joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63c220
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x63c452
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rcx
lea rax, [rsp + 0x98]
mov rbx, rax
mov ecx, 0x30
call fcn.0061dc20
test al, al
je 0x63c27f
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x63c2c7
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x22
lea rcx, [0x00782209]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00815340]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rcx, rdi
mov rdx, rax
mov rax, rsi
cmp qword [rsp + 0xa0], 0
je 0x63c438
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x70], 0
movups xmmword [rsp + 0x78], xmm15
lea rax, [rsp + 0x98]
lea rbx, [rsp + 0x70]
mov ecx, 0x30
call fcn.0061dc20
test al, al
je 0x63c3f8
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rax, [rsp + 0x70]
lea rbx, [rsp + 0x58]
call fcn.0061d720
test al, al
je 0x63c3b8
mov rcx, qword [rsp + 0x40]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x48]
cmp rdi, rsi
jb 0x63c353
mov rax, qword [rsp + 0x50]
jmp 0x63c371
lea rax, [0x00726ee0]
mov rbx, qword [rsp + 0x50]
nop
call fcn.004493e0
lea rsi, [rbx + 1]
mov rdi, rcx
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + rcx*2]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x68]
mov qword [rax + rdx*8 + 8], r9
mov qword [rax + rdx*8 + 0x10], r10
lea r9, [rax + rdx*8]
cmp dword [0x00a5a130], 0
jne 0x63c3a5
mov qword [rax + rdx*8], r8
nop
jmp 0x63c2be
mov rcx, rdi
mov rdi, r9
call fcn.00462e20
mov rdi, rcx
jmp 0x63c2be
lea rax, [0x0072c820]
nop
call fcn.0040d400
mov qword [rax + 8], 0x22
lea rcx, [0x00782209]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00815340]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x0072c820]
nop
call fcn.0040d400
mov qword [rax + 8], 0x22
lea rcx, [0x00782209]
mov qword [rax], rcx
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00815340]
mov rsi, rax
xor eax, eax
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rbx, rax
xor edi, edi
xor esi, esi
mov rax, rdx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0063c220
Function at 0x6420a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64223f
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rdi
nop dword [rax + rax]
test rbx, rbx
je 0x642229
mov rdx, qword [rdi + 0x278]
mov r8, qword [rdi + 0x270]
nop word [rax + rax]
test rdx, rdx
jne 0x6421af
mov rdx, qword [rdi + 0x1d0]
cmp qword [rdi + 0x1d8], 0
je 0x642129
mov rsi, qword [rdx + 8]
mov rdx, qword [rdx]
test rbx, rbx
jmp 0x6421b8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x28], rbx
mov rdx, qword [rdi + 0xb8]
test rdx, rdx
jne 0x64214d
mov eax, 5
lea rdx, [0x00771c03]
jmp 0x64217c
mov rax, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
mov rcx, qword [rdx + 0x18]
movzx edi, byte [rdx]
mov esi, 0xa
call fcn.00529b40
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x30]
call fcn.0044d200
mov rdx, rax
mov rax, rbx
lea rbx, [0x00772648]
mov ecx, 7
mov rdi, rdx
mov rsi, rax
xor eax, eax
call fcn.0044ce60
mov rdx, qword [rsp + 0x28]
test rdx, rdx
mov rcx, qword [rsp + 0x50]
mov rsi, rbx
mov rdx, rax
mov rbx, qword [rsp + 0x28]
jmp 0x6421b8
test rbx, rbx
mov rsi, rdx
mov rdx, r8
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
je 0x6421ca
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov rax, rdx
mov rbx, rsi
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x0078b744]
mov ebx, 0x53
lea rcx, [rsp + 0x58]
mov edi, 2
mov rsi, rdi
call fcn.004d1ba0
mov ecx, 0x2d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x007865b2]
call fcn.0044ce60
jmp 0x642235
mov ebx, 0x2d
