joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a8960
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6a8a95
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
cmp byte [0x00a59c35], 0
je 0x6a8a51
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, rbx
mov rbx, rcx
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [0x00784978]
mov ebx, 0x28
lea rcx, [rsp + 0x30]
mov edi, 2
mov rsi, rdi
call fcn.005cd520
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov rax, qword [rax + 0x170]
mov rbx, qword [rsp + 0x50]
xor r8d, r8d
call fcn.00689400
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.006a8960
Function at 0x6aa6a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6aa912
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x20], rax
mov rcx, qword [rbx]
test byte [rbx], al
mov ecx, dword [rcx + 8]
mov ebx, ecx
call fcn.006ace00
test rax, rax
je 0x6aa904
mov qword [rsp + 0x18], rax
cmp byte [rax + 0x15f], 0
jne 0x6aa86f
cmp byte [rax + 0x15b], 0
jne 0x6aa719
mov rsi, qword [rax + 0x20]
test rsi, rsi
je 0x6aa712
nop
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x6aa712
mov rax, qword [rdx]
call rax
mov rax, qword [rsp + 0x18]
mov byte [rax + 0x15b], 1
cmp byte [rax + 0x15c], 0
jne 0x6aa850
mov byte [rax + 0x15c], 1
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x20]
call fcn.006aa940
nop
test rbx, rbx
je 0x6aa7c2
lea rdx, [0x00815f20]
cmp rbx, rdx
jne 0x6aa761
mov rax, rbx
mov rbx, rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov edx, dword [rdx + 8]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
lea rax, [0x00752da0]
lea rbx, [rsp + 0x28]
call fcn.0040a8c0
mov rcx, qword [rsp + 0x18]
mov byte [rcx + 0x160], 1
lea rbx, [0x00815f60]
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.006a0300
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
test rax, rax
je 0x6aa842
lea rcx, [rax + 0x78]
cmp dword [0x00a5a130], 0
jne 0x6aa7e9
mov rdx, qword [rsp + 0x18]
mov qword [rdx + 0x170], rcx
mov qword [rdx + 0x100], rax
jmp 0x6aa806
mov rdx, qword [rsp + 0x18]
lea rdi, [rdx + 0x170]
call fcn.00462da0
lea rdi, [rdx + 0x100]
call fcn.00462ca0
mov rax, qword [rdx + 0xf8]
call fcn.00405cc0
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
movzx ecx, byte [rcx + 2]
nop
test cl, 1
je 0x6aa834
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
call fcn.006acc20
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov rbx, rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x20]
nop dword [rax]
call fcn.006ab740
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x28
lea rcx, [0x00784a40]
mov qword [rax], rcx
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x30], xmm15
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov ecx, dword [rcx + 8]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], 1
lea rcx, [0x00815340]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rax, [0x00752da0]
lea rbx, [rsp + 0x28]
call fcn.0040a8c0
mov rcx, qword [rsp + 0x18]
mov byte [rcx + 0x160], 1
lea rbx, [0x00815f60]
mov rdx, rax
mov rax, rcx
mov rcx, rdx
call fcn.006a0300
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006aa6a0
Function at 0x6ad120
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6ad2c8
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x90], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rcx]
test byte [rdx], al
movups xmmword [rsp + 0x58], xmm15
lea rsi, [0x006cf840]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdx
mov esi, dword [rdx + 0x58]
test esi, esi
jne 0x6ad188
mov qword [rsp + 0x30], rdx
lea rax, [rdx + 0x58]
lea rbx, [rsp + 0x58]
call fcn.0046bf60
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 0x68]
mov rsi, qword [rsi + 0x20]
mov rax, qword [rdx + 0x70]
mov rbx, rcx
call rsi
mov rbx, qword [rsp + 0x90]
cmp dword [rbx + 0x10], 0
je 0x6ad2b0
movups xmmword [rsp + 0x48], xmm15
mov eax, dword [rbx + 0x10]
call fcn.0040aa40
lea rcx, [0x00721720]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
nop
cmp byte [0x00a59c35], 0
je 0x6ad1f3
nop
lea rax, [0x007851e1]
mov ebx, 0x29
lea rcx, [rsp + 0x48]
mov edi, 1
mov rsi, rdi
call fcn.005cd520
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x48]
