joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5db2c0
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5db45b
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0x90], rax
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov edi, 1
call fcn.004b89c0
lea rdx, [0x0070c4c0]
cmp rax, rdx
jne 0x5db34a
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rbx]
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x90]
xor esi, esi
jmp 0x5db380
xor eax, eax
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rdi, qword [rsp + 0x58]
mov qword [rdi + rcx*8], rax
lea rsi, [rcx + 1]
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x90]
mov rcx, rdx
mov rdx, rdi
nop
cmp rax, rsi
jle 0x5db3b6
mov rdi, qword [rbx + 8]
mov r8, qword [rdi + 0x18]
cmp qword [rdi + 8], r8
je 0x5db3d6
mov qword [rsp + 0x30], rsi
mov rax, rbx
nop dword [rax + rax]
call fcn.005db820
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
cmp rcx, rdx
jb 0x5db35c
jmp 0x5db3cb
mov eax, 1
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rax, rcx
mov rcx, rdx
call fcn.00463140
movups xmmword [rsp + 0x60], xmm15
nop dword [rax]
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x38]
lea rbx, [0x00771d48]
mov ecx, 5
lea rdi, [0x0078acfb]
mov esi, 0x47
call fcn.0044ce60
lea rcx, [rsp + 0x60]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
movups xmmword [rsp + 0x70], xmm15
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
lea rax, [0x0072c620]
lea rbx, [rsp + 0x70]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005db2c0
Function at 0x5db5e0
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5db7c8
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xb8], r8
mov qword [rsp + 0xc0], r9
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov edi, 1
call fcn.004b89c0
lea rdx, [0x0070c540]
cmp rax, rdx
jne 0x5db67a
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rbx]
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x90]
xor esi, esi
jmp 0x5db6ac
xor eax, eax
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rdi, qword [rsp + 0x58]
mov qword [rdi + rdx*8], rax
lea rsi, [rdx + 1]
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x90]
mov rdx, rdi
cmp rax, rsi
jle 0x5db6ee
mov rdi, qword [rbx + 8]
mov r8, qword [rdi + 0x18]
nop dword [rax]
cmp qword [rdi + 8], r8
je 0x5db746
mov qword [rsp + 0x30], rsi
mov rax, rbx
call fcn.005db820
cmp rax, 0xffffffffffffffff
ja 0x5db70b
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x5db68c
jmp 0x5db703
mov eax, 1
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rax, rdx
call fcn.00463140
nop
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x78], rcx
lea rax, [0x0072c620]
lea rbx, [rsp + 0x70]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
call fcn.004356e0
movups xmmword [rsp + 0x60], xmm15
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x38]
lea rbx, [0x00771d48]
mov ecx, 5
lea rdi, [0x0078af35]
mov esi, 0x48
nop
call fcn.0044ce60
lea rcx, [rsp + 0x60]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
movups xmmword [rsp + 0x70], xmm15
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
lea rax, [0x0072c620]
lea rbx, [rsp + 0x70]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005db5e0
Function at 0x5db820
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5dba5f
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov rsi, qword [rax + 8]
mov rdi, qword [rsi + 0x18]
mov rcx, qword [rsi + 8]
mov r8, qword [rsi]
cmp rcx, rdi
jg 0x5db86d
mov rsi, qword [0x00a03230]
mov rdi, qword [0x00a03238]
xor r8d, r8d
jmp 0x5db884
jbe 0x5dba56
movzx r8d, byte [r8 + rdi]
lea r9, [rdi + 1]
mov qword [rsi + 0x18], r9
xor esi, esi
xor edi, edi
test rsi, rsi
jne 0x5dba25
cmp r8b, 0x7f
jbe 0x5db8f0
movsx rcx, r8b
mov rsi, rcx
neg rcx
nop dword [rax]
cmp rcx, 8
jg 0x5db9ed
mov rbx, qword [rax + 8]
mov rdi, qword [rbx + 8]
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
nop dword [rax]
cmp rdi, rax
jb 0x5db9e5
sub rdx, rax
sub rdi, rax
mov r9, rdx
neg rdx
sar rdx, 0x3f
and rdx, rax
add r8, rdx
nop
cmp rcx, rdi
jg 0x5db93b
cmp rcx, r9
ja 0x5db933
xor edx, edx
xor edi, edi
jmp 0x5db913
movzx eax, r8b
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
movzx r9d, byte [r8 + rdx]
inc rdx
shl rdi, 8
or rdi, r9
cmp rdx, rcx
jl 0x5db904
nop
sub rax, rsi
mov qword [rbx + 0x18], rax
mov rax, rdi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rdx, r9
call fcn.004631c0
mov qword [rsp + 0x28], rdi
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rax, rcx
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
call fcn.0040aac0
lea rcx, [0x0070e840]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x30]
lea rbx, [0x00771d48]
mov ecx, 5
lea rdi, [0x00787e67]
mov esi, 0x32
nop dword [rax]
call fcn.0044ce60
lea rcx, [rsp + 0x60]
mov edi, 2
mov rsi, rdi
call fcn.004ced20
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, [0x0072c620]
lea rbx, [rsp + 0x50]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
nop dword [rax]
call fcn.004356e0
mov rcx, rdi
call fcn.00463200
mov rcx, qword [0x00a02e70]
mov rdx, qword [0x00a02e78]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdx
lea rax, [0x0072c620]
lea rbx, [rsp + 0x50]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
call fcn.004356e0
nop
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
lea rax, [0x0072c620]
lea rbx, [rsp + 0x50]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x0072c620]
call fcn.004356e0
mov rax, rdi
call fcn.00463140
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.005db820
Function at 0x5ea400
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ea553
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.005eb160
test rbx, rbx
je 0x5ea521
test rdi, rdi
je 0x5ea513
cmp byte [rcx], 0x2f
nop word [rax + rax]
jne 0x5ea4e1
lea rbx, [rdi - 1]
mov rdx, rbx
neg rbx
sar rbx, 0x3f
and ebx, 1
lea rax, [rcx + rbx]
mov rbx, rdx
nop
call fcn.005eb160
test rbx, rbx
je 0x5ea4af
test rdi, rdi
je 0x5ea4a1
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x2c
lea rcx, [0x00785f3c]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x20
lea rcx, [0x00780c4a]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x26
lea rcx, [0x00783b88]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x13
lea rcx, [0x00778def]
mov qword [rax], rcx
mov rbx, rax
lea rax, [0x00815340]
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005ea400
Function at 0x5f1040
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5f124c
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005f1040
Function at 0x6121c0
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x61245e
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xb0], rcx
mov rdx, qword [rax + 0x30]
mov rax, rbx
call rdx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx + 8]
lea rsi, [rdx - 1]
test rsi, rsi
jl 0x61224b
mov rdx, qword [rbx + rdx*8 - 8]
bsr rdx, rdx
mov rdi, 0xffffffffffffffff
cmove rdx, rdi
shl rsi, 6
lea rdx, [rdx + rsi]
lea rdx, [rdx + 1]
jmp 0x61224d
xor edx, edx
mov qword [rsp + 0x30], rdx
lea rsi, [rdx + 7]
sar rsi, 0x3f
shr rsi, 0x3d
lea rcx, [rsi + rdx]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x40], rcx
lea rax, [0x0070f280]
mov rbx, rcx
call fcn.00449300
mov qword [rsp + 0x68], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
xor esi, esi
jmp 0x6122a2
mov rcx, rax
mov rdx, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x68]
test rcx, rcx
jne 0x61241a
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rdx
nop
mov rbx, qword [rsp + 0xb8]
mov rcx, rax
mov rdi, qword [rsp + 0x40]
mov rsi, rdi
mov r8, rsi
mov rax, qword [rsp + 0xb0]
call fcn.0046d960
nop dword [rax]
test rbx, rbx
jne 0x6123ed
mov r8, qword [rsp + 0x40]
test r8, r8
jbe 0x612453
mov rdi, qword [rsp + 0x68]
movzx edx, byte [rdi]
mov r9, qword [0x009f5498]
mov r10, qword [0x009f5490]
mov rax, qword [rsp + 0x30]
mov r11, rax
sar rax, 0x3f
shr rax, 0x3d
lea r12, [rax + r11]
sar r12, 3
shl r12, 3
mov rax, r11
sub rax, r12
cmp r9, rax
jbe 0x61244b
movzx r9d, byte [r10 + rax]
and edx, r9d
mov byte [rdi], dl
cmp r8, 1
jbe 0x61243e
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rbx
movzx edx, byte [rdi + 1]
xor edx, 0x42
mov byte [rdi + 1], dl
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
movups xmmword [rsp + 0x80], xmm15
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rsi, r8
call fcn.00529040
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov byte [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov rbx, qword [rsp + 0x50]
call fcn.0051f0e0
test rax, rax
jl 0x6123c5
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
nop
jmp 0x61228d
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
mov rdi, rcx
call rsi
jmp 0x61228d
mov rax, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r8, rbx
mov r9, rcx
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov rdi, rcx
mov r8, rbx
mov r9, rsi
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
mov rsi, rdx
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, 1
mov rcx, r8
call fcn.00463140
mov rcx, r9
call fcn.00463140
xor eax, eax
mov rcx, r8
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.006121c0
Function at 0x612960
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x612b92
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rax, [0x00736680]
nop
call fcn.0040d400
lea rbx, [0x0078a67e]
mov ecx, 0x44
mov edi, 0xa
call fcn.0051f1a0
nop dword [rax + rax]
test bl, bl
je 0x612b7e
mov qword [rsp + 0x40], rax
lea rax, [0x00736680]
call fcn.0040d400
lea rbx, [0x0078a63a]
mov ecx, 0x44
mov edi, 0xa
call fcn.0051f1a0
test bl, bl
je 0x612b6b
mov qword [rsp + 0x38], rax
lea rax, [0x00736680]
call fcn.0040d400
lea rbx, [0x007890be]
mov ecx, 0x38
mov edi, 0x10
call fcn.0051f1a0
nop
test bl, bl
je 0x612b58
mov qword [rsp + 0x30], rax
lea rax, [0x00736680]
call fcn.0040d400
lea rbx, [0x007890f6]
mov ecx, 0x38
mov edi, 0x10
call fcn.0051f1a0
test bl, bl
je 0x612b45
mov qword [rsp + 0x28], rax
lea rax, [0x00736680]
call fcn.0040d400
lea rbx, [0x0078912e]
mov ecx, 0x38
mov edi, 0x10
call fcn.0051f1a0
nop
test bl, bl
je 0x612b30
mov qword [rsp + 0x20], rax
lea rax, [0x00758fc0]
call fcn.0040d400
mov qword [rax + 0x38], 5
lea rcx, [0x00771c94]
mov qword [rax + 0x30], rcx
mov qword [rax + 0x28], 0xe0
cmp dword [0x00a5a130], 0
jne 0x612ad2
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rax + 0x20], rcx
mov qword [0x009ff000], rax
jmp 0x612b26
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00462da0
lea rcx, [rax + 8]
mov rdi, rcx
mov rdx, qword [rsp + 0x38]
call fcn.00462dc0
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0x30]
call fcn.00462da0
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x28]
call fcn.00462da0
lea rdi, [rax + 0x20]
mov rcx, qword [rsp + 0x20]
call fcn.00462da0
lea rdi, [0x009ff000]
call fcn.00462ca0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814260]
nop
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814260]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814260]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814260]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814260]
call fcn.004356e0
nop
call fcn.00460a60
jmp fcn.00612960
Function at 0x612fe0
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x613110
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
movups xmmword [rsp + 0x3b], xmm15
lea rdi, [rsp + 0x40]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463422
mov rbp, qword [rbp]
lea rbx, [rsp + 0x3b]
call fcn.006085a0
nop dword [rax]
cmp rbx, 1
jne 0x613086
cmp byte [rax], 0
jne 0x613086
lea rax, [0x00736680]
call fcn.0040d400
mov qword [rsp + 0xc8], rax
lea rax, [0x00736680]
call fcn.0040d400
mov rbx, rax
mov rax, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
nop
mov edx, dword [0x00a59fe8]
test edx, edx
jne 0x6130c8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x00a59fe8]
lea rbx, [0x007a7850]
call fcn.0046bf60
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdx, qword [0x009ff000]
mov rdi, rbx
mov rsi, rcx
mov rbx, rdx
mov rcx, rax
lea rax, [0x00818428]
call fcn.00612620
test rax, rax
je 0x6130fc
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814270]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
