joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4262a0
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x426426
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
cmp dword [0x00b94058], ebx
je 0x4262d0
jmp 0x42640f
mov rax, rbx
mov ecx, dword [rax]
mov edx, ecx
btr ecx, 0x1f
dec ecx
nop word [rax + rax]
cmp ecx, 0x80000000
jae 0x4263fe
lea ecx, [rdx - 1]
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx], ecx
sete cl
test cl, cl
je 0x4262cd
nop
cmp edx, 0x80000000
jne 0x4263f4
cmp dword [0x00bc2550], 0
jle 0x4263ea
mov rax, qword [0x00b94080]
mov qword [rsp + 0x10], rax
mov rcx, qword [0x00bc2d68]
mov qword [rsp + 0x28], rcx
mov rdx, qword [0x00b94090]
mov qword [rsp + 0x20], rdx
movsd xmm0, qword [0x00b94098]
movsd qword [rsp + 0x18], xmm0
call fcn.0043aec0
lea rax, [0x008df803]
mov ebx, 0x1f
nop dword [rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x28]
shr rax, 0x14
call fcn.0043b4c0
lea rax, [0x008d6ab8]
mov ebx, 0xe
nop
call fcn.0043b7c0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rax, rcx
shr rax, 0x14
call fcn.0043b4c0
lea rax, [0x008dae48]
mov ebx, 0x17
call fcn.0043b7c0
mov rax, qword [rsp + 0x10]
call fcn.0043b4c0
lea rax, [0x008d508d]
mov ebx, 0xa
call fcn.0043b7c0
movsd xmm0, qword [rsp + 0x18]
call fcn.0043b1c0
lea rax, [0x008d5d10]
mov ebx, 0xc
nop
call fcn.0043b7c0
call fcn.0043af40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x008e18db]
mov ebx, 0x23
call fcn.00439600
lea rax, [0x008e7637]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.00464c60
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.004262a0
Function at 0x426a60
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x426ba9
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [r14 + 0x30]
cmp dword [rcx + 0xd8], 0
jne 0x426a9a
cmp dword [rcx + 0xc0], 0
jne 0x426a9a
mov rdx, r14
cmp qword [rcx], rdx
jne 0x426b97
jmp 0x426a9f
mov rax, rbx
nop
mov ecx, dword [0x00b6c5fc]
mov edx, ecx
and ecx, 0x80000000
test ecx, ecx
jne 0x426ad6
lea esi, [rdx + 1]
mov rbx, rax
mov eax, edx
lea rdi, [0x00b6c5fc]
lock cmpxchg dword [rdi], esi
sete dl
test dl, dl
je 0x426a9c
mov edx, dword [0x00b94058]
test ecx, ecx
jmp 0x426adf
mov edx, dword [0x00b94058]
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
sete byte [rsp + 0x14]
jne 0x426b7b
lea rax, [rsp + 0x10]
call fcn.004266e0
mov qword [rsp + 0x18], rax
test bl, bl
jne 0x426b22
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x00b6c5fc]
call fcn.004262a0
mov rbx, qword [rsp + 0x20]
jmp 0x426b7b
lea rax, [rsp + 0x18]
xor ebx, ebx
call fcn.00426bc0
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
lea rax, [0x00b6c5fc]
nop
call fcn.004262a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x009098c8]
mov qword [rsp], rax
call fcn.00464b20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rbx, rax
mov eax, dword [rbx + 0x58]
mov ecx, dword [rsp + 0x10]
cmp eax, ecx
je 0x426b8d
add ecx, 3
cmp eax, ecx
jne 0x426b4f
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x008e11da]
mov ebx, 0x22
call fcn.00439600
nop
mov qword [rsp + 8], rax
call fcn.00464c60
mov rax, qword [rsp + 8]
jmp fcn.00426a60
Function at 0x428840
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42892c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop
lea rax, [0x00b6cff0]
call fcn.0040cd60
cmp qword [0x00b6cfa0], 0
jne 0x42891a
mov qword [0x00b6cfa8], 0
mov rcx, qword [0x00b6d008]
test rcx, rcx
jne 0x4288b0
nop
nop
lea rax, [0x00b6cff0]
call fcn.0040cf80
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rdx, [0x00b6cff8]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x4288a2
mov rcx, qword [0x00b6cff8]
nop dword [rax]
test rcx, rcx
je 0x4288f1
mov rdx, qword [0x00b6d010]
mov qword [rdx], rcx
mov rcx, qword [0x00b6cff8]
mov rdx, qword [0x00b6d010]
mov qword [rcx + 8], rdx
mov rcx, qword [0x00b6d008]
mov qword [0x00b6cff8], rcx
jmp 0x42890d
