joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d63a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x101d2014]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea ebx, [ebp - 0x24]
lea edi, [ebp - 0x20]
mov edx, 0x101d3b08
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [edi], eax
mov dword [ebx], eax
push ebx
push edi
call fcn.100d49d0
add esp, 8
test eax, eax
je 0x100d640f
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov esi, eax
xor edi, edi
test esi, esi
jne 0x100d63fb
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.100d41f0
add esp, 4
xor edi, edi
dec edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov dword [eax], 0xc
mov dword [eax + 4], edi
mov dword [eax + 8], 0
push eax
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov ebx, dword [ebp - 0x24]
mov esi, eax
test edi, edi
je 0x100d6440
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
test ebx, ebx
je 0x100d63e3
push ebx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x100d63e3

Function at 0x100d6450
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x100d6476
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.100d41f0
add esp, 4
xor eax, eax
dec eax
pop ebp
ret

Function at 0x100d6480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push 0xffffffffffffffff
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_LockFile]
test eax, eax
je 0x100d649f
mov eax, esi
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push eax
call fcn.100d41f0
add esp, 4
mov eax, dword [0x101d4d9c]
xor esi, esi
dec esi
cmp dword [eax + 4], 2
jl 0x100d6499
push edi
push str._PR_MD_LOCKFILE___failed._Error:__d
call sym.nss3.dll_PR_LogPrint
add esp, 8
jmp 0x100d6499
Function at 0x100d6650
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x140], eax
lea eax, [esi + 0xdc]
mov ecx, dword [esi + 0x10]
push eax
push 0x10004
push esi
push 0x100d6710
push dword [ecx + 0x1c]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
test eax, eax
mov dword [esi + 0x108], eax
je 0x100d66fe
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 0xdc]
cmp ecx, 1
mov dword [esi + 0x10c], edx
jne 0x100d66bc
push dword [esi + 0x108]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
neg eax
pop esi
pop ebp
ret
cmp ecx, 4
mov edx, 3
cmovl edx, ecx
xor ecx, ecx
test edx, edx
cmovns ecx, edx
dec ecx
xor edx, edx
dec edx
cmp ecx, 3
cmovb edx, ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
test eax, eax
jne 0x100d66a1
mov eax, dword [0x101d4d74]
cmp dword [eax + 4], 4
jl 0x100d66a1
push str.PR_SetThreadPriority:_cant_set_thread_priority_n
call sym.nss3.dll_PR_LogPrint
add esp, 4
jmp 0x100d66a1
xor eax, eax
dec eax
jmp 0x100d66b9

Function at 0x100d6950
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0x108]
call dword [sym.imp.kernel32.dll_SuspendThread]
pop ebp
ret

Function at 0x100d6970
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax + 0x108]
call dword [sym.imp.kernel32.dll_ResumeThread]
pop ebp
ret

Function at 0x100d6990
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2738
jne 0x100d69b0
push 0x2738
push 0xffffe89d
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.100d41f0

Function at 0x100d69c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x273d
je 0x100d69db
cmp eax, 0x2726
jne 0x100d69ec
mov ecx, 0xffffe8d5
jmp 0x100d69e0
mov ecx, 0xffffe8b0
push eax
push ecx
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.100d41f0

Function at 0x100d6a00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, 0xffffe8d2
cmp esi, 0x2733
jne 0x100d6a50
cmp dword [0x101d4d40], 0
je 0x100d6a5f
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d6a3f
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
pop esi
pop edi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100d6a2e
cmp esi, 0x274c
jne 0x100d6a66
mov edi, 0xffffe89a
jmp 0x100d6a15
call sym.nss3.dll_PR_Init
jmp 0x100d6a1e
cmp esi, 0x2726
jne 0x100d6a75
mov edi, 0xffffe8d3
jmp 0x100d6a15
pop esi
pop edi
pop ebp
jmp fcn.100d41f0

Function at 0x100d6a80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2726
jne 0x100d6aa0
push 0x2726
push 0xffffe8b1
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.100d41f0
Function at 0x100d6ab0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2726
jne 0x100d6ad0
push 0x2726
push 0xffffe8d5
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.100d41f0

Function at 0x100d6ae0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2736
jne 0x100d6b00
push 0x2736
push 0xffffe891
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.100d41f0

Function at 0x100d6b60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
cmp dword [0x101d4d40], 0
je 0x100d6ba6
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d6b95
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
pop esi
pop edi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100d6b84
call fcn.100da0a0
jmp 0x100d6b6e

Function at 0x100d9a90
Capabilities:
Get thread local storage value
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
cmp dword [0x101d4d40], 0
je 0x100d9b0e
mov ebx, dword [0x101d4d44]
test ebx, ebx
je 0x100d9af1
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100d9afb
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
mov ebx, dword [0x101d4d44]
push edi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov esi, eax
test ebx, ebx
je 0x100d9aea
push ebx
call sym.nss3.dll_PR_Unlock
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100d9abe
call fcn.100da0a0
jmp 0x100d9aa2

Function at 0x100d9b20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
cmp dword [0x101d4d40], 0
je 0x100d9ba4
push 0x3d
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
je 0x100d9bab
mov ebx, dword [0x101d4d44]
test ebx, ebx
je 0x100d9b6a
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100d9b91
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
push edi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
add esp, 4
mov esi, eax
mov eax, dword [0x101d4d44]
test eax, eax
je 0x100d9b88
push eax
call sym.nss3.dll_PR_Unlock
add esp, 4
neg esi
sbb eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100d9b5d
call fcn.100da0a0
jmp 0x100d9b32
xor eax, eax
dec eax
jmp 0x100d9b8c
Function at 0x100d9c20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x101d4d40], 0
je 0x100d9c52
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100d9c41
mov eax, dword [eax + 0x28]
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100d9c3c
call fcn.100da0a0
jmp 0x100d9c2c

Function at 0x100da8d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d39f0

Function at 0x100da950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d4030

Function at 0x100da960
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
cmp dword [0x101d4d40], 0
je 0x100daa05
cmp dword [edi], 0
je 0x100da98d
cmp dword [edi + 8], 0
jne 0x100daa0f
mov eax, dword [edi + 8]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
inc eax
xchg dword [edi + 4], eax
test eax, eax
jne 0x100daa28
mov ecx, dword [ebp + 0xc]
call dword [section..00cfg]
call ecx
mov dword [edi + 8], eax
mov ebx, dword [0x101d5704]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100da9f2
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
mov dword [edi], 1
push dword [0x101d5708]
call sym.nss3.dll_PR_NotifyAllCondVar
add esp, 4
push dword [0x101d5704]
call sym.nss3.dll_PR_Unlock
add esp, 4
jmp 0x100da985
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100da9c1
call fcn.100da0a0
jmp 0x100da976
call sym.nss3.dll_PR_GetCurrentThread
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe8db
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x100da985
push dword [0x101d5704]
call sym.nss3.dll_PR_Lock
add esp, 4
cmp dword [edi], 0
jne 0x100da9e2
push 0xffffffffffffffff
push dword [0x101d5708]
call sym.nss3.dll_PR_WaitCondVar
add esp, 8
jmp 0x100daa36
Function at 0x100daa50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
cmp dword [0x101d4d40], 0
je 0x100daaf4
cmp dword [edi], 0
jne 0x100daafe
xor eax, eax
inc eax
xchg dword [edi + 4], eax
test eax, eax
jne 0x100dab1a
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov dword [edi + 8], eax
mov ebx, dword [0x101d5704]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100daae1
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
mov dword [edi], 1
push dword [0x101d5708]
call sym.nss3.dll_PR_NotifyAllCondVar
add esp, 4
push dword [0x101d5704]
call sym.nss3.dll_PR_Unlock
add esp, 4
mov eax, dword [edi + 8]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100daaaa
call fcn.100da0a0
jmp 0x100daa66
cmp dword [edi + 8], 0
je 0x100daad9
call sym.nss3.dll_PR_GetCurrentThread
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe8db
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x100daad9
push dword [0x101d5704]
call sym.nss3.dll_PR_Lock
add esp, 4
cmp dword [edi], 0
jne 0x100daacb
push 0xffffffffffffffff
push dword [0x101d5708]
call sym.nss3.dll_PR_WaitCondVar
add esp, 8
jmp 0x100dab28

