joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c7d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x18]
call sub.wsock32.dll_getsockname
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1001c7f1
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.101a7880
add esp, 4
xor eax, eax
dec eax
jmp 0x1001c7ef

Function at 0x1001cc50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [0x101f4f80], 0
je 0x1001cd6d
mov ebx, dword [ebp + 8]
mov edi, dword [0x101f4610]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x1001cd41
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [edi + 8], esi
mov edi, dword [ebx + 8]
mov eax, dword [0x101f4610]
mov esi, dword [ebx]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
test esi, esi
je 0x1001ccc6
xor esi, esi
test edi, edi
jne 0x1001cd77
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
inc eax
xchg dword [ebx + 4], eax
test eax, eax
jne 0x1001cd92
mov ecx, dword [ebp + 0xc]
call dword [section..00cfg]
call ecx
mov esi, eax
mov eax, dword [0x101f4610]
mov dword [ebp - 0x14], eax
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1001cd58
mov edi, dword [ebp - 0x14]
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov dword [ebx + 8], esi
mov dword [ebx], 1
mov eax, dword [0x101f4614]
mov dword [esp], eax
call sym.nss3.dll_PR_NotifyAllCondVar
mov eax, dword [0x101f4610]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
jmp 0x1001ccbc
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x1001cc8a
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov dword [ebp - 0x10], eax
jmp 0x1001cd01
call fcn.1001b2f0
jmp 0x1001cc66
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], 0xffffe8db
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov esi, edi
jmp 0x1001ccbc
mov eax, dword [0x101f4610]
mov dword [esp], eax
call sym.nss3.dll_PR_Lock
cmp dword [ebx], 0
jne 0x1001cdbb
mov eax, dword [0x101f4614]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call sym.nss3.dll_PR_WaitCondVar
jmp 0x1001cd9f
mov esi, dword [ebx + 8]
mov eax, dword [0x101f4610]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
test esi, esi
je 0x1001cde8
call sym.nss3.dll_PR_GetCurrentThread
mov dword [eax + 0x28], 0xffffe8db
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x1001ccbc
xor esi, esi
jmp 0x1001ccbc
Function at 0x1001cdf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov esi, dword [ebp + 8]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1001ce30
mov ecx, dword [esi]
cmp dword [ecx + 8], eax
jne 0x1001ce42
add ecx, 0x1c
add esi, 0x74
mov dword [esp + 4], ecx
mov dword [esp], esi
call sym.nss3.dll__PR_MD_NOTIFYALL_CV
xor eax, eax
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x1001ce0f
xor eax, eax
dec eax
jmp 0x1001ce2a

Function at 0x1001d050
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movups xmm0, xmmword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x18]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call sub.wsock32.dll_setsockopt
sub esp, 0x14
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1001d080
add esp, 0x14
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
mov dword [esp], eax
call fcn.101a6af0
xor eax, eax
dec eax
jmp 0x1001d07b

Function at 0x1001dc60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov esi, dword [0x101f1014]
xor esi, ebp
mov dword [ebp - 8], esi
mov edx, dword [edx + 4]
lea esi, [ebp - 0xc]
push 0
push esi
push ecx
push eax
push dword [edx + 0x18]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x1001dca8
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
xor esi, esi
cmp eax, 0x6d
je 0x1001dc96
push eax
call fcn.10129ef0
add esp, 4
xor esi, esi
dec esi
jmp 0x1001dc96