lea rax, [0x007865b2]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.006420a0
Function at 0x642c00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x642d66
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x98], r8
mov rax, rsi
mov rbx, r8
lea rcx, [0x007715ba]
mov edi, 1
nop dword [rax + rax]
call fcn.0047c2e0
test rax, rax
jl 0x642d3d
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
nop
call fcn.00642340
test sil, sil
je 0x642ce1
mov rdx, qword [rsp + 0x30]
cmp rbx, rdx
je 0x642c98
xor eax, eax
jmp 0x642cd3
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov rbx, rax
mov rcx, rdx
mov rax, qword [rsp + 0x48]
call fcn.004029c0
test al, al
jne 0x642cba
xor eax, eax
jmp 0x642cd3
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
call fcn.0047c080
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
movups xmmword [rsp + 0x50], xmm15
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rax, [0x00787654]
mov ebx, 0x30
lea rcx, [rsp + 0x50]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
call fcn.00643000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00642c00
Function at 0x642dc0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x642fc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rax + 0x30]
mov rsi, qword [rax + 0x28]
test rdx, rdx
je 0x642f70
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov rax, rsi
mov rbx, rdx
lea rcx, [0x007715b5]
mov edi, 1
call fcn.0047c2e0
nop
test rax, rax
jge 0x642e29
xor eax, eax
jmp 0x642e4f
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
lea rax, [rsi + rdx]
lea rax, [rax - 1]
lea rbx, [0x00813d34]
mov ecx, 1
call fcn.004029c0
xor eax, 1
test al, al
jne 0x642e5f
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
jmp 0x642e7a
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x28]
mov rbx, qword [rcx + 0x30]
call fcn.0057f800
test rsi, rsi
jne 0x642f5e
nop word [rax + rax]
cmp rbx, 1
jl 0x642e8e
cmp byte [rax], 0x5b
sete dl
jmp 0x642e90
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
test dl, dl
je 0x642ed4
nop
cmp rbx, 1
jge 0x642eaa
xor ecx, ecx
jmp 0x642ed6
lea rdx, [rax + rbx]
lea rdx, [rdx - 1]
mov ecx, 1
mov rax, rdx
lea rbx, [0x00813d34]
call fcn.004029c0
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x30]
jmp 0x642ed6
xor ecx, ecx
test cl, cl
jne 0x642ee5
call fcn.0057e240
nop
test rax, rax
je 0x642f3b
mov rax, qword [rsp + 0x58]
call fcn.005c6b00
movups xmmword [rsp + 0x38], xmm15
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00788911]
mov ebx, 0x36
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
call fcn.00643000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
mov rbx, rsi
mov rcx, r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.005c6b00
movups xmmword [rsp + 0x38], xmm15
nop dword [rax + rax]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x00789dbb]
mov ebx, 0x3e
lea rcx, [rsp + 0x38]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00642dc0
Function at 0x643000
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64323f
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x6431b7
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x90], rbx
call fcn.006428e0
test dil, dil
je 0x64315b
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x98]
movzx edx, byte [rcx]
mov byte [rsp + 0x2f], dl
cmp dl, 0x2e
jne 0x64309b
mov rsi, qword [rsp + 0xa0]
lea rdi, [rsi - 1]
mov rsi, rdi
neg rdi
sar rdi, 0x3f
and edi, 1
add rcx, rdi
jmp 0x6430a3
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rsi
mov rax, rcx
mov rbx, rsi
call fcn.006428e0
test dil, dil
je 0x643105
mov rdx, qword [rsp + 0x38]
cmp rdx, rbx
jl 0x6430f5
movzx esi, byte [rsp + 0x2f]
cmp sil, 0x2e
jne 0x6430e0
cmp rdx, rbx
je 0x6430f5
