joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d1890
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [edi + 0x20]
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100d195d
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
mov ecx, dword [edi + 0x68]
mov eax, ecx
or eax, 1
mov dword [edi + 0x68], eax
test cl, 4
jne 0x100d18eb
xor esi, esi
test cl, 2
je 0x100d192b
and eax, 0xfffffffd
mov dword [edi + 0x68], eax
jmp 0x100d192b
cmp byte [0x101f5248], 1
jne 0x100d18fd
push 0
push 0xffffe001
jmp 0x100d1920
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + 6]
call dword [section..00cfg]
push 0
call ecx
add esp, 4
test eax, eax
je 0x100d194a
push eax
call fcn.100aaef0
add esp, 4
push 0
push eax
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
push dword [edi + 0x20]
call sym.nss3.dll_PR_Unlock
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0
push edi
call fcn.100b7490
add esp, 0xc
xor esi, esi
jmp 0x100d192b
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
mov esi, eax
jmp 0x100d18bf
Function at 0x100d1c80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f1014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x2c]
mov dword [ecx], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0xce534368
mov dword [ebp - 0x18], eax
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
inc eax
mov dword [ebp - 0x14], eax
mov ebx, dword [esi + 0x3c]
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test eax, eax
je 0x100d1d4b
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], edi
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x28]
push eax
push 0
push 2
push ecx
push dword [esi + 0x38]
push esi
call fcn.100bd990
add esp, 0x18
mov edi, eax
push dword [esi + 0x3c]
call sym.nss3.dll_PR_Unlock
add esp, 4
test edi, edi
je 0x100d1d2a
push edi
call fcn.100aaef0
add esp, 4
push 0
push eax
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x100d1d37
push dword [esi + 4]
call sym.nss3.dll_SECMOD_UpdateSlotList
add esp, 4
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
mov edi, eax
jmp 0x100d1cdb