Function at 0x1001ddd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1001de64
cmp dword [0x101f4f80], 0
je 0x1001de78
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1001de46
push dword [esi + 0x3c]
call dword [sym.imp.mozglue.dll_free]
add esp, 4
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
inc edi
push edi
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
mov dword [esi + 0x3c], eax
test eax, eax
je 0x1001de73
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 0x3c]
call fcn.1001de90
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
mov esi, eax
test eax, eax
jne 0x1001de00
jmp 0x1001de73
push 0
push 0xffffe89d
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
jmp 0x1001de41
call fcn.1001b2f0
jmp 0x1001ddee
Function at 0x1001e580
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [0x101f5008]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
test eax, eax
je 0x1001e666
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], edi
test byte [esi + 0xe0], 1
jne 0x1001e6c6
mov eax, dword [0x101f4f90]
dec eax
mov dword [0x101f4f90], eax
cmp eax, dword [0x101f500c]
je 0x1001e61c
mov esi, dword [0x101f5008]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1001e67d
cmp dword [esi + 8], eax
jne 0x1001e614
mov dword [esi + 8], 0
add esi, 0x1c
mov dword [esp], esi
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x101f5010]
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x1001e6af
mov eax, dword [esi]
cmp dword [eax + 8], ecx
jne 0x1001e5de
add esi, 0x74
mov ecx, dword [eax + 0x34]
add eax, 0x34
xor edi, edi
test ecx, ecx
jg 0x1001e692
lea edx, [edi + edi*2]
mov dword [eax + edx*4 + 8], 1
mov dword [eax + edx*4 + 4], esi
inc ecx
mov dword [eax], ecx
jmp 0x1001e5de
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov edi, eax
jmp 0x1001e5ac
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x1001e5fd
mov ebx, eax
add eax, 8
mov edx, ecx
cmp dword [eax - 4], esi
je 0x1001e6d1
add eax, 0xc
dec edx
jne 0x1001e699
cmp ecx, 6
jge 0x1001e6dd
mov eax, ebx
mov edi, ecx
jmp 0x1001e64f
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov ecx, eax
jmp 0x1001e639
dec dword [0x101f4f8c]
jmp 0x1001e5de
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x1001e65e
jmp 0x1001e5de
mov eax, dword [ebx + 0x4c]
test eax, eax
jne 0x1001e6fc
mov dword [esp + 4], 0x50
mov dword [esp], 1
call dword [sym.imp.mozglue.dll_calloc]
mov dword [ebx + 0x4c], eax
mov ecx, dword [eax]
jmp 0x1001e64b

Function at 0x1001ee50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
test dl, dl
je 0x1001ee70
inc ecx
xor eax, eax
rol eax, 4
movzx edx, dl
xor eax, edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1001ee5f
pop ebp
ret
xor eax, eax
jmp 0x1001ee6e
Function at 0x1001efe0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x101f1014]
xor edx, ebp
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], 1
push ecx
push eax
push edi
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
je 0x1001f046
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
push esi
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x1001f056
cmp edi, 0x17
jne 0x1001f033
test byte [0x101f43f8], 1
jne 0x1001f074
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret
call sub.wsock32.dll_WSAGetLastError
push eax
call fcn.101a6af0
add esp, 4
jmp 0x1001f06f
call sub.wsock32.dll_WSAGetLastError
push eax
push 0xffffe896
call sym.nss3.dll_PR_SetError
add esp, 8
push esi
call sub.wsock32.dll_closesocket
xor esi, esi
dec esi
jmp 0x1001f033
lea eax, [ebp - 0x18]
mov dword [eax], 4
lea edi, [ebp - 0x14]
push eax
push edi
push 0x1002
push 0xffff
push esi
call sub.wsock32.dll_getsockopt
test eax, eax
jne 0x1001f033
cmp dword [ebp - 0x14], 0x10000
jl 0x1001f033
mov eax, 0xffff
mov dword [ebp - 0x14], eax
push dword [ebp - 0x18]
push edi
push 0x1002
push eax
push esi
call sub.wsock32.dll_setsockopt
jmp 0x1001f033
Function at 0x10024280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ecx + 0x14]
test edi, edi
jle 0x100243a3
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
lea eax, [edx + 1]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
cmp ecx, 2
setb al
mov dword [ebp - 0x24], ecx
xor eax, ecx
mov ecx, eax
shl ecx, 4
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + ecx + 0xc]
mov dword [ebp - 0x20], edx
cmp dword [ebp + 8], 0
je 0x1002430b
mov edx, dword [ebp - 0x10]
mov esi, dword [edx + ecx]
xor edx, edx
movzx ebx, byte [esi + edx]
mov ecx, dword [ebp + 8]
movzx ecx, byte [ecx + edx]
cmp bl, cl
jne 0x100242e8
test ebx, ebx
je 0x1002430b
inc edx
jmp 0x100242d2
mov bl, byte [ebx + 0x101b1828]
cmp bl, byte [ecx + 0x101b1828]
je 0x100242e5
test eax, eax
je 0x100243ad
mov ecx, dword [ebp - 0x24]
inc ecx
cmp ecx, edi
jne 0x100242a8
jmp 0x100243a3
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebx + 0x24]
test esi, esi
jne 0x10024369
lea esi, [ebx + 0x20]
add ebx, 0x1c
mov edi, dword [ebx]
mov eax, 0x101f4340
test edi, edi
je 0x10024359
mov esi, dword [esi]
mov ecx, dword [esi + 0xc]
xor edx, edx
movzx eax, byte [ecx + edx]
mov ebx, dword [ebp - 0x14]
movzx ebx, byte [ebx + edx]
cmp al, bl
jne 0x10024343
test eax, eax
je 0x10024365
inc edx
jmp 0x1002432d
mov al, byte [eax + 0x101b1828]
cmp al, byte [ebx + 0x101b1828]
je 0x10024340
dec edi
jne 0x10024326
mov eax, 0x101f4340
mov eax, dword [eax + 8]
test eax, eax
mov edi, dword [ebp - 0x1c]
je 0x100242fe
jmp 0x100243a5
mov eax, esi
jmp 0x10024359
mov eax, dword [ebp - 0x14]
mov cl, byte [eax]
xor eax, eax
test cl, cl
je 0x10024390
mov edx, dword [ebp - 0x18]
movzx ecx, cl
movzx ecx, byte [ecx + 0x101b1828]
add ecx, eax
imul eax, ecx, 0x9e3779b1
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10024377
xor edx, edx
div dword [ebx + 0x18]
lea ebx, [esi + edx*8]
lea esi, [esi + edx*8]
add esi, 4
jmp 0x1002431b
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
movzx ecx, byte [eax + str.main]
mov edx, dword [ebp + 8]
movzx edx, byte [edx + eax]
cmp cl, dl
je 0x100243d5
mov cl, byte [ecx + 0x101b1828]
cmp cl, byte [edx + 0x101b1828]
jne 0x100242fe
jmp 0x100243dd
test ecx, ecx
je 0x1002430b
inc eax
jmp 0x100243af
Function at 0x10067010
Capabilities:
Connect socket
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x1006707e
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebx + 4]
cmp dword [eax + 4], 0
jne 0x10067048
cmp esi, 0x2733
je 0x100670b1
mov edi, 0xffffe8d2
cmp esi, 0x2733
jne 0x1006709b
cmp dword [0x101f4f80], 0
je 0x100670aa
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10067083
mov dword [eax + 0x28], edi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
xor eax, eax
dec eax
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x1006706e
cmp esi, 0x274c
jne 0x100670c8
mov edi, 0xffffe89a
jmp 0x10067055
call fcn.1001b2e0
jmp 0x1006705e
mov ecx, edi
mov edx, 3
push dword [ebp + 0x14]
call fcn.101a0dc0
add esp, 4
sar eax, 0x1f
jmp 0x1006707e
cmp esi, 0x2726
jne 0x100670da
mov edi, 0xffffe8d3
jmp 0x10067055
push esi
call fcn.10129ef0
add esp, 4
jmp 0x1006707b
Function at 0x10069a60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov edi, dword [ecx + 0xc]
test edi, edi
jne 0x10069b21
push esi
push dword [ecx + 0x10]
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test eax, eax
je 0x10069aa2
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
cmp dword [0x101f4f80], 0
je 0x10069b57
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10069b09
mov dword [eax + 0x28], 0xffffe8a9
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], 0
call dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [ebp - 0x20]
push eax
push str.error__d
push 0x14
push esi
call sym.nss3.dll_PR_snprintf
add esp, 0x10
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
push esi
push eax
call sym.nss3.dll_PR_SetErrorText
add esp, 8
xor esi, esi
jmp 0x10069a8f
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x10069ac7
mov eax, dword [edi]
test eax, eax
je 0x10069b41
add edi, 8
push eax
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x10069b4f
mov eax, dword [edi]
add edi, 8
test eax, eax
jne 0x10069b2a
push 0
push 0xffffe8a9
call sym.nss3.dll_PR_SetError
jmp 0x10069b02
mov esi, dword [edi - 4]
jmp 0x10069a8f
call fcn.1001b2e0
jmp 0x10069ab7
Function at 0x10069b70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10069c79
mov ecx, dword [ebp + 0xc]
cmp edi, 0xffffffff
je 0x10069c5d
push edi
mov edi, ecx
call sym.nss3.dll_PR_IntervalToMilliseconds
mov ecx, edi
add esp, 4
mov ebx, eax
mov edx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0
jne 0x10069c65
inc dword [edx + 0xc]
mov dword [esi + 0x104], 1
mov dword [esi + 0x13c], 0
mov eax, dword [edx + 8]
mov dword [esi + 0x138], eax
cmp dword [edx + 4], 0
jne 0x10069c96
lea eax, [edx + 4]
mov dword [eax], esi
mov dword [edx + 8], esi
push ecx
mov edi, ecx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push ebx
push dword [esi + 0x100]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov ebx, eax
push edi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp ebx, 0x102
jne 0x10069c58
cmp dword [esi + 0x104], 0
je 0x10069ca3
mov ecx, dword [ebp + 8]
dec dword [ecx + 0xc]
mov dword [esi + 0x104], 0
mov eax, dword [esi + 0x13c]
cmp dword [ecx + 4], esi
jne 0x10069cb3
mov dword [ecx + 4], eax
test eax, eax
jne 0x10069cdc
mov dword [ecx + 8], 0
xor eax, eax
mov dword [esi + 0x138], eax
mov dword [esi + 0x13c], eax
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
dec ebx
jmp 0x10069baa
mov edi, ecx
mov eax, edx
mov edx, esi
push eax
call fcn.101598c0
add esp, 4
jmp 0x10069bf2
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
mov esi, eax
jmp 0x10069b8f
mov eax, 0x13c
add eax, dword [edx + 8]
jmp 0x10069be4
push 0xffffffffffffffff
push dword [esi + 0x100]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
jmp 0x10069c58
mov edx, ecx
mov ecx, dword [esi + 0x138]
mov dword [ecx + 0x13c], eax
mov eax, dword [esi + 0x138]
mov ecx, dword [esi + 0x13c]
test ecx, ecx
je 0x10069ceb
mov dword [ecx + 0x138], eax
jmp 0x10069c4a
mov dword [eax + 0x138], 0
jmp 0x10069c4a
mov dword [edx + 8], eax
jmp 0x10069c4a
Function at 0x10069dd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp dword [0x101f4f80], 0
je 0x10069e4d
mov edi, dword [ebp + 8]
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10069e33
test edi, edi
je 0x10069e54
mov eax, dword [esi + 0x38]
cmp dword [esi + 0x34], edi
jg 0x10069e1b
lea ebx, [edi + 0x1f]
test eax, eax
jne 0x10069e76
push ebx
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
mov dword [esi + 0x38], eax
test eax, eax
je 0x10069e6b
mov dword [esi + 0x34], ebx
lea ecx, [edi + 1]
push ecx
push dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x30], edi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
mov esi, eax
jmp 0x10069df4
call fcn.1001b2f0
jmp 0x10069ddf
mov eax, dword [esi + 0x38]
test eax, eax
je 0x10069e6b
push eax
call sym.nss3.dll_PR_Free
add esp, 4
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
xor edi, edi
jmp 0x10069e2b
push eax
call sym.nss3.dll_PR_Free
add esp, 4
jmp 0x10069e07
Function at 0x1006ac70
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x140], eax
lea eax, [esi + 0xdc]
mov ecx, dword [esi + 0x10]
