joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66e140
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x66e3a7
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x66e189
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x18
cmp qword [rsp + 0x50], 0
jne 0x66e2d4
cmp qword [rsp + 0x80], 0
jne 0x66e393
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x66e21e
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x66e272
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x66e272
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x66e2d4
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x66e2bd
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0066e3c0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x66e385
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x66e37f
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x66e364
mov qword [rdi], rax
jmp 0x66e369
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x66e38b
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0066e140
Function at 0x66eda0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x66f007
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x66ede9
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0xd
cmp qword [rsp + 0x50], 0
jne 0x66ef34
cmp qword [rsp + 0x80], 0
jne 0x66eff3
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x66ee7e
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x66eed2
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x66eed2
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x66ef34
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x66ef1d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0066f020]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x66efe5
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x66efdf
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x66efc4
mov qword [rdi], rax
jmp 0x66efc9
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x66efeb
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.0066eda0
Function at 0x671440
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x6716a7
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x671489
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0xb
cmp qword [rsp + 0x50], 0
jne 0x6715d4
cmp qword [rsp + 0x80], 0
jne 0x671693
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x67151e
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x671572
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x671572
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x6715d4
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x6715bd
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x006716c0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x671685
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x67167f
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x671664
mov qword [rdi], rax
jmp 0x671669
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x67168b
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00671440
Function at 0x6731e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x673447
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x673229
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x16
cmp qword [rsp + 0x50], 0
jne 0x673374
cmp qword [rsp + 0x80], 0
jne 0x673433
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x6732be
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x673312
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x673312
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x673374
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x67335d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00673460]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x673425
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x67341f
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x673404
mov qword [rdi], rax
jmp 0x673409
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x67342b
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.006731e0
Function at 0x673b00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x673d67
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x673b49
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x14
cmp qword [rsp + 0x50], 0
jne 0x673c94
cmp qword [rsp + 0x80], 0
jne 0x673d53
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x673bde
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x673c32
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x673c32
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x673c94
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x673c7d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00673d80]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x673d45
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x673d3f
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x673d24
mov qword [rdi], rax
jmp 0x673d29
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x673d4b
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00673b00
Function at 0x674aa0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x674d07
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test rdx, rdx
je 0x674ae9
mov rax, rdx
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 0xb8], rax
movups xmmword [rsp + 0x50], xmm15
lea rdi, [rsp + 0x58]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463430
mov rbp, qword [rbp]
nop
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0xf
cmp qword [rsp + 0x50], 0
jne 0x674c34
cmp qword [rsp + 0x80], 0
jne 0x674cf3
mov rdx, qword [rsp + 0x68]
inc rdx
cmp rdx, 1
jge 0x674b7e
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x1b
lea rcx, [0x0077df66]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