Function at 0x100dae10
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
mov eax, dword [0x101d2014]
mov esi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [0x101d4d40], 0
jne 0x100dae31
call fcn.100da0a0
push esi
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x100dae70
mov edi, 0xffffe8ab
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
xor esi, esi
mov dword [eax + 0x30], 0
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebp
ret
lea esi, [ebp + 0x10]
lea edx, [ebp + 0xc]
mov ecx, eax
push dword [ebp + 0x14]
push 0
push esi
call fcn.100daea0
add esp, 0xc
xor esi, esi
mov edi, 0xffffe8aa
test eax, eax
jne 0x100dae48
jmp 0x100dae5d
Function at 0x100db170
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [0x101d2014]
movzx esi, word [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x101d4d40], 0
jne 0x100db193
call fcn.100da0a0
cmp si, 0x17
je 0x100db19f
cmp si, 2
jne 0x100db1e1
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x100db1ea
mov edi, 0xffffe8ab
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
xor esi, esi
mov dword [eax + 0x30], 0
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
mov edi, 0xffffe89d
jmp 0x100db1b8
xor ebx, ebx
cmp si, 0x17
lea esi, [ebp + 0x18]
lea edx, [ebp + 0x14]
mov ecx, eax
sete bl
push dword [ebp + 0x1c]
push ebx
push esi
call fcn.100daea0
add esp, 0xc
xor esi, esi
mov edi, 0xffffe8aa
test eax, eax
jne 0x100db1b8
jmp 0x100db1cd
Function at 0x100dbe70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov eax, dword [0x101d2014]
mov edi, dword [ebp + 8]
xor eax, ebp
mov dword [esp + 0x98], eax
cmp dword [0x101d4d40], 0
je 0x100dbf21
test edi, edi
je 0x100dbedf
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100dbedf
cmp byte [edi], 0
je 0x100dbedf
push 0x25
push edi
call sub.VCRUNTIME140.dll_strchr
add esp, 8
test eax, eax
jne 0x100dbf2b
mov ecx, edi
mov edx, esi
call fcn.100dc050
mov esi, eax
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [0x101d4d40], 0
je 0x100dc03c
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100dbf10
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x28], 0xffffe89d
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
jmp 0x100dbec7
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100dbefc
call fcn.100da0a0
jmp 0x100dbe9d
push 0x100cbaa0
push 0x101d4b6c
call sym.nss3.dll_PR_CallOnce
add esp, 8
test eax, eax
jne 0x100dbebc
test byte [0x101d4b78], 1
je 0x100dbebc
mov ecx, dword [0x101d4d88]
xor eax, eax
lea ebx, [esp + 4]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x1c], eax
mov dword [ebx], 4
mov dword [ebx + 4], eax
mov dword [ebx + 8], 1
call dword [section..00cfg]
lea eax, [esp + 0x24]
push eax
push ebx
xor eax, eax
push eax
push edi
call ecx
test eax, eax
je 0x100dbfb2
mov edi, eax
call sym.nss3.dll_PR_GetCurrentThread
xor esi, esi
mov dword [eax + 0x28], 0xffffe89d
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], 0
jmp 0x100dbf0d
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x28]
mov ebx, dword [edi + 0x18]
push dword [edi + 0x10]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movzx eax, word [ebx]
cmp ax, 2
je 0x100dbffd
cmp ax, 0x17
jne 0x100dc01f
mov word [esi], 0x17
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x38]
movsd qword [esi + 8], xmm0
movsd qword [esi + 0x10], xmm1
mov eax, dword [esp + 0x40]
mov dword [esi + 0x18], eax
jmp 0x100dc009
mov word [esi], 2
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], eax
xor esi, esi
mov ecx, dword [0x101d4d8c]
call dword [section..00cfg]
push edi
call ecx
jmp 0x100dbec7
call sym.nss3.dll_PR_GetCurrentThread
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe89d
xor esi, esi
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
mov edi, dword [esp + 0x24]
jmp 0x100dc00b
call fcn.100da0a0
jmp 0x100dbeec
Function at 0x100dca00
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x101d2014]
lea esi, [ebp - 0x2c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov esi, dword [esi + 0x14]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret

Function at 0x100dca30
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x101d2014]
xor eax, ebp
mov dword [esp + 0x44], eax
mov eax, esp
mov dword [eax], 0x40
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov esi, eax
test eax, eax
mov edi, eax
je 0x100dca65
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0x44]
xor ecx, ebp
call fcn.10192ef0
mov eax, edi
mov edx, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x100df720
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100df74b
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
pop esi
pop edi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100df73a
Function at 0x100e09b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100e0a5e
mov ebx, dword [edi]
cmp dword [ebx + 8], eax
jne 0x100e0a72
mov ecx, dword [ebx + 0x34]
add edi, 0x74
add ebx, 0x34
xor esi, esi
test ecx, ecx
jg 0x100e0a08
xor eax, eax
lea eax, [eax + eax*2]
inc ecx
mov dword [ebx + eax*4 + 8], 1
mov dword [ebx + eax*4 + 4], edi
mov dword [ebx], ecx
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
mov eax, ebx
inc edx
mov ebx, eax
mov eax, edx
test ecx, ecx
lea edx, [ebx + 8]
cmovg eax, ecx
mov dword [ebp - 0x10], edx
mov edx, eax
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x10]
cmp dword [edx - 4], edi
je 0x100e0a77
mov edx, dword [ebp - 0x14]
add dword [ebp - 0x10], 0xc
dec edx
jne 0x100e0a1e
cmp ecx, 6
jl 0x100e09ec
mov eax, dword [ebx + 0x4c]
test eax, eax
jne 0x100e0a4f
push 0x50
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
mov dword [ebx + 0x4c], eax
mov ecx, dword [eax]
mov edx, 1
test ecx, ecx
jg 0x100e0a0d
mov ebx, eax
jmp 0x100e09ea
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100e09d0
xor esi, esi
dec esi
jmp 0x100e09fe
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x100e09fe
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ecx], eax
jmp 0x100e09fe

Function at 0x100e0b40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100e0bb5
mov ecx, edi
mov edi, dword [edi]
xor eax, eax
dec eax
cmp dword [edi + 8], esi
jne 0x100e0bb0
mov eax, dword [esi + 0xe0]
mov ebx, 0x1002
and eax, ebx
cmp eax, 2
je 0x100e0bc8
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov dword [esi + 0xd8], ecx
xor ecx, ecx
mov dword [edi + 8], ecx
lea ecx, [edi + 0x1c]
add edx, 0x74
push eax
push ecx
push edx
call sym.nss3.dll__PR_MD_WAIT_CV
xor eax, eax
add esp, 0xc
mov dword [esi + 0xd8], eax
mov dword [edi + 8], esi
and ebx, dword [esi + 0xe0]
cmp ebx, 2
je 0x100e0bc8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100e0b5b
push 0
push 0xffffe897
call sym.nss3.dll_PR_SetError
add esp, 8
and byte [esi + 0xe0], 0xfd
xor eax, eax
dec eax
jmp 0x100e0bb0

Function at 0x100e0d00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100e0d33
mov ecx, dword [esi]
cmp dword [ecx + 8], eax
jne 0x100e0d44
add ecx, 0x1c
add esi, 0x74
push ecx
push esi
call sym.nss3.dll__PR_MD_NOTIFYALL_CV
add esp, 8
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100e0d17
xor eax, eax
dec eax
jmp 0x100e0d30
Function at 0x100e0fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100e1109
mov ebx, dword [esi + 0xe8]
test ebx, ebx
je 0x100e115d
lea eax, [ebx + 4]
cmp dword [ebx + 4], eax
jne 0x100e116c
mov edi, dword [0x101d4dcc]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100e111d
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
mov edi, dword [ebp + 8]
cmp dword [edi], 5
jne 0x100e1089
mov esi, dword [0x101d4dcc]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100e1133
cmp dword [esi + 8], eax
jne 0x100e106b
mov dword [esi + 8], 0
add esi, 0x1c
push esi
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 4
xor eax, eax
inc eax
mov dword [edi], eax
push 0
push eax
push dword [edi + 0x100]
call dword [sym.imp.kernel32.dll_ReleaseSemaphore]
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebx + 0x74]
mov dword [ebp - 0x10], eax
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100e1147
mov edi, dword [ebx]
mov ecx, 0x1002
cmp dword [edi + 8], esi
jne 0x100e10fb
mov eax, dword [esi + 0xe0]
and eax, ecx
cmp eax, 2
je 0x100e1174
xor eax, eax
mov dword [esi + 0xd8], ebx
mov dword [edi + 8], eax
lea eax, [edi + 0x1c]
push 0xffffffffffffffff
push eax
push dword [ebp - 0x10]
call sym.nss3.dll__PR_MD_WAIT_CV
add esp, 0xc
xor eax, eax
mov ecx, 0x1002
mov dword [esi + 0xd8], eax
mov dword [edi + 8], esi
mov eax, dword [esi + 0xe0]
and eax, ecx
cmp eax, 2
je 0x100e1174
mov edi, dword [ebp + 8]
cmp dword [edi], 5
je 0x100e1039
jmp 0x100e108f
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100e0fee
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100e1024
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x100e1053
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x100e10a5
push 0
push 0xffffe89d
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
jmp 0x100e1081
push 0
push 0xffffe897
call sym.nss3.dll_PR_SetError
add esp, 8
and byte [esi + 0xe0], 0xfd
jmp 0x100e10fb

Function at 0x100e15e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d5280