423c02
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x00a0471c]
call fcn.004233a0
mov rbx, qword [rsp + 0x20]
jmp 0x423c5b
lea rax, [rsp + 0x18]
xor ebx, ebx
call fcn.00423ca0
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x00a0471c]
nop
call fcn.004233a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x007a8588]
mov qword [rsp], rax
call fcn.00460920
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbx, rax
mov eax, dword [rbx + 0x58]
mov ecx, dword [rsp + 0x10]
cmp eax, ecx
je 0x423c6d
add ecx, 3
cmp eax, ecx
jne 0x423c2f
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x00781f1d]
mov ebx, 0x22
call fcn.00435e60
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00423b40