joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500240
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50047e
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
test rcx, rcx
jne 0x5002f8
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0xc8], r8
lea rax, [0x00720be0]
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call fcn.00449300
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x50032f
mov rsi, qword [rsp + 0x88]
xor ecx, ecx
jmp 0x5003eb
mov rdx, qword [rcx + 0x18]
mov rcx, rbx
mov rsi, r10
mov r8, qword [rsp + 0x88]
mov r10, qword [rsp + 0x98]
mov rbx, rax
mov rax, rdi
mov rdi, r9
mov r9, qword [rsp + 0x90]
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor ecx, ecx
xor ebx, ebx
test rcx, rcx
jne 0x5003d3
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rcx + 0x20]
mov rax, qword [rsp + 0xa8]
call rdx
mov rbx, rax
xor eax, eax
call fcn.00406ae0
test al, al
je 0x500396
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 0x28]
mov rax, qword [rsp + 0xa8]
nop
call rcx
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rdx, qword [rsp + 0xc0]
mov rdx, qword [rdx + 0x18]
mov rax, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r8, rsi
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor eax, eax
mov rdi, rbx
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
add rsi, 0x28
mov rcx, r8
mov r8, qword [rsi]
mov qword [rsp + 0x50], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rsp + 0x68], xmm0
cmp qword [rsp + 0x58], 0
jne 0x50044c
mov r8, rcx
shl rcx, 4
mov r9, qword [rsp + 0x70]
mov r10, qword [rsp + 0x68]
mov qword [rax + rcx], r10
lea rdi, [rax + rcx]
lea rdi, [rdi + 8]
cmp dword [0x00a5a130], 0
jne 0x50043a
mov qword [rax + rcx + 8], r9
jmp 0x50043f
call fcn.00462e40
inc r8
cmp rdx, r8
jg 0x5003e4
jmp 0x50032f
nop
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x38
lea rcx, [0x00789326]
mov qword [rax], rcx
lea rcx, [0x00815340]
xor edx, edx
mov rbx, rax
xor eax, eax
jmp 0x500333
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r10
call fcn.00460a60
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
jmp fcn.00500240
Function at 0x5004e0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5006fc
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
lea rax, [0x007269e0]
mov rbx, rcx
mov rcx, rdi
call fcn.0040ade0
test rax, rax
jne 0x50057e
lea rax, [0x00720be0]
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
nop
call fcn.00449300
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x5005b6
mov rsi, qword [rsp + 0x40]
xor ecx, ecx
jmp 0x500666
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xb0]
call rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor ebx, ebx
nop word [rax + rax]
test rcx, rcx
jne 0x50064e
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx + 0x20]
mov rax, qword [rsp + 0x88]
call rdx
mov rbx, rax
xor eax, eax
call fcn.00406ae0
test al, al
je 0x500621
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x28]
mov rax, qword [rsp + 0x88]
call rcx
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rdx, qword [rsp + 0x90]
mov rdx, qword [rdx + 0x20]
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor eax, eax
mov rdi, rbx
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
add rsi, 0x28
mov rcx, r8
mov r8, qword [rsi]
mov qword [rsp + 0x48], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rsp + 0x60], xmm0
cmp qword [rsp + 0x50], 0
jne 0x5006ca
mov r8, rcx
shl rcx, 4
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x60]
mov qword [rax + rcx], r10
lea rdi, [rax + rcx]
lea rdi, [rdi + 8]
cmp dword [0x00a5a130], 0
jne 0x5006b5
mov qword [rax + rcx + 8], r9
jmp 0x5006ba
call fcn.00462e40
inc r8
nop dword [rax]
cmp rdx, r8
jg 0x50065f
jmp 0x5005b6
nop
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x38
lea rcx, [0x00789326]
mov qword [rax], rcx
lea rcx, [0x00815340]
xor edx, edx
mov rbx, rax
xor eax, eax
jmp 0x5005c0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005004e0
Function at 0x500760
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50097c
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
lea rax, [0x00726a60]
mov rbx, rcx
mov rcx, rdi
call fcn.0040ade0
test rax, rax
jne 0x5007fe
lea rax, [0x00720be0]
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
nop
call fcn.00449300
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x500836
mov rsi, qword [rsp + 0x40]
xor ecx, ecx
jmp 0x5008e6
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0xa8]
mov r8, qword [rsp + 0xb0]
call rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor ebx, ebx
nop word [rax + rax]
test rcx, rcx
jne 0x5008ce
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rcx + 0x20]
mov rax, qword [rsp + 0x88]
call rdx
mov rbx, rax
xor eax, eax
call fcn.00406ae0
test al, al
je 0x5008a1
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x28]
mov rax, qword [rsp + 0x88]
call rcx
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rdx, qword [rsp + 0x90]
