joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432ac0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
lea rcx, [0x007baec0]
test byte [rcx], al
mov rcx, qword [0x00735bf8]
nop
mov rdx, qword [0x007baec0]
mov qword [rsp], rcx
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x28], xmm15
call fcn.004335a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
nop
test rax, rax
je 0x432b58
mov rcx, qword [0x00735bd8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00433320
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov ecx, dword [0x009e5984]
nop
test ecx, ecx
jne 0x432c0c
mov rax, qword [0x009924b0]
sub rax, qword [0x009924c0]
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x40], rax
call fcn.00438580
lea rax, [0x007b5534]
mov ebx, 0x2e
call fcn.00438e80
mov rax, qword [rsp + 0x48]
movsxd rax, eax
nop
call fcn.00438c80
lea rax, [0x007a9e65]
mov ebx, 0x10
call fcn.00438e80
mov rax, qword [rsp + 0x40]
nop dword [rax + rax]
call fcn.00438b80
lea rax, [0x007a34e7]
mov ebx, 2
call fcn.00438e80
call fcn.00438600
lea rax, [0x007aac20]
mov ebx, 0x11
call fcn.00436e00
nop
nop
lea rax, [0x009e5bf0]
call fcn.0040c2a0
nop
nop
lea rax, [0x009e5bf0]
call fcn.0040c2a0
jmp 0x432b68
Function at 0x4372e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43743d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x10], r14
cmp qword [0x009be6a8], 0
jne 0x437325
call fcn.00438580
lea rax, [0x007b5590]
mov ebx, 0x2e
call fcn.00438e80
nop dword [rax]
call fcn.00438600
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rcx + 0x30]
inc dword [rdx + 0xc0]
mov rdx, qword [rcx + 0x30]
cmp dword [rdx + 0xd8], 0
nop
jge 0x43734c
mov dword [rdx + 0xd8], 1
mov rcx, qword [rcx + 0x30]
mov edx, dword [rcx + 0xdc]
test edx, edx
je 0x4373e7
nop
cmp edx, 1
je 0x4373b1
cmp edx, 2
jne 0x437399
mov dword [rcx + 0xdc], 3
call fcn.00438580
lea rax, [0x007ae2ba]
mov ebx, 0x18
call fcn.00438e80
call fcn.00438600
mov eax, 4
call fcn.00432020
mov eax, 5
nop
call fcn.00432020
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 2
nop dword [rax + rax]
call fcn.00438580
lea rax, [0x007abb27]
mov ebx, 0x13
call fcn.00438e80
call fcn.00438600
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov dword [rcx + 0xdc], 1
mov ecx, 1
lea rdx, [0x009e59c0]
lock xadd dword [rdx], ecx
lea rax, [0x009e5c80]
call fcn.0040c260
cmp dword [0x009e6030], 0
jg 0x43741f
cmp dword [0x009e602c], 0
jle 0x437429
mov eax, 1
call fcn.004442c0
call fcn.0043ab80
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop dword [rax]
call fcn.00461f00
jmp fcn.004372e0
Function at 0x43afe0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43b08c
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x2c], ecx
lea edx, [rbx - 1]
cmp edx, 3
ja 0x43b02e
mov edx, ebx
bts ebx, 0xc
cmp ecx, ebx
jne 0x43b02e
mov rbx, rax
mov eax, edx
lock cmpxchg dword [rbx + 0x90], ecx
sete cl
mov eax, ecx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
call fcn.00438580
lea rax, [0x007b1935]
mov ebx, 0x21
nop
call fcn.00438e80
mov eax, dword [rsp + 0x28]
mov eax, eax
call fcn.00438ce0
lea rax, [0x007a6672]
mov ebx, 8
nop dword [rax]
call fcn.00438e80
mov eax, dword [rsp + 0x2c]
mov eax, eax
call fcn.00438ce0
call fcn.004387e0
call fcn.00438600
lea rax, [0x007aa2b5]
mov ebx, 0x10
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x14], ecx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov ecx, dword [rsp + 0x14]
jmp fcn.0043afe0
Function at 0x43bb60
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43bd26
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x60], al
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x38], rcx
mov edx, dword [0x009e59b0]
test edx, edx
je 0x43bbb4
xor eax, eax
nop dword [rax]
call fcn.00430260
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
call fcn.0043f240
nop
nop
lea rax, [0x00992498]
nop dword [rax]
call fcn.0040c2a0
mov ecx, dword [0x009e59a8]
mov edx, dword [0x009e59bc]
test edx, edx
je 0x43bbe2
mov dword [0x009e59bc], 0
nop
jmp 0x43bbe4
mov edx, ecx
mov eax, edx
call fcn.00442b20
mov qword [rsp + 0x40], rax
mov dword [0x00992580], 0
cmp dword [0x00992590], 0
je 0x43bc19
mov dword [0x00992590], 0
lea rax, [0x00992598]
call fcn.0040c5a0
nop
nop
lea rax, [0x00992498]
call fcn.0040c4c0
mov rcx, qword [rsp + 0x40]
jmp 0x43bc33
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x43bc8f
mov rdx, qword [rcx + 8]
mov rsi, qword [rcx + 0x38]
mov qword [rsp + 0x48], rdx
test rsi, rsi
je 0x43bc7c
nop
mov qword [rcx + 0x38], 0
cmp qword [rsi + 0xa8], 0
nop dword [rax + rax]
jne 0x43bd14
nop
mov qword [rsi + 0xa8], rcx
lea rax, [rsi + 0x120]
call fcn.0040c5a0
jmp 0x43bc2e
xor eax, eax
mov rbx, rcx
mov rcx, 0xffffffffffffffff
call fcn.0043cda0
jmp 0x43bc2e
nop
call fcn.00465f20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [rsp + 0x28], rax
movzx ecx, byte [rsp + 0x60]
test cl, cl
je 0x43bcd4
nop
mov eax, 0xa
mov rbx, 0xffffffffffffffff
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call fcn.00454880
call fcn.0043d9c0
nop
mov rax, qword [rsp + 0x38]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43bd05
cmp byte [r14 + 0xb1], 0
je 0x43bd05
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x007b30dc]
mov ebx, 0x25
call fcn.00436e00
nop
mov byte [rsp + 8], al
call fcn.00461f00
movzx eax, byte [rsp + 8]
jmp fcn.0043bb60
Function at 0x43cda0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43ce95
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x38], rbx
mov rdx, rax
mov rax, rbx
mov rbx, rdx
call fcn.0043c5c0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
setne byte [rax + 0x118]
nop
mov qword [rax + 0xa8], rdx
mov rdx, r14
test rdx, rdx
je 0x43ce74
mov rcx, qword [rdx + 0x30]
test rcx, rcx
je 0x43ce74
mov qword [rsp + 0x18], rax
cmp dword [rcx + 0x240], 0
jne 0x43ce0e
cmp byte [rcx + 0xe8], 0
je 0x43ce74
nop
nop
lea rax, [0x009e5ee0]
call fcn.0040c2a0
cmp dword [0x009e5f00], 0
je 0x43ce83
mov rcx, qword [0x009e5ee8]
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x130], rcx
nop
mov qword [0x009e5ee8], rdx
cmp byte [0x009e5ef0], 0
je 0x43ce5c
mov byte [0x009e5ef0], 0
lea rax, [0x009e5ef8]
call fcn.0040c5a0
nop
nop
lea rax, [0x009e5ee0]
call fcn.0040c4c0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0043cec0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x007b4667]
mov ebx, 0x2a
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0043cda0

Function at 0x43d0c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
mov ecx, dword [rcx + 0x288]
nop dword [rax + rax]
test ecx, ecx
je 0x43d17a
mov qword [rsp + 0x18], r14
mov rcx, qword [r14 + 0x30]
test byte [rcx], al
lea rax, [rcx + 0x280]
nop
nop dword [rax + rax]
call fcn.0040c2a0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x290]
mov qword [rsp + 0x10], rdx
test rdx, rdx
je 0x43d14f
cmp dword [0x009e59a4], 0
jne 0x43d186
mov rcx, qword [rdx]
xor eax, eax
