joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e120
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40e246
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
xor edx, edx
jmp 0x40e15e
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x10], rdx
lea rsi, [rcx + rbx]
mov qword [rsp + 0x20], rsi
mov rbx, rsi
call fcn.00419d40
mov rcx, rax
nop word [rax + rax]
test rax, rax
je 0x40e221
mov rdx, qword [rsp + 0x50]
lea rsi, [rdx - 1]
test rax, rsi
je 0x40e20f
mov qword [rsp + 0x18], rax
mov rax, rcx
mov rbx, qword [rsp + 0x20]
call fcn.00419c00
nop
nop
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x50]
lea rcx, [rax + rcx]
lea rcx, [rcx - 1]
neg rax
and rax, rcx
mov qword [rsp + 0x18], rax
mov rbx, qword [rsp + 0x48]
call fcn.00419d40
mov rcx, rax
mov rdx, qword [rsp + 0x18]
cmp rax, rdx
je 0x40e1fd
mov rax, rcx
mov rbx, qword [rsp + 0x48]
call fcn.00419c00
mov rcx, qword [rsp + 0x10]
cmp rcx, 0x63
jne 0x40e14b
jmp 0x40e22f
mov rax, rcx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rcx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
xor ebx, ebx
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x008e90c9]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040e120
Function at 0x40e280
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40e473
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x40e465
mov qword [rsp + 0x30], rdx
mov byte [rsp + 0x50], bl
mov qword [rsp + 0x48], rax
mov rcx, qword [rax + rdx*8 + 0x28]
mov qword [rsp + 0x28], rcx
mov rax, rcx
call fcn.004156c0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x38]
cmp rax, rdx
jne 0x40e32f
mov qword [rsp + 0x20], rdx
movzx ecx, word [rcx + 0x60]
cmp rdx, rcx
jne 0x40e3f6
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x48]
movzx ebx, byte [rsp + 0x50]
nop dword [rax]
call fcn.00418420
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rdx + rcx*8 + 0x28]
mov qword [rsp + 0x28], rax
call fcn.004156c0
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x28]
jmp 0x40e332
mov rbx, rax
cmp qword [rcx + 0x38], rax
jbe 0x40e3e5
mov rsi, qword [rcx + 0x68]
imul rax, rsi
add rax, qword [rcx + 0x18]
movzx esi, word [rcx + 0x60]
inc esi
mov word [rcx + 0x60], si
movzx edi, si
mov r8, qword [rcx + 0x38]
cmp r8, rdi
jb 0x40e373
cmp rbx, rdx
sete dl
mov rbx, rcx
mov ecx, edx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov word [rsp + 0x16], si
mov qword [rsp + 0x20], r8
nop dword [rax]
call fcn.0043aec0
lea rax, [0x008d6d74]
mov ebx, 0xe
call fcn.0043b7c0
movzx eax, word [rsp + 0x16]
movzx eax, ax
nop
call fcn.0043b4c0
lea rax, [0x008d5721]
mov ebx, 0xb
call fcn.0043b7c0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.0043b4c0
call fcn.0043b120
call fcn.0043af40
lea rax, [0x008db4ee]
mov ebx, 0x17
nop dword [rax + rax]
call fcn.00439600
lea rax, [0x008da7c0]
mov ebx, 0x16
call fcn.00439600
mov word [rsp + 0x16], cx
nop dword [rax + rax]
call fcn.0043aec0
lea rax, [0x008db4d7]
mov ebx, 0x17
call fcn.0043b7c0
movzx eax, word [rsp + 0x16]
nop dword [rax + rax]
call fcn.0043b4c0
lea rax, [0x008d5721]
mov ebx, 0xb
call fcn.0043b7c0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.0043b4c0
call fcn.0043b120
call fcn.0043af40
lea rax, [0x008e7542]
mov ebx, 0x31
nop dword [rax + rax]
call fcn.00439600
mov rax, rdx
mov ecx, 0x88
call fcn.00467360
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop dword [rax]
call fcn.00464c60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0040e280
Function at 0x40eec0
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ef4d
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp rbx, 1
je 0x40ef1c
mov rdx, qword [rax]
mov rcx, rax
mov rax, rbx
mul rdx
jo 0x40ef39
movabs rdx, 0x1000000000000
cmp rax, rdx
ja 0x40ef39
nop dword [rax + rax]
test rbx, rbx
jl 0x40ef39
mov rbx, rcx
mov ecx, 1
call fcn.0040e4a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rdx, qword [rax]
mov rbx, rax
mov ecx, 1
mov rax, rdx
call fcn.0040e4a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x00882cc0]
lea rbx, [0x0096ef30]
call fcn.00438e60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0040eec0

Function at 0x40ef80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40f026
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rdx, qword [rax + 0xa0]
nop
test rdx, rdx
je 0x40efab
mov rdx, qword [rdx + 0x40]
jmp 0x40efb2
mov rdx, qword [0x00bc1f78]
test rdx, rdx
je 0x40f00f
mov rax, qword [0x00bc1ee0]
nop
cmp rax, 1
jne 0x40efca
xor eax, eax
jmp 0x40eff3
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rbx
call fcn.0040f060
movsxd rcx, eax
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, rcx
mov rcx, qword [rsp + 0x18]
mov qword [rdx], rax
mov rax, rbx
mov rbx, rcx
nop dword [rax]
call fcn.00430160
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rax, [0x008e9219]
mov ebx, 0x38
nop dword [rax + rax]
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040ef80
Function at 0x40f2e0
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x40f577
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
nop dword [rax + rax]
test rax, rax
je 0x40f565
test rbx, rbx
je 0x40f32e
lea rdx, [rbx - 1]
test rbx, rdx
jne 0x40f550
nop dword [rax + rax]
cmp rbx, 0x2000
jbe 0x40f333
jmp 0x40f53f
mov ebx, 8
cmp rax, 0x10000
jae 0x40f405
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x10], rbx
mov rdx, qword [r14 + 0x30]
nop
inc dword [rdx + 0xd8]
mov rdx, qword [r14 + 0x30]
mov qword [rsp + 0x20], rdx
test rdx, rdx
je 0x40f37e
mov rsi, qword [rdx + 0xa0]
test rsi, rsi
je 0x40f37e
test byte [rsi], al
add rsi, 0x11f0
jmp 0x40f3a7
nop
nop
lea rax, [0x00bc2290]
call fcn.0040cd60
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
lea rsi, [0x00bc2298]
mov qword [rsp + 0x28], rsi
mov rdi, qword [rsi + 8]
lea rdi, [rbx + rdi]
lea rdi, [rdi - 1]
neg rbx
mov qword [rsp + 0x18], rbx
and rdi, rbx
mov qword [rsi + 8], rdi
add rdi, rax
cmp rdi, 0x40000
ja 0x40f3d9
cmp qword [rsi], 0
jne 0x40f417
mov eax, 0x40000
lea rbx, [0x00bc7500]
call fcn.00419540
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
cmp qword [rcx], 0
jne 0x40f4c3
nop dword [rax]
jmp 0x40f512
mov rbx, rcx
call fcn.00419540
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdi, qword [rsi]
mov r8, qword [rsi + 8]
lea r9, [rax + r8]
mov qword [rsi + 8], r9
nop
mov r9d, dword [rdx + 0xd8]
lea r10d, [r9 - 1]
mov dword [rdx + 0xd8], r10d
lea rdx, [rdi + r8]
nop dword [rax]
cmp r9d, 1
jne 0x40f458
cmp byte [r14 + 0xb1], 0
je 0x40f458
mov qword [r14 + 0x10], 0xfffffffffffffade
mov qword [rsp + 0x30], rdx
lea rdi, [0x00bc2298]
cmp rsi, rdi
jne 0x40f486
nop
nop
lea rax, [0x00bc2290]
call fcn.0040cf80
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
lea rsi, [0x00bc7500]
cmp rcx, rsi
je 0x40f4b6
mov rbx, rax
mov rax, rcx
call fcn.00432020
mov rbx, qword [rsp + 0x48]
neg rbx
lea rax, [0x00bc7500]
call fcn.00432020
mov rdx, qword [rsp + 0x30]
mov rax, rdx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [rcx]
mov rax, qword [0x00bc1fa8]
mov qword [rdx], rax
mov rdx, qword [rcx]
lea rsi, [0x00bc1fa8]
lock cmpxchg qword [rsi], rdx
sete dl
test dl, dl
je 0x40f4c3
mov rdi, qword [rsp + 0x10]
add rdi, 7
mov r8, qword [rsp + 0x18]
and rdi, r8
mov qword [rcx + 8], rdi
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x20]
mov rsi, rcx
mov rcx, qword [rsp + 0x58]
jmp 0x40f417
lea rdx, [0x00bc2298]
cmp rcx, rdx
je 0x40f52f
lea rax, [0x008df8dc]
mov ebx, 0x1f
call fcn.00439600
nop
nop
lea rax, [0x00bc2290]
call fcn.0040cf80
jmp 0x40f51e
lea rax, [0x008e1944]
mov ebx, 0x23
call fcn.00439600
lea rax, [0x008e4b03]
mov ebx, 0x2a
nop dword [rax]
call fcn.00439600
lea rax, [0x008dcec0]
mov ebx, 0x1a
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00469440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0040f2e0
Function at 0x415820
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415a0f
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
call fcn.0043aec0
call fcn.0043aec0
lea rax, [0x008d8103]
mov ebx, 0x11
call fcn.0043b7c0
mov rax, qword [rsp + 0x38]
call fcn.0043b620
call fcn.0043af40
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
test rax, rax
je 0x415937
nop
mov cl, byte [rax + 0x63]
mov byte [rsp + 0x27], cl
cmp cl, 1
je 0x4159ea
call fcn.0043aec0
lea rax, [0x008d9333]
mov ebx, 0x14
call fcn.0043b7c0
call fcn.0043af40
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x38], rcx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
call fcn.0043aec0
lea rax, [0x008d6419]
mov ebx, 0xd
nop dword [rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x28]
call fcn.0043b620
lea rax, [0x008d5d40]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x38]
call fcn.0043b620
lea rax, [0x008d5d4c]
mov ebx, 0xc
nop dword [rax + rax]
call fcn.0043b7c0
movzx eax, byte [rsp + 0x27]
movzx eax, al
call fcn.0043b4c0
call fcn.0043af40
call fcn.0043aec0
nop dword [rax]
call fcn.0043b120
call fcn.0043af40
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x415970
mov rcx, qword [r14 + 0x30]
mov byte [rcx + 0xf9], 2
lea rax, [0x008ea267]
mov ebx, 0x3e
call fcn.00439600
call fcn.0043aec0
lea rax, [0x008df12b]
mov ebx, 0x1e
call fcn.0043b7c0
mov rax, qword [rsp + 0x60]
call fcn.0043b620
lea rax, [0x008d353e]
mov ebx, 1
nop dword [rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x30]
call fcn.0043b620
lea rax, [0x008d357a]
mov ebx, 2
nop dword [rax + rax]
call fcn.0043b7c0
call fcn.0043af40
lea rax, [0x008d40e1]
mov ebx, 6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
call fcn.00422060
jmp 0x415954
call fcn.0043aec0
lea rax, [0x008dbe95]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043b7c0
call fcn.0043af40
jmp 0x4158b5
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00415820
Function at 0x416260
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, rbx
or rbx, rax
or rbx, rcx
nop word [rax + rax]
test rbx, 7
jne 0x416445
cmp byte [0x00bc2244], 0
je 0x41632f
mov rsi, qword [r14 + 0x30]
mov rsi, qword [rsi + 0xa0]
test byte [rsi], al
nop
movabs r8, 0x800000000000
add r8, rax
mov r9, r8
shr r8, 0x2a
nop dword [rax]
cmp r8, 0x40
jae 0x416435
lea r10, [0x00b940b0]
mov r8, qword [r10 + r8*8]
test byte [r8], al
shr r9, 0x16
mov r10, r9
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test r8, r8
je 0x416310
mov r11, rax
shr rax, 5
and eax, 0x1ffff
lea r12, [r8 + rax]
shr r11, 3
and r11d, 3
add r8, 0x1ffff
jmp 0x41631c
xor r10d, r10d
xor r11d, r11d
xor r8d, r8d
xor r12d, r12d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rsi
xor eax, eax
jmp 0x416340
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rax, 8
mov r11d, r9d
cmp rcx, rax
jbe 0x41642b
mov qword [rsp + 0x20], rax
movzx r9d, byte [r12]
bt r9d, r11d
jae 0x4163d3
lea r9, [rax + rdx]
mov r13, qword [rsi + 0x1268]
mov r9, qword [r9]
mov qword [r13], 0
mov qword [r13 + 8], r9
mov r9, qword [rsi + 0x1268]
add r9, 0x10
mov qword [rsi + 0x1268], r9
cmp qword [rsi + 0x1270], r9
jne 0x4163d3
mov dword [rsp + 0x18], r11d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x1c], r10d
xor eax, eax
xor ebx, ebx
call fcn.00432320
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10d, dword [rsp + 0x1c]
mov r11d, dword [rsp + 0x18]
mov r12, qword [rsp + 0x38]
cmp r11d, 3
jae 0x4163e5
lea r9d, [r11 + 1]
nop dword [rax]
jmp 0x416339
cmp r8, r12
je 0x4163f5
inc r12
xor r9d, r9d
jmp 0x416339
mov rax, r12
mov ebx, r11d
mov ecx, r10d
mov rdi, r8
call fcn.00415bc0
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r10d, ecx
mov r9d, ebx
mov r8, rdi
mov r12, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
jmp 0x416339
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, r8
mov ecx, 0x40
nop dword [rax]
call fcn.00467380
lea rax, [0x008e3b13]
mov ebx, 0x28
call fcn.00439600
nop
int3
Function at 0x416600
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x416825
mov qword [rsp + 0x58], rax
nop dword [rax]
cmp qword [rax], rdi
jne 0x41677b
movzx edx, byte [rax + 0x17]
test dl, 0x40
jne 0x41671d
cmp byte [0x00bc2244], 0
je 0x416666
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov rdx, qword [r14 + 0x30]
mov rdx, qword [rdx + 0xa0]
mov qword [rsp + 0x40], rdx
test byte [rdx], al
mov rsi, qword [rax + 0x20]
xor edi, edi
xor r8d, r8d
jmp 0x416674
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
add rdi, 8
cmp qword [rax + 8], rdi
jbe 0x416713
nop
test rdi, 0x3f
jne 0x416692
movzx r8d, byte [rsi]
inc rsi
jmp 0x416695
shr r8d, 1
bt r8d, 0
jae 0x416670
lea r9, [rdi + rbx]
lea r10, [rdi + rcx]
mov r11, qword [rdx + 0x1268]
mov r9, qword [r9]
mov r10, qword [r10]
mov qword [r11], r9
mov qword [r11 + 8], r10
mov r9, qword [rdx + 0x1268]
add r9, 0x10
mov qword [rdx + 0x1268], r9
cmp qword [rdx + 0x1270], r9
jne 0x416670
mov qword [rsp + 0x18], rdi
mov dword [rsp + 0x14], r8d
mov qword [rsp + 0x30], rsi
xor eax, eax
xor ebx, ebx
call fcn.00432320
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x18]
mov r8d, dword [rsp + 0x14]
jmp 0x416670
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
nop dword [rax]
call fcn.0045d840
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
call fcn.0043aec0
lea rax, [0x008e403b]
mov ebx, 0x28
call fcn.0043b7c0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.0043b7c0
lea rax, [0x008d6e7e]
mov ebx, 0xf
call fcn.0043b7c0
call fcn.0043af40
lea rax, [0x008e217a]
mov ebx, 0x24
call fcn.00439600
mov qword [rsp + 0x70], rdi
call fcn.0045d840
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
nop dword [rax]
call fcn.0043aec0
lea rax, [0x008e403b]
mov ebx, 0x28
call fcn.0043b7c0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
call fcn.0043b7c0
lea rax, [0x008d5687]
mov ebx, 0xb
call fcn.0043b7c0
mov rax, qword [rsp + 0x20]
nop dword [rax + rax]
call fcn.0043b4c0
lea rax, [0x008d8235]
mov ebx, 0x12
call fcn.0043b7c0
mov rax, qword [rsp + 0x70]
nop dword [rax + rax]
call fcn.0043b4c0
call fcn.0043b120
call fcn.0043af40
lea rax, [0x008e217a]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00439600
lea rax, [0x008e4622]
mov ebx, 0x29
call fcn.00439600
nop
int3
Function at 0x418420
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418655
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test byte [rax], al
movzx edx, bl
nop dword [rax]
cmp rdx, 0x88
jae 0x418647
mov rcx, qword [rax + rdx*8 + 0x28]
movzx esi, word [rcx + 0x60]
nop word [rax + rax]
nop
cmp qword [rcx + 0x38], rsi
jne 0x418636
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdx
lea rsi, [0x00bc2780]
nop dword [rax + rax]
cmp rcx, rsi
je 0x41855a
mov esi, dword [0x00b94058]
add esi, 3
cmp dword [rcx + 0x58], esi
jne 0x418625
mov byte [rsp + 0x48], bl
mov qword [rsp + 0x20], rcx
lea rsi, [rdx + rdx*2]
shl rsi, 6
lea rdi, [0x00b94358]
lea rax, [rsi + rdi]
mov rbx, rcx
call fcn.00418f20
lea rax, [0x00bc6700]
call fcn.004320e0
test byte [rax], al
mov rcx, qword [rsp + 0x20]
movzx edx, word [rcx + 0x60]
movzx esi, word [rcx + 0x66]
sub rdx, rsi
movzx esi, byte [rsp + 0x48]
mov edi, esi
shr sil, 1
movsx rsi, sil
cmp rsi, 0x44
jae 0x418616
mov qword [rsp + 0x18], rdx
lea rbx, [rax + rsi*8]
lea rbx, [rbx + 0x48]
lock xadd qword [rbx], rdx
cmp dil, 5
jne 0x418524
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rdx + 0x20]
lock xadd qword [rax + 0x30], rbx
mov qword [rdx + 0x20], 0
lea rax, [0x00bc6700]
call fcn.004321c0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x68]
mov rbx, qword [rsp + 0x18]
imul rbx, rdx
nop
lea rdx, [0x00bc2e28]
lock xadd qword [rdx], rbx
mov word [rcx + 0x66], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rdx + rdx*2]
shl rcx, 6
lea rbx, [0x00b94358]
lea rax, [rcx + rbx]
call fcn.00418bc0
test rax, rax
je 0x418605
movzx edx, word [rax + 0x60]
nop
cmp qword [rax + 0x38], rdx
je 0x4185f1
mov qword [rsp + 0x20], rax
mov edx, dword [0x00b94058]
add edx, 3
mov dword [rax + 0x58], edx
movzx edx, word [rax + 0x60]
mov word [rax + 0x66], dx
movzx edx, word [rax + 0x60]
mov rsi, qword [rax + 0x68]
imul rdx, rsi
mov rbx, qword [rax + 0x20]
shl rbx, 0xd
sub rbx, rdx
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx + 8]
lea rax, [0x00bc2ce0]
call fcn.00423680
mov rdx, qword [rsp + 0x40]
mov qword [rdx + 8], 0
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov qword [rdx + rsi*8 + 0x28], rdi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x008dab46]
mov ebx, 0x16
nop dword [rax]
call fcn.00439600
lea rax, [0x008d6829]
mov ebx, 0xd
call fcn.00439600
mov rax, rsi
mov ecx, 0x44
nop
call fcn.00467360
lea rax, [0x008da6ce]
mov ebx, 0x16
call fcn.00439600
lea rax, [0x008e3e83]
mov ebx, 0x28
call fcn.00439600
mov rax, rdx
mov ecx, 0x88
call fcn.00467360
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
nop
call fcn.00464c60
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.00418420
Function at 0x418f20
Capabilities:
Gather firefox profile information
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418fe6
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
cmp word [rbx + 0x60], 0
nop dword [rax]
je 0x418fcf
mov ecx, dword [0x00b94058]
lea edx, [rcx + 1]
mov esi, dword [rbx + 0x58]
cmp esi, edx
jne 0x418f62
lea edi, [rcx - 1]
xchg dword [rbx + 0x58], edi
cmp esi, edx
nop
jmp 0x418f69
mov edx, ecx
xchg dword [rbx + 0x58], ecx
mov ecx, edx
je 0x418faf
mov rdx, qword [rbx + 0x38]
movzx esi, word [rbx + 0x60]
sub rdx, rsi
test rdx, rdx
jle 0x418f95
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 8]
call fcn.00431a80
jmp 0x418fc5
test byte [rax], al
shr ecx, 1
and ecx, 1
lea rcx, [rcx + rcx*4]
lea rax, [rax + rcx*8]
lea rax, [rax + 0x58]
call fcn.00431a80
jmp 0x418fc5
mov qword [rsp + 0x10], rbx
lea rax, [rsp + 0x10]
xor ebx, ebx
nop dword [rax + rax]
call fcn.00426bc0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008e232a]
mov ebx, 0x24
nop dword [rax + rax]
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00418f20
Function at 0x419340
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4194e6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x58], rdi
movzx edx, byte [rdi]
test dl, sil
je 0x4193fa
nop
movabs rdx, 0x800000000000
add rdx, rax
mov rbx, rdx
shr rdx, 0x2a
nop
cmp rdx, 0x40
jae 0x4193ed
lea rsi, [0x00b940b0]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
mov rdx, qword [rdx + 0x210c0]
test byte [rdx], al
mov rcx, rax
shr rax, 0x19
movzx ebx, ax
add rdx, rbx
mov bl, byte [rdx]
shr rcx, 0x16
and ecx, 7
mov esi, 1
shl esi, cl
test sil, bl
je 0x4193dd
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lock or byte [rdx], sil
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00467380
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rax
call fcn.0043aec0
call fcn.0043aec0
lea rax, [0x008e94f5]
mov ebx, 0x39
nop
call fcn.0043b7c0
mov rax, qword [rsp + 0x40]
call fcn.0043b620
call fcn.0043b120
call fcn.0043af40
call fcn.0043aec0
lea rax, [0x008dbd44]
mov ebx, 0x18
call fcn.0043b7c0
mov rax, qword [rsp + 0x28]
call fcn.0043b620
lea rax, [0x008d353e]
mov ebx, 1
call fcn.0043b7c0
mov rax, qword [rsp + 0x20]
call fcn.0043b620
lea rax, [0x008d357a]
mov ebx, 2
call fcn.0043b7c0
call fcn.0043af40
lea rax, [0x008d3a36]
mov ebx, 4
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
call fcn.00422060
lea rax, [0x008d384f]
mov ebx, 3
mov rcx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
nop dword [rax]
call fcn.00422060
mov rax, qword [r14 + 0x30]
mov byte [rax + 0xf9], 2
lea rax, [0x008df5b6]
mov ebx, 0x1f
nop dword [rax]
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x30], r8
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.00419340
Function at 0x4197c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41996b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x008333e8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41982e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x419841
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x419865
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x419879
cmp rbx, 0x1000
jae 0x419838
nop
jmp 0x4198e9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41988d
xor edx, edx
jmp 0x4198e0
mov rcx, qword [0x008333e8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00436700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41986f
jmp 0x419855
call fcn.00468820
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043aec0
lea rax, [0x008dbd2c]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x38]
call fcn.0043b4c0
lea rax, [0x008dbe7c]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043b7c0
mov rax, qword [rsp + 0x30]
call fcn.0043b4c0
call fcn.0043b120
call fcn.0043af40
lea rax, [0x008e09b9]
mov ebx, 0x21
call fcn.00439600
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464c60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004197c0