mov rdx, qword [rdx + 0x30]
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor eax, eax
mov rdi, rbx
xor ebx, ebx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
add rsi, 0x28
mov rcx, r8
mov r8, qword [rsi]
mov qword [rsp + 0x48], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rsp + 0x60], xmm0
cmp qword [rsp + 0x50], 0
jne 0x50094a
mov r8, rcx
shl rcx, 4
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x60]
mov qword [rax + rcx], r10
lea rdi, [rax + rcx]
lea rdi, [rdi + 8]
cmp dword [0x00a5a130], 0
jne 0x500935
mov qword [rax + rcx + 8], r9
jmp 0x50093a
call fcn.00462e40
inc r8
nop dword [rax]
cmp rdx, r8
jg 0x5008df
jmp 0x500836
nop
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x38
lea rcx, [0x00789326]
mov qword [rax], rcx
lea rcx, [0x00815340]
xor edx, edx
mov rbx, rax
xor eax, eax
jmp 0x500840
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00500760
Function at 0x5009e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x500b41
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov r13, 0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x2f], 0
lea rax, [0x00a5a140]
call fcn.0046d1a0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00500b80]
mov qword [rsp + 0x30], rcx
lea rcx, [0x00a5a140]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x2f], 1
mov rcx, qword [rsp + 0x68]
nop dword [rax + rax]
test rcx, rcx
je 0x500b1d
mov rbx, qword [0x009ff0b0]
lea rax, [0x0071f880]
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
call fcn.00412700
test bl, bl
jne 0x500aec
mov rbx, qword [0x009ff0b0]
lea rax, [0x0071f880]
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
call fcn.00412b20
mov rdx, qword [rsp + 0x68]
mov qword [rax], rdx
cmp dword [0x00a5a130], 0
jne 0x500ac3
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
jmp 0x500ad1
lea rdi, [rax + 8]
mov rax, qword [rsp + 0x70]
call fcn.00462ca0
mov byte [rsp + 0x2f], 0
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx]
nop
call rax
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
xor eax, eax
lea rbx, [0x00783c46]
mov ecx, 0x26
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
call fcn.0044ce60
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814390]
call fcn.004356e0
nop
call fcn.00434b60
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005009e0
Function at 0x501ac0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x501d42
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x68]
lea rax, [0x0071e440]
mov rbx, rdx
lea rcx, [rsp + 0x40]
call fcn.0040e600
mov rdx, qword [rax]
nop dword [rax + rax]
test bl, bl
je 0x501ce3
test rdx, rdx
je 0x501b52
mov rsi, qword [rdx]
jmp 0x501b54
xor esi, esi
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rdi
mov r8, qword [rsp + 0xc0]
mov qword [rsp + 0x58], r8
lea rax, [0x007263e0]
mov rbx, rdx
lea rcx, [rsp + 0x50]
call fcn.0040ef60
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x501b9b
mov rdx, qword [rdx]
jmp 0x501b9d
xor edx, edx
mov r8, qword [rsp + 0x28]
cmp rdx, r8
je 0x501c5d
test rdx, rdx
jne 0x501c46
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rdi + 0x68]
lea rax, [0x0071e440]
lea rcx, [rsp + 0x40]
call fcn.0040ef60
mov rdx, qword [rsp + 0x38]
test byte [rdx], al
lea rax, [0x0072eca0]
call fcn.0040d400
lea rdx, [0x005081e0]
mov qword [rax], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 8], rdx
cmp dword [0x00a5a130], 0
jne 0x501c25
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
jmp 0x501c36
lea rdi, [rax + 0x10]
mov rcx, qword [rsp + 0xb0]
call fcn.00462da0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
lea rax, [0x007a7948]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rdx, qword [rsp + 0xb8]
mov qword [rsp + 0x70], rdx
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x78], rdx
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x501cde
mov rbx, qword [rdx + 8]
mov qword [rsp + 0x80], rbx
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x88], rdx
lea rax, [0x00782851]
mov ebx, 0x23
lea rcx, [rsp + 0x70]
mov edi, 2
mov rsi, rdi
call fcn.004d1ba0
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
call fcn.004356e0
mov rbx, rdx
jmp 0x501c94
movups xmmword [rsp + 0x60], xmm15
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x501d3b
mov rbx, qword [rdx + 8]
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x68], rdx
lea rax, [0x00782181]
mov ebx, 0x22
lea rcx, [rsp + 0x60]
mov edi, 1
mov rsi, rdi
call fcn.004d1ba0
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
call fcn.004356e0
mov rbx, rdx
nop
jmp 0x501cf7
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop dword [rax + rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.00501ac0
Function at 0x502040
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x502238
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rdi
mov edx, 1
lea rsi, [0x00a5a150]
lock xadd dword [rsi], edx
inc edx
test edx, edx
jge 0x5020ae
lea rax, [0x00a5a14c]
xor ebx, ebx
xor ecx, ecx
call fcn.0045e340