mov rcx, qword [0x00b6d010]
mov rdx, qword [0x00b6d008]
mov qword [0x00b6cff8], rdx
mov qword [0x00b6d000], rcx
movups xmmword [0x00b6d008], xmm15
jmp 0x42888a
lea rax, [0x008e3b3b]
mov ebx, 0x28
call fcn.00439600
nop
call fcn.00464c60
jmp fcn.00428840

Function at 0x4296e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42971b
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test cl, cl
je 0x429709
xor edi, edi
call fcn.00429ac0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008e9de7]
mov ebx, 0x3c
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00469440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.004296e0

Function at 0x429840
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42995a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
xor edx, edx
jmp 0x429873
sub r12, rbx
lea rbx, [r12 + r9]
shr r12, 0xd
sub r11, r12
mov rax, rcx
mov rcx, r11
mov edx, r10d
test rcx, rcx
jbe 0x4298f9
test byte [rax], al
nop
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
cmp rdi, 0x40
jae 0x42994c
mov rdi, qword [rax + rdi*8 + 0x10190]
test byte [rdi], al
shr r8, 0x16
and r8d, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x210c8]
mov r9, rbx
and ebx, 0x3fffff
cmp r8, rbx
seta r10b
mov r11, rcx
shl rcx, 0xd
lea r12, [rcx + rbx]
or r10d, edx
nop
cmp r12, 0x400000
jbe 0x42990b
mov r12d, 0x400000
jmp 0x42990b
mov rcx, rax
jmp 0x42985c
mov eax, edx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rcx
mov r8, rdx
cmp r12, r8
jbe 0x4298f1
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x210c8], r12
sete dl
test dl, dl
jne 0x42985c
mov rdx, qword [rdi + 0x210c8]
cmp rdx, r12
ja 0x429905
cmp rdx, rbx
jbe 0x429905
lea rax, [0x008e7e9f]
mov ebx, 0x33
call fcn.00439600
mov rax, rdi
mov ecx, 0x40
call fcn.00467380
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00429840
Function at 0x42a320
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42a5ba
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
test byte [rax], al
add rbx, 0x1ff
and rbx, 0xfffffffffffffe00
shl rbx, 0xd
mov rdx, qword [rax + 0x10420]
lea rsi, [rbx + rdx]
mov rdi, qword [0x00bc1fc0]
lea r8, [rdi + rsi]
lea r8, [r8 - 1]
neg rdi
and rdi, r8
cmp qword [rax + 0x10428], rdi
jb 0x42a389
nop word [rax + rax]
cmp rdx, rsi
jbe 0x42a523
mov qword [rsp + 0x50], rbx
call fcn.0040da00
test rax, rax
je 0x42a48b
mov rdx, rax
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsi + 0x10428]
cmp rax, rdi
jne 0x42a3c5
lea rdx, [rax + rbx]
mov qword [rsi + 0x10428], rdx
xor eax, eax
nop dword [rax]
jmp 0x42a462
mov rax, qword [rsi + 0x10420]
sub rdi, rax
test rdi, rdi
jne 0x42a3d8
xor eax, eax
jmp 0x42a44d
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rdi
mov rbx, rdi
lea rcx, [0x00bc2e18]
call fcn.00419760
lea rax, [0x00bc6700]
nop dword [rax]
call fcn.004320e0
mov rdx, qword [rsp + 0x40]
lock xadd qword [rax + 8], rdx
lea rax, [0x00bc6700]
call fcn.004321c0
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 0x10]
mov rbx, qword [rax + 0x10420]
mov rcx, qword [rsp + 0x40]
mov rax, rdx
call fcn.0042bcc0
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x40]
mov rdi, rdx
mov qword [rsi + 0x10420], rdx
lea rdx, [rdi + rbx]
mov qword [rsi + 0x10428], rdx
mov rdi, qword [0x00bc1fc0]
mov rdx, qword [rsi + 0x10420]
mov r8, qword [rsp + 0x50]
add rdx, r8
lea rdx, [rdi + rdx]
lea rdx, [rdx - 1]
neg rdi
and rdi, rdx
jmp 0x42a528
mov rax, qword [0x00bc2e20]
mov qword [rsp + 0x28], rax
mov rcx, qword [0x00bc2e18]
mov qword [rsp + 0x20], rcx
mov rdx, qword [0x00bc2e10]
mov qword [rsp + 0x18], rdx
call fcn.0043aec0
lea rax, [0x008e4013]
mov ebx, 0x28
call fcn.0043b7c0
mov rax, qword [rsp + 0x50]
call fcn.0043b4c0
lea rax, [0x008d6467]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
add rax, rcx
mov rcx, qword [rsp + 0x18]
add rax, rcx
call fcn.0043b4c0
lea rax, [0x008d4b9b]
mov ebx, 9
call fcn.0043b7c0
call fcn.0043af40