nop
jmp fcn.00612fe0

Function at 0x613140
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6131bc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop
mov edx, dword [0x00a59fe8]
test edx, edx
jne 0x613172
lea rax, [0x00a59fe8]
lea rbx, [0x007a7850]
call fcn.0046bf60
mov rcx, qword [0x00a02bd0]
mov rdi, qword [0x00a02bd8]
mov rbx, qword [0x009ff000]
lea rax, [0x00818428]
call fcn.006121c0
test r8, r8
jne 0x6131a8
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814280]
call fcn.004356e0
nop
nop dword [rax]
call fcn.00460a60
jmp fcn.00613140
Function at 0x613500
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6136c4
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x00758fc0]
nop
call fcn.0040d400
mov qword [rax + 0x38], 5
lea rcx, [0x00771c99]
mov qword [rax + 0x30], rcx
cmp dword [0x00a5a130], 0
nop
jne 0x61354b
mov qword [0x009ff008], rax
jmp 0x613557
lea rdi, [0x009ff008]
call fcn.00462ca0
lea rax, [0x00736680]
nop
call fcn.0040d400
lea rbx, [0x0078b475]
mov ecx, 0x4e
mov edi, 0xa
call fcn.0051f1a0
mov rdi, qword [0x009ff008]
test byte [rdi], al
cmp dword [0x00a5a130], 0
jne 0x613592
mov qword [rdi], rax
jmp 0x613597
call fcn.00462ca0
lea rax, [0x00736680]
nop
call fcn.0040d400
lea rbx, [0x0078b427]
mov ecx, 0x4e
mov edi, 0xa
call fcn.0051f1a0
mov rcx, qword [0x009ff008]
test byte [rcx], al
cmp dword [0x00a5a130], 0
jne 0x6135d3
mov qword [rcx + 8], rax
jmp 0x6135dc
lea rdi, [rcx + 8]
call fcn.00462ca0
lea rax, [0x00736680]
call fcn.0040d400
lea rbx, [0x0078a0ea]
mov ecx, 0x40
mov edi, 0x10
call fcn.0051f1a0
mov rcx, qword [0x009ff008]
test byte [rcx], al
cmp dword [0x00a5a130], 0
jne 0x613616
mov qword [rcx + 0x10], rax
jmp 0x61361f
lea rdi, [rcx + 0x10]
call fcn.00462ca0
lea rax, [0x00736680]
call fcn.0040d400
lea rbx, [0x0078a12a]
mov ecx, 0x40
mov edi, 0x10
nop dword [rax]
call fcn.0051f1a0
mov rcx, qword [0x009ff008]
test byte [rcx], al
cmp dword [0x00a5a130], 0
jne 0x61365d
mov qword [rcx + 0x18], rax
jmp 0x613666
lea rdi, [rcx + 0x18]
call fcn.00462ca0
lea rax, [0x00736680]
call fcn.0040d400
lea rbx, [0x0078a0aa]
mov ecx, 0x40
mov edi, 0x10
call fcn.0051f1a0
mov rcx, qword [0x009ff008]
test byte [rcx], al
cmp dword [0x00a5a130], 0
jne 0x6136a2
mov qword [rcx + 0x20], rax
nop
jmp 0x6136ab
lea rdi, [rcx + 0x20]
call fcn.00462ca0
mov rax, qword [0x009ff008]
mov qword [rax + 0x28], 0x100
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00460a60
jmp fcn.00613500
Function at 0x618320
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x618450
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
movups xmmword [rsp + 0x3b], xmm15
lea rdi, [rsp + 0x40]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463422
mov rbp, qword [rbp]
lea rbx, [rsp + 0x3b]
call fcn.0060a700
nop dword [rax]
cmp rbx, 1
jne 0x6183c6
cmp byte [rax], 0
jne 0x6183c6
lea rax, [0x00736680]
call fcn.0040d400
mov qword [rsp + 0xc8], rax
lea rax, [0x00736680]
call fcn.0040d400
mov rbx, rax
mov rax, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
nop
mov edx, dword [0x00a59fe8]
test edx, edx
jne 0x618408
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x00a59fe8]
lea rbx, [0x007a7850]
call fcn.0046bf60
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdx, qword [0x009ff010]
mov rdi, rbx
mov rsi, rcx
mov rbx, rdx
mov rcx, rax
lea rax, [0x008184b8]
call fcn.00612620
test rax, rax
je 0x61843c
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814270]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
nop
jmp fcn.00618320

Function at 0x618480
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6184fc
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop
mov edx, dword [0x00a59fe8]
test edx, edx
jne 0x6184b2
lea rax, [0x00a59fe8]
lea rbx, [0x007a7850]
call fcn.0046bf60
mov rcx, qword [0x00a02bd0]
mov rdi, qword [0x00a02bd8]
mov rbx, qword [0x009ff010]
lea rax, [0x008184b8]
call fcn.006121c0
test r8, r8
jne 0x6184e8
mov rax, rdi
mov rbx, rsi
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814280]
call fcn.004356e0
nop
nop dword [rax]
call fcn.00460a60
jmp fcn.00618480