Function at 0x100d1ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
push dword [esi + 0x40]
push str.tokens_0x_x___
call sym.nss3.dll_PR_smprintf
add esp, 8
test eax, eax
je 0x100d1f52
mov ebx, eax
mov ecx, esi
mov edx, 0xce534356
push eax
call fcn.100d1c80
add esp, 4
mov edi, eax
push ebx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
push esi
call fcn.100cd0c0
add esp, 4
test eax, eax
je 0x100d1f64
mov ebx, eax
mov esi, dword [eax + 0x14]
test esi, esi
je 0x100d1f3c
mov dword [ebp - 0x14], edi
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100d1f6e
mov edi, dword [ebp - 0x18]
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov dword [esi + 0x34], 0
push dword [esi + 0x44]
call sym.nss3.dll_PR_Unlock
add esp, 4
mov edi, dword [ebp - 0x14]
push ebx
call fcn.10096ae0
add esp, 4
xor edx, edx
inc edx
mov ecx, dword [ebp + 8]
call fcn.100cd440
jmp 0x100d1f64
push 0
push 0xffffe013
call sym.nss3.dll_PR_SetError
add esp, 8
xor edi, edi
dec edi
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x100d1f14
Function at 0x100d1f90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x101f53dc]
test eax, eax
je 0x100d216d
push eax
call fcn.100d4620
add esp, 4
mov esi, dword [0x101f53e8]
test esi, esi
je 0x100d2181
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov edi, dword [esi + 4]
cmp dword [ebp + 8], 0
jne 0x100d1fff
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + 0x12]
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push eax
call ecx
add esp, 0xc
test eax, eax
je 0x100d207f
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + 6]
call dword [section..00cfg]
xor ebx, ebx
push ebx
call ecx
add esp, 4
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.100b7490
add esp, 0xc
test eax, eax
mov dword [ebp - 0x24], esi
je 0x100d208e
mov ebx, eax
cmp dword [0x101f4f80], 0
je 0x100d213f
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d2124
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x2c], 0
jle 0x100d2079
xor eax, eax
mov ecx, dword [edi + 0x28]
mov ecx, dword [ecx + eax*4]
mov dword [ecx + 0x18], 1
mov ecx, dword [edi + 0x28]
mov ecx, dword [ecx + eax*4]
mov dword [ecx + 0x1c], 2
inc eax
cmp eax, dword [edi + 0x2c]
jl 0x100d2059
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp - 0x24]
mov esi, dword [esi]
test esi, esi
jne 0x100d1fd5
jmp 0x100d2149
cmp dword [edi + 0x2c], 0
jle 0x100d207c
xor esi, esi
mov eax, dword [edi + 0x28]
push 1
push dword [eax + esi*4]
call fcn.100cc510
add esp, 8
test eax, eax
je 0x100d20fa
mov ebx, eax
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + esi*4]
xor edx, edx
inc edx
call fcn.100cd440
test eax, eax
je 0x100d20fa
cmp dword [0x101f4f80], 0
je 0x100d211d
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d2105
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0x28]
mov eax, dword [eax + esi*4]
mov dword [eax + 0x18], 1
mov eax, dword [edi + 0x28]
mov eax, dword [eax + esi*4]
mov dword [eax + 0x1c], 2
mov dword [ebp - 0x1c], ebx
inc esi
cmp esi, dword [edi + 0x2c]
jl 0x100d2096
jmp 0x100d207c
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100d20d7
call fcn.1001b2e0
jmp 0x100d20c7
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100d204b
call fcn.1001b2e0
jmp 0x100d2037
push dword [0x101f53dc]
call fcn.100d4700
add esp, 4
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x100d218f
push 0
push dword [ebp - 0x20]
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x100d2191
push 0
push 0xffffe09a
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
dec esi
jmp 0x100d2191
push dword [0x101f53dc]
call fcn.100d4700
add esp, 4
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100d3900
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100d3934
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push eax
push ebx
push edi
push esi
call fcn.100d33f0
add esp, 0x10
cmp eax, 1
sbb esi, esi
jmp 0x100d395f
cmp dword [0x101f4f80], 0
je 0x100d397e
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d3966
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100d394d
call fcn.1001b2e0
jmp 0x100d393d
Function at 0x100d4620
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [0x101f4f80], 0
je 0x100d46f5
mov ebx, dword [ebp + 8]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x100d46c6
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100d46dd
mov edi, dword [ebp - 0x14]
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x24]
cmp eax, esi
je 0x100d46b1
test eax, eax
jne 0x100d4696
cmp dword [ebx + 0x18], 0
je 0x100d46b1
inc dword [ebx + 0x14]
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call sym.nss3.dll_PR_WaitCondVar
dec dword [ebx + 0x14]
jmp 0x100d4685
inc dword [ebx + 0x10]
mov eax, dword [ebx]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x100d4650
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov dword [ebp - 0x10], eax
jmp 0x100d466d
call fcn.1001b2e0
jmp 0x100d4636

Function at 0x100d4700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov ebx, dword [edi]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x100d476d
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], esi
mov eax, dword [edi + 0x10]
test eax, eax
jle 0x100d475b
dec eax
mov dword [edi + 0x10], eax
jne 0x100d475b
cmp dword [edi + 0x24], 0
jne 0x100d475b
cmp dword [edi + 0x18], 0
je 0x100d475b
mov eax, dword [edi + 0x20]
mov dword [esp], eax
call sym.nss3.dll_PR_NotifyCondVar
mov eax, dword [edi]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x100d4725
Function at 0x100d4790
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [0x101f4f80], 0
je 0x100d4868
mov ebx, dword [ebp + 8]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x100d4839
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x100d4850
mov edi, dword [ebp - 0x14]
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x24]
cmp eax, esi
je 0x100d4821
test eax, eax
jne 0x100d4806
cmp dword [ebx + 0x10], 0
je 0x100d4821
inc dword [ebx + 0x18]
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call sym.nss3.dll_PR_WaitCondVar
dec dword [ebx + 0x18]
jmp 0x100d47f5
mov dword [ebx + 0x24], esi
inc dword [ebx + 0xc]
mov eax, dword [ebx]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x100d47c0
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov dword [ebp - 0x10], eax
jmp 0x100d47dd
call fcn.1001b2e0
jmp 0x100d47a6

Function at 0x100d4880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [0x101f4f80], 0
je 0x100d496d
mov edi, dword [ebp + 8]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x100d493f
mov ebx, dword [edi]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
test eax, eax
je 0x100d4956
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], edi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], esi
mov esi, eax
je 0x100d48ff
mov eax, dword [esi]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xc]
test eax, eax
jle 0x100d48ed
dec eax
mov dword [esi + 0xc], eax
jne 0x100d48ed
mov dword [esi + 0x24], 0
cmp dword [esi + 0x18], 0
je 0x100d492c
cmp dword [esi + 0x10], 0
jne 0x100d48ed
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call sym.nss3.dll_PR_NotifyCondVar
jmp 0x100d48ed
cmp dword [esi + 0x14], 0
je 0x100d48ed
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call sym.nss3.dll_PR_NotifyAllCondVar
jmp 0x100d48ed
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x100d48b4
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov edi, eax
jmp 0x100d48d1
call fcn.1001b2e0
jmp 0x100d4896
Function at 0x100d5540
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x20], edx
mov edi, ecx
mov esi, dword [ecx]
mov bl, byte [esi]
test bl, bl
je 0x100d56e7
movsx eax, bl
push eax
push dword [ebp - 0x20]
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x100d56e7
mov dword [ebp - 0x10], esi
xor esi, esi
test bl, bl
je 0x100d56e2
movzx eax, bl
cmp eax, 0x3d
je 0x100d55ab
movsx eax, bl
push 0x41
push eax
push str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789__
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100d56e2
mov eax, dword [ebp - 0x10]
mov bl, byte [eax + esi + 1]
inc esi
jmp 0x100d5576
test esi, esi
je 0x100d56e2
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x10]
lea edi, [eax + esi]
inc edi
movsx ebx, byte [edi]
mov dword [ebp - 0x14], edi
test ebx, ebx
je 0x100d5644
mov edi, dword [ebp - 0x14]
cmp ebx, dword [ebp + 8]
je 0x100d5644
mov edi, dword [ebp - 0x14]
push ebx
push dword [ebp - 0x20]
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x100d5644
push ebx
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x100d5636
cmp bl, 0x25
jne 0x100d56e2
movsx eax, byte [edi + 1]
push 0x17
push eax
push str.0123456789abcdefABCDEF
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100d56e2
movsx eax, byte [edi + 2]
push 0x17
push eax
push str.0123456789abcdefABCDEF
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100d56e2
add edi, 2
movsx ebx, byte [edi + 1]
inc edi
test ebx, ebx
je 0x100d5644
cmp ebx, dword [ebp + 8]
jne 0x100d55d2
mov dword [ebp - 0x24], edi
sub edi, dword [ebp - 0x10]
mov ecx, esi
not ecx
add ecx, edi
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + ebx*4]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
cmp eax, esi
jne 0x100d5679
push esi
push edi
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x100d56a2
inc ebx
cmp dword [ebp + 0x14], ebx
jne 0x100d5655
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x10]
push dword [ebp + 0x24]
push sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push esi
call fcn.100d6130
add esp, 0x14
test eax, eax
je 0x100d56c0
jmp 0x100d56e2
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0x10]
push 0
push dword [ebp + 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push esi
call fcn.100d6130
add esp, 0x14
test eax, eax
jne 0x100d56ed
mov ecx, dword [ebp - 0x24]
movzx eax, byte [ecx]
test eax, eax
je 0x100d56f5
cmp eax, 0x3f
je 0x100d56f5
mov bl, byte [ecx + 1]
inc ecx
mov esi, ecx
test bl, bl
mov edi, dword [ebp - 0x18]
jne 0x100d555a
jmp 0x100d56e9
xor eax, eax
dec eax
jmp 0x100d56ed
mov ecx, esi
mov dword [edi], ecx
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp - 0x18]
jmp 0x100d56e9
Function at 0x100dbd50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 8
mov ecx, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ecx + 8]
test eax, eax
je 0x100dbd8e
mov ecx, dword [ecx + 4]
xor edx, edx
mov bl, byte [ecx + edx]
mov esi, edx
and esi, 3
xor byte [ebp + esi - 0x10], bl
inc edx
cmp eax, edx
jne 0x100dbd78
mov esi, dword [ebp - 0x10]
jmp 0x100dbd90
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 8
pop esi
pop ebx
pop ebp
ret

Function at 0x100dcac0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
test eax, eax
js 0x100dcae4
xor ecx, ecx
inc ecx
test eax, eax
cmovne ecx, eax
mov dword [esp], ecx
call dword [sym.imp.mozglue.dll_malloc]
mov ecx, eax
test eax, eax
jne 0x100dcb11
cmp dword [0x101f4f80], 0
je 0x100dcb2a
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100dcb18
mov dword [eax + 0x28], 0xffffe013
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, ecx
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x100dcb02
call fcn.1001b2e0
jmp 0x100dcaed

Function at 0x100dcb40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
cmp dword [0x101f4f80], 0
je 0x100dcb8b
mov esi, dword [ebp + 8]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100dcb79
mov dword [eax + 0x28], esi
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x100dcb68
call fcn.1001b2e0
jmp 0x100dcb50

Function at 0x100dcba0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x100dcbc3
mov ecx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.mozglue.dll_realloc]
mov ecx, eax
test eax, eax
jne 0x100dcbf0
cmp dword [0x101f4f80], 0
je 0x100dcc09
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100dcbf7
mov dword [eax + 0x28], 0xffffe013
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, ecx
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x100dcbe1
call fcn.1001b2e0
jmp 0x100dcbcc
Function at 0x100dcc10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
test eax, eax
js 0x100dcc3c
xor ecx, ecx
inc ecx
test eax, eax
cmovne ecx, eax
mov dword [esp + 4], ecx
mov dword [esp], 1
call dword [sym.imp.mozglue.dll_calloc]
mov ecx, eax
test eax, eax
jne 0x100dcc69
cmp dword [0x101f4f80], 0
je 0x100dcc82
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100dcc70
mov dword [eax + 0x28], 0xffffe013
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, ecx
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x100dcc5a
call fcn.1001b2e0
jmp 0x100dcc45

Function at 0x100dcc90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [ebp + 0x10], eax
ja 0x100dcd80
mov ebx, dword [ebp + 0xc]
lea edi, [ebx - 1]
test ebx, edi
sete cl
test ebx, ebx
setne dl
test dl, cl
je 0x100dccf8
xor ecx, ecx
inc ecx
test eax, eax
cmove eax, ecx
add eax, edi
js 0x100dcd23
cmove eax, ecx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [sym.imp.mozglue.dll_calloc]
test eax, eax
je 0x100dcd23
add edi, eax
neg ebx
and ebx, edi
je 0x100dcd80
mov ecx, dword [ebp + 0x10]
mov dword [ebx + ecx], eax
mov esi, ebx
jmp 0x100dcd80
cmp dword [0x101f4f80], 0
je 0x100dcdc3
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100dcd8a
mov dword [eax + 0x28], 0xffffe005
jmp 0x100dcd78
cmp dword [0x101f4f80], 0
je 0x100dcdcd
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100dcd9f
mov dword [eax + 0x28], 0xffffe013
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101f4f80], ecx
je 0x100dcdd7
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x100dcdb1
mov dword [eax + 0x28], 0xffffe013
xor esi, esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x100dcd1a
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x100dcd45
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x100dcd71
call fcn.1001b2e0
jmp 0x100dcd05
call fcn.1001b2e0
jmp 0x100dcd30
call fcn.1001b2e0
jmp 0x100dcd5c
Function at 0x100dcdf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov esi, eax
inc esi
js 0x100dce2c
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
test eax, eax
je 0x100dce2c
mov edi, eax
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100dce54
cmp dword [0x101f4f80], 0
je 0x100dce73
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100dce5b
mov dword [eax + 0x28], 0xffffe013
xor edi, edi
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], edi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100dce45
call fcn.1001b2e0
jmp 0x100dce35

Function at 0x100dce80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
test edi, edi
js 0x100dcec5
push 0x24
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
test eax, eax
je 0x100dcec5
mov esi, eax
mov dword [eax + 0x1c], 0xb8ac9bdf
call sym.nss3.dll_PR_NewLock
mov dword [esi + 0x20], eax
test eax, eax
je 0x100dcef3
push 8
push edi
push str.security
push esi
call sym.nss3.dll_PL_InitArenaPool
add esp, 0x10
jmp 0x100dceed
cmp dword [0x101f4f80], 0
je 0x100dcf19
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100dcf01
mov dword [eax + 0x28], 0xffffe013
xor esi, esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
pop esi
pop edi
pop ebp
ret
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
xor esi, esi
jmp 0x100dceed
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100dcede
call fcn.1001b2e0
jmp 0x100dcece