Function at 0x10012840
Capabilities:
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [esp + 0xf0], eax
cmp byte [ecx + 0x14], 0
je 0x10013439
mov esi, edx
mov dword [esp + 0xc], ecx
test byte [ecx + 0x10], 4
jne 0x1001289e
mov edx, esi
mov edi, edx
movzx eax, byte [edx]
cmp eax, 0xff
je 0x1001336b
mov edx, edi
cmp eax, 0xeb
je 0x10013381
cmp edi, edx
jne 0x10012875
cmp edi, esi
jne 0x10013543
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], 0
mov eax, dword [0x100a6a68]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x10012908
push 0x100a6a68
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a68], 0xffffffff
jne 0x10012908
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x100a6a64], eax
push 0x100a6a68
call fcn.1004fb5e
add esp, 4
mov esi, dword [0x100a6a64]
xor edi, edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], edi
mov eax, dword [0x100a6a70]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10012edb
push 0x100a6a74
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp byte [esp + 0x48], 0
mov dword [esp], esi
jne 0x1001344e
mov dword [esp + 4], 0
mov esi, dword [0x100a6a60]
test esi, esi
jne 0x10012988
mov ebx, 0xc
push ebx
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], ebx
mov dword [0x100a6a60], esi
cmp byte [esp + 0x48], 0
jne 0x10013485
cmp dword [esi + 4], 0
jne 0x100129ed
push 0x14
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x100129be
mov ecx, esi
call fcn.10013c40
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
mov ecx, dword [esi]
mov dword [ecx + eax*4 + 4], edi
mov edx, dword [esp + 4]
mov dword [ecx + eax*4], edx
mov dword [ecx + eax*4 + 8], ebx
inc dword [esi + 4]
mov esi, dword [0x100a6a60]
test esi, esi
je 0x10013424
cmp dword [esi + 4], 0
je 0x10013424
mov ebx, dword [esi]
mov edi, dword [ebx + 8]
test edi, edi
mov esi, dword [esp]
je 0x10013825
test esi, esi
je 0x10013825
cmp dword [edi + 4], 0
jne 0x10012ed3
mov eax, dword [0x100a6a68]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x10012a68
push 0x100a6a68
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a68], 0xffffffff
jne 0x10012a68
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov esi, dword [esp]
mov dword [0x100a6a64], eax
push 0x100a6a68
call fcn.1004fb5e
add esp, 4
mov ebx, dword [0x100a6a64]
mov eax, esi
xor edx, edx
div ebx
sub ebx, edx
test edx, edx
cmove ebx, edx
add ebx, esi
lea esi, [edi + 8]
mov dword [edi + 8], ebx
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
cmp byte [esp + 0x48], 0
jne 0x10013754
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
je 0x10013818
mov dword [edi + 4], eax
cmp dword [esi], 0
je 0x10013825
push 0x100a6a74
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [0x100a6a70]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10012f23
push 0x100a6a74
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [edi + 4]
test eax, eax
je 0x10013825
mov esi, dword [edi + 0x10]
shl esi, 7
mov edx, esi
or edx, 0x7f
mov ecx, dword [edi + 0xc]
cmp edx, ecx
jb 0x10012b84
cmp ecx, dword [edi + 8]
jae 0x10013825
mov eax, dword [0x100a6a5c]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100132d5
mov eax, dword [edi + 4]
add eax, dword [edi + 0xc]
push 0x20
push 0x1000
push dword [0x100a6a58]
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
je 0x10013825
mov eax, dword [0x100a6a5c]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10013317
mov eax, dword [0x100a6a58]
add dword [edi + 0xc], eax
mov eax, dword [edi + 4]
add esi, eax
lea eax, [esp + 0x9c]
mov dword [eax - 4], edi
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, 0x80
mov dword [eax + 0x14], ecx
mov byte [eax + 0x18], 1
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x10013554
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0xa4]
test ecx, ecx
je 0x10013564
mov esi, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov bl, byte [esp + 0xb4]
mov byte [esp + 4], bl
mov dword [esp], eax
test eax, eax
mov dword [esp + 0x10], esi
je 0x10012c0b
test edx, edx
je 0x10012c0b
test esi, esi
je 0x10012c0b
cmp byte [esp + 4], 0
je 0x10012c0b
inc dword [edi + 0x10]
mov dword [esp + 0x40], ecx
mov esi, dword [esp]
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edx
mov ebx, dword [esp + 0xa8]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xac]
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], eax
mov edi, dword [esp + 0xb0]
mov dword [esp + 0x58], edi
mov byte [esp + 0x60], 1
push 0x100a6a74
mov dword [esp + 0x20], edx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x38], edi
mov edi, eax
mov al, byte [esp + 4]
mov byte [esp + 0x3c], al
xor esi, esi
mov dword [esp + 0x44], esi
mov byte [esp + 0x5c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test edi, edi
je 0x10013589
cmp dword [esp], 0
mov ebx, dword [esp + 0x14]
je 0x1001323a
test edx, edx
je 0x1001323a
test ecx, ecx
je 0x1001323a
cmp byte [esp + 4], 0
je 0x1001323a
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_EncodePointer]
lea ecx, [ebx + 4]
cmp ecx, dword [esp + 0x18]
ja 0x100135c0
mov ecx, dword [esp]
mov dword [ecx + ebx], eax
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x30]
add ebx, 4
mov dword [esp + 0x30], ebx
mov dword [esp + 4], eax
test eax, eax
je 0x100135d8
mov al, byte [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x1001323a
test edx, edx
je 0x1001323a
test ecx, ecx
je 0x1001323a
test al, al
je 0x1001323a
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x70]
mov dword [esp], eax
add eax, edi
push eax
call dword [sym.imp.kernel32.dll_EncodePointer]
lea esi, [ebx + 4]
cmp dword [esp + 4], 0
je 0x100135e5
cmp esi, dword [esp + 0x38]
ja 0x10013628
mov ecx, dword [esp + 0x28]
mov dword [ecx + ebx], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add esi, 4
mov dword [esp + 0x30], esi
mov dword [esp + 4], eax
test eax, eax
je 0x100135e9
mov al, byte [esp + 0x3c]
cmp dword [esp + 0x28], 0
je 0x1001322e
cmp dword [esp + 0x2c], 0
je 0x1001322e
cmp dword [esp + 0x24], 0
je 0x1001322e
test al, al
je 0x1001322e
mov dword [esp + 0x34], esi
xor eax, eax
dec eax
cmp edi, 4
ja 0x10012f6b
mov dword [esp + 0xc], eax
xor eax, eax
mov ebx, edi
mov ecx, dword [esp]
movzx ecx, byte [ecx + ebx]
cmp ecx, 0x65
jg 0x10012e07
lea edx, [ecx - 0x2e]
cmp edx, 0x10
ja 0x10012dfa
mov edi, 0x10101
bt edi, edx
jb 0x10013359
add ecx, 0xffffff9c
cmp ecx, 2
jae 0x10012e2d
jmp 0x10013359
cmp ecx, 0x66
je 0x10013406
cmp ecx, 0x67
je 0x10013415
add ecx, 0xffffff10
cmp ecx, 3
ja 0x10012e2d
cmp ecx, 1
jne 0x1001373e
test al, 0xc
jne 0x1001322e
mov edx, dword [esp]
movzx eax, byte [edx + ebx]
mov ecx, eax
and cl, 0xfc
cmp cl, 0x88
jne 0x10012e72
movzx eax, byte [edx + ebx + 1]
mov edi, eax
shr edi, 6
xor edx, edx
inc edx
cmp edi, 3
jne 0x100133c9
lea edi, [edx + ebx]
inc edi
mov dword [esp + 0x70], edi
cmp edi, 5
jb 0x10012dd4
jmp 0x10012f6f
cmp eax, 0xa0
jg 0x10012e8c
cmp eax, 0xf
je 0x10013837
cmp eax, 0x33
jne 0x10012ea2
jmp 0x10013862
cmp eax, 0xa1
je 0x100133c1
cmp eax, 0xb8
je 0x100133c1
mov ecx, eax
and cl, 0xf8
cmp cl, 0x40
je 0x10012ece
cmp eax, 0x68
je 0x100133c1
cmp eax, 0x83
je 0x10013683
mov ecx, eax
and cl, 0xf0
cmp cl, 0x50
jne 0x1001369a
inc ebx
mov edi, ebx
jmp 0x10012e60
lea esi, [edi + 8]
jmp 0x10012aaf
push 0x100a6a70
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a70], 0xffffffff
jne 0x1001293d
push 0x1000000
push 0xfa0
push 0x100a6a74
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionEx]
mov byte [0x100a6a6c], 1
push 0x100a6a70
call fcn.1004fb5e
add esp, 4
jmp 0x1001293d
push 0x100a6a70
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a70], 0xffffffff
jne 0x10012ae4
push 0x1000000
push 0xfa0
push 0x100a6a74
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionEx]
mov byte [0x100a6a6c], 1
push 0x100a6a70
call fcn.1004fb5e
add esp, 4
jmp 0x10012ae4
mov dword [esp + 0xc], eax
lea eax, [edi + esi]
cmp dword [esp + 4], 0
je 0x10013636
cmp eax, dword [esp + 0x38]
ja 0x1001365a
add esi, dword [esp + 0x28]
push edi
push dword [esp + 4]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, dword [esp + 0x30]
add esi, edi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
mov eax, esi
je 0x1001363a
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1001322e
cmp dword [esp + 0x2c], 0
je 0x1001322e
cmp dword [esp + 0x24], 0
je 0x1001322e
cmp byte [esp + 0x3c], 0
je 0x1001322e
cmp edi, 0x64
ja 0x1001322e
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x100136bb
mov ecx, dword [esp + 0x38]
cmp esi, ecx
jae 0x100136d8
mov byte [eax + esi], 0xe9
mov esi, dword [esp + 0x30]
inc esi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
je 0x1001364e
mov ecx, dword [esp + 0x38]
lea eax, [esi + 4]
cmp eax, ecx
ja 0x100136ce
mov eax, dword [esp]
add eax, edi
mov ecx, dword [esp + 0x2c]
add ecx, esi
sub eax, ecx
add eax, 0xfffffffc
mov ecx, dword [esp + 0x28]
mov dword [ecx + esi], eax
add dword [esp + 0x30], 4
cmp byte [esp + 0x3c], 0
je 0x1001322e
cmp dword [esp + 0x20], 0
je 0x1001322e
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
je 0x1001322e
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0xb8]
mov dword [ecx - 0x20], edx
mov eax, dword [esp]
mov dword [ecx - 0x1c], eax
mov dword [ecx - 0x18], edi
xor ebx, ebx
mov dword [ecx - 0x14], ebx
mov dword [ecx - 0x10], ebx
mov dword [ecx - 8], ebx
mov dword [ecx - 4], 0x10
mov dword [ecx - 0xc], ecx
mov byte [ecx + 0x10], 1
lea esi, [esp + 0xcc]
mov ecx, esi
push edi
push eax
call fcn.10013b10
add esp, 8
cmp dword [esi + 8], ebx
je 0x100131a7
cmp byte [esp + 0xc8], 0
je 0x100131a7
lea esi, [esp + 0xac]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x10013700
mov ecx, dword [esp + 0xac]
mov byte [ecx + eax], 0xe9
mov edi, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
inc eax
mov dword [esp + 0xb0], eax
inc edi
mov dword [esp + 0xa4], edi
add edi, dword [esp + 0x9c]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 0xb4]
ja 0x1001371e
mov ecx, dword [ebp + 8]
sub ecx, edi
add ecx, 0xfffffffc
mov edx, dword [esp + 0xac]
mov dword [edx + eax], ecx
mov eax, dword [esp + 0xb0]
add eax, 4
mov dword [esp + 0xb0], eax
add dword [esp + 0xa4], 4
cmp dword [esp + 0xd4], 0
je 0x100131a7
cmp byte [esp + 0xc8], 0
je 0x100131a7
test eax, eax
je 0x1001319e
mov ecx, dword [esp + 0xa8]
add ecx, dword [esp + 0x9c]
push eax
push dword [esp + 0xb0]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
xor esi, esi
push esi
push esi
push eax
call dword [sym.imp.kernel32.dll_FlushInstructionCache]
mov eax, dword [esp + 0xb0]
add dword [esp + 0xa8], eax
mov dword [esp + 0xb0], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [0x100a6a5c]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10013296
mov esi, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x10013202
mov edi, dword [0x100a6a58]
lea ebx, [esi + eax*8]
lea eax, [esp + 0x74]
push eax
push dword [esi]
push edi
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_VirtualProtect]
add esi, 8
cmp esi, ebx
jne 0x100131e3
mov esi, dword [esp + 0xd0]
lea eax, [esp + 0xdc]
mov dword [eax - 8], 0
cmp esi, eax
jne 0x100136e2
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0xb8]
cmp eax, ecx
jne 0x100136f1
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x100135f6
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
setne bl
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10013263
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10013263
lea edx, [esp + 0x24]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
cmp byte [esp + 0x60], 0
je 0x1001327e
mov eax, dword [esp + 0x48]
test eax, eax
je 0x1001327e
mov ecx, dword [esp + 0x44]
test ecx, ecx
jne 0x100135ab
mov ecx, dword [esp + 0xf0]
xor ecx, ebp
call fcn.1004fb50
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a5c], 0xffffffff
jne 0x100131c8
lea esi, [esp + 0x74]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x100a6a58], eax
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
jmp 0x100131c8
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a5c], 0xffffffff
jne 0x10012b36
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x100a6a58], eax
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
jmp 0x10012b36
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a5c], 0xffffffff
jne 0x10012b79
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x100a6a58], eax
push 0x100a6a5c
call fcn.1004fb5e
add esp, 4
jmp 0x10012b79
mov cl, 2
test al, 2
jne 0x1001322e
or al, cl
inc ebx
jmp 0x10012dd8
cmp byte [edi + 1], 0x25
mov edx, edi
jne 0x10012892
mov eax, dword [edi + 2]
mov edx, dword [eax]
jmp 0x10012892
movsx eax, byte [edi + 1]
add eax, edi
add eax, 2
mov ecx, eax
sub ecx, edi
shl ecx, 0x18
add ecx, 0xfe000000
mov edx, edi
test ecx, ecx
jle 0x10012892
sar ecx, 0x18
xor edx, edx
cmp byte [edx + edi + 2], 0x90
jne 0x1001374d
inc dl
movsx edx, dl
cmp ecx, edx
jg 0x100133a6
mov edx, eax
jmp 0x10012892
add ebx, 5
jmp 0x10012ecf
test edi, edi
jne 0x10013664
mov ecx, eax
and ecx, 7
cmp ecx, 5
je 0x10013673
cmp ecx, 4
jne 0x100138b4
mov ecx, dword [esp]
mov cl, byte [ecx + ebx + 2]
and cl, 7
xor edx, edx
cmp cl, 5
sete dl
lea ecx, [edx*4 + 1]
jmp 0x10013673
mov cl, 4
test al, 4
je 0x10013363
jmp 0x1001322e
mov cl, 8
test al, 8
je 0x10013363
jmp 0x1001322e
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_mPolicies___mPolicies__empty___
int3
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_isSome___
int3
lea esi, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], esi
mov dword [ecx + 4], 0
call fcn.1004f2c0
mov dword [esp + 4], eax
cmp byte [esi + 8], 0
je 0x1001295e
lea ecx, [esp + 0x40]
call fcn.10081980
mov edi, eax
jmp 0x1001295e
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov eax, ecx
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x100134d2
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], edx
mov ecx, dword [esp + 4]
shr edx, 1
lea eax, [edx + edx*2]
lea eax, [ebx + eax*4]
cmp dword [eax], ecx
jae 0x100134c9
add eax, 0xc
not edx
add edx, dword [esp + 8]
mov ebx, eax
mov dword [esp + 8], edx
test edx, edx
jg 0x100134a8
jmp 0x100134d2
jne 0x100134bf
cmp dword [eax + 4], edi
jb 0x100134b4
jmp 0x100134bf
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*2]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax*4]
cmp ebx, eax
je 0x100134f5
mov eax, dword [esp + 4]
cmp dword [ebx], eax
ja 0x100134f5
cmp dword [ebx + 4], edi
jae 0x100129ef
lea ecx, [esp + 0x98]
mov dword [ecx + 4], edi
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov edi, ecx
push 0x14
call sym.mozglue.dll_moz_xmalloc
add esp, 4
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov dword [edi + 8], eax
mov ecx, esi
mov edx, ebx
push edi
call fcn.10081830
add esp, 4
mov ebx, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x100129ef
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x100129ef
mov ecx, edi
call fcn.10053160
test al, al
cmovne esi, edi
jmp 0x1001289e
mov dword [esp + 0x9c], 0
jmp 0x10012bbf
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
mov al, byte [esp + 0xb4]
mov byte [esp + 4], al
jmp 0x10012c08
mov dword [esp + 4], 0
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_EncodePointer]
mov ebx, dword [esp + 0x14]
add ebx, 4
mov dword [esp + 0x30], ebx
jmp 0x10012d45
lea edx, [esp + 0x44]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
jmp 0x1001327e
mov byte [esp + 0x3c], 0
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [esp + 4], edi
mov edx, ecx
mov esi, dword [esp]
jmp 0x10012d25
mov dword [esp + 4], 0
jmp 0x10012d45
mov dword [esp + 0x30], esi
mov dword [esp + 4], 0
jmp 0x10012dc0
xor esi, esi
mov dword [esp + 0x30], esi
push esi
call dword [sym.imp.kernel32.dll_EncodePointer]
cmp dword [esp + 0x20], esi
je 0x10013af6
cmp dword [esp + 0x38], 3
jbe 0x10013b03
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
add dword [esp + 0x30], 4
jmp 0x1001323a
mov byte [esp + 0x3c], 0
xor eax, eax
mov esi, ebx
jmp 0x10012d97
mov dword [esp + 0x30], eax
cmp edi, 0x64
ja 0x1001322e
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x100136bb
inc eax
mov esi, eax
add esi, 4
mov dword [esp + 0x30], esi
jmp 0x10013041
mov byte [esp + 0x3c], 0
jmp 0x10012fb0
mov ecx, 2
cmp edi, 1
je 0x10013673
mov ecx, 5
and al, 7
xor edx, edx
cmp al, 4
sete dl
add edx, ecx
jmp 0x10012e5c
mov eax, dword [esp]
mov al, byte [eax + ebx + 1]
cmp al, 0xc0
jb 0x10013878
add ebx, 3
jmp 0x10012ecf
cmp al, 0xff
je 0x100138c8
cmp eax, 0xe9
je 0x100138bc
cmp eax, 0x6a
je 0x10013870
jmp 0x1001322e
mov eax, dword [esp + 0x34]
add ecx, eax
add ecx, 5
cmp ecx, dword [esp + 0x38]
jbe 0x10013898
mov byte [esp + 0x3c], 0
jmp 0x10013041
mov byte [esp + 0x3c], 0
jmp 0x1001301a
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x10013218
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x1001322e
xor edx, edx
inc edx
mov ecx, esi
call fcn.10081710
test al, al
je 0x10013a88
mov eax, dword [esp + 0xb0]
jmp 0x100130d6
mov ecx, esi
mov edx, 4
call fcn.10081710
test al, al
je 0x10013aa3
mov eax, dword [esp + 0xb0]
jmp 0x10013116
mov cl, 1
test al, 1
je 0x10013363
jmp 0x1001322e
mov edx, edi
jmp 0x10012892
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], eax
mov dword [ecx + 4], 0
call fcn.1004f2c0
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
cmp byte [eax + 8], 0
je 0x10013ab0
lea ecx, [esp + 0x40]
call fcn.10081980
mov dword [esp], eax
mov eax, dword [0x100a6a94]
mov ecx, dword [0x100a53c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10013ac5
mov ecx, dword [0x100a6a90]
test ecx, ecx
je 0x100138de
lea eax, [esp + 0x74]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [esp]
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
movaps xmm0, xmmword [0x10094120]
movups xmmword [esp + 0x98], xmm0
mov dword [esp + 0xa0], eax
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea edx, [esp + 0x9c]
push edx
push eax
push 0x2000
push ebx
xor eax, eax
push eax
push dword [esp + 0x1c]
call ecx
mov dword [edi + 4], eax
test eax, eax
jne 0x10012aaf
jmp 0x10013825
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [edi + 4], 0
push 0x100a6a74
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor ebx, ebx
jmp 0x1001327e
mov eax, dword [esp]
mov al, byte [eax + ebx + 1]
and al, 0xfe
cmp al, 0x10
jne 0x1001322e
lea eax, [ebx + 2]
lea ecx, [esp + 0x68]
mov dword [ecx + 8], eax
call fcn.10081bc0
lea edi, [ebx + eax]
add edi, 2
jmp 0x10012e60
mov eax, dword [esp]
cmp byte [eax + ebx + 1], 0xc0
jb 0x1001322e
add ebx, 2
jmp 0x10012ecf
mov ecx, eax
and cl, 0xc0
cmp cl, 0x40
jne 0x1001322e
and al, 7
cmp al, 4
je 0x1001322e
add ebx, 4
jmp 0x10012ecf
mov ecx, dword [esp + 0xc]
add ecx, eax
inc ecx
mov edx, dword [esp + 0x28]
add eax, dword [esp + 0x2c]
mov esi, dword [esp]
sub esi, eax
add dword [edx + ecx], esi
jmp 0x10013041
xor ecx, ecx
inc ecx
jmp 0x10013673
lea edi, [ebx + 5]
mov dword [esp + 0xc], ebx
jmp 0x10012e60
mov eax, dword [esp]
cmp byte [eax + ebx + 1], 0x25
jne 0x1001322e
add ebx, 6
jmp 0x10012ecf
mov eax, dword [esp]
inc eax
mov ecx, dword [esp + 4]
mov edx, ebx
mov dword [esp], eax
push eax
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.100819d0
add esp, 8
test eax, eax
je 0x1001381e
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x10012aac
jmp 0x10012a94
mov byte [esp + 0xc8], 0
mov edi, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
jmp 0x100130ff
mov byte [esp + 0xc8], 0
jmp 0x100131a7
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_isSome___
int3
push 0x100a6a94
call fcn.1004fb5e
add esp, 4
cmp dword [0x100a6a94], 0xffffffff
jne 0x100137b0
call fcn.10081b70
push 0x100a6a94
call fcn.1004fb5e
add esp, 4
jmp 0x100137b0
mov dword [esp + 0x30], 4
jmp 0x1001323a
mov byte [esp + 0x3c], 0
jmp 0x1001323a