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rsi, rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov rdx, qword [rsi + 0x10420]
mov qword [rsp + 0x30], rdx
mov qword [rsi + 0x10420], rdi
mov r8, rdx
sub rdi, r8
mov qword [rsp + 0x50], rdi
mov rbx, rdi
lea rcx, [0x00bc2e18]
mov rax, rdx
call fcn.00419760
lea rax, [0x00bc6700]
call fcn.004320e0
mov rdx, qword [rsp + 0x50]
lock xadd qword [rax + 8], rdx
lea rax, [0x00bc6700]
nop dword [rax + rax]
call fcn.004321c0
mov rax, qword [rsp + 0x70]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.0042bcc0
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
lea rax, [rsi + rdx]
mov ebx, 1
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042a320
Function at 0x42aae0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42ac2b
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rbx + 0x10]
nop dword [rax]
cmp rax, rcx
jne 0x42ab51
cmp qword [rax], rbx
jne 0x42ab12
mov rcx, qword [rbx]
mov qword [rax], rcx
jmp 0x42ab20
mov rcx, qword [rbx + 8]
mov rdx, qword [rbx]
mov qword [rcx], rdx
nop dword [rax]
cmp qword [rax + 8], rbx
jne 0x42ab30
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
jmp 0x42ab3b
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
movups xmmword [rbx], xmm15
mov qword [rbx + 0x10], 0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x18], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x10], rcx
call fcn.0043aec0
lea rax, [0x008e5b88]
mov ebx, 0x2d
call fcn.0043b7c0
mov rax, qword [rsp + 0x18]
call fcn.0043b4c0
lea rax, [0x008d3e9b]
mov ebx, 6
nop
call fcn.0043b7c0
mov rax, qword [rsp + 0x40]
call fcn.0043b780
lea rax, [0x008d3e95]
mov ebx, 6
nop dword [rax + rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x10]
call fcn.0043b780
lea rax, [0x008d5737]
mov ebx, 0xb
nop dword [rax + rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x20]
call fcn.0043b780
lea rax, [0x008d3e71]
mov ebx, 6
nop dword [rax + rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x38]
call fcn.0043b780
call fcn.0043b120
call fcn.0043af40
lea rax, [0x008d799f]
mov ebx, 0x10
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042aae0

Function at 0x42b480
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42b50a
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x18], rax
nop
lea rax, [0x00b9aac0]
call fcn.0040cd60
lea rax, [0x00b9aa30]
call fcn.0041ae60
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x00b9aac0]
call fcn.0040cf80
mov rbx, qword [rsp + 0x10]
mov byte [rbx + 0xa], 2
mov rcx, qword [rsp + 0x38]
mov qword [rbx + 0x10], rcx
mov rax, qword [rsp + 0x18]
call fcn.0042ad80
test al, al
je 0x42b4f8
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008e295b]
mov ebx, 0x25
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0042b480
Function at 0x42bb60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42bc97
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [0x00802480]
nop
cmp rdx, 0x15
ja 0x42bc15
mov qword [rsp + 0x30], rbx
test byte [rax], al
cmp dword [0x00bc2240], 0
jne 0x42bba3
mov qword [rax + 0x10110], rcx
jmp 0x42bbaf
lea rdi, [rax + 0x10110]
call fcn.00466fc0
mov qword [rsp + 0x28], rax
lea rdx, [rax + 0x10090]
mov rbx, rcx
mov rax, rdx
call fcn.00431240
mov rax, qword [rsp + 0x28]
call fcn.0042de00
mov rcx, qword [0x00800620]
mov rdi, qword [rsp + 0x28]
mov qword [rdi + 0x10078], rcx
cmp dword [0x00bc2240], 0
jne 0x42bbfa
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10108], rax
jmp 0x42bc0b
add rdi, 0x10108
mov rax, qword [rsp + 0x30]
call fcn.00466ec0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rdx
call fcn.0043aec0
lea rax, [0x008e006b]
mov ebx, 0x20
call fcn.0043b7c0
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x40
sbb rax, rax
mov edx, 1
shl rdx, cl
and rax, rdx
call fcn.0043b5c0
call fcn.0043b120
call fcn.0043af40
call fcn.0043aec0
lea rax, [0x008dea15]
mov ebx, 0x1d
call fcn.0043b7c0
mov eax, 0x200000
call fcn.0043b5c0
call fcn.0043b120
nop dword [rax + rax]
call fcn.0043af40
lea rax, [0x008e50ae]
mov ebx, 0x2b
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0042bb60
Function at 0x42de00
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42df97
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov rdx, qword [0x008024c0]
mov qword [rsp + 0x50], rdx
movups xmm0, xmmword [0x008024c8]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [0x008024d8]
movups xmmword [rsp + 0x68], xmm0
xor ecx, ecx
jmp 0x42de4f
lea rcx, [r8 + 1]
mov rax, rsi
cmp rcx, 5
jge 0x42df12
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + rcx*8 + 0x50]
add rdx, 0xffffffffffffffd0
neg rdx
cmp rdx, 0x40
sbb rsi, rsi
mov rcx, rdx
mov edi, 1
shl rdi, cl
and rdi, rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [0x00bc1fc0]
nop
lea rdx, [rbx + rdi*8]
lea rdx, [rdx - 1]
neg rbx
and rbx, rdx
xor eax, eax
nop dword [rax]
call fcn.00419d40
test rax, rax
je 0x42df85
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x48], rdx
mov rsi, qword [rsp + 0x88]
test byte [rsi], al
mov r8, qword [rsp + 0x10]
lea r9, [r8 + r8*2]
mov r10, qword [rsp + 0x38]
mov qword [rsi + r9*8 + 8], 0
mov qword [rsi + r9*8 + 0x10], rdx
lea rdi, [rsi + r9*8]
cmp dword [0x00bc2240], 0
jne 0x42df05
mov qword [rsi + r9*8], r10
nop dword [rax]
jmp 0x42de48
mov rdx, r10
call fcn.00466fe0
jmp 0x42de48
nop
xor eax, eax
mov ebx, section..data
call fcn.00419d40
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], section..data
mov qword [rsp + 0x30], section..data
mov rdi, qword [rsp + 0x88]
test byte [rdi], al
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov qword [rdi + 0x100d0], rdx
mov qword [rdi + 0x100d8], rsi
cmp dword [0x00bc2240], 0
jne 0x42df6f
mov qword [rdi + 0x100c8], rcx
jmp 0x42df7b
add rdi, 0x100c8
call fcn.00466fc0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x008e269c]
mov ebx, 0x25
call fcn.00439600
nop
mov qword [rsp + 8], rax
nop dword [rax]
call fcn.00464c60
mov rax, qword [rsp + 8]
jmp fcn.0042de00
Function at 0x4307a0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4307ed
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
nop
test rcx, rcx
je 0x4307db
lea rbx, [0x009097f0]
call fcn.00430800
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x008e55f5]
mov ebx, 0x2c
call fcn.00439600
nop
mov qword [rsp + 8], rax
call fcn.00464c60
mov rax, qword [rsp + 8]
jmp fcn.004307a0

Function at 0x430960
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x430aa6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov ecx, dword [rax + 0x90]
nop
cmp ecx, 2
je 0x430a59
nop
mov ecx, 1
lea rdx, [0x00839008]
lock xadd qword [rdx], rcx
mov rdx, qword [0x00839018]
cmp rcx, rdx
jge 0x430a47
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x18], rcx
movups xmmword [rsp + 0x20], xmm15
mov qword [rsp + 0x30], 0
lea rdx, [0x00430ac0]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x20]
mov qword [rsp], rdx
call fcn.00464b20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [0x00839028]
mov rcx, qword [0x00839030]
test rax, rax
je 0x430a3d
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx + 0x168]
mov rbx, qword [rsp + 0x18]
cmp rbx, rcx
jae 0x430a51
lea rdi, [rax + rbx*8]
cmp dword [0x00bc2240], 0
jne 0x430a38
mov qword [rax + rbx*8], rdx
jmp 0x430a3d
call fcn.00466fe0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rax, rbx
call fcn.00467360
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x10], rax
call fcn.0043aec0
lea rax, [0x008de58d]
mov ebx, 0x1d
call fcn.0043b7c0
mov rax, qword [rsp + 0x10]
call fcn.0043b5c0
call fcn.0043b120
call fcn.0043af40
lea rax, [0x008e2cba]
mov ebx, 0x26
nop dword [rax + rax]
call fcn.00439600
nop
mov qword [rsp + 8], rax
call fcn.00464c60
mov rax, qword [rsp + 8]
jmp fcn.00430960

Function at 0x4310e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431131
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
movabs rcx, 0x800000000000
lea rdx, [rcx + rax]
cmp rax, rdx
setbe dl
add rcx, rbx
cmp rbx, rcx
setbe cl
cmp cl, dl
jne 0x43111f
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x008e9c43]
mov ebx, 0x3c
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004310e0
Function at 0x4323e0
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x432686
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1278]
mov rcx, qword [rax + 0x1268]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x43267a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00bc1c69], 0
jne 0x432442
xor edx, edx
xor ebx, ebx
nop
jmp 0x43248a
xor edx, edx
jmp 0x43246d
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.00421cc0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x432446
add rax, 0x1268
call fcn.00432260
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x432614
mov rsi, qword [rax + rdx*8 + 0x1278]
nop dword [rax + rax]
cmp rsi, 0x1000
jb 0x432487
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00415a60
test rax, rax
jne 0x4324e2
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x432487
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x432525
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x432487
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x43266d
lea r10, [0x00b940b0]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x4325ab
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x4325e5
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x68]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x432487
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x432665
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x432487
cmp rbx, 0x200
ja 0x432658
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00427e40
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.00432260
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
call fcn.004673e0
mov rax, r8
call fcn.00467360
mov rax, r8
mov ecx, 0x40
call fcn.00467380
mov edx, 0x200
nop
call fcn.004673c0
nop
mov qword [rsp + 8], rax
call fcn.00469440
mov rax, qword [rsp + 8]
jmp fcn.004323e0
Function at 0x432f60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43303d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov rax, qword [0x00833300]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
movups xmmword [rsp + 0x10], xmm15
mov eax, 0xffffffff
mov qword [rsp + 0x20], rax
nop dword [rax]
call fcn.00436780
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [0x00800610], rax
test rax, rax
je 0x432fd4
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00468820
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043aec0
lea rax, [0x008e693a]
mov ebx, 0x2f
call fcn.0043b7c0
mov rax, qword [rsp + 0x30]
call fcn.0043b4c0
lea rax, [0x008d3672]
mov ebx, 3
call fcn.0043b7c0
call fcn.0043af40
lea rax, [0x008dd7f2]
mov ebx, 0x1b
call fcn.00439600
nop
nop dword [rax]
call fcn.00464c60
jmp fcn.00432f60

Function at 0x433120
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43320d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
xor eax, eax
lea rcx, [0x00bc1cc8]
mov edx, 1
lock cmpxchg dword [rcx], edx
sete cl
test cl, cl
je 0x433198
mov rax, qword [0x00800610]
mov rcx, qword [0x00833388]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
movups xmmword [rsp + 0x10], xmm15
mov qword [rsp + 0x20], 0
call fcn.00436780
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
je 0x4331a2
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00468820
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043aec0
lea rax, [0x008e9f13]
mov ebx, 0x3c
call fcn.0043b7c0
mov rax, qword [rsp + 0x30]
nop
call fcn.0043b4c0
lea rax, [0x008d3672]
mov ebx, 3
call fcn.0043b7c0
call fcn.0043af40
lea rax, [0x008e7f05]
mov ebx, 0x33
call fcn.00439600
nop
call fcn.00464c60
jmp fcn.00433120