call rcx
mov rcx, qword [rsp + 0x18]
mov rbx, qword [rcx + 0x30]
mov qword [rbx + 0x290], 0
mov rbx, qword [rcx + 0x30]
xor esi, esi
xchg dword [rbx + 0x288], esi
mov rcx, qword [rcx + 0x30]
test byte [rcx], al
lea rax, [rcx + 0x280]
nop
nop dword [rax]
call fcn.0040c4c0
mov rcx, qword [rsp + 0x10]
test rcx, rcx
setne al
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x007b63da]
mov ebx, 0x33
call fcn.00436e00
nop
int3
Function at 0x43d420
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d6aa
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], bl
mov rcx, qword [r14 + 0x30]
nop
inc dword [rcx + 0xd8]
nop
mov rcx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rcx
nop
lea rax, [0x00992498]
nop
call fcn.0040c2a0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x43d480
call fcn.00445020
test rax, rax
je 0x43d572
mov rcx, rax
nop
mov rdx, qword [0x009924a0]
test rdx, rdx
je 0x43d4a4
mov rbx, qword [rdx + 0x130]
mov qword [0x009924a0], rbx
dec dword [0x009924a8]
test rdx, rdx
mov qword [rsp + 0x28], rcx
jne 0x43d525
call fcn.0043a720
mov qword [rsp + 0x18], rax
nop
nop
lea rax, [0x00992498]
nop
call fcn.0040c4c0
movzx eax, byte [rsp + 0x50]
movzx eax, al
test rax, rax
mov eax, 0
lea rcx, [0x007bad98]
cmovne rax, rcx
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x18]
call fcn.0043cda0
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43d51b
cmp byte [r14 + 0xb1], 0
je 0x43d51b
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 0x30], rdx
nop
nop
lea rax, [0x00992498]
call fcn.0040c4c0
mov rcx, qword [rsp + 0x30]
cmp byte [rcx + 0xe4], 0
jne 0x43d698
cmp qword [rcx + 0xa8], 0
jne 0x43d687
movzx edx, byte [rsp + 0x50]
nop dword [rax]
test dl, dl
je 0x43d56e
mov rsi, qword [rsp + 0x28]
jmp 0x43d641
xor eax, eax
jmp 0x43d5eb
nop
nop
lea rax, [0x00992498]
nop dword [rax + rax]
call fcn.0040c4c0
movzx ecx, byte [rsp + 0x50]
test cl, cl
je 0x43d5a4
mov ecx, 0xffffffff
lea rdx, [0x009924dc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43d5da
nop
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 0xd8]
lea edx, [rcx - 1]
mov dword [rax + 0xd8], edx
cmp ecx, 1
jne 0x43d5d0
cmp byte [r14 + 0xb1], 0
je 0x43d5d0
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x007af67e]
mov ebx, 0x1b
call fcn.00436e00
mov byte [rcx + 0xe4], al
mov rdx, qword [rsp + 0x28]
mov qword [rcx + 0xa8], rdx
lea rax, [rcx + 0x120]
call fcn.0040c5a0
nop
mov rcx, qword [rsp + 0x20]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
nop
cmp edx, 1
jne 0x43d637
cmp byte [r14 + 0xb1], 0
je 0x43d637
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov edi, dword [rsi + 0x5f0]
mov r8d, dword [rsi + 0x5f4]
mov r9, qword [rsi + 0xdf8]
mov r10d, dword [rsi + 0x5f4]
nop dword [rax]
cmp r10d, r8d
jne 0x43d641
cmp r8d, edi
jne 0x43d676
test r9, r9
jne 0x43d676
mov eax, edx
jmp 0x43d5eb
lea rax, [0x007ae9d6]
mov ebx, 0x19
call fcn.00436e00
lea rax, [0x007a9dfc]
mov ebx, 0xf
call fcn.00436e00
lea rax, [0x007acb20]
mov ebx, 0x15
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00461f00
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0043d420
Function at 0x43da40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43dc7d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rcx + 0x138]
test rdx, rdx
je 0x43dc6b
mov rdx, qword [rdx + 0xe8]
cmp rdx, rcx
jne 0x43dc6b
mov qword [rsp + 0x28], r14
cmp qword [rcx + 0xa0], 0
je 0x43da95
call fcn.004434e0
call fcn.0043d6e0
mov eax, 1