nop word [rax + rax]
test rbx, rbx
je 0x6431ca
mov qword [rsp + 0x40], rbx
xor ecx, ecx
jmp 0x6431e9
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x007860c8]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x68], xmm15
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x007860c8]
mov ebx, 0x2c
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov r8, qword [rsp + 0x58]
lea rax, [r8 + 0x10]
mov rcx, rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
shl rcx, 4
mov r8, qword [rsp + 0x50]
mov r9, qword [r8 + rcx]
mov rdi, qword [r8 + rcx + 8]
mov rcx, r9
mov rax, rdx
call fcn.0047c080
test al, al
je 0x64322f
mov rdx, qword [rsp + 0x30]
inc rdx
mov rsi, qword [rsp + 0x40]
cmp rsi, rdx
jg 0x6431dd
jmp 0x6431ca
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00643000
Function at 0x6479a0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x647a57
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
lea rdx, [rax - 1]
cmp rdx, 4
jae 0x6479e2
shl rax, 4
lea rdx, [0x009fac40]
mov rsi, qword [rdx + rax + 8]
mov rdx, qword [rdx + rax]
jmp 0x6479f3
nop
mov ebx, 0xa
call fcn.004ac540
mov rsi, rbx
mov rdx, rax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
mov rax, rdx
mov rbx, rsi
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rax, [0x0078b891]
mov ebx, 0x54
lea rcx, [rsp + 0x28]
mov edi, 2
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.006479a0
Function at 0x649960
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6499f2
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
nop dword [rax]
cmp rcx, 0x20
jne 0x6499de
mov rcx, qword [rbx]
movabs rdx, 0x7ffffffffffff
and rcx, rdx
mov qword [rax], rcx
mov rcx, qword [rbx + 6]
shr rcx, 3
and rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rbx + 0xc]
shr rcx, 6
and rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rbx + 0x13]
shr rcx, 1
and rcx, rdx
mov qword [rax + 0x18], rcx
mov rcx, qword [rbx + 0x18]
shr rcx, 0xc
and rcx, rdx
mov qword [rax + 0x20], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814fc0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop
jmp fcn.00649960

Function at 0x649a40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x649b94
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.00648e60
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x649ae4
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x649b35
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x649b60
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x649ade
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x649ade
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x649b4c
mov rax, rsi
mov ecx, 0x20
call fcn.00463140
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00649a40
Function at 0x64a880
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64a911
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [0x00a04128]
mov rdx, qword [0x00a04120]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
mov byte [rsp + 0x10], 9
cmp rcx, 0x20
jne 0x64a8c3
xor eax, eax
xor ebx, ebx
jmp 0x64a900
xor eax, eax
cmp rax, 1
jne 0x64a8d5
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814fb0]
call fcn.004356e0
lea rsi, [rax + 1]
movzx edi, byte [rdx + rax]
movzx r8d, byte [rsp + rax + 0x10]
xor edi, r8d
or ebx, edi
mov rax, rsi
nop
cmp rax, rcx
jl 0x64a8e8
nop
movzx ecx, bl
lea eax, [rcx - 1]
shr eax, 0x1f
jmp 0x64a8c5
call fcn.00460a60
jmp fcn.0064a880
Function at 0x64b8c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64ba9d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
cmp ax, 0x501
ja 0x64b911
nop
cmp ax, 0x203
ja 0x64b8f7
cmp ax, 0x201
je 0x64b92a
cmp ax, 0x203
je 0x64b937
jmp 0x64ba4f
cmp ax, 0x401
je 0x64b92a
nop dword [rax]
cmp ax, 0x403
je 0x64b937
cmp ax, 0x501
je 0x64b92a
jmp 0x64ba4f
cmp ax, 0x601
ja 0x64b931
cmp ax, 0x503
je 0x64b937
nop dword [rax]
cmp ax, 0x601
jne 0x64ba4f
mov ecx, 0xffffffe1
jmp 0x64b960
cmp ax, 0x603
jne 0x64b93e
mov ecx, 0xffffffe3
jmp 0x64b960
lea edx, [rax - 0x804]
cmp dx, 2
ja 0x64b951
mov ecx, 0xffffffe2
jmp 0x64b960
cmp ax, 0x807
jne 0x64ba4f
mov ecx, 0xffffffe4
cmp ax, 0x503
ja 0x64b9a0
cmp ax, 0x401
ja 0x64b988
cmp ax, 0x201
je 0x64b978
cmp ax, 0x203
jne 0x64b980
mov edx, 3
jmp 0x64b9ed
cmp ax, 0x401
je 0x64b9b8
jmp 0x64ba01
cmp ax, 0x403
je 0x64b9b8
cmp ax, 0x501
je 0x64b9c6
cmp ax, 0x503
je 0x64b9c6
jmp 0x64ba01
cmp ax, 0x804
ja 0x64b9c0
cmp ax, 0x601
je 0x64b9d3
cmp ax, 0x603
je 0x64b9d3
cmp ax, 0x804
jne 0x64ba01
mov edx, 5
jmp 0x64b9ed
cmp ax, 0x805
jne 0x64b9cd
mov edx, 6
jmp 0x64b9ed
cmp ax, 0x806
jne 0x64b9e0
mov edx, 7
jmp 0x64b9ed
cmp ax, 0x807
jne 0x64ba01
mov rdx, qword [0x00a59d20]
mov eax, ecx
mov rbx, rdx
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
nop
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040a9c0
lea rcx, [0x00717060]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00782874]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
call fcn.0040a9c0
lea rcx, [0x00717060]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00782874]
mov ebx, 0x23
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 8], ax
call fcn.00460a60
movzx eax, word [rsp + 8]
jmp fcn.0064b8c0
Function at 0x64bac0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64bbdf
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
test rax, rax
je 0x64bb9d
mov edx, dword [rax + 0x10]
cmp edx, 0x188a5798
jne 0x64bb40
lea rdx, [0x0071d120]
nop dword [rax]
cmp rax, rdx
jne 0x64bb9d
lea rax, [0x00789524]
mov ebx, 0x39
xor ecx, ecx
xor edi, edi
mov rsi, rdi
nop dword [rax]
call fcn.004ced20
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp edx, 0x2fd00e80
jne 0x64bb6c
lea rdx, [0x007493c0]
cmp rax, rdx
jne 0x64bb9d
mov eax, 0xffffffe3
mov ebx, 3
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp edx, 0xcc456746
jne 0x64bb9d
lea rdx, [0x00722420]
nop dword [rax + rax]
cmp rax, rdx
jne 0x64bb9d
mov eax, 0xffffffe1
mov ebx, 8
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
lea rax, [0x00780714]
mov ebx, 0x1f
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0064bac0
Function at 0x64c160
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64c261
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x18], rbx
mov word [rsp + 0x30], ax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
call fcn.0064bc00
test rbx, rbx
je 0x64c1d6
mov rdx, qword [rsp + 0x48]
nop dword [rax + rax]
test rdx, rdx
jne 0x64c1cd
movzx esi, word [rsp + 0x30]
cmp si, 0x303
jne 0x64c1cd
mov dword [rsp + 0x14], 0
mov dword [rsp + 0x14], 0x2030201
mov edx, 2
lea rcx, [rsp + 0x14]
jmp 0x64c1d2
mov rcx, qword [rsp + 0x40]
xor esi, esi
jmp 0x64c1fa
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.0064c2a0
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
inc rsi
cmp rsi, rdx
jge 0x64c208
movzx edi, word [rcx + rsi*2]
xor r8d, r8d
jmp 0x64c240
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x47
lea rcx, [0x0078add0]
mov qword [rax], rcx
lea rbx, [0x00815340]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
inc r8
nop
cmp rbx, r8
jle 0x64c1f7
movzx r9d, word [rax + r8*2]
cmp r9w, di
jne 0x64c23c
mov eax, edi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
nop
ret
mov word [rsp + 8], ax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00460a60
movzx eax, word [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0064c160