nop
test rdx, rdx
je 0x6ad2a8
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x90]
mov ecx, dword [rdx + 0x10]
mov dword [rsp + 0x2c], ecx
mov rbx, qword [0x00a02220]
lea rax, [0x0071ec20]
call fcn.004105c0
mov rdx, qword [rax]
mov rsi, qword [rax + 8]
test bl, bl
jne 0x6ad27f
movups xmmword [rsp + 0x68], xmm15
mov eax, dword [rsp + 0x2c]
call fcn.0040aa40
lea rcx, [0x0070f200]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x00775631]
mov ebx, 0xe
lea rcx, [rsp + 0x68]
mov edi, 1
mov rsi, rdi
call fcn.004d1ba0
mov rsi, rbx
mov rdx, rax
xor eax, eax
lea rbx, [0x00774aa9]
mov ecx, 0xc
mov rdi, rdx
call fcn.0044ce60
mov rdx, qword [rsp + 0x38]
mov r8, qword [rdx]
nop dword [rax]
call r8
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x40]
call fcn.006a2a40
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006ad120
Function at 0x6bece0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6bedc4
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], r8
mov rdx, qword [rax + 0x78]
test rdx, rdx
jne 0x6beda2
mov rdx, qword [rax + 0x80]
test rdx, rdx
je 0x6bed8c
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x6bed82
nop
test rcx, rcx
jne 0x6bed82
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
nop
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x31
lea rcx, [0x00787963]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x40]
lea rcx, [0x00815340]
mov rdi, rax
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
lea rax, [0x00a04a60]
call fcn.00576b20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.006bece0
Function at 0x6bee80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6bf029
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
mov r13, 0
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x17], 0
mov byte [rsp + 0x16], 0
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x90], esi
sete sil
lea rax, [rdx + 0x90]
test sil, sil
jne 0x6bef11
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x20], rcx
call fcn.0046bb80
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
movups xmmword [rsp + 0x30], xmm15
lea rsi, [0x006bf060]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x17], 1
cmp qword [rdx + 0x98], 0
nop
jne 0x6bef4c
cmp qword [rdx + 0xa0], 0
je 0x6bef71
mov byte [rsp + 0x16], 0
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx]
nop
call rax
movzx eax, byte [rsp + 0x16]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
cmp dword [0x00a5a130], 0
jne 0x6bef83
mov qword [rdx + 0x98], rbx
jmp 0x6bef98
lea rsi, [rdx + 0x98]
mov rax, rdi
mov rdi, rsi
call fcn.00462de0
mov rdi, rax
mov qword [rdx + 0xa0], rcx
cmp dword [0x00a5a130], 0
jne 0x6befb1
mov qword [rdx + 0xa8], rdi
jmp 0x6befc5
lea rcx, [rdx + 0xa8]
mov rax, rdi
mov rdi, rcx
nop
call fcn.00462ca0
test rbx, rbx
jne 0x6befd4
cmp qword [rdx + 0xa0], 0
je 0x6bf001
mov rax, qword [rdx + 0x78]
call fcn.00405cc0
mov byte [rsp + 0x16], 1
mov byte [rsp + 0x17], 0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x16]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814790]
call fcn.004356e0
nop
call fcn.00434b60
movzx eax, byte [rsp + 0x16]
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop dword [rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.006bee80
Function at 0x6bf3e0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6bf49c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r8
mov rdx, qword [rax + 0x88]
test rdx, rdx
je 0x6bf432
mov r10, qword [rdx]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
mov rsi, r8
mov r8, r9
call r10
jmp 0x6bf44b
mov rdx, qword [rax + 0x90]
mov r10, qword [rdx]
mov rax, rdi
mov rbx, rsi
mov rcx, r8
mov rdi, r9
call r10
test rax, rax
jne 0x6bf492
test rcx, rcx
jne 0x6bf492
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
nop
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x41
lea rcx, [0x0078a3ec]
mov qword [rax], rcx
mov rbx, qword [rsp + 0x38]
lea rcx, [0x00815340]
mov rdi, rax
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
nop
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.006bf3e0
Function at 0x6c62e0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6c64c5