push eax
push 0x10004
push esi
push 0x10077ba0
push dword [ecx + 0x1c]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x108], eax
test eax, eax
je 0x1006acef
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 0xdc]
mov dword [esi + 0x10c], edx
cmp ecx, 1
jne 0x1006acd7
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
sete al
neg eax
pop esi
pop ebp
ret
lea eax, [esi + 0x100]
push ecx
push eax
call fcn.1006f320
add esp, 8
mov eax, dword [esi + 0x108]
jmp 0x1006acc1
xor eax, eax
dec eax
jmp 0x1006acd4

Function at 0x1006ad40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x1006ade3
test byte [esi + 0xe0], 8
jne 0x1006addc
mov dword [esp], esi
call fcn.10147830
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call dword [sym.imp.mozglue.dll_free]
xor edi, edi
mov dword [esi + 0x24], edi
mov ecx, esi
call fcn.1001e580
mov dword [esp], esi
call fcn.1006ae00
mov eax, dword [0x101f45d4]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
cmp dword [esi + 0xf0], edi
jne 0x1006adc4
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call dword [sym.imp.mozglue.dll_free]
mov dword [esi + 0x10], 0
lea eax, [esi + 0x40]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.mozglue.dll_free]
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x1006ad63
Function at 0x1006e720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x1006e867
xor edi, edi
mov esi, dword [sym.imp.kernel32.dll_TlsSetValue]
push edi
push dword [0x101f45d4]
call esi
push edi
push dword [0x101f45c8]
call esi
push 0x144
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
test eax, eax
je 0x1006e85d
mov esi, eax
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
cmovle eax, edi
cmp eax, 3
mov ecx, 3
cmovl ecx, eax
mov ebx, dword [ebp + 0x10]
mov dword [esi + 4], ecx
mov dword [esi + 0x10], ebx
mov dword [esi], 2
lea eax, [esi + 0xc8]
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
lea eax, [esi + 0x40]
mov dword [ebp - 0x10], eax
push eax
call sym.nss3.dll__PR_MD_NEW_LOCK
add esp, 4
cmp eax, 0xffffffff
je 0x1006e86b
mov edi, dword [ebp + 0x14]
push esi
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsSetValue]
or edi, 0x84
mov dword [esi + 0xe0], edi
test ebx, ebx
jne 0x1006e7f5
push 0x2c
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
mov dword [esi + 0x10], eax
test eax, eax
je 0x1006e877
mov eax, esi
add eax, 0xb8
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
push esi
call fcn.1001e400
add esp, 4
cmp eax, 0xffffffff
je 0x1006e889
mov ebx, dword [ebp + 8]
push 0
push dword [0x101f45c8]
call dword [sym.imp.kernel32.dll_TlsSetValue]
push dword [0x101f45c8]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x1006e8b1
mov eax, 0x101f4f90
cmp ebx, 1
je 0x1006e8d4
inc dword [eax]
push dword [0x101f45c8]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x1006e8e5
mov edi, esi
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, eax
jmp 0x1006e85d
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x1006e85d
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push esi
call dword [sym.imp.mozglue.dll_free]
jmp 0x1006e8aa
mov edi, dword [sym.imp.mozglue.dll_free]
push dword [esi + 0x10]
call edi
add esp, 4
mov dword [esi + 0x10], 0
push dword [ebp - 0x10]
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push esi
call edi
add esp, 4
xor edi, edi
jmp 0x1006e85d
mov edi, dword [0x101f5008]
call fcn.10156040
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
jmp 0x1006e837
or byte [esi + 0xe0], 1
mov eax, 0x101f4f8c
jmp 0x1006e845
mov edi, dword [0x101f5008]
call fcn.10156040
cmp dword [edi + 8], eax
jne 0x1006e85b
mov dword [edi + 8], 0
add edi, 0x1c
push edi
call sym.nss3.dll__PR_MD_UNLOCK
add esp, 4
jmp 0x1006e85b