joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014c8b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1014c8d0
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1014c8cb

Function at 0x1014cc60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edx, dword [ebp + 0x10]
test edx, edx
jle 0x1014cca7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0x18]
xor ebx, ebx
push 0
push edx
push ecx
mov edi, esi
push esi
mov esi, edx
call sub.wsock32.dll_send
cmp eax, 0xffffffff
je 0x1014ccab
add ebx, eax
cmp ebx, esi
mov eax, dword [ebp + 8]
jge 0x1014cca0
mov eax, dword [eax + 4]
cmp dword [eax + 4], 0
je 0x1014ccf1
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1014cca2
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1014cce3
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
cmp dword [ecx + 4], 0
jne 0x1014cce3
mov esi, edi
mov ecx, edi
mov edx, 2
push dword [ebp + 0x18]
call fcn.10077cb0
add esp, 4
test eax, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jns 0x1014cc7b
jmp 0x1014ccec
push eax
call fcn.1018a020
add esp, 4
xor eax, eax
dec eax
jmp 0x1014cca2
mov ecx, edi
mov edx, 2
push dword [ebp + 0x18]
call fcn.10077cb0
mov edx, esi
mov esi, edi
add esp, 4
mov ecx, eax
xor eax, eax
dec eax
test ecx, ecx
mov ecx, dword [ebp + 0xc]
jns 0x1014cc7b
jmp 0x1014cca2

Function at 0x1014cd20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101de200], 0
je 0x1014cd5e
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1014cd4c
mov eax, dword [eax + 0x28]
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1014cd44
call fcn.100745f0
jmp 0x1014cd2f

Function at 0x1014cd70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x1014cdab
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [edi + 8], esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
mov esi, eax
jmp 0x1014cd92

Function at 0x1014ce40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101de200], 0
je 0x1014ce7b
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1014ce69
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1014ce64
call fcn.100745f0
jmp 0x1014ce4f
Function at 0x1014cf20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
cmp dword [0x101de200], 0
je 0x1014cf73
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1014cf61
mov edx, dword [eax + 0x24]
xor ecx, ecx
test edx, edx
je 0x1014cf59
mov esi, dword [ebp + 8]
cmp dword [eax + 0x20], esi
jbe 0x1014cf59
mov ecx, dword [edx + esi*4]
mov eax, ecx
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1014cf45
call fcn.100745f0
jmp 0x1014cf30

Function at 0x1014dad1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1014dae0
pop dword [ebp - 0x4c]
mov eax, 0x2408d29f
add eax, 0xec0c0841
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x417c86cd
sub dword [ebp - 0x5c], 0xf32a4182
mov dword [ebp - 0x58], 0xc74f867d
add dword [ebp - 0x58], 0x6ae3c5c8
mov dword [ebp - 0x54], 0xfc785236
add dword [ebp - 0x54], 0x4fd3f1f8
mov dword [ebp - 0x50], 0x28687c3b
add dword [ebp - 0x50], 0xd79783c5
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x2213a530
add eax, 0xee09ebcc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x1652cb8
sub dword [ebp - 0x5c], 0x8cf2c362
mov dword [ebp - 0x58], 0xd60b5180
add dword [ebp - 0x58], 0x6b610ff5
mov dword [ebp - 0x54], 0xfd4f8951
sub dword [ebp - 0x54], 0x99e01ce5
mov dword [ebp - 0x50], 0x15ebe3e8
sub dword [ebp - 0x50], 0x15ebe3e8
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x4f12084c
sub eax, 0x3ef47748
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x34aea
push 0
call eax
mov ecx, 0xe042af31
add ecx, 0x1fbd91a1
mov ebx, eax
mov esi, 0x101f2e00
add esi, dword [ebp - 0x4c]
mov edx, 0xc8de54e0
sub edx, 0x2b3ae3fd
sub dword [ebp - 0x14], 0x6f589efb
mov edi, dword [esi]
xor dword [ebp - 0x34], eax
sub edi, edx
add dword [ebp - 0x34], edi
mov dword [ebx], edi
sub dword [ebp - 0xc], 0x5df7a433
add ebx, 4
add esi, 4
loop 0x1014dbfc
add eax, 0x8c680ec0
add eax, 0x7398e75b
xor ebx, ebx
add ebx, eax
add eax, 0xb0c26191
add eax, 0x4f3d9e74
mov ecx, 0x111de935
add ecx, 0xfee216cb
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1014eb00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 8]
mov byte [ecx + 0x10], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push edx
push edx
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ecx
call fcn.1001a670
add esp, 0x1c
test ebx, ebx
jne 0x1014eb41
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push esi
call fcn.1001a670
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1014f350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1014f360

Function at 0x1014f360
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 8], eax
lea esi, [ebp - 0x2c]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov esi, dword [esi + 0x1c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x28
pop esi
pop ebp
ret

Function at 0x1015c720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
mov ecx, edx
call fcn.1000e2e0
cmp eax, 0x10
je 0x1015c837
mov esi, eax
test eax, eax
jne 0x1015c83e
xor esi, esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x110]
test eax, eax
jne 0x1015c83e
mov eax, dword [edi + 0x74]
cmp byte [eax + 8], 0
je 0x1015c7e0
movzx ecx, word [eax + 0x18]
add dword [ebp - 0x14], ecx
adc dword [ebp - 0x10], 0
movsx ecx, byte [edi + 0x44]
test ecx, ecx
je 0x1015c848
mov word [edi + 0x32], 0
and byte [edi + 1], 0xf9
movzx edx, word [edi + ecx*2 + 0x46]
mov word [edi + 0x46], dx
dec cl
mov byte [edi + 0x44], cl
movsx ecx, cl
mov ecx, dword [edi + ecx*4 + 0x78]
mov dword [edi + 0x74], ecx
mov ecx, dword [eax + 0x48]
call fcn.1014e440
movzx ecx, word [edi + 0x46]
mov eax, dword [edi + 0x74]
cmp cx, word [eax + 0x18]
jae 0x1015c780
inc ecx
mov word [edi + 0x46], cx
movzx ecx, word [edi + 0x46]
cmp cx, word [eax + 0x18]
jne 0x1015c7f3
mov ecx, dword [eax + 0x38]
movzx eax, byte [eax + 9]
add eax, ecx
add eax, 8
jmp 0x1015c818
cmp byte [eax + 2], 0
jne 0x1015c7c8
movzx ecx, word [eax + 0x18]
add dword [ebp - 0x14], ecx
adc dword [ebp - 0x10], 0
jmp 0x1015c7c8
mov dword [ebp - 0x1c], ebx
movzx ebx, word [eax + 0x1a]
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 0x40]
movzx eax, word [eax + ecx*2]
push eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__byteswap_ushort
add esp, 4
and eax, ebx
mov ebx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x18]
push dword [eax]
call sub.api_ms_win_crt_utility_l1_1_0.dll__byteswap_ulong
add esp, 4
mov ecx, edi
mov edx, eax
call fcn.1014e4c0
test eax, eax
je 0x1015c75b
mov esi, eax
jmp 0x1015c83e
xor esi, esi
mov dword [ebx + 4], esi
mov dword [ebx], esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 4], eax
mov ecx, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1000e2e0
Function at 0x1015c870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
movzx eax, byte [ecx + 0x3b]
lea esi, [eax - 1]
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x38], 1
mov ecx, 0
cmp eax, 2
jb 0x1015c8d1
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
movzx eax, byte [ecx + 0x3a]
add eax, ebx
cdq
idiv esi
lea eax, [edx + edx*8]
lea ecx, [ecx + eax*8]
add ecx, 0x40
cmp dword [ecx + 4], 0
je 0x1015c8c1
mov edi, ecx
call fcn.1015c380
mov ecx, edi
test eax, eax
jne 0x1015c92a
cmp dword [ecx], 0
je 0x1015c8d0
inc ebx
mov eax, dword [ebp - 0x14]
cmp eax, ebx
jne 0x1015c899
jmp 0x1015c932
dec ebx
cmp ebx, esi
je 0x1015c932
mov ebx, dword [ecx + 0x14]
mov eax, ecx
mov esi, dword [ebp - 0x10]
sub eax, esi
add eax, 0xffffffc0
shr eax, 3
imul eax, eax, 0x39
mov byte [esi + 0x3a], al
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0x18], eax
movsd xmm0, qword [esi + 0x24]
mov edi, ecx
movsd qword [ecx + 0x10], xmm0
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
test ebx, ebx
jne 0x1015c94d
cmp dword [esi + 0x28], 0
je 0x1015c965
mov ecx, dword [esi + 0x34]
mov edx, ecx
sar edx, 0x1f
call fcn.10144e50
mov ecx, eax
mov dword [esi + 0x28], eax
mov eax, 7
test ecx, ecx
jne 0x1015c965
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + esi*8]
mov edx, dword [ebp - 0x10]
lea ecx, [edx + eax*8]
add ecx, 0x40
add edx, 0x24
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1015fe60
mov dword [esi + 0x28], ebx
mov ecx, dword [0x101db04c]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
mov dword [esi + 0x34], eax
mov ecx, edi
mov edx, 0x10160760
push edi
call fcn.10160170
add esp, 0xc
jmp 0x1015c92d
Function at 0x1015f460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, edx
je 0x1015f52a
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ecx
mov esi, dword [ecx + 0x70]
movzx eax, word [esi + 6]
lea eax, [eax + eax*4]
lea edx, [eax*8 + 0x38]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1015f531
push 0
call fcn.1014e1f0
add esp, 4
mov ebx, eax
test eax, eax
je 0x1015f53f
lea eax, [ebx + 0x10]
mov dword [ebx + 4], eax
mov dword [ebx], esi
movzx eax, word [esi + 6]
inc eax
mov word [ebx + 8], ax
mov ecx, esi
mov edx, dword [ebp - 0x14]
push ebx
push edi
call fcn.10017650
add esp, 8
movzx eax, word [ebx + 8]
test ax, ax
je 0x1015f4ed
cmp ax, word [esi + 8]
jbe 0x1015f546
push 0x101c47ed
push 0x102e9
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call sym.nss3.dll_sqlite3_log
add esp, 0x14
mov esi, 0xb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x70]
mov ecx, dword [eax + 0xc]
mov edx, ebx
call fcn.10139000
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
xor edx, edx
jmp fcn.10143e70
mov ecx, edx
xor edx, edx
call fcn.10144e50
jmp 0x1015f4b4
mov esi, 7
jmp 0x1015f520
mov esi, dword [ebp - 0x10]
mov ecx, esi
mov edx, ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call fcn.10143e70
mov ecx, esi
add esp, 0x10
mov esi, eax
jmp 0x1015f513
Function at 0x10160170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
mov dword [ecx], 0
mov ecx, 0x14
xor edx, edx
call fcn.10144e50
test eax, eax
je 0x10160220
mov ebx, eax
cmp byte [0x101db024], 0
je 0x101601ee
mov ecx, dword [0x101db120]
test ecx, ecx
je 0x101601bd
call dword [section..00cfg]
push 0xc8
call ecx
add esp, 4
test eax, eax
jne 0x101601ee
mov dword [ebx + 8], edi
mov eax, dword [ebp + 8]
mov dword [ebx + 0xc], eax
mov eax, ebx
add eax, 4
xor ecx, ecx
push eax
push ecx
push ebx
push 0x101980f0
push ecx
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x101601ee
cmp dword [ebx + 8], 0
jne 0x10160217
jmp 0x101601fb
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [ebx + 4], eax
mov ecx, edi
call dword [section..00cfg]
push dword [ebp + 8]
call edi
add esp, 4
mov dword [ebx + 0x10], eax
mov dword [esi], ebx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 7
jmp 0x1016021b
Function at 0x10189f70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2736
jne 0x10189f90
push 0x2736
push 0xffffe891
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10001070