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
cmp qword [rax + 0xe8], 0
jne 0x6c64bb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rax + 0x68]
mov r8, qword [rdx + 0x30]
sub r8, qword [rdx + 0x28]
test r8, r8
jle 0x6c63f0
mov rax, rdx
mov rbx, r8
call fcn.0047cee0
cmp rbx, 0xc
jl 0x6c636f
cmp dword [rax], 0x50545448
jne 0x6c636f
cmp word [rax + 4], 0x312f
jne 0x6c636f
cmp byte [rax + 6], 0x2e
nop
jne 0x6c636f
cmp dword [rax + 8], 0x38303420
je 0x6c6499
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
nop dword [rax + rax]
call fcn.0040abe0
lea rdx, [0x0070c500]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
test rdx, rdx
je 0x6c63ab
mov rbx, qword [rdx + 8]
jmp 0x6c63ae
mov rbx, rdx
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x58], rdx
lea rax, [0x0078b214]
mov ebx, 0x4b
lea rcx, [rsp + 0x40]
mov edi, 2
mov rsi, rdi
call fcn.005cd520
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x28]
mov rdx, qword [0x00a03238]
nop word [rax + rax]
cmp qword [0x00a03230], rbx
jne 0x6c642d
mov rax, rbx
mov rbx, rcx
mov rcx, rdx
call fcn.00403ce0
test al, al
jne 0x6c6477
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x28]
movups xmmword [rsp + 0x30], xmm15
test rbx, rbx
je 0x6c643c
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
lea rax, [0x0077da17]
mov ebx, 0x1a
lea rcx, [rsp + 0x30]
mov edi, 1
mov rsi, rdi
nop
call fcn.004ced20
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x70]
call fcn.006c85a0
jmp 0x6c648f
mov rbx, qword [0x00a03610]
mov rcx, qword [0x00a03618]
mov rax, qword [rsp + 0x70]
call fcn.006c85a0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbx, qword [0x00a03610]
mov rcx, qword [0x00a03618]
mov rax, qword [rsp + 0x70]
call fcn.006c85a0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.006c62e0
Function at 0x6d1840
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x6d19be
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xa0], rcx
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x0078663a]
mov ebx, 0x2e
lea rcx, [rsp + 0x60]
mov edi, 2
mov rsi, rdi
nop
call fcn.004d1ba0
nop
mov rcx, qword [0x009f4780]
mov rdx, rax
mov rax, rcx
mov rsi, rbx
mov rbx, rdx
mov rcx, rsi
nop dword [rax]
call fcn.00691d60
test rbx, rbx
jne 0x6d19a1
mov qword [rsp + 0x40], rax
mov rbx, qword [rax + 0x40]
mov rcx, qword [rax + 0x48]
mov qword [rsp + 0x48], rcx
lea rax, [0x00727ce0]
call fcn.0040aca0
mov rbx, qword [rsp + 0x48]
call fcn.0046e2e0
test rdi, rdi
je 0x6d194b
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x40]
mov rax, qword [rcx + 0x48]
mov rcx, qword [rdx + 0x18]
call rcx
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
nop
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.006d1840
Function at 0x6d23e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x60]
cmp r12, qword [r14 + 0x10]
jbe 0x6d265f
sub rsp, 0xe0
mov qword [rsp + 0xd8], rbp
lea rbp, [rsp + 0xd8]
mov qword [rsp + 0x128], r9
mov r13, 0
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0x108], rcx
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xf8], rax
mov byte [rsp + 0x3f], 0
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov rax, r9
mov rbx, r10
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xf0]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xc8], rax
lea rax, [0x007830bc]
mov ebx, 0x25
lea rcx, [rsp + 0xb0]
mov edi, 2
mov rsi, rdi
nop
call fcn.004d1ba0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rbx
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x90], rcx
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x98], rcx
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0xa0], rcx
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0xa8], rcx
mov ecx, 2
lea rax, [rsp + 0x90]
mov rbx, rcx
call fcn.0050a7a0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
nop
mov rcx, qword [0x009f4780]
mov rax, rcx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call fcn.00691d60
test rbx, rbx
je 0x6d2566
xor eax, eax
jmp 0x6d2622
mov qword [rsp + 0x60], rax
nop
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x48]
mov ecx, 0x242
mov edi, 0x1b6
call fcn.004cb280
test rbx, rbx
jne 0x6d25ce