call fcn.00443640
nop
call fcn.0043bf20
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0x138]
mov edx, dword [rdx + 0x90]
mov ebx, edx
btr edx, 0xc
cmp edx, 1
jne 0x43daf4
mov rdx, qword [rcx + 0x30]
mov rax, qword [rdx + 0xa8]
call fcn.00443360
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0xa8], 0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov dword [rsp + 0x1c], ebx
call fcn.00438580
lea rax, [0x007b4b3c]
mov ebx, 0x2b
call fcn.00438e80
mov eax, dword [rsp + 0x1c]
mov eax, eax
call fcn.00438b80
lea rax, [0x007b2609]
mov ebx, 0x24
call fcn.00438e80
call fcn.00438600
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0x138]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
nop
call fcn.00438580
lea rax, [0x007aa555]
mov ebx, 0x10
call fcn.00438e80
mov rax, qword [rsp + 0x38]
nop dword [rax + rax]
call fcn.00438e00
lea rax, [0x007a57c9]
mov ebx, 7
call fcn.00438e80
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.00438c80
lea rax, [0x007ab4d8]
mov ebx, 0x13
call fcn.00438e80
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x18], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x20], rdx
call fcn.00438580
lea rax, [0x007aa525]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x30]
call fcn.00438e00
lea rax, [0x007a57c9]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x20]
call fcn.00438c80
lea rax, [0x007ab4c5]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438e80
mov eax, dword [rsp + 0x18]
mov eax, eax
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007ae9ef]
mov ebx, 0x19
call fcn.00436e00
lea rax, [0x007b1aa0]
mov ebx, 0x21
call fcn.00436e00
nop
nop dword [rax]
call fcn.00461f00
jmp fcn.0043da40
Function at 0x43dd60
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43de37
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp dword [0x00992580], 0
nop
je 0x43de25
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
je 0x43ddb0
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x009924dc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43de14
call fcn.004434e0
mov qword [rsp + 0x10], rax
nop
nop
lea rax, [0x00992498]
call fcn.0040c2a0
mov rax, qword [rsp + 0x10]
mov dword [rax + 4], 3
mov eax, dword [0x00992584]
lea ecx, [rax - 1]
mov dword [0x00992584], ecx
cmp eax, 1
jne 0x43ddf4
lea rax, [0x00992588]
call fcn.0040c5a0
nop
nop
lea rax, [0x00992498]
nop dword [rax]
call fcn.0040c4c0
call fcn.0043d300
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x007af9f7]
mov ebx, 0x1c
call fcn.00436e00
lea rax, [0x007af38a]
mov ebx, 0x1b
call fcn.00436e00
nop
call fcn.00461f00
nop dword [rax]
jmp fcn.0043dd60
Function at 0x43f1c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43f237
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
cmp byte [rcx + 0xe4], 0
nop
je 0x43f225
mov byte [rcx + 0xe4], 0
mov ecx, 0xffffffff
lea rdx, [0x009924dc]
lock xadd dword [rdx], ecx
dec ecx
test ecx, ecx
jl 0x43f20f
nop
call fcn.0043d9c0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007b1725]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436e00
lea rax, [0x007b0d20]
mov ebx, 0x1f
call fcn.00436e00
nop
call fcn.00461f00
jmp fcn.0043f1c0
Function at 0x440100
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x44036c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
cmp byte [0x00997b50], 0
je 0x440137
mov eax, 0x14
xor ebx, ebx
call fcn.00455c20
mov rax, qword [rsp + 0x48]
nop
mov edx, dword [rax + 0x90]
btr edx, 0xc
cmp edx, 2
jne 0x440245
mov byte [rax + 0xb0], 0x19
cmp byte [rax + 0xb4], 0
je 0x44017e
mov rcx, qword [rax + 0x40]
mov rax, rcx
call fcn.004506e0
test rax, rax
je 0x44022f
movzx edx, byte [rax + 0x29]
test dl, 2
jne 0x4401d4
mov rax, qword [rsp + 0x48]
mov ebx, 2
mov ecx, 0x1009
call fcn.0043b4e0
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0x90]
nop
nop
xor esi, esi
mov qword [rdx + 0x30], rsi
mov rdx, qword [r14 + 0x30]
nop
xor esi, esi
mov qword [rdx + 0x90], rsi
mov rax, qword [rsp + 0x48]
mov ebx, 0x1009
mov ecx, 9
nop dword [rax]
call fcn.0043ac20
call fcn.0043f560
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.00450dc0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call fcn.00438580
lea rax, [0x007b306d]
mov ebx, 0x25
call fcn.00438e80
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
call fcn.00438e80
lea rax, [0x007aad98]
mov ebx, 0x12
call fcn.00438e80
call fcn.00438600
lea rax, [0x007a9d66]
mov ebx, 0xf
call fcn.00436e00
lea rax, [0x007ac9e5]
mov ebx, 0x15
nop dword [rax + rax]
call fcn.00436e00
nop
mov qword [rsp + 0x28], r14
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x14], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438580
lea rax, [0x007aa555]
mov ebx, 0x10
call fcn.00438e80
mov rax, qword [rsp + 0x48]
nop dword [rax]
call fcn.00438e00
lea rax, [0x007a57c9]
mov ebx, 7
call fcn.00438e80
mov rax, qword [rsp + 0x18]
nop dword [rax + rax]
call fcn.00438c80
lea rax, [0x007ab4d8]
mov ebx, 0x13
call fcn.00438e80
mov eax, dword [rsp + 0x14]
mov eax, eax
nop dword [rax]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x90]
mov dword [rsp + 0x10], ecx
mov rdx, qword [rax + 0x98]
mov qword [rsp + 0x18], rdx
call fcn.00438580
lea rax, [0x007aa525]
mov ebx, 0x10
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x28]
call fcn.00438e00
lea rax, [0x007a57c9]
mov ebx, 7
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x18]
call fcn.00438c80
lea rax, [0x007ab4c5]
mov ebx, 0x13
nop dword [rax + rax]
call fcn.00438e80
mov eax, dword [rsp + 0x10]
mov eax, eax
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007a88d4]
mov ebx, 0xc
call fcn.00436e00
nop
mov qword [rsp + 8], rax
call fcn.00466620
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00440100
Function at 0x440780
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [r14 + 0x30]
mov rdx, r14
cmp qword [rcx], rdx
je 0x4407d4
nop word [rax + rax]
cmp qword [rcx + 0x50], rdx
je 0x4407d4
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x38], rbx
mov qword [rdx + 0x60], 0
mov qword [rdx + 0x58], 0
cmp qword [rdx + 0x50], 0
je 0x4407ca
call fcn.0043a0a0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rax, [0x007afc97]
mov ebx, 0x1c
call fcn.00436e00
nop
int3
Function at 0x4436a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44396d
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
cmp byte [0x009e595b], 0
nop
jne 0x4436cb
cmp byte [0x009e595a], 0
je 0x4436d5
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp dword [0x009e59c0], 0
nop dword [rax]
ja 0x4437d0
cmp byte [0x0071c044], 0
jne 0x4436f8
cmp byte [0x009e5953], 0
jne 0x4436fc
xor ecx, ecx
jmp 0x44371e
mov eax, 1
call fcn.0043cca0
nop
cmp dword [0x009e5988], 0
lea rcx, [0x009e5c00]
xchg qword [rcx], rax
seta cl
movzx ecx, cl
mov edx, dword [0x009924a8]
mov rbx, qword [0x009924b0]
sub rbx, qword [0x009924c0]
mov rsi, rbx
sub ebx, edx
mov edi, dword [0x009924ac]
sub ebx, edi
mov r8d, dword [0x009924bc]
sub ebx, r8d
cmp ecx, ebx
jge 0x443757
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test ebx, ebx
jl 0x4438c5
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x00443980]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x30]
call fcn.0043a220
cmp qword [rsp + 0x20], 0
je 0x4438a5
cmp qword [0x009e5c08], 0
je 0x4437be
call fcn.004541e0
test rbx, rbx
je 0x4437be
mov qword [0x009e5c08], rax
lea rax, [0x009924d0]
jmp 0x443832
mov rcx, qword [0x009903b0]
mov rdx, qword [0x009903b8]
xor eax, eax
jmp 0x4437e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
inc rax
nop dword [rax]
cmp rax, rdx
jge 0x4437ff
mov rbx, qword [rcx + rax*8]
test byte [rbx], al
cmp qword [rbx + 0x26e8], 0
jle 0x4437da
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rcx, qword [r14 + 0x30]
mov dword [rcx + 0xc4], 0xffffffff
nop
nop
lea rax, [0x00992498]
call fcn.0040c4c0
lea rax, [0x007b2cd0]
mov ebx, 0x25
call fcn.00436e00
test byte [rcx], al
lea rax, [rcx + 8]
mov rcx, qword [rax]
test rcx, rcx
je 0x443846
cmp rbx, rcx
jne 0x44382c
mov rcx, qword [rbx + 8]
mov qword [rax], rcx
nop
mov rcx, qword [0x009924a0]
test rcx, rcx
je 0x44386a
mov rdx, qword [rcx + 0x130]
mov qword [0x009924a0], rdx
dec dword [0x009924a8]
test rcx, rcx
je 0x44388f
nop
mov qword [rcx + 0xa8], rbx
lea rax, [rcx + 0x120]
nop dword [rax + rax]
call fcn.0040c5a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x007ae733]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436e00
nop
nop
lea rax, [0x00992498]
call fcn.0040c4c0
lea rax, [0x007b6b03]
mov ebx, 0x36
nop
call fcn.00436e00
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x1c], edx
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x14], r8d
call fcn.00438580
lea rax, [0x007af5a6]
mov ebx, 0x1b
call fcn.00438e80
mov eax, dword [rsp + 0x1c]
movsxd rax, eax
call fcn.00438c80
lea rax, [0x007a9162]
mov ebx, 0xe
call fcn.00438e80
mov eax, dword [rsp + 0x18]
movsxd rax, eax
call fcn.00438c80
lea rax, [0x007a665a]
mov ebx, 8
call fcn.00438e80
mov rax, qword [rsp + 0x28]
movsxd rax, eax
call fcn.00438c80
lea rax, [0x007a5783]
mov ebx, 7
call fcn.00438e80
mov eax, dword [rsp + 0x14]
movsxd rax, eax
call fcn.00438c80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007b053f]
mov ebx, 0x1e
call fcn.00436e00
nop
call fcn.00461f00
jmp fcn.004436a0
Function at 0x444f00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444ffc
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov ecx, dword [rax + 0x5f0]
mov edx, dword [rax + 0x5f4]
mov rsi, qword [rax + 0xdf8]
mov edi, dword [rax + 0x5f4]
cmp edi, edx
jne 0x444f18
cmp edx, ecx
jne 0x444fea
nop dword [rax]
test rsi, rsi
jne 0x444fea
mov qword [rsp + 0x20], rax
call fcn.00444e00
mov rcx, qword [0x00990418]
mov rdx, qword [0x00990410]
mov rbx, qword [rsp + 0x20]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
nop dword [rax]
test edi, edi
jl 0x444fe5
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
nop dword [rax]
cmp rax, rsi
jbe 0x444fda
lea rax, [rdx + rsi*4]
lock or dword [rax], r9d
mov rax, qword [0x009924d0]
mov qword [rbx + 8], rax
nop
mov qword [0x009924d0], rbx
mov eax, 1
lea rcx, [0x009924d8]
lock xadd dword [rcx], eax
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov rax, rsi
call fcn.00464620
call fcn.00434760
lea rax, [0x007b23fa]
mov ebx, 0x23
call fcn.00436e00
nop
mov qword [rsp + 8], rax
call fcn.00461f00
mov rax, qword [rsp + 8]
jmp fcn.00444f00