joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de8e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dead6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rcx
call fcn.004d9560
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx + 0x10]
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x18]
lea rdi, [rsi - 1]
nop
cmp rdx, rdi
jb 0x4deacd
mov r8, qword [rsp + 0x20]
lea rax, [r8 - 1]
cmp rdi, rax
jb 0x4deac5
sub rsi, r8
sub rdx, r8
inc rdx
mov rdi, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
lea rdx, [rbx + rax]
test rsi, rsi
jbe 0x4deabb
movzx r8d, byte [rbx + rax]
cmp r8b, 0x66
ja 0x4de9c1
cmp r8b, 0x22
je 0x4de97a
cmp r8b, 0x66
je 0x4de9d1
jmp 0x4de9f7
nop
mov rax, rdx
mov rbx, rsi
mov rcx, rdi
call fcn.004deb80
mov byte [rsp + 0x1f], dil
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0044d200
movzx edx, byte [rsp + 0x1f]
test dl, dl
je 0x4deaa8
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp r8b, 0x6e
je 0x4dea87
cmp r8b, 0x74
jne 0x4de9f7
cmp r8b, 0x74
sete cl
movzx ecx, cl
lea rdx, [0x009bba60]
lea rbx, [rdx + rcx*8]
lea rax, [0x0070ce00]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
cmp r8b, 0x2d
je 0x4dea0b
lea edi, [r8 - 0x30]
cmp dil, 9
ja 0x4dea95
xor eax, eax
mov rbx, rdx
mov rcx, rsi
call fcn.0044d200
mov rcx, rbx
mov rbx, rax
mov rax, qword [rsp + 0x48]
call fcn.004dc260
test rcx, rcx
je 0x4dea7d
nop
mov rdx, qword [rsp + 0x48]
cmp qword [rdx + 0x70], 0
jne 0x4dea7d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov rax, rdx
mov rbx, rcx
mov rcx, rdi
call fcn.004d91a0
mov rdx, qword [rsp + 0x48]
mov qword [rdx + 0x70], rax
cmp dword [0x00a5a130], 0
jne 0x4dea6a
mov qword [rdx + 0x78], rbx
jmp 0x4dea73
lea rdi, [rdx + 0x78]
call fcn.00462de0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814430]
call fcn.004356e0
xor eax, eax
mov rcx, rsi
call fcn.00463140
mov rcx, rdi
call fcn.00463200
mov rcx, rdi
call fcn.004631c0
nop
mov qword [rsp + 8], rax
nop dword [rax + rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004de8e0
Function at 0x4dfa60
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfb3f
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x00a04380]
nop
call fcn.0046c220
test rax, rax
je 0x4dfada
lea rdx, [0x007664c0]
cmp rax, rdx
jne 0x4dfb2f
mov qword [rbx + 8], 0
mov qword [rbx + 0x18], 0
mov byte [rbx + 0x20], 0
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x4dfabc
mov rcx, qword [rcx]
jmp 0x4dfac0
xor ecx, ecx
nop
test rcx, rcx
jg 0x4dfb1c
mov qword [rbx + 0x68], 0
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.0040df40
mov qword [rsp + 0x18], rax
lea rax, [0x0074bf40]
call fcn.0040d400
cmp dword [0x00a5a130], 0
jne 0x4dfb04
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x70], rcx
jmp 0x4dfb12
lea rdi, [rax + 0x70]
mov rcx, qword [rsp + 0x18]
call fcn.00462da0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814440]
call fcn.004356e0
mov rbx, rdx
lea rcx, [0x00718680]
call fcn.0040a700
nop
nop
call fcn.00460a60
jmp fcn.004dfa60
Function at 0x4e8300
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e846a
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
cmp bl, 0x20
ja 0x4e8340
je 0x4e832f
nop
cmp bl, 9
je 0x4e832f
cmp bl, 0xd
je 0x4e832f
cmp bl, 0xa
jne 0x4e8340
mov eax, 9
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp bl, 0x22
jne 0x4e837a
test byte [rax], al
cmp dword [0x00a5a130], 0
jne 0x4e835c
lea rcx, [0x007a7d10]
mov qword [rax], rcx
jmp 0x4e836b