Function at 0x10189fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10001070

Function at 0x10189fb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x273d
je 0x10189fcb
cmp eax, 0x2726
jne 0x10189fdc
mov ecx, 0xffffe8d5
jmp 0x10189fd0
mov ecx, 0xffffe8b0
push eax
push ecx
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10001070

Function at 0x10189ff0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2726
jne 0x1018a010
push 0x2726
push 0xffffe8b1
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10001070

Function at 0x1018a020
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2738
jne 0x1018a040
push 0x2738
push 0xffffe89d
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10001070

Function at 0x1018a050
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov edi, dword [eax + 0x18]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push ebx
push dword [ebp + 0xc]
push edi
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
jne 0x1018a0ae
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1018a0c5
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
jne 0x1018a0c5
mov ecx, edi
mov edx, 2
push dword [ebp + 0x20]
call fcn.10077cb0
add esp, 4
test eax, eax
jns 0x1018a06a
jmp 0x1018a0ce
mov ecx, dword [ebp - 0x10]
add ecx, eax
cmp ecx, ebx
jge 0x1018a0d9
mov eax, dword [esi + 4]
cmp dword [eax + 4], 0
jne 0x1018a0d9
mov dword [ebp - 0x10], ecx
jmp 0x1018a096
push eax
call fcn.1018a020
add esp, 4
xor eax, eax
dec eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, ecx
jmp 0x1018a0d1

