joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ecx + 0x14]
test edi, edi
jle 0x10019da3
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
lea eax, [edx + 1]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
cmp ecx, 2
setb al
mov dword [ebp - 0x24], ecx
xor eax, ecx
mov ecx, eax
shl ecx, 4
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + ecx + 0xc]
mov dword [ebp - 0x20], edx
cmp dword [ebp + 8], 0
je 0x10019d0b
mov edx, dword [ebp - 0x10]
mov esi, dword [edx + ecx]
xor edx, edx
movzx ebx, byte [esi + edx]
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + edx]
cmp bl, cl
jne 0x10019ce8
test ebx, ebx
je 0x10019d0b
inc edx
jmp 0x10019cd2
mov bl, byte [ebx + 0x101af7e8]
cmp bl, byte [ecx + 0x101af7e8]
je 0x10019ce5
test eax, eax
je 0x10019dad
mov ecx, dword [ebp - 0x24]
inc ecx
cmp ecx, edi
jne 0x10019ca8
jmp 0x10019da3
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebx + 0x24]
test esi, esi
jne 0x10019d69
lea esi, [ebx + 0x20]
add ebx, 0x1c
mov edi, dword [ebx]
mov eax, 0x101f2310
test edi, edi
je 0x10019d59
mov esi, dword [esi]
mov ecx, dword [esi + 0xc]
xor edx, edx
movzx eax, byte [ecx + edx]
mov ebx, dword [ebp - 0x14]
movzx ebx, byte [ebx + edx]
cmp al, bl
jne 0x10019d43
test eax, eax
je 0x10019d65
inc edx
jmp 0x10019d2d
mov al, byte [eax + 0x101af7e8]
cmp al, byte [ebx + 0x101af7e8]
je 0x10019d40
dec edi
jne 0x10019d26
mov eax, 0x101f2310
mov eax, dword [eax + 8]
test eax, eax
mov edi, dword [ebp - 0x1c]
je 0x10019cfe
jmp 0x10019da5
mov eax, esi
jmp 0x10019d59
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
xor eax, eax
test cl, cl
je 0x10019d90
mov edx, dword [ebp - 0x18]
movzx ecx, cl
movzx ecx, byte [ecx + 0x101af7e8]
add ecx, eax
imul eax, ecx, 0x9e3779b1
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10019d77
xor edx, edx
div dword [ebx + 0x18]
lea ebx, [esi + edx*8]
lea esi, [esi + edx*8]
add esi, 4
jmp 0x10019d1b
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
movzx ecx, byte [eax + str.main]
mov edx, dword [ebp + 8]
movzx edx, byte [edx + eax]
cmp cl, dl
je 0x10019dd5
mov cl, byte [ecx + 0x101af7e8]
cmp cl, byte [edx + 0x101af7e8]
jne 0x10019cfe
jmp 0x10019ddd
test ecx, ecx
je 0x10019d0b
inc eax
jmp 0x10019daf
Function at 0x10063660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov esi, dword [0x101ef014]
xor esi, ebp
mov dword [ebp - 8], esi
mov edx, dword [edx + 4]
lea esi, [ebp - 0xc]
push 0
push esi
push ecx
push eax
push dword [edx + 0x18]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x100636a8
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
je 0x10063696
push eax
call fcn.10128810
add esp, 4
xor esi, esi
dec esi
jmp 0x10063696

Function at 0x100637d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10063864
cmp dword [0x101f2f50], 0
je 0x10063878
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10063846
push dword [esi + 0x3c]
call dword [sym.imp.mozglue.dll_free]
add esp, 4
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
inc edi
push edi
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
mov dword [esi + 0x3c], eax
test eax, eax
je 0x10063873
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 0x3c]
call fcn.10063890
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
test eax, eax
jne 0x10063800
jmp 0x10063873
push 0
push 0xffffe89d
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
jmp 0x10063841
call fcn.100029e0
jmp 0x100637ee
Function at 0x10063f80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [0x101f2fd8]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
test eax, eax
je 0x10064066
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], edi
test byte [esi + 0xe0], 1
jne 0x100640c6
mov eax, dword [0x101f2f60]
dec eax
mov dword [0x101f2f60], eax
cmp eax, dword [0x101f2fdc]
je 0x1006401c
mov esi, dword [0x101f2fd8]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1006407d
cmp dword [esi + 8], eax
jne 0x10064014
mov dword [esi + 8], 0
add esi, 0x1c
mov dword [esp], esi
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x101f2fe0]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x100640af
mov eax, dword [esi]
cmp dword [eax + 8], ecx
jne 0x10063fde
add esi, 0x74
mov ecx, dword [eax + 0x34]
add eax, 0x34
xor edi, edi
test ecx, ecx
jg 0x10064092
lea edx, [edi + edi*2]
mov dword [eax + edx*4 + 8], 1
mov dword [eax + edx*4 + 4], esi
inc ecx
mov dword [eax], ecx
jmp 0x10063fde
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov edi, eax
jmp 0x10063fac
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10063ffd
mov ebx, eax
add eax, 8
mov edx, ecx
cmp dword [eax - 4], esi
je 0x100640d1
add eax, 0xc
dec edx
jne 0x10064099
cmp ecx, 6
jge 0x100640dd
mov eax, ebx
mov edi, ecx
jmp 0x1006404f
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov ecx, eax
jmp 0x10064039
dec dword [0x101f2f5c]
jmp 0x10063fde
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x1006405e
jmp 0x10063fde
mov eax, dword [ebx + 0x4c]
test eax, eax
jne 0x100640fc
mov dword [esp + 4], 0x50
mov dword [esp], 1
call dword [sym.imp.mozglue.dll_calloc]
mov dword [ebx + 0x4c], eax
mov ecx, dword [eax]
jmp 0x1006404b
Function at 0x100647b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10064822
mov ecx, edi
mov edi, dword [edi]
cmp dword [edi + 8], esi
jne 0x10064852
mov ebx, 0x1002
mov eax, dword [esi + 0xe0]
and eax, ebx
cmp eax, 2
je 0x1006483c
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov dword [esi + 0xd8], ecx
xor ecx, ecx
mov dword [edi + 8], ecx
lea ecx, [edi + 0x1c]
add edx, 0x74
push eax
push ecx
push edx
call sym.nss3.dll__PR_MD_WAIT_CV
xor eax, eax
add esp, 0xc
mov dword [esi + 0xd8], eax
mov dword [edi + 8], esi
and ebx, dword [esi + 0xe0]
cmp ebx, 2
je 0x1006483c
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x100647cb
push 0
push 0xffffe897
call sym.nss3.dll_PR_SetError
add esp, 8
and byte [esi + 0xe0], 0xfd
xor eax, eax
dec eax
jmp 0x1006481d

Function at 0x10064860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10064969
mov ecx, dword [ebp + 0xc]
cmp edi, 0xffffffff
je 0x1006494d
push edi
mov edi, ecx
call sym.nss3.dll_PR_IntervalToMilliseconds
mov ecx, edi
add esp, 4
mov ebx, eax
mov edx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
jne 0x10064955
inc dword [edx + 0xc]
mov dword [esi + 0x104], 1
mov dword [esi + 0x13c], 0
mov eax, dword [edx + 8]
mov dword [esi + 0x138], eax
cmp dword [edx + 4], 0
jne 0x10064986
lea eax, [edx + 4]
mov dword [eax], esi
mov dword [edx + 8], esi
push ecx
mov edi, ecx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push ebx
push dword [esi + 0x100]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ebx, eax
push edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp ebx, 0x102
jne 0x10064948
cmp dword [esi + 0x104], 0
je 0x10064993
mov ecx, dword [ebp + 8]
dec dword [ecx + 0xc]
mov dword [esi + 0x104], 0
mov eax, dword [esi + 0x13c]
cmp dword [ecx + 4], esi
jne 0x100649a3
mov dword [ecx + 4], eax
test eax, eax
jne 0x100649cc
mov dword [ecx + 8], 0
xor eax, eax
mov dword [esi + 0x138], eax
mov dword [esi + 0x13c], eax
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
dec ebx
jmp 0x1006489a
mov edi, ecx
mov eax, edx
mov edx, esi
push eax
call fcn.10158cc0
add esp, 4
jmp 0x100648e2
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1006487f
mov eax, 0x13c
add eax, dword [edx + 8]
jmp 0x100648d4
push 0xffffffffffffffff
push dword [esi + 0x100]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
jmp 0x10064948
mov edx, ecx
mov ecx, dword [esi + 0x138]
mov dword [ecx + 0x13c], eax
mov eax, dword [esi + 0x138]
mov ecx, dword [esi + 0x13c]
test ecx, ecx
je 0x100649db
mov dword [ecx + 0x138], eax
jmp 0x1006493a
mov dword [eax + 0x138], 0
jmp 0x1006493a
mov dword [edx + 8], eax
jmp 0x1006493a
Function at 0x10064ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
test dl, dl
je 0x10064af0
inc ecx
xor eax, eax
rol eax, 4
movzx edx, dl
xor eax, edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10064adf
pop ebp
ret
xor eax, eax
jmp 0x10064aee

Function at 0x10064c60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x101ef014]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 1
push ecx
push eax
push edi
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
je 0x10064cc6
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
push esi
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x10064cd6
cmp edi, 0x17
jne 0x10064cb3
test byte [0x101f23c8], 1
jne 0x10064cf4
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.101a4a30
add esp, 4
jmp 0x10064cef
call sub.wsock32.dll_WSAGetLastError
push eax
push 0xffffe896
call sym.nss3.dll_PR_SetError
add esp, 8
push esi
call sub.wsock32.dll_closesocket
xor esi, esi
dec esi
jmp 0x10064cb3
lea eax, [ebp - 0x18]
mov dword [eax], 4
lea edi, [ebp - 0x14]
push eax
push edi
push 0x1002
push 0xffff
push esi
call sub.wsock32.dll_getsockopt
test eax, eax
jne 0x10064cb3
cmp dword [ebp - 0x14], 0x10000
jl 0x10064cb3
mov eax, 0xffff
mov dword [ebp - 0x14], eax
push dword [ebp - 0x18]
push edi
push 0x1002
push eax
push esi
call sub.wsock32.dll_setsockopt
jmp 0x10064cb3

Function at 0x10065c60
Capabilities:
Connect socket
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x10065cce
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebx + 4]
cmp dword [eax + 4], 0
jne 0x10065c98
cmp esi, 0x2733
je 0x10065d01
mov edi, 0xffffe8d2
cmp esi, 0x2733
jne 0x10065ceb
cmp dword [0x101f2f50], 0
je 0x10065cfa
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10065cd3
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
xor eax, eax
dec eax
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x10065cbe
cmp esi, 0x274c
jne 0x10065d18
mov edi, 0xffffe89a
jmp 0x10065ca5
call fcn.100029d0
jmp 0x10065cae
mov ecx, edi
mov edx, 3
push dword [ebp + 0x14]
call fcn.1019ed00
add esp, 4
sar eax, 0x1f
jmp 0x10065cce
cmp esi, 0x2726
jne 0x10065d2a
mov edi, 0xffffe8d3
jmp 0x10065ca5
push esi
call fcn.10128810
add esp, 4
jmp 0x10065ccb
Function at 0x10069b60
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x140], eax
lea eax, [esi + 0xdc]
mov ecx, dword [esi + 0x10]
push eax
push 0x10004
push esi
push 0x10076600
push dword [ecx + 0x1c]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x108], eax
test eax, eax
je 0x10069bdf
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 0xdc]
mov dword [esi + 0x10c], edx
cmp ecx, 1
jne 0x10069bc7
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
neg eax
pop esi
pop ebp
ret
lea eax, [esi + 0x100]
push ecx
push eax
call fcn.10070eb0
add esp, 8
mov eax, dword [esi + 0x108]
jmp 0x10069bb1
xor eax, eax
dec eax
jmp 0x10069bc4

Function at 0x10069c30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x10069cd3
test byte [esi + 0xe0], 8
jne 0x10069ccc
mov dword [esp], esi
call fcn.10152400
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call dword [sym.imp.mozglue.dll_free]
xor edi, edi
mov dword [esi + 0x24], edi
mov ecx, esi
call fcn.10063f80
mov dword [esp], esi
call fcn.10069cf0
mov eax, dword [0x101f25a4]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
cmp dword [esi + 0xf0], edi
jne 0x10069cb4
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call dword [sym.imp.mozglue.dll_free]
mov dword [esi + 0x10], 0
lea eax, [esi + 0x40]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.mozglue.dll_free]
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov esi, eax
jmp 0x10069c53
Function at 0x1006b360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov edi, dword [ecx + 0xc]
test edi, edi
jne 0x1006b421
push esi
push dword [ecx + 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test eax, eax
je 0x1006b3a2
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp dword [0x101f2f50], 0
je 0x1006b457
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1006b409
mov dword [eax + 0x28], 0xffffe8a9
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
call dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [ebp - 0x20]
push eax
push str.error__d
push 0x14
push esi
call sym.nss3.dll_PR_snprintf
add esp, 0x10
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push esi
push eax
call sym.nss3.dll_PR_SetErrorText
add esp, 8
xor esi, esi
jmp 0x1006b38f
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x1006b3c7
mov eax, dword [edi]
test eax, eax
je 0x1006b441
add edi, 8
push eax
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x1006b44f
mov eax, dword [edi]
add edi, 8
test eax, eax
jne 0x1006b42a
push 0
push 0xffffe8a9
call sym.nss3.dll_PR_SetError
jmp 0x1006b402
mov esi, dword [edi - 4]
jmp 0x1006b38f
call fcn.100029d0
jmp 0x1006b3b7

Function at 0x1006b500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp dword [0x101f2f50], 0
je 0x1006b57d
mov edi, dword [ebp + 8]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1006b563
test edi, edi
je 0x1006b584
mov eax, dword [esi + 0x38]
cmp dword [esi + 0x34], edi
jg 0x1006b54b
lea ebx, [edi + 0x1f]
test eax, eax
jne 0x1006b5a6
push ebx
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
mov dword [esi + 0x38], eax
test eax, eax
je 0x1006b59b
mov dword [esi + 0x34], ebx
lea ecx, [edi + 1]
push ecx
push dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x30], edi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1006b524
call fcn.100029e0
jmp 0x1006b50f
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1006b59b
push eax
call sym.nss3.dll_PR_Free
add esp, 4
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
xor edi, edi
jmp 0x1006b55b
push eax
call sym.nss3.dll_PR_Free
add esp, 4
jmp 0x1006b537
Function at 0x1006d800
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x1006d947
xor edi, edi
mov esi, dword [sym.imp.kernel32.dll_TlsSetValue]
push edi
push dword [0x101f25a4]
call esi
push edi
push dword [0x101f2598]
call esi
push 0x144
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
test eax, eax
je 0x1006d93d
mov esi, eax
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
cmovle eax, edi
cmp eax, 3
mov ecx, 3
cmovl ecx, eax
mov ebx, dword [ebp + 0x10]
mov dword [esi + 4], ecx
mov dword [esi + 0x10], ebx
mov dword [esi], 2
lea eax, [esi + 0xc8]
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
lea eax, [esi + 0x40]
mov dword [ebp - 0x10], eax
push eax
call sym.nss3.dll__PR_MD_NEW_LOCK
add esp, 4
cmp eax, 0xffffffff
je 0x1006d94b
mov edi, dword [ebp + 0x14]
push esi
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
or edi, 0x84
mov dword [esi + 0xe0], edi
test ebx, ebx
jne 0x1006d8d5
push 0x2c
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
mov dword [esi + 0x10], eax
test eax, eax
je 0x1006d957
mov eax, esi
add eax, 0xb8
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
push esi
call fcn.10063e00
add esp, 4
cmp eax, 0xffffffff
je 0x1006d969
mov ebx, dword [ebp + 8]
push 0
push dword [0x101f2598]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push dword [0x101f2598]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x1006d991
mov eax, 0x101f2f60
cmp ebx, 1
je 0x1006d9b4
inc dword [eax]
push dword [0x101f2598]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x1006d9c5
mov edi, esi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, eax
jmp 0x1006d93d
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x1006d93d
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.mozglue.dll_free]
jmp 0x1006d98a
mov edi, dword [sym.imp.mozglue.dll_free]
push dword [esi + 0x10]
call edi
add esp, 4
mov dword [esi + 0x10], 0
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push esi
call edi
add esp, 4
xor edi, edi
jmp 0x1006d93d
mov edi, dword [0x101f2fd8]
call fcn.10155630
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
jmp 0x1006d917
or byte [esi + 0xe0], 1
mov eax, 0x101f2f5c
jmp 0x1006d925
mov edi, dword [0x101f2fd8]
call fcn.10155630
cmp dword [edi + 8], eax
jne 0x1006d93b
mov dword [edi + 8], 0
add edi, 0x1c
push edi
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 4
jmp 0x1006d93b
Function at 0x100716a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x98
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 8], eax
lea esi, [ebp - 0x98]
push 0x90
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi - 4], 0x94
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x10071735
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0x8c]
cmp esi, 2
jne 0x10071749
xor esi, esi
cmp edx, 5
je 0x1007176f
cmp edx, 2
jne 0x1007171f
push dword [ebp - 0x94]
push dword [ebp - 0x98]
push 0x101cf7a9
push ecx
push eax
call sym.nss3.dll_PR_snprintf
add esp, 0x14
jmp 0x10071784
cmp edx, 1
jne 0x10071784
push str.Windows_NT
push ecx
push eax
call sym.nss3.dll_PR_snprintf
add esp, 0xc
jmp 0x10071784
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10128810
add esp, 4
xor esi, esi
dec esi
jmp 0x10071784
cmp esi, 1
jne 0x10071799
xor esi, esi
cmp edx, 5
je 0x1007176f
cmp edx, 2
je 0x10071702
cmp edx, 1
jne 0x10071784
cmp dword [ebp - 0x98], 4
jbe 0x100717cf
push str.Windows_98
jmp 0x10071729
push dword [ebp - 0x90]
push 0x101cfd18
push ecx
push eax
call sym.nss3.dll_PR_snprintf
add esp, 0x10
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 0x98
pop esi
pop ebp
ret
cmp edx, 2
je 0x100717b6
cmp edx, 1
jne 0x100717bf
push str.Windows_Unknown
push ecx
push eax
call sym.nss3.dll_PR_snprintf
add esp, 0xc
xor esi, esi
jmp 0x10071784
xor esi, esi
push esi
push esi
jmp 0x1007170e
xor esi, esi
cmp edx, 5
jne 0x10071784
test ecx, ecx
je 0x10071784
mov byte [eax], 0
jmp 0x10071784
jne 0x100717da
cmp dword [ebp - 0x94], 0
jne 0x10071768
push str.Windows_95
jmp 0x10071729