cmp byte [rsp + 0x78], 0
je 0x674bd2
mov rdx, qword [rsp + 0x68]
inc rdx
cmp qword [rsp + 0x70], rdx
jge 0x674bd2
lea rax, [0x0072c820]
nop dword [rax + rax]
call fcn.0040d400
mov qword [rax + 8], 0x36
lea rcx, [0x007889b3]
mov qword [rax], rcx
lea rcx, [0x00815340]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb8]
jmp 0x674c34
mov rcx, qword [rsp + 0x68]
lea rsi, [rcx + 1]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp rdi, rsi
jae 0x674c1d
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
lea rax, [0x0070f280]
nop dword [rax + rax]
call fcn.004493e0
mov rsi, qword [rsp + 0x30]
mov rbx, rax
mov rdi, rcx
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x38]
movzx edx, byte [rsp + 0x2f]
mov byte [rbx + rcx], dl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x00674d20]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rax
mov ebx, 3
xor ecx, ecx
lea rdi, [rsp + 0x40]
lea rax, [rsp + 0x50]
nop dword [rax]
call fcn.0061eb20
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
jne 0x674ce5
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x674cdf
sub rcx, rax
mov rdi, qword [rsp + 0xb8]
mov qword [rdi + 8], rcx
sub rsi, rax
mov qword [rdi + 0x10], rsi
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
cmp dword [0x00a5a130], 0
jne 0x674cc4
mov qword [rdi], rax
jmp 0x674cc9
call fcn.00462ca0
mov rbx, rcx
mov rcx, r8
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
nop
call fcn.00463200
je 0x674ceb
mov rdx, qword [rdx + 8]
mov rax, rdx
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814360]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.00674aa0
Function at 0x6770e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6771dc
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
test r9, r9
jne 0x677143
mov rcx, qword [rax + 0x18]
mov rax, rcx
call fcn.00514940
mov r9, rax
mov r10, rbx
mov rdx, qword [r9 + 0x30]
mov rax, r10
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx + 0x18]
lea r8, [rsi - 1]
cmp r8, 0x13
jae 0x6771c8
mov r12, qword [0x009f5458]
mov r13, qword [0x009f5450]
cmp r12, rsi
jbe 0x6771bd
movzx r12d, byte [r13 + rsi]
mov qword [rsp], r12
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, rax
mov r10, rbx
mov r11, rcx
mov rax, rdx
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.00676640
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rsi
mov rcx, r12
call fcn.00463160
lea rax, [0x0070f0c0]
lea rbx, [0x00814350]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.006770e0
Function at 0x677240
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x677351
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], rsi
test rbx, rbx
jne 0x677306
mov rdx, qword [rax + 0x18]
lea rdi, [rdx - 1]
nop word [rax + rax]
nop
cmp rdi, 0x13
jae 0x67733d
mov rcx, qword [0x009f5458]
mov rdi, qword [0x009f5450]
nop dword [rax + rax]
cmp rcx, rdx
jbe 0x677335
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x90], r9
movzx ecx, byte [rdi + rdx]
mov qword [rsp + 0x38], rcx
lea rax, [0x0070f280]
mov rbx, rcx
call fcn.00449300
mov rsi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
mov rdi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm15
lea rdx, [0x0067b400]
mov qword [rsp + 0x40], rdx
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x40]
call fcn.0064ac60
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rdx
call fcn.00463160
lea rax, [0x0070f0c0]
lea rbx, [0x00814350]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00677240

Function at 0x6773c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x67744e
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x68], rbx
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
cmp r12, 0x13
jae 0x67743a
mov r12, qword [0x009f5458]
mov r13, qword [0x009f5450]
cmp r12, rdx
jbe 0x67742f
movzx edx, byte [r13 + rdx]
mov qword [rsp], rdx
lea rsi, [0x007741df]
mov r8d, 0xb
xor r9d, r9d
xor r10d, r10d
mov r11, r10
nop
call fcn.00676640
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rdx
mov rcx, r12
call fcn.00463160
lea rax, [0x0070f0c0]
lea rbx, [0x00814350]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.006773c0
Function at 0x6775a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6776fd
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
mov rdx, qword [rax + 0x18]
lea r12, [rdx - 1]
nop dword [rax + rax]
cmp r12, 0x13
jae 0x6776e9
mov r12, qword [0x009f5458]
mov r13, qword [0x009f5450]
nop dword [rax + rax]
cmp r12, rdx
jbe 0x6776de
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r8
movzx edx, byte [r13 + rdx]
mov qword [rsp], rdx
lea rsi, [0x00772b42]
mov r8d, 8
xor r9d, r9d
xor r10d, r10d
mov r11, r10
call fcn.00676640
movups xmmword [rsp + 0x58], xmm15
lea rdx, [0x0067b400]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0x18]
mov qword [rsp + 0x60], rdx
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
lea rax, [rsp + 0x58]
call fcn.00514280
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
mov rdx, qword [rsp + 0xa0]
mov rdx, qword [rdx + 0x30]
xor ecx, ecx
mov rdi, rcx
mov rax, qword [rsp + 0xa8]
xor ebx, ebx
call rdx
mov rdx, qword [rsp + 0x50]
mov r12, qword [rdx + 0x38]
mov rdi, rcx
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x68]
call r12
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x30]
mov rax, qword [rsp + 0x68]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
call rdx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, rdx
mov rcx, r12
call fcn.00463160
lea rax, [0x0070f0c0]
lea rbx, [0x00814350]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax + rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.006775a0