joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011a960
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push dword [0x101dfbd0]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1011aa73
mov ebx, dword [ebp + 0x10]
mov edi, dword [eax + 4]
mov dword [edi], eax
test ebx, ebx
je 0x1011a99f
push ebx
push dword [ebp + 0xc]
call fcn.1010ce90
add esp, 8
test eax, eax
jne 0x1011aa9b
test byte [edi + 0x1d], 4
jne 0x1011a9b3
push dword [edi + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
lea esi, [edi + 8]
push 0
push esi
call sym.nss3.dll_SECITEM_FreeItem_Util
add esp, 8
test ebx, ebx
je 0x1011a9ff
push ebx
push esi
push 0
call sym.nss3.dll_SECITEM_AllocItem_Util
add esp, 0xc
mov edx, dword [ebp + 0xc]
movzx esi, byte [edx]
lea eax, [esi + 1]
sub ebx, eax
mov ecx, dword [edi + 0xc]
add ecx, ebx
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, esi
inc eax
push ebx
push eax
push dword [edi + 0xc]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
test byte [edi + 0x1d], 4
jne 0x1011aa13
push dword [edi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
push dword [0x101dfbd0]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1011aa73
mov edi, dword [eax + 4]
mov dword [edi], eax
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011aa47
push dword [edi + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [edi + 0x1c]
mov dword [edi + 0x120], 0x1011aad0
mov dword [edi + 0x124], 0
xor esi, esi
bt eax, 0xa
jb 0x1011aa9e
push dword [edi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
jmp 0x1011aa9e
cmp dword [0x101de200], 0
je 0x1011aabd
push dword [0x101de1f0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1011aaa5
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
add esp, 0x10
jmp 0x1011aa8c
call fcn.100745e0
jmp 0x1011aa7c
Function at 0x1011ac60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011ad19
mov ecx, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
test ecx, ecx
je 0x1011ad44
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1011ad44
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x1011ad44
mov edx, dword [edi + 0x99c]
mov dword [ecx], edx
xor esi, esi
cmp dword [edi + 0x99c], 0
mov edx, 0
je 0x1011ad90
mov ecx, dword [edi + 0x994]
mov edx, 0
test ecx, ecx
je 0x1011ad90
mov edx, dword [edi + 0x998]
cmp edx, dword [ebp + 0x18]
jbe 0x1011ad7a
cmp dword [0x101de200], 0
je 0x1011ade9
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011adc0
mov dword [eax + 0x28], 0xffffe003
jmp 0x1011ad6d
cmp dword [0x101de200], 0
je 0x1011add5
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011ad9c
mov dword [eax + 0x28], 0xffffe891
jmp 0x1011ad6d
cmp dword [0x101de200], 0
je 0x1011addf
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011adae
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x1011ad92
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [edi + 0x998]
mov dword [ebx], edx
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011ad3b
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011ad66
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011ad10
call fcn.100745e0
jmp 0x1011ad26
call fcn.100745e0
jmp 0x1011ad51
call fcn.100745e0
jmp 0x1011acf7
Function at 0x1011ae00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011ae87
mov ecx, dword [eax + 4]
mov dword [ecx], eax
cmp dword [ecx + 0x9f8], 1
jne 0x1011aeb8
mov eax, dword [ebp + 0x10]
cmp eax, 5
jae 0x1011aeb8
mov word [ecx + 0x69a], 0
test eax, eax
je 0x1011aeb8
xor esi, esi
mov edx, dword [ebp + 0xc]
movzx edi, word [edx + esi*2]
lea ebx, [edi - 1]
cmp bx, 1
ja 0x1011ae74
movzx ebx, word [ecx + 0x69a]
lea edx, [ebx + 1]
mov word [ecx + 0x69a], dx
mov word [ecx + ebx*2 + 0x692], di
inc esi
cmp eax, esi
jne 0x1011ae4b
xor eax, eax
cmp word [ecx + 0x69a], 0
jne 0x1011aee8
jmp 0x1011aeb8
cmp dword [0x101de200], 0
je 0x1011af1b
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011af02
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101de200], 0
je 0x1011af14
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011aef0
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011aed6
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011aea9
call fcn.100745e0
jmp 0x1011aec1
call fcn.100745e0
jmp 0x1011ae94

Function at 0x1011af30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011af6a
mov ecx, dword [eax + 4]
mov dword [ecx], eax
movzx eax, word [ecx + 0x9a0]
test ax, ax
je 0x1011afcf
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
xor eax, eax
jmp 0x1011afca
cmp dword [0x101de200], 0
je 0x1011b003
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011aff1
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101de200], ecx
je 0x1011afd8
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011afdf
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
add esp, 0x10
pop ebp
ret
cmp dword [0x101de200], 0
jne 0x1011afa3
call fcn.100745e0
jmp 0x1011afa3
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011afb8
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011af8c
call fcn.100745e0
jmp 0x1011af77
Function at 0x1011b0c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, 0xfffffe80
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x101b2f4c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1011b11a
add esi, 8
jne 0x1011b0d0
cmp dword [0x101de200], 0
je 0x1011b13b
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011b129
mov dword [eax + 0x28], 0xffffd0a4
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x1011b120
mov ecx, dword [esi + 0x101b2f50]
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011b109
call fcn.100745e0
jmp 0x1011b0f4

Function at 0x1011b450
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011b485
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x1011b4ae
add eax, 0xf8
jmp 0x1011b4dd
cmp dword [0x101de200], 0
je 0x1011b50a
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x1011b4e2
mov dword [ecx + 0x28], 0xffffe891
jmp 0x1011b4d5
cmp dword [0x101de200], 0
je 0x1011b514
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x1011b4f6
mov dword [ecx + 0x28], 0xffffe09a
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
mov ecx, eax
jmp 0x1011b4a5
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
mov ecx, eax
jmp 0x1011b4ce
call fcn.100745e0
jmp 0x1011b48e
call fcn.100745e0
jmp 0x1011b4b7
Function at 0x1011b520
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 0xc]
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 0xc], eax
test edi, edi
je 0x1011b54b
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1011b582
cmp ecx, 1
jne 0x1011b54b
mov ax, 0x302
jmp 0x1011b586
cmp dword [0x101de200], 0
je 0x1011b617
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011b602
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x1011b5c6
mov ax, 0x300
mov word [edi], ax
mov word [edi + 2], 0x304
lea edx, [ebp - 0x10]
call fcn.1011b150
cmp eax, 0xffffffff
je 0x1011b5bb
movzx ecx, word [edi]
mov eax, dword [ebp - 0x10]
cmp cx, ax
cmova eax, ecx
movzx edx, word [edi + 2]
movzx ecx, word [ebp - 0xe]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1011b5dc
mov word [edi + 2], 0
mov word [edi], 0
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
mov word [edi], ax
mov word [edi + 2], cx
movzx ecx, cx
xor esi, esi
cmp ecx, 0x304
jb 0x1011b5c9
movzx ecx, ax
mov edx, 0x301
cmp ecx, edx
cmovbe eax, edx
mov word [edi], ax
jmp 0x1011b5c9
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011b571
call fcn.100745e0
jmp 0x1011b558

Function at 0x1011b630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 8], eax
cmp ecx, 1
ja 0x1011b697
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1011b697
test ecx, ecx
mov eax, 0x101dd898
mov edx, 0x101dd89c
cmove edx, eax
mov eax, dword [edx]
mov dword [esi], eax
lea edx, [ebp - 0xc]
call fcn.1011b150
cmp eax, 0xffffffff
je 0x1011b68f
movzx ecx, word [esi]
mov eax, dword [ebp - 0xc]
cmp cx, ax
cmova eax, ecx
movzx edx, word [esi + 2]
movzx ecx, word [ebp - 0xa]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1011b6d9
mov dword [esi], 0
jmp 0x1011b6c4
cmp dword [0x101de200], 0
je 0x1011b6f6
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011b6e4
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x18
pop esi
pop ebp
ret
mov word [esi], ax
mov word [esi + 2], cx
xor esi, esi
jmp 0x1011b6c7
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011b6b5
call fcn.100745e0
jmp 0x1011b6a0
Function at 0x1011b700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x101db014]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x1011b749
mov edi, dword [ebp + 8]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
mov dword [edx], eax
mov ecx, edi
call fcn.1011b7b0
mov esi, eax
test eax, eax
jne 0x1011b779
test edi, edi
mov eax, 0x101dd898
mov ecx, 0x101dd89c
cmove ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
xor esi, esi
jmp 0x1011b779
cmp dword [0x101de200], 0
je 0x1011b79e
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011b78c
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011b767
call fcn.100745e0
jmp 0x1011b752

Function at 0x1011b7b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx edx, word [edx]
movzx eax, word [esi + 2]
cmp dx, ax
ja 0x1011b81c
test ecx, ecx
je 0x1011b7f1
cmp ecx, 1
jne 0x1011b81c
mov edi, 0xfffffcfe
add edx, edi
cmp dx, 2
ja 0x1011b81c
add eax, edi
cmp ax, 3
jb 0x1011b868
jmp 0x1011b81c
mov edi, 0xfffffd00
lea ebx, [edx + edi]
cmp bx, 4
ja 0x1011b81c
add edi, eax
cmp di, 4
ja 0x1011b81c
movzx edx, dx
cmp edx, 0x300
ja 0x1011b868
movzx eax, ax
cmp eax, 0x304
jb 0x1011b868
cmp dword [0x101de200], 0
je 0x1011b8d7
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011b8c2
mov dword [eax + 0x28], 0xffffd078
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor edi, edi
dec edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014dc80
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebp - 0x14]
call fcn.1011b150
cmp eax, 0xffffffff
je 0x1011b894
movzx ecx, word [esi]
mov eax, dword [ebp - 0x14]
cmp cx, ax
cmova eax, ecx
movzx edx, word [esi + 2]
movzx ecx, word [ebp - 0x12]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1011b89c
mov dword [esi], 0
jmp 0x1011b851
mov word [esi], ax
mov word [esi + 2], cx
movzx ecx, cx
xor edi, edi
cmp ecx, 0x304
jb 0x1011b854
movzx ecx, ax
mov edx, 0x301
cmp ecx, edx
cmovbe eax, edx
mov word [esi], ax
jmp 0x1011b854
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011b842
call fcn.100745e0
jmp 0x1011b829
Function at 0x1011b8f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [0x101db014]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011b9cb
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
test esi, esi
je 0x1011b9f6
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011b94a
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011b95e
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x24]
mov dword [esi], eax
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011b97d
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011b991
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov ecx, dword [edi + 0x9f8]
lea edx, [ebp - 0x10]
call fcn.1011b150
cmp eax, 0xffffffff
je 0x1011b9c3
movzx ecx, word [esi]
mov eax, dword [ebp - 0x10]
cmp cx, ax
cmova eax, ecx
movzx edx, word [esi + 2]
movzx ecx, word [ebp - 0xe]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1011ba39
mov dword [esi], 0
jmp 0x1011ba23
cmp dword [0x101de200], 0
je 0x1011ba68
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011ba44
mov dword [eax + 0