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov rdx, qword [0x009ff0b0]
mov rcx, rax
mov rdi, rbx
lea rax, [0x0071f880]
mov rbx, rdx
call fcn.00412700
mov rdx, qword [rax]
mov qword [rsp + 0x30], rdx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
nop
mov esi, 0xffffffff
lea r8, [0x00a5a150]
lock xadd dword [r8], esi
dec esi
test esi, esi
jge 0x502114
mov byte [rsp + 0x2f], bl
lea rax, [0x00a5a140]
mov ebx, esi
call fcn.0046d100
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
movzx ebx, byte [rsp + 0x2f]
test bl, bl
je 0x5021dc
lea rax, [0x00726660]
mov rbx, rdx
call fcn.0040ade0
test rax, rax
je 0x502174
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
call rdx
test rcx, rcx
je 0x502161
xor eax, eax
mov rbx, rcx
mov rcx, rdi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
call fcn.00501e20
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x68], rcx
lea rax, [0x00743780]
lea rbx, [rsp + 0x50]
call fcn.0040a8c0
mov rbx, rax
lea rax, [0x00817050]
call fcn.00501e20
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [0x00785675]
mov ebx, 0x2a
lea rcx, [rsp + 0x40]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00502040
Function at 0x502740
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5029c6
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
cmp rbx, 0x3b9aca00
mov ecx, 0x3b9aca00
cmovl rbx, rcx
mov rax, rbx
call fcn.00499260
mov qword [rsp + 0x50], rax
jmp 0x5027a1
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
call fcn.00499340
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax]
mov r9, qword [rsp + 0x98]
mov r10, qword [r9 + 0x98]
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x68], r10
lea rbx, [rsp + 0x48]
xor ecx, ecx
xor edi, edi
mov esi, 2
mov r8d, 1
lea rax, [rsp + 0x68]
call fcn.00446140
test rax, rax
je 0x5027f6
cmp rax, 1
jne 0x5029c5
xor eax, eax
mov rcx, qword [rsp + 0x98]
mov edx, 1
lock cmpxchg dword [rcx + 0x20], edx
sete sil
lea rax, [rcx + 0x20]
mov qword [rsp + 0x58], rax
test sil, sil
jne 0x502837
nop dword [rax]
call fcn.0046bb80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x98]
mov edx, 1
mov rsi, qword [rcx + 0x90]
nop
test rsi, rsi
jg 0x50284e
mov rsi, qword [rcx + 0x88]
jmp 0x502861
mov r8, qword [rcx + 0x88]
test r8, r8
jle 0x502861
cmp r8, rsi
cmovl rsi, r8
cmp byte [rcx + 0x60], 0
jne 0x50292a
cmp qword [rcx + 0x50], 0
je 0x50292a
test rsi, rsi
jle 0x50292a
mov rax, rcx
mov rbx, rsi
call fcn.00502a00
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rcx
nop
mov edx, 0xffffffff
mov rsi, qword [rsp + 0x98]
lock xadd dword [rsi + 0x20], edx
dec edx
test edx, edx
je 0x5028d5
mov rax, qword [rsp + 0x58]
mov ebx, edx
call fcn.0046be80
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x98]
xor edx, edx
jmp 0x5029a7
cmp rax, 0x3b9aca00
mov ecx, 0x3b9aca00
cmovl rax, rcx
mov rdx, qword [rsp + 0x50]
cmp qword [rdx + 0x20], 0
je 0x5029b1
mov qword [rsp + 0x30], rax
lea rax, [rdx + 8]
call fcn.0045f9c0
test al, al
jne 0x50278d
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rcx]
xor eax, eax
nop dword [rax + rax]
call fcn.00406ae0
jmp 0x50278d
cmp dword [0x00a5a130], 0
jne 0x502942
mov qword [rcx + 0x98], 0
nop
jmp 0x502950
lea rdi, [rcx + 0x98]
xor edx, edx
call fcn.00462dc0
nop
mov edx, 0xffffffff
lock xadd dword [rcx + 0x20], edx
lea ebx, [rdx - 1]
nop
test ebx, ebx
je 0x502969
call fcn.0046be80
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 0x40], rdx
mov rax, qword [rbx + rdx*8]
call fcn.005012c0
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x98]
cmp rcx, rdx
jg 0x502979
jmp 0x5028dc
lea rax, [0x0070f0c0]
lea rbx, [0x00814e70]
nop
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00502740
Function at 0x50b760
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b82d
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x48], rcx
mov rdx, qword [rax + 0x18]
mov rax, rbx
call rdx
mov rcx, qword [rsp + 0x50]
nop
cmp rax, rcx
jne 0x50b819
lea rax, [0x00725fe0]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.0040ade0
nop dword [rax + rax]
test rax, rax
je 0x50b7e7
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
call rdx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
call fcn.0050b100
mov rbx, rax
lea rax, [0x00816650]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008141d0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0050b760
Function at 0x50d5a0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x50d60b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x50d5c4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x50d5e1
cmp rdx, 0
je 0x50d62d
test rdx, 0xf
je 0x50d5bd
test rdx, 7
jne 0x50d5e1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x50d5bd
ret
Function at 0x50fd60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x50fd9f
jb 0x50fdb4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x50fe20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x50fe5f
jb 0x50fe74
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret