joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4afe40
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b003b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
nop dword [rax + rax]
cmp rdi, 8
ja 0x4b0027
test sil, sil
je 0x4afe79
cmp rcx, 8
jne 0x4b0014
mov rdx, qword [rax + 0x38]
add rdx, rdi
cmp qword [0x009a5780], rdx
jl 0x4afeb5
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa0], rdi
mov byte [rsp + 0xa8], sil
mov qword [rsp + 0x98], rcx
xor edx, edx
jmp 0x4aff04
xor eax, eax
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea r8, [rcx + 1]
mov qword [rax + 8], r8
lea r8, [rcx + rcx*2]
shl r8, 4
lea r12, [r11 + r8]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r12], xmm0
lea r8, [r11 + r8]
lea r8, [r8 + 0x10]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [r8 + 0x10], xmm0
inc qword [rax + 0x38]
inc rdx
mov rcx, r9
cmp rdi, rdx
jle 0x4b0005
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
cmp rdx, 0x20
sbb r8d, r8d
mov r9, rcx
mov rcx, rdx
mov r10d, 1
shl r10d, cl
and r10d, r8d
test sil, r10b
mov r8d, 2
mov r10d, 3
cmovne r8, r10
mov qword [rsp + 0x48], r8
imul rcx, r9
lea r8, [rbx + rcx]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
mov r8, qword [rax + 0x38]
mov qword [rsp + 0x68], r8
mov rcx, qword [rax + 8]
lea r8, [rcx + 1]
mov r11, qword [rax]
mov r12, qword [rax + 0x10]
nop word [rax + rax]
cmp r12, r8
jae 0x4afec1
mov qword [rsp + 0x40], rdx
lea rax, [0x00756ac0]
mov rbx, r11
mov rdi, r12
mov rsi, r8
nop
call fcn.004493e0
mov rdi, qword [rsp + 0x88]
mov qword [rdi + 0x10], rcx
cmp dword [0x00a5a130], 0
jne 0x4affc0
mov qword [rdi], rax
jmp 0x4affc5
call fcn.00462ca0
mov rdx, qword [rsp + 0x40]
movzx esi, byte [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x98]
mov r10d, 3
mov rcx, rbx
mov r11, rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
nop
jmp 0x4afec1
mov eax, 1
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814a90]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814820]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], sil
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
movzx esi, byte [rsp + 0x28]
jmp fcn.004afe40
Function at 0x4b26a0
Capabilities:
Gather firefox profile information

Disassembly:
lea r12, [rsp - 0x200]
cmp r12, qword [r14 + 0x10]
jbe 0x4b295d
sub rsp, 0x280
mov qword [rsp + 0x278], rbp
lea rbp, [rsp + 0x278]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rdi
bt esi, 9
jae 0x4b2949
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], rbx
movzx edx, byte [rcx + 0x17]
mov byte [rsp + 0xcf], dl
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.004baf40
mov rdx, qword [rsp + 0xe0]
and edx, 0x1e0
movzx edi, byte [rsp + 0xcf]
and edi, 0x1f
or rdi, rdx
lea rdx, [0x00818d60]
cmp rax, rdx
jne 0x4b2936
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xf0], rbx
nop
lea rcx, [0x004be2a0]
mov qword [rsp + 0xd0], rcx
movups xmmword [rsp + 0x1c0], xmm15
lea rdi, [rsp + 0x1c8]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046340f
mov rbp, qword [rbp]
mov rax, rbx
xor ebx, ebx
call fcn.004b5d80
mov rcx, qword [rsp]
mov qword [rsp + 0x1c0], rcx
lea rdi, [rsp + 0x1c8]
lea rsi, [rsp + 8]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463746
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x108], rcx
lea rdi, [rsp + 0x110]
lea rsi, [rsp + 0x1c8]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00463746
mov rbp, qword [rbp]
lea rax, [0x00741bc0]
call fcn.0040d400
mov rcx, qword [rsp + 0xd0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1b0]
cmp dword [0x00a5a130], 0
jne 0x4b2862
mov qword [rax + 8], rcx
nop
jmp 0x4b286b
lea rdi, [rax + 8]
call fcn.00462da0
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x198]
mov qword [rax + 0x10], rdx
movzx edx, word [rsp + 0x1b8]
mov word [rax + 0x18], dx
mov r8, qword [rsp + 0xe0]
sar r8, 0xa
mov qword [rax + 0x20], r8
mov rsi, qword [rsp + 0xd8]
mov qword [rax + 0x38], rsi
cmp dword [0x00a5a130], 0
jne 0x4b28ca
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0x28], rcx
mov rdi, qword [rsp + 0x100]
mov qword [rax + 0x30], rdi
jmp 0x4b28ef
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0xf8]
call fcn.00462da0
lea rdi, [rax + 0x30]
mov r9, qword [rsp + 0x100]
call fcn.00462e40
mov rdi, r9
mov rax, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x290]
nop
call fcn.004b71c0
mov rax, qword [rsp + 0xf0]
test byte [rax], al
mov rcx, qword [rsp + 0xe0]
and ecx, 0x60
or rcx, 0x13
mov rbx, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0x278]
add rsp, 0x280
ret
lea rbx, [0x00769380]
lea rcx, [0x0075ee40]
call fcn.0040a7e0
lea rax, [0x0070f0c0]
lea rbx, [0x008149c0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004b26a0
Function at 0x4b36c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3727
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x12
jne 0x4b36f4
mov rax, qword [rax + 0x38]
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.004b3300
mov ecx, 0x22
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00781f61]
call fcn.0044ce60
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004b36c0

Function at 0x4b4260
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b43dd
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movups xmmword [rsp + 0x30], xmm15
lea rdi, [rsp + 0x38]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046342b
mov rbp, qword [rbp]
nop word [rax + rax]
test rbx, rbx
jl 0x4b43c9
mov rcx, qword [rax + 0x38]
cmp qword [rax + 0x40], rbx
jle 0x4b43c9
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
lea rdx, [rbx + rbx*2]
mov rsi, qword [rcx + rdx*8 + 8]
test rsi, rsi
je 0x4b42de
lea rdi, [0x00818d60]
jmp 0x4b42e2
xor edi, edi
xor esi, esi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov rax, qword [rcx + rdx*8]
call fcn.004b2a60
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rdx + rcx*8 + 0x10]
bt ebx, 0
setb byte [rsp + 0x90]
mov rbx, qword [rdx + rcx*8]
movzx ebx, byte [rbx]
test bl, 1
jne 0x4b4359
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x30]
nop dword [rax]
call fcn.004b2a60
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rax, qword [rdx + rcx*8]
nop dword [rax]
call fcn.004b2b00
test rbx, rbx
je 0x4b4374
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rcx, qword [rdx + rcx*8 + 0x10]
shr rcx, 1
mov qword [rsp + 0x70], rcx
lea rax, [0x00710720]
call fcn.0040d400
mov rcx, qword [rsp + 0xa0]
mov qword [rax], rcx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
mov qword [rsp + 0x88], 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x008149f0]
call fcn.004356e0
nop
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
call fcn.00460a60
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
jmp fcn.004b4260
Function at 0x4b4400
Capabilities:
Hash data using fnv

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4b4680
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x4b44c3
mov qword [rsp + 0x90], rax
lea rbx, [0x00769380]
mov rcx, rax
lea rax, [0x00a04600]
call fcn.0046a580
test cl, cl
jne 0x4b44a2
mov rax, qword [rsp + 0x90]
nop dword [rax + rax]
call fcn.004b3300
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x38]
lea rbx, [0x007715ae]
nop dword [rax]
call fcn.0044ce60
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], rbx
call fcn.004b59c0
mov rcx, qword [rsp + 0x90]
xor edx, edx
nop
jmp 0x4b44ea
lea rdx, [0x007690c0]
cmp rax, rdx
jne 0x4b44d8
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
call fcn.0045e020
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rbx, rdx
lea rcx, [0x00718680]
call fcn.0040a700
inc rdx
cmp rbx, rdx
jle 0x4b453e
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4b44e7
lea rax, [0x00a04600]
lea rbx, [0x00769380]
lea rdi, [0x007690c0]
call fcn.0046ada0
lea rdx, [0x007690c0]
nop word [rax + rax]
cmp rax, rdx
jne 0x4b4670
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
lea rcx, [0x00709180]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x60], rcx
lea rax, [0x00737580]
call fcn.0040d400
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x60]
test byte [rcx], al
cmp dword [0x00a5a130], 0
jne 0x4b459e
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x4b45ad
mov rbx, rax
lea rax, [0x00737580]
call fcn.00413760
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
xor edi, edi
xor esi, esi
nop dword [rax]
call fcn.004b2d60
call fcn.0045e0e0
mov rsi, qword [rsp + 0x68]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x90]
mov edx, dword [rcx + 0x10]
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x2f], 0x2a
xor eax, eax
jmp 0x4b4604
movzx r8d, byte [rsp + rax + 0x2f]
inc rax
imul edx, edx, 0x1000193
xor edx, r8d
cmp rax, 1
jl 0x4b45f2
mov dword [rsi + 0x10], edx
cmp dword [0x00a5a130], 0
jne 0x4b461c
mov qword [rsi + 0x30], rcx
jmp 0x4b4625
lea rdi, [rsi + 0x30]
call fcn.00462da0
lea rax, [0x00a04600]
lea rbx, [0x00769380]
lea rdi, [0x007690c0]
call fcn.0046ada0
lea rdx, [0x007690c0]
cmp rax, rdx
jne 0x4b4661
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
nop
ret
mov rbx, rdx
lea rcx, [0x00718680]
call fcn.0040a700
mov rbx, rdx
lea rcx, [0x00718680]
call fcn.0040a700
nop
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004b4400
Function at 0x4b46a0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b474c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
test rbx, rbx
je 0x4b4738
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x40], rbx
mov rdx, qword [rbx + 0x98]
mov rax, rcx
call rdx
cmp rax, 0x14
jne 0x4b4725
mov rax, qword [rsp + 0x40]
lea rdx, [0x00818d60]
cmp rax, rdx
jne 0x4b4712
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
call fcn.004b4940
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
lea rbx, [0x00769380]
lea rcx, [0x0075ee40]
call fcn.0040a7e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814a10]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814a00]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax + rax]
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b46a0
Function at 0x4b6c00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6cd4
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
test rax, rax
je 0x4b6c74
nop dword [rax]
test rax, 0x60
jne 0x4b6c32
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004b6ba0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00785c7c]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x0077326e]
call fcn.0044cf00
nop dword [rax]
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
call fcn.004356e0
call fcn.004b6ba0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x007373a0]
call fcn.0040d400
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00a5a130], 0
nop
jne 0x4b6cc5
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x0071c160]
nop dword [rax]
call fcn.004356e0
mov rdi, rax
mov rcx, qword [rsp + 0x40]
call fcn.00462da0
jmp 0x4b6caa
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004b6c00

Function at 0x4b6d00
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6e27
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
nop dword [rax + rax]
test rax, rax
je 0x4b6dc5
test rax, 0x60
jne 0x4b6d85
bt eax, 8
jae 0x4b6d41
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004b6ba0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x0077d15b]
mov r9d, 0x1a
xor eax, eax
lea rbx, [0x0077326e]
call fcn.0044cf00
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
nop dword [rax + rax]
call fcn.004356e0
call fcn.004b6ba0
mov ecx, 9
mov rdi, rax
mov rsi, rbx
lea r8, [0x00785c7c]
mov r9d, 0x2c
xor eax, eax
lea rbx, [0x0077326e]
call fcn.0044cf00
call fcn.0040ab40
mov rbx, rax
lea rax, [0x0070f0c0]
nop
call fcn.004356e0
call fcn.004b6ba0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [0x007373a0]
nop dword [rax + rax]
call fcn.0040d400
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00a5a130], 0
jne 0x4b6e16
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 0x10], 0
mov rbx, rax
lea rax, [0x0071c160]
call fcn.004356e0
mov rdi, rax
mov rcx, qword [rsp + 0x40]
nop
call fcn.00462da0
jmp 0x4b6dff
mov qword [rsp + 8], rax
call fcn.00460a60
mov rax, qword [rsp + 8]
jmp fcn.004b6d00

Function at 0x4b6e40
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6ea6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
bt ecx, 8
jae 0x4b6e8e
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rbx
call fcn.004b4400
mov rcx, qword [rsp + 0x10]
and ecx, 0x60
or rcx, 0x16
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814a60]
nop dword [rax]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b6e40
Function at 0x4b6fc0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7096
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
and ecx, 0x1f
cmp rcx, 0x17
jne 0x4b7035
mov qword [rsp + 0x28], rbx
call fcn.004b3740
mov rcx, qword [rax + 0x98]
mov rax, rbx
nop
call rcx
cmp rax, 8
jne 0x4b7022
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814a70]
call fcn.004356e0
mov qword [rsp + 0x18], rcx
call fcn.004b6b40
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rbx
lea rax, [0x007373a0]
call fcn.0040d400
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x00a5a130], 0
jne 0x4b7087
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x0071c160]
call fcn.004356e0
mov rdi, rax
mov rcx, qword [rsp + 0x20]
call fcn.00462da0
jmp 0x4b706f
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b6fc0

Function at 0x4b70c0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7196
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
and ecx, 0x1f
cmp rcx, 0x17
jne 0x4b7135
mov qword [rsp + 0x28], rbx
call fcn.004b3740
mov rcx, qword [rax + 0x98]
mov rax, rbx
nop
call rcx
cmp rax, 5
jne 0x4b7122
mov rdx, qword [rsp + 0x28]
mov rax, qword [rdx]
mov rbx, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814a80]
call fcn.004356e0
mov qword [rsp + 0x18], rcx
call fcn.004b6b40
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rbx
lea rax, [0x007373a0]
call fcn.0040d400
mov rcx, qword [rsp + 0x10]
mov qword [rax + 8], rcx
cmp dword [0x00a5a130], 0
jne 0x4b7187
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x0071c160]
call fcn.004356e0
mov rdi, rax
mov rcx, qword [rsp + 0x20]
call fcn.00462da0
jmp 0x4b716f
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b70c0
Function at 0x4b83e0
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b84b3
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
je 0x4b8455
cmp rcx, 0x12
jne 0x4b8441
cmp qword [rax], 8
jne 0x4b849f
cmp qword [rax + 8], 0
je 0x4b849f
bt edx, 7
jae 0x4b842e
mov rbx, qword [rbx]
mov rax, rbx
call fcn.0045be60
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
nop
ret
cmp rcx, 0x17
jne 0x4b8464
mov rax, qword [rbx + 0x10]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.004b3b80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 0x10], rcx
lea rax, [0x007373a0]
call fcn.0040d400
mov qword [rax + 8], 0x11
lea rcx, [0x007778ac]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x0071c160]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814930]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b83e0
Function at 0x4b84e0
Capabilities:
Gather firefox profile information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8686
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x20], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x14
je 0x4b8598
nop dword [rax]
cmp rcx, 0x16
jne 0x4b864a
bt edx, 7
jae 0x4b8561
movzx esi, byte [rax + 0x17]
test sil, 0x20
jne 0x4b855e
mov qword [rsp + 0x18], rax
mov rax, qword [rbx]
call fcn.0045c7e0
test al, al
je 0x4b8637
mov rax, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
test rbx, rbx
je 0x4b8588
mov rax, qword [rax + 0x30]
and edx, 0x60
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
or rcx, rdx
or rcx, 0x180
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
call fcn.004b3520
nop dword [rax]
test rax, rax
jne 0x4b85b3
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
jmp 0x4b85c9
mov rdx, qword [rsp + 0x20]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
nop
test rsi, rsi
je 0x4b85c9
mov rsi, qword [rsi + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdx
mov rsi, qword [rsp + 0x28]
test rsi, rsi
je 0x4b85fa
movzx edi, byte [rsi + 0x17]
mov r8d, edi
and edi, 0x1f
mov r9, rdi
bts rdi, 7
test r8b, 0x20
cmove r9, rdi
nop
jmp 0x4b8601
xor r9d, r9d
xor esi, esi
xor edx, edx
test r9, r9
je 0x4b8624
mov rdi, qword [rsp + 0x10]
test rdi, 0x60
mov edi, 0
mov r8d, 0x20
cmovne rdi, r8
or r9, rdi
mov rax, rsi
mov rbx, rdx
mov rcx, r9
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814af0]
call fcn.004356e0
mov qword [rsp + 0x10], rcx
lea rax, [0x007373a0]
call fcn.0040d400
mov qword [rax + 8], 0x12
lea rcx, [0x00778353]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x0071c160]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b84e0
Function at 0x4b8800
Capabilities:
Gather firefox profile information
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8986
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x4b8879
cmp qword [rax + 0x40], rdi
jbe 0x4b896d
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov esi, 0x20
cmovne rcx, rsi
mov rsi, qword [rax]
imul rdi, rsi
nop
and edx, 0x180
or rcx, rdx
movzx edx, byte [rax + 0x17]
and edx, 0x1f
or rcx, rdx
add rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x17
jne 0x4b88cb
nop
cmp qword [rbx + 8], rdi
jbe 0x4b895a
mov rax, qword [rax + 0x30]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rax]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
or rcx, rsi
or rcx, 0x180
imul rdi, rdx
add rdi, qword [rbx]
mov rbx, rdi
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
cmp rcx, 0x18
jne 0x4b891f
cmp qword [rbx + 8], rdi
jbe 0x4b890c
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
mov rdx, qword [rbx]
or rcx, 0x88
mov rax, qword [0x00a022e8]
nop
lea rbx, [rdx + rdi]
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x0070f0c0]
lea rbx, [0x00814b20]
call fcn.004356e0
mov qword [rsp + 0x10], rcx
lea rax, [0x007373a0]
call fcn.0040d400
mov qword [rax + 8], 0x13
lea rcx, [0x00778f58]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x0071c160]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x008149d0]
call fcn.004356e0
lea rax, [0x0070f0c0]
lea rbx, [0x00814b10]
nop dword [rax + rax]
call fcn.004356e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460a60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004b8800