joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418740
Capabilities:
Access peb ldr_data
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4188eb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00735ce0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433420
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4187ae
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4187c1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4187e5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4187f9
cmp rbx, 0x1000
jae 0x4187b8
nop
jmp 0x418869
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41880d
xor edx, edx
jmp 0x418860
mov rcx, qword [0x00735ce0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433420
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4187ef
jmp 0x4187d5
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00438580
lea rax, [0x007ae242]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438b80
lea rax, [0x007ae332]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00438e80
mov rax, qword [rsp + 0x30]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007b1977]
mov ebx, 0x21
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418740
Function at 0x418920
Capabilities:
Access peb ldr_data
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418b4a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00735cd8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004334a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41899b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4189ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4189d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4189e4
cmp rbx, 0x1000
jae 0x4189a5
jmp 0x418a6e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4189f6
xor esi, esi
jmp 0x418a60
mov rax, qword [0x00735cd8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004334a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4189da
jmp 0x4189c2
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418ae9
call fcn.00438580
lea rax, [0x007ae940]
mov ebx, 0x19
call fcn.00438e80
mov rax, qword [rsp + 0x68]
call fcn.00438b80
lea rax, [0x007ae332]
mov ebx, 0x19
nop
call fcn.00438e80
mov eax, dword [rsp + 0x34]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007a9050]
mov ebx, 0xd
call fcn.00436e00
cmp eax, 0x5af
je 0x418a93
call fcn.00438580
lea rax, [0x007ae940]
mov ebx, 0x19
call fcn.00438e80
mov rax, qword [rsp + 0x38]
call fcn.00438b80
lea rax, [0x007ae332]
mov ebx, 0x19
nop dword [rax]
call fcn.00438e80
mov eax, dword [rsp + 0x34]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007b0d5e]
mov ebx, 0x1f
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00418920
Function at 0x418b80
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
neg rbx
mov rax, rcx
nop
call fcn.0042f0e0
mov rcx, qword [0x00735ce0]
mov rdx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0x8000
call fcn.00433420
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x418bf7
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00465ac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x28], rax
call fcn.00438580
lea rax, [0x007ae242]
mov ebx, 0x18
call fcn.00438e80
mov rax, qword [rsp + 0x48]
call fcn.00438b80
lea rax, [0x007ae332]
mov ebx, 0x19
call fcn.00438e80
mov rax, qword [rsp + 0x28]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007b12b5]
mov ebx, 0x20
call fcn.00436e00
nop
int3

Function at 0x419d00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x419e0e
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rsi, qword [rax]
nop dword [rax + rax]
test rsi, rsi
je 0x419de1
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x419d68
mov rcx, qword [rdi]
mov qword [rax + 0x18], rcx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
cmp byte [rax + 0x40], 0
je 0x419d5b
mov qword [rsp + 0x18], rdi
mov rbx, qword [rax]
mov rax, rdi
call fcn.00464ce0
mov rdi, qword [rsp + 0x18]
mov rax, rdi
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov qword [rsp + 0x38], rax
mov edi, dword [rax + 0x28]
cmp rsi, rdi
jbe 0x419d98
mov rcx, qword [rax + 0x38]
xor ebx, ebx
mov eax, 0x4000
call fcn.0040e6c0
mov rdx, qword [rsp + 0x38]
mov qword [rdx + 0x20], rax
mov dword [rdx + 0x28], 0x4000
mov rax, rdx
mov rbx, qword [rax + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x419dc0
mov qword [rsp + 0x20], rbx
mov rcx, qword [rdx]
mov rsi, qword [rax + 0x10]
mov rax, rsi
call rcx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rax]
add qword [rax + 0x20], rcx
mov rcx, qword [rax]
sub dword [rax + 0x28], ecx
mov rcx, qword [rax]
add qword [rax + 0x30], rcx
mov rax, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00438580
lea rax, [0x007b66de]
mov ebx, 0x34
call fcn.00438e80
call fcn.00438600
lea rax, [0x007adb95]
mov ebx, 0x17
call fcn.00436e00
nop
mov qword [rsp + 8], rax
call fcn.00461f00
mov rax, qword [rsp + 8]
nop dword [rax]
jmp fcn.00419d00
Function at 0x41d740
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41d9d0
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov edx, dword [0x009b7d48]
mov rcx, qword [0x009b8038]
mov rsi, qword [0x009b8030]
cmp rbx, rcx
jae 0x41d9c7
mov rbx, qword [rsi + rbx*8]
mov rsi, rbx
shr rbx, 0x14
cmp rbx, 0x40
jae 0x41d9ba
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x68], rax
lea rdi, [0x009b7db8]
mov rbx, qword [rdi + rbx*8]
test byte [rbx], al
and rsi, 0xfffff
mov rbx, qword [rbx + rsi*8]
mov qword [rsp + 0x50], rbx
test byte [rbx], al
xor ecx, ecx
jmp 0x41d7b9
inc rcx
cmp rcx, 0x40
jge 0x41d7e2
lea rsi, [rbx + rcx]
lea rsi, [rsi + 0x21080]
mov sil, byte [rsi]
test sil, sil
je 0x41d7b6
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x2e], sil
xor edi, edi
nop
jmp 0x41d7f3
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
lea rdi, [rcx + 1]
mov rcx, r8
cmp rdi, 8
jae 0x41d7b6
mov r8, rcx
mov rcx, rdi
mov r9d, 1
shl r9d, cl
test sil, r9b
je 0x41d7ec
lea r9, [rcx + r8*8]
cmp r9, 0x200
jae 0x41d9ad
mov r9, qword [rbx + r9*8 + 0x20000]
mov r10b, byte [r9 + 0x63]
cmp r10b, 1
jne 0x41d969
mov qword [rsp + 0x58], rcx
cmp byte [0x009e5961], 0
jne 0x41d858
mov r10d, dword [r9 + 0x58]
cmp r10d, edx
je 0x41d858
lea r11d, [rdx + 3]
cmp r10d, r11d
jne 0x41d917
mov qword [rsp + 0x40], r9
lea rax, [r9 + 0x78]
mov qword [rsp + 0x60], rax
nop
call fcn.0040c2a0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx + 0x80]
jmp 0x41d8ad
nop
mov rax, qword [rsp + 0x60]
call fcn.0040c4c0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
movzx esi, byte [rsp + 0x2e]
mov rdi, rcx
mov r8, qword [rsp + 0x48]
jmp 0x41d7ec
mov rdx, qword [rdx]
test rdx, rdx
je 0x41d87a
cmp byte [rdx + 0xa], 1
jne 0x41d8aa
movzx eax, word [rdx + 8]
mov rsi, qword [rcx + 0x68]
mov rdi, qword [rcx + 0x18]
test rsi, rsi
je 0x41d912
mov qword [rsp + 0x38], rdx
xor edx, edx
div rsi
imul rax, rsi
add rax, rdi
mov rbx, qword [rsp + 0x68]
nop
call fcn.0041f480
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + 0x10]
mov ebx, 8
mov rdi, qword [rsp + 0x68]
xor esi, esi
lea rcx, [0x0071c045]
call fcn.0041f2e0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
jmp 0x41d8aa
call fcn.004347c0
mov dword [rsp + 0x34], r10d
nop dword [rax]
call fcn.00438580
lea rax, [0x007a55d6]
mov ebx, 6
call fcn.00438e80
mov eax, dword [rsp + 0x34]
call fcn.00438b80
nop
call fcn.004387a0
mov eax, dword [rsp + 0x30]
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007aa335]
mov ebx, 0x10
call fcn.00436e00
mov byte [rsp + 0x2f], r10b
call fcn.00438580
lea rax, [0x007a7cea]
mov ebx, 0xa
nop
call fcn.00438e80
movzx eax, byte [rsp + 0x2f]
movzx eax, al
call fcn.00438b80
call fcn.004387e0
call fcn.00438600
lea rax, [0x007b498e]
mov ebx, 0x2b
call fcn.00436e00
mov rax, r9
mov ecx, 0x200
call fcn.00464640
mov rax, rbx
mov ecx, 0x40
call fcn.00464640
mov rax, rbx
call fcn.00464620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0041d740
Function at 0x420220
Capabilities:
Gather firefox profile information
Hash data using murmur3
Reference sql statements

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x009e5961], 0
jne 0x420319
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x42030f
lea rbx, [0x009b7db8]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x4202ea
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00464640
lea rax, [0x007b4d9f]
mov ebx, 0x2c
call fcn.00436e00
nop
int3
Function at 0x420de0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42103d
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
cmp dword [0x009e599c], 0
nop
je 0x42102b
test rbx, rbx
je 0x420e33
mov rdx, qword [rbx + 0x1698]
test rdx, rdx
je 0x420e33
cmp qword [rdx + 0x10], 0
jne 0x420e2c
mov rdx, qword [rbx + 0x16a0]
cmp qword [rdx + 0x10], 0
je 0x420e33
mov ecx, 1
jmp 0x420e60
mov rdx, qword [0x009e6660]
test rdx, rdx
jne 0x420e58
mov edx, dword [0x009e66e8]
cmp dword [0x009e66ec], edx
jbe 0x420e54
mov ecx, 1
jmp 0x420e60
xor ecx, ecx
jmp 0x420e60
mov ecx, 1
nop dword [rax]
test cl, cl
je 0x420e66
jmp 0x420e75
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rcx
mov rdx, qword [0x009e5c30]
nop dword [rax]
test rdx, rdx
je 0x420eb1
mov rsi, rdx
sar rdx, 0x13
shl rdx, 3
nop
mov rdi, qword [rdx]
mov rcx, rax
mov rax, rsi
lea r8, [0x009e5c30]
lock cmpxchg qword [r8], rdi
sete sil
test sil, sil
je 0x420e72
jmp 0x420ec0
mov rcx, rax
lea r8, [0x009e5c30]
xor edx, edx
nop dword [rax]
test rdx, rdx
je 0x420ec9
test byte [rcx], al
jmp 0x420ed5
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rsi, qword [rcx + 0x80]
nop dword [rax]
test rsi, rsi
jle 0x420f03
lea rdi, [rsi - 1]
mov rax, rsi
lock cmpxchg qword [rcx + 0x80], rdi
sete dil
test dil, dil
je 0x420ed5
nop
test rsi, rsi
jg 0x420fe2
movsd xmm0, qword [rcx + 0x98]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x420f26
nop word [rax + rax]
jnp 0x420fcb
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x10], rdx
call fcn.00465f20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x20]
sub rax, qword [rcx + 0x78]
nop dword [rax + rax]
test rax, rax
jle 0x420fb2
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov rsi, qword [rdx + 0x1680]
xorps xmm0, xmm0
cvtsi2sd xmm0, rsi
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm0, xmm1
movsd xmm1, qword [rcx + 0x98]
ucomisd xmm0, xmm1
jbe 0x420fb7
lea rax, [0x009e5c30]
mov rbx, qword [rsp + 0x10]
call fcn.0040c040
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, qword [rsp + 0x40]
test byte [rdx], al
mov qword [rdx + 0x1688], 2
mov rdx, qword [rsp + 0x10]
jmp 0x420fef
mov rax, r8
mov rbx, rdx
call fcn.0040c040
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
test byte [rbx], al
mov qword [rbx + 0x1688], 1
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x18], rax
mov ebx, 4
mov ecx, 1
call fcn.0043b0c0
cmp byte [0x00997b50], 0
je 0x42101c
mov rax, qword [rsp + 0x18]
xor ebx, ebx
call fcn.00455ca0
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x007b6a97]
mov ebx, 0x36
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00420de0
Function at 0x4220c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x422153
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test byte [rax], al
movabs rdx, 0x800000000000
lea rsi, [rdx + rbx]
add rdx, rcx
cmp rdx, rsi
jbe 0x4220f9
nop
mov rdx, rcx
sub rcx, rbx
jmp 0x422100
mov rdx, rcx
xor ecx, ecx
nop
test rcx, rcx
je 0x42210d
cmp dword [rax + 0x100e0], edi
je 0x422120
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
test rbx, 0x3fffff
jne 0x422141
add rax, 0x100b8
mov rcx, rdx
call fcn.0042e240
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x007afccf]
mov ebx, 0x1c
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
call fcn.00466620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
nop
jmp fcn.004220c0
Function at 0x422aa0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x422bb7
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x30], rbx
lea rcx, [rbx - 1]
test rcx, rbx
jne 0x422b76
test rbx, rbx
je 0x422b76
cmp rbx, 0x40
ja 0x422b36
mov qword [rsp + 0x28], rax
mov ecx, 7
jmp 0x422af8
mov rdx, qword [rsp + 0x10]
lea rcx, [rdx - 1]
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
test rcx, rcx
jl 0x422b2a
mov qword [rsp + 0x10], rcx
test byte [rax], al
mov rdx, qword [rax + rcx*8 + 0x40]
or rdx, qword [rax + rcx*8]
mov rax, rdx
call fcn.004228e0
cmp rax, 0xffffffffffffffff
je 0x422ae5
mov eax, 1
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xor eax, eax
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.00438580
lea rax, [0x007a9dcf]
mov ebx, 0xf
call fcn.00438e80
mov rax, qword [rsp + 0x30]
call fcn.00438b80
call fcn.004387e0
nop dword [rax + rax]
call fcn.00438600
lea rax, [0x007a9029]
mov ebx, 0xd
call fcn.00436e00
call fcn.00438580
lea rax, [0x007a9dcf]
mov ebx, 0xf
call fcn.00438e80
mov rax, qword [rsp + 0x30]
call fcn.00438b80
call fcn.004387e0
nop dword [rax + rax]
call fcn.00438600
lea rax, [0x007b180c]
mov ebx, 0x21
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00422aa0
Function at 0x4231a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4232fa
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rax + 0x138]
test rdx, rdx
jne 0x423205
call fcn.00425660
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], rax
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov rsi, qword [rdx + 0x10]
test rsi, rsi
jle 0x423288
mov rdi, qword [rax + 0x100]
mov r8, rbx
sub rbx, rdi
lea rdi, [rsi - 1]
nop
cmp rdi, 0x3f
jae 0x4232ec
shl rdi, 5
mov r9d, dword [rdx + rdi + 0x20]
add r9d, dword [rdx + rdi + 0x24]
nop dword [rax + rax]
cmp r9d, ebx
ja 0x4232db
cmp rsi, 0x3f
jne 0x42328b
mov qword [rsp + 0x10], rdx
call fcn.00425660
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x18], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x138], rax
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
jmp 0x42328b
mov r8, rbx
mov rbx, qword [rdx + 0x10]
cmp rbx, 0x3f
jae 0x4232ce
lea rsi, [rbx + 1]
mov qword [rdx + 0x10], rsi
shl rbx, 5
mov rsi, qword [rax + 0x100]
sub r8, rsi
mov dword [rdx + rbx + 0x20], r8d
mov esi, dword [rcx + 4]
mov dword [rdx + rbx + 0x24], esi
nop
mov qword [rdx + rbx + 0x28], rcx
inc qword [rax + 0x140]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rax, rbx
mov ecx, 0x3f
call fcn.00464620
lea rax, [0x007b41dd]
mov ebx, 0x29
call fcn.00436e00
mov rax, rdi
mov ecx, 0x3f
call fcn.00464620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004231a0
Function at 0x425b00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x425bec
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
nop
lea rax, [0x009e66b0]
call fcn.0040c2a0
cmp qword [0x009e6660], 0
jne 0x425bda
mov qword [0x009e6668], 0
mov rcx, qword [0x009e66c8]
test rcx, rcx
jne 0x425b70
nop
nop
lea rax, [0x009e66b0]
call fcn.0040c4c0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
lea rdx, [0x009e66b8]
mov qword [rcx + 0x10], rdx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x425b62
mov rcx, qword [0x009e66b8]
nop dword [rax]
test rcx, rcx
je 0x425bb1
mov rdx, qword [0x009e66d0]
mov qword [rdx], rcx
mov rcx, qword [0x009e66b8]
mov rdx, qword [0x009e66d0]
mov qword [rcx + 8], rdx
mov rcx, qword [0x009e66c8]
mov qword [0x009e66b8], rcx
jmp 0x425bcd
mov rcx, qword [0x009e66d0]
mov rdx, qword [0x009e66c8]
mov qword [0x009e66b8], rdx
mov qword [0x009e66c0], rcx
movups xmmword [0x009e66c8], xmm15
jmp 0x425b4a
lea rax, [0x007b3c50]
mov ebx, 0x28
call fcn.00436e00
nop
call fcn.00461f00
jmp fcn.00425b00
Function at 0x426dc0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x426dfb
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
test cl, cl
je 0x426de9
xor edi, edi
call fcn.00427180
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x007b78be]
mov ebx, 0x3c
call fcn.00436e00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.00466620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00426dc0

Function at 0x426f20
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42703a
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
xor edx, edx
jmp 0x426f53
sub r12, rbx
lea rbx, [r12 + r9]
shr r12, 0xd
sub r11, r12
mov rax, rcx
mov rcx, r11
mov edx, r10d
test rcx, rcx
jbe 0x426fd9
test byte [rax], al
nop
movabs rsi, 0x800000000000
lea rdi, [rsi + rbx]
mov r8, rdi
shr rdi, 0x2a
cmp rdi, 0x40
jae 0x42702c
mov rdi, qword [rax + rdi*8 + 0x10198]
test byte [rdi], al
shr r8, 0x16
and r8, 0xfffff
mov rdi, qword [rdi + r8*8]
test byte [rdi], al
mov r8, qword [rdi + 0x210c8]
mov r9, rbx
and rbx, 0x3fffff
cmp r8, rbx
seta r10b
mov r11, rcx
shl rcx, 0xd
lea r12, [rcx + rbx]
or r10d, edx
nop
cmp r12, 0x400000
jbe 0x426feb
mov r12d, 0x400000
jmp 0x426feb
mov rcx, rax
jmp 0x426f3c
mov eax, edx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rcx
mov r8, rdx
cmp r12, r8
jbe 0x426fd1
mov rcx, rax
mov rax, r8
lock cmpxchg qword [rdi + 0x210c8], r12
sete dl
test dl, dl
jne 0x426f3c
mov rdx, qword [rdi + 0x210c8]
cmp rdx, r12
ja 0x426fe5
cmp rdx, rbx
jbe 0x426fe5
lea rax, [0x007b64a6]
mov ebx, 0x33
call fcn.00436e00
mov rax, rdi
mov ecx, 0x40
call fcn.00464640
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00461f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.00426f20