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x60]
mov rbx, qword [rcx + 0x40]
mov rdx, qword [rcx + 0x48]
mov qword [rsp + 0x58], rdx
lea rax, [0x00727ce0]
call fcn.0040aca0
mov rbx, qword [rsp + 0x70]
mov rcx, rax
mov rdi, qword [rsp + 0x58]
xor esi, esi
xor r8d, r8d
mov r9, r8
lea rax, [0x00815780]
call fcn.0046dc40
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x40]
test byte [rcx], al
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x78], 0
movups xmmword [rsp + 0x80], xmm15
lea rbx, [0x006d26c0]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0x3f], 1
mov eax, 1
test al, 1
je 0x6d263a
and eax, 0xfffffffe
mov byte [rsp + 0x3f], al
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rdx]
call rax
mov rbp, qword [rsp + 0xd8]
add rsp, 0xe0
ret
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x50], r10
call fcn.00460a60
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
jmp fcn.006d23e0
Function at 0x6d43e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x6d4573
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
lea rax, [0x007562c0]
mov ebx, 0x808
mov rcx, rbx
call fcn.00449300
mov qword [rsp + 0x48], rax
lea rax, [0x0070f200]
call fcn.0040d400
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x50], rax
lea rax, [0x00711bc0]
call fcn.0040d400
mov qword [rax], 8
mov rdx, qword [rsp + 0x38]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], 0x18180
mov rdx, qword [rsp + 0x50]
mov qword [rax + 0x18], rdx
mov rdx, qword [0x00a010c8]
mov rbx, rax
mov ecx, 4
mov rdi, rcx
mov rax, rdx
call fcn.005aa860
test rax, rax
jne 0x6d44ce
mov r8, qword [rsp + 0x58]
mov ecx, dword [r8]
mov ebx, 0xaaaaaaab
imul rcx, rbx
shr rcx, 0x25
cmp rcx, 0x808
ja 0x6d4568
mov rax, qword [rsp + 0x48]
mov rbx, rcx
mov ecx, 0x808
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx + 0x18]
mov rax, rdi
call rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rax, qword [rsp + 0x28]
call fcn.0040aac0
lea rcx, [0x0070f2c0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
lea rax, [0x00788695]
mov ebx, 0x35
lea rcx, [rsp + 0x60]
mov edi, 2
mov rsi, rdi
call fcn.004ced20
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov edx, 0x808
call fcn.004631c0
nop
call fcn.00460a60
jmp fcn.006d43e0
Function at 0x6d74e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6d76f9
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov byte [rsp + 0x2f], 0
mov rdx, rcx
and ecx, 0xf
lea rax, [rcx - 0x10]
neg rax
mov byte [rsp + 0x2f], al
nop
test rax, rax
je 0x6d75be
jl 0x6d76e5
mov rsi, rax
cqo
idiv rax
nop word [rax + rax]
cmp rax, 1
jne 0x6d76d0
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rdi
lea rax, [0x0070f280]
mov rbx, rsi
mov rcx, rbx
call fcn.00449300
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, 1
mov edx, 1
mov rsi, rcx
cmovg rcx, rdx
lea rbx, [rsp + 0x2f]
cmp rax, rbx
je 0x6d75b4
mov qword [rsp + 0x38], rcx
nop
call fcn.00463ac0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x6d7641
xor eax, eax
lea rcx, [rsp + 0x2f]
lea rsi, [rdx + rax]
mov qword [rsp + 0x48], rsi
cmp rdi, rsi
jae 0x6d7604
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x50], rcx
lea rax, [0x0070f280]
mov rcx, rdx
call fcn.004493e0
mov rdx, qword [rsp + 0x88]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x58], rbx
add rdx, rbx
mov rsi, rax
mov rax, rdx
mov rbx, rcx
mov rcx, rsi
nop dword [rax]
call fcn.00463ac0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
shl rcx, 1
cmp rcx, rsi
jge 0x6d769b
ja 0x6d76c5
lea r8, [rcx + rdx]
lea r8, [r8 - 0x10]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
sar r9, 0x3f
and r9, rcx
lea r10, [r9 + rax]
test r9, r9
je 0x6d763e
mov qword [rsp + 0x38], rcx
mov rbx, rax
mov rcx, r8
mov rax, r10
nop dword [rax + rax]
call fcn.00463ac0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
jmp 0x6d763e
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
mov rax, rsi
mov rcx, qword [rsp + 0x60]
nop dword [rax + rax]
jmp 0x6d75c5
mov rax, rcx
mov rcx, rsi
call fcn.00463200
lea rax, [0x0070f0c0]
lea rbx, [0x00814060]
nop
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814050]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.006d74e0