mov rdi, rax
lea rcx, [0x007a7d10]
call fcn.00462da0
mov eax, 1
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 0x70], rax
test byte [rax], al
cmp dword [0x00a5a130], 0
jne 0x4e8396
lea rcx, [0x007a7cb8]
mov qword [rax], rcx
jmp 0x4e83a5
mov rdi, rax
lea rcx, [0x007a7cb8]
call fcn.00462da0
mov eax, ebx
call fcn.004eaa60
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
lea rax, [0x00735320]
nop dword [rax]
call fcn.0040d400
mov qword [rsp + 0x50], rax
lea rbx, [0x007782c3]
mov ecx, 0x12
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00813fa0]
mov r9d, 1
lea r10, [0x007854fb]
mov r11d, 0x2a
xor eax, eax
nop dword [rax]
call fcn.0044cfe0
mov rdi, qword [rsp + 0x50]
mov qword [rdi + 8], rbx
cmp dword [0x00a5a130], 0
jne 0x4e8420
mov qword [rdi], rax
jmp 0x4e8425
call fcn.00462ca0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx + 0x38]
mov qword [rdi + 0x10], rdx
lea rdx, [0x008152a0]
mov qword [rcx + 0x28], rdx
cmp dword [0x00a5a130], 0
jne 0x4e844c
mov qword [rcx + 0x30], rdi
jmp 0x4e845b
add rcx, 0x30
mov rax, rdi
mov rdi, rcx
call fcn.00462ca0
mov eax, 0xb
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.00460a60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.004e8300
Function at 0x4ecb00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4ecbd5
movdqa xmm0, xmmword [0x00814800]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4ecb41
movdqa xmm0, xmmword [0x00814810]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4ecc57
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4ecc2b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00813f78]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00814cf0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x4ed060
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed2ac
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
cmp qword [rax], 2
jl 0x4ed136
cmp qword [rax + 0xa0070], 0
jne 0x4ed298
cmp qword [rax + 0xa0090], 0
nop dword [rax]
jne 0x4ed298
cmp rcx, 0x8000
jle 0x4ed0d2
sub rdi, rcx
lea r9, [rdi + 0x8000]
neg r9
sar r9, 0x3f
lea r10, [rcx - 0x8000]
and r9, r10
add rbx, r9
mov ecx, 0x8000
mov qword [rsp + 0x68], rax
mov r9, qword [rax + 0xa0080]
cmp rcx, r9
cmovl r9, rcx
mov qword [rsp + 0x30], r9
mov r10, qword [rax + 0xa0078]
cmp rbx, r10
je 0x4ed10f
mov rax, r10
mov rcx, r9
nop dword [rax]
call fcn.00463ac0
mov rax, qword [rsp + 0x68]
mov r9, qword [rsp + 0x30]
lea r10, [r9 + 0xfc]
sar r10, 0x3f
shr r10, 0x38
lea r10, [r9 + r10]
lea r10, [r10 + 0xfc]
sar r10, 8
mov qword [rsp + 0x38], r10
xor ecx, ecx
jmp 0x4ed145
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
lea rcx, [r11 + 1]
cmp rcx, r10
jge 0x4ed216
mov r11, rcx
shl rcx, 8
lea rbx, [rcx + 0x103]
cmp r9, rbx
cmovl rbx, r9
mov rdx, qword [rax + 0xa0088]
mov r12, qword [rax + 0xa0078]
cmp rdx, rbx
jb 0x4ed290
nop word [rax + rax]
cmp rbx, rcx
jb 0x4ed285
sub rbx, rcx
sub rdx, rcx
mov r13, rdx
neg rdx
sar rdx, 0x3f
and rdx, rcx
add r12, rdx
lea rsi, [rbx - 3]
test rsi, rsi
jle 0x4ed141
cmp rsi, 0x101
ja 0x4ed276
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rsi
lea rdi, [rax + 0xa00f0]
mov rdx, qword [rax + 0x38]
mov r9, qword [rdx]
mov rcx, r13
mov r8d, 0x101
mov rax, r12
nop
call r9
mov rsi, qword [rsp + 0x40]
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x50]
xor eax, eax
xor ecx, ecx
jmp 0x4ed26f
mov dword [r9 + 0xa00d0], ecx
mov rax, r9
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x48]
jmp 0x4ed141
mov qword [rax + 0xa0090], r9
mov qword [rax + 0xa0070], r9
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, dword [r9 + rax*4 + 0xa00f0]
lea r11, [rax + r10]
mov r12d, ecx
and ecx, 0x1ffff
mov r13, r11
and r11d, 0x7fff
mov r15d, dword [r9 + rcx*4 + 0x68]
mov dword [r9 + r11*4 + 0x80068], r15d
mov r11, qword [r9 + 0xa0068]
add r11, r13
mov dword [r9 + rcx*4 + 0x68], r11d
inc rax
mov ecx, r12d
cmp rax, rsi
jl 0x4ed22e
jmp 0x4ed1f8
mov rcx, rsi
mov edx, 0x101
nop
call fcn.00463180
mov rax, rcx
mov rcx, rbx
call fcn.00463200
mov rcx, rbx
call fcn.004631c0
lea rax, [0x0070f0c0]
lea rbx, [0x008140b0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004ed060
Function at 0x4f89a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8ac6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
test rax, rax
je 0x4f8ab1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
lea rax, [0x007556c0]
nop dword [rax]
call fcn.0040d400
mov qword [rsp + 0x20], rax
cmp dword [0x00a5a130], 0
jne 0x4f8a19
movups xmmword [rax], xmm15
movups xmmword [rax + 0x10], xmm15
movups xmmword [rax + 0x20], xmm15
movups xmmword [rax + 0x30], xmm15
mov rdx, qword [rsp + 0x38]
mov qword [rax], rdx
mov rbx, qword [rsp + 0x40]
mov qword [rax + 8], rbx
jmp 0x4f8a50
mov rbx, rax
lea rax, [0x007556c0]
call fcn.00413a00
mov rdi, qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
call fcn.00462ca0
lea rcx, [rdi + 8]
mov rdi, rcx
mov rbx, qword [rsp + 0x40]
call fcn.00462de0
mov rdx, rax
mov rax, qword [rsp + 0x20]
lea rcx, [0x00816600]
mov rdi, rax
mov rax, rdx
nop dword [rax]
call fcn.004f8b60
lea rax, [0x0072f0a0]
call fcn.0040d400
lea rdx, [0x004f8b00]
mov qword [rax], rdx
cmp dword [0x00a5a130], 0
jne 0x4f8a8f
mov rbx, qword [rsp + 0x20]
mov qword [rax + 8], rbx
jmp 0x4f8a9d
lea rdi, [rax + 8]
mov rbx, qword [rsp + 0x20]
call fcn.00462de0
mov rcx, rax
lea rax, [0x00817950]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008140e0]
nop
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004f89a0
Function at 0x4f9620
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4f989f
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rdi
test rcx, rcx
je 0x4f988b
mov byte [rsp + 0xb0], bl
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xb8], rcx
mov rdx, rax
xor eax, eax
mov esi, 1
lock cmpxchg dword [rdx + 0x10], esi
sete sil
lea rax, [rdx + 0x10]
mov qword [rsp + 0x20], rax
test sil, sil
jne 0x4f96ca
nop
call fcn.0046bb80
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xa8]
movzx ebx, byte [rsp + 0xb0]
mov rdi, qword [rsp + 0xc0]
cmp qword [rdx + 0x30], 0
jne 0x4f97a7
mov qword [rdx + 0x30], rcx
cmp dword [0x00a5a130], 0
jne 0x4f96e8
mov qword [rdx + 0x38], rdi
jmp 0x4f96fa
lea rsi, [rdx + 0x38]
mov r8, rdi
mov rdi, rsi
call fcn.00462e20
mov rdi, r8
movups xmmword [rsp + 0x28], xmm15
mov rsi, qword [rdx + 0x18]
test rsi, rsi
je 0x4f9725
lea r8, [0x00a59c4e]
cmp rsi, r8
je 0x4f9725
mov r8, qword [rdx + 0x20]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
jmp 0x4f972b
movups xmmword [rsp + 0x28], xmm15
mov rsi, qword [rsp + 0x30]
lea r8, [0x0070d180]
cmp qword [rsp + 0x28], r8
je 0x4f9740
xor esi, esi
test rsi, rsi
je 0x4f974f
mov rax, rsi
call fcn.00405cc0
jmp 0x4f9765
lea rax, [rdx + 0x18]
mov rcx, qword [0x009fefc0]
mov rbx, r8
nop dword [rax]
call fcn.004688a0
mov rdx, qword [rsp + 0xa8]
mov rbx, qword [rdx + 0x28]
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046342b
mov rbp, qword [rbp]
lea rax, [0x0071e200]
lea rcx, [rsp + 0x38]
nop
call fcn.0040f360
jmp 0x4f97f7
nop
mov ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
lea ebx, [rcx - 1]
test ebx, ebx
je 0x4f97be
call fcn.0046be80
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov rsi, qword [rdx]
mov rax, qword [rdx + 8]
mov rdx, qword [rsi + 0x20]
xor ebx, ebx
mov rcx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
call rdx
lea rax, [rsp + 0x38]
call fcn.0040f5e0
mov rdx, qword [rsp + 0x38]
nop dword [rax]
test rdx, rdx
jne 0x4f97ce
cmp dword [0x00a5a130], 0
jne 0x4f9822
mov rdi, qword [rsp + 0xa8]
mov qword [rdi + 0x28], 0
nop
jmp 0x4f9838
mov rdx, qword [rsp + 0xa8]
lea rdi, [rdx + 0x28]
xor esi, esi
call fcn.00462e00
mov rdi, rdx
nop
mov edx, 0xffffffff
lock xadd dword [rdi + 0x10], edx
lea ebx, [rdx - 1]
test ebx, ebx
je 0x4f985c
mov rax, qword [rsp + 0x20]
call fcn.0046be80
mov rdi, qword [rsp + 0xa8]
movzx edx, byte [rsp + 0xb0]
test dl, dl
je 0x4f987b
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
lea rcx, [0x00816600]
call fcn.004f8fe0
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008140f0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004f9620
Function at 0x4fa080
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa186
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x40], bl
mov qword [rsp + 0x38], rax
test byte [rax], al
xor ebx, ebx
call fcn.004f9620
movzx edx, byte [rsp + 0x40]
test dl, dl
je 0x4fa0d5
mov rdi, qword [rsp + 0x38]
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
lea rcx, [0x00816628]
call fcn.004f8fe0
xor eax, eax
mov rcx, qword [rsp + 0x38]
mov edx, 1
lock cmpxchg dword [rcx + 0x10], edx
sete dl
lea rax, [rcx + 0x10]
mov qword [rsp + 0x20], rax
test dl, dl
jne 0x4fa105
call fcn.0046bb80
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je 0x4fa14c
nop
cmp qword [rdx + 0x20], 0
je 0x4fa16f
lea rax, [rdx + 8]
call fcn.0045f9c0
cmp dword [0x00a5a130], 0
jne 0x4fa137
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x40], 0
jmp 0x4fa147
mov rcx, qword [rsp + 0x38]
lea rdi, [rcx + 0x40]
xor edx, edx
call fcn.00462dc0
mov rax, qword [rsp + 0x20]
nop
mov edx, 0xffffffff
lock xadd dword [rcx + 0x10], edx
lea ebx, [rdx - 1]
test ebx, ebx
je 0x4fa165
nop
call fcn.0046be80
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814e70]
nop dword [rax]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004fa080
Function at 0x4fa240
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa3b9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
test rax, rax
je 0x4fa3a5
nop
test rcx, rcx
je 0x4fa38d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x4fa2c4
lea r9, [0x00818870]
jmp 0x4fa2c9
xor r9d, r9d
xor edx, edx
mov rcx, qword [r9 + 0x20]
mov rax, rdx
call rcx
test al, al
je 0x4fa37a
lea rax, [0x007517c0]
call fcn.0040d400
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
cmp dword [0x00a5a130], 0
jne 0x4fa302
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
jmp 0x4fa310
lea rdi, [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.00462da0
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
cmp dword [0x00a5a130], 0
jne 0x4fa32d
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x18], rcx
jmp 0x4fa33b
lea rdi, [rax + 0x18]
mov rcx, qword [rsp + 0x58]
call fcn.00462da0
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x20], rcx
cmp dword [0x00a5a130], 0
jne 0x4fa358
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x28], rcx
jmp 0x4fa366
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x68]
call fcn.00462da0
mov rbx, rax
lea rax, [0x008179f8]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814110]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814100]
nop dword [rax + rax]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x008140e0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004fa240
Function at 0x4fc540
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc616
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
nop dword [rax]
test rbx, rbx
je 0x4fc608
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
call fcn.0046f000
cmp eax, 0xff
ja 0x4fc595
movzx ecx, al
lea rdx, [0x009ae800]
movzx ecx, byte [rdx + rcx]
test cl, 0x60
setne cl
jmp 0x4fc5a8
mov rcx, qword [0x009f4ab8]
mov ebx, eax
mov rax, rcx
call fcn.0046ff20
mov ecx, eax
test cl, cl
je 0x4fc5ba
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
movups xmmword [rsp + 0x28], xmm15
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
call fcn.0040ab40
lea rcx, [0x0070f0c0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rax, [0x00782d12]
mov ebx, 0x24
lea rcx, [rsp + 0x28]
mov edi, 1
mov rsi, rdi
call fcn.004ced20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004fc540
Function at 0x4fffa0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5001de
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
test rcx, rcx
jne 0x500058
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0xc8], r8
lea rax, [0x00720be0]
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call fcn.00449300
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x50008f
mov rsi, qword [rsp + 0x88]
xor ecx, ecx
jmp 0x50014b
mov rdx, qword [rcx + 0x18]
mov rcx, rbx
mov rsi, r10
mov r8, qword [rsp + 0x88]
mov r10, qword [rsp + 0x98]
mov rbx, rax
mov rax, rdi
mov rdi, r9
mov r9, qword [rsp + 0x90]
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor ecx, ecx
xor ebx, ebx
test rcx, rcx
jne 0x500133
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rcx + 0x20]
mov rax, qword [rsp + 0xa8]
call rdx
mov rbx, rax
xor eax, eax
call fcn.00406ae0
test al, al
je 0x5000f6
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx + 0x28]
mov rax, qword [rsp + 0xa8]
nop
call rcx
mov rcx, rax
mov rdi, rbx
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rdx, qword [rsp + 0xc0]
mov rdx, qword [rdx + 0x18]
mov rax, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r8, rsi
call rdx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
xor eax, eax
mov rdi, rbx
xor ebx, ebx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
add rsi, 0x28
mov rcx, r8
mov r8, qword [rsi]
mov qword [rsp + 0x50], r8
movups xmm0, xmmword [rsi + 8]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rsi + 0x18]
movups xmmword [rsp + 0x68], xmm0
cmp qword [rsp + 0x58], 0
jne 0x5001ac
mov r8, rcx
shl rcx, 4
mov r9, qword [rsp + 0x70]
mov r10, qword [rsp + 0x68]
mov qword [rax + rcx], r10
lea rdi, [rax + rcx]
lea rdi, [rdi + 8]
cmp dword [0x00a5a130], 0
jne 0x50019a
mov qword [rax + rcx + 8], r9
jmp 0x50019f
call fcn.00462e40
inc r8
cmp rdx, r8
jg 0x500144
jmp 0x50008f
nop
lea rax, [0x0072c820]
call fcn.0040d400
mov qword [rax + 8], 0x38
lea rcx, [0x00789326]
mov qword [rax], rcx
lea rcx, [0x00815340]
xor edx, edx
mov rbx, rax
xor eax, eax
jmp 0x500093
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r10
call fcn.00460a60
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
jmp fcn.004fffa0