Function at 0x1018a0e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
mov esi, dword [eax + 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sub.wsock32.dll_recvfrom
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1018a13e
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x1018a135
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
jne 0x1018a135
mov ecx, esi
xor edx, edx
inc edx
push dword [ebp + 0x20]
call fcn.10077cb0
add esp, 4
test eax, eax
jns 0x1018a0ef
jmp 0x1018a13e
push eax
call fcn.10189fa0
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1018a210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x2726
jne 0x1018a230
push 0x2726
push 0xffffe8d5
call sym.nss3.dll_PR_SetError
add esp, 8
pop ebp
ret
pop ebp
jmp fcn.10001070

Function at 0x1018a590
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1018a5b8
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10001070
add esp, 4
xor eax, eax
dec eax
pop ebp
ret

Function at 0x1018a5f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x20]
mov dword [edi], eax
lea ebx, [ebp - 0x24]
mov dword [ebx], eax
mov edx, 0x101dd098
push ebx
push edi
call fcn.1018f050
add esp, 8
test eax, eax
je 0x1018a65f
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov esi, eax
xor edi, edi
test esi, esi
jne 0x1018a64b
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10001070
add esp, 4
xor edi, edi
dec edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014dc80
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [eax], 0xc
mov edi, dword [ebp - 0x20]
mov dword [eax + 4], edi
mov dword [eax + 8], 0
push eax
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
mov esi, eax
mov ebx, dword [ebp - 0x24]
test edi, edi
je 0x1018a690
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
test ebx, ebx
je 0x1018a633
push ebx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x1018a633

Function at 0x1018a6c0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1018a6e6
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10001070
add esp, 4
xor eax, eax
dec eax
pop ebp
ret

Function at 0x1018aaf0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1018ab16
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10001070
add esp, 4
xor eax, eax
dec eax
pop ebp
ret

Function at 0x1018acf0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_MoveFileA]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1018ad19
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.10001070
add esp, 4
xor eax, eax
dec eax
pop ebp
ret
Function at 0x1018aef0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x101a4790]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LockFile]
sub esp, 0x14
xor esi, esi
test eax, eax
je 0x1018af22
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
mov dword [esp], eax
call fcn.10001070
mov eax, dword [0x101de25c]
xor esi, esi
dec esi
cmp dword [eax + 4], 2
jl 0x1018af19
mov dword [esp + 4], edi
mov dword [esp], str._PR_MD_LOCKFILE___failed._Error:__d
call sym.nss3.dll_PR_LogPrint
jmp 0x1018af19
Function at 0x1018bbf0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
cmp dword [0x101de184], 0
je 0x1018bc6a
cmp dword [0x101de180], 0
je 0x1018bc6a
mov eax, dword [0x101de170]
add eax, 0x1c
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [0x101de188]
mov eax, dword [0x101de184]
mov edx, ecx
sub edx, eax
jbe 0x1018bc59
mov esi, dword [0x101de180]
cmp esi, 0xfffffffe
je 0x1018bc6e
push esi
push edx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
push dword [0x101de180]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
mov eax, dword [0x101de184]
mov dword [0x101de188], eax
mov eax, dword [0x101de170]
add eax, 0x1c
push eax
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 4
pop esi
pop ebx
pop ebp
ret
mov bl, byte [ecx]
mov byte [ecx], 0
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [0x101de188]
mov byte [eax], bl
jmp 0x1018bc4f

Function at 0x1018d940
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x101de200], 0
jne 0x1018d952
call fcn.100745e0
push dword [0x101de19c]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [0x101de1a8]
test eax, eax
je 0x1018d989
push eax
call dword [sym.imp.mozglue.dll_strdup]
add esp, 4
mov esi, eax
push dword [0x101de19c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
test esi, esi
jne 0x1018d9d3
jmp 0x1018d9c2
push str.LD_LIBRARY_PATH
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
mov ecx, str.._lib
cmovne ecx, eax
push ecx
call dword [sym.imp.mozglue.dll_strdup]
add esp, 4
mov dword [0x101de1a8], eax
test eax, eax
jne 0x1018d969
push dword [0x101de19c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
push 0
push 0xffffe890
call sym.nss3.dll_PR_SetError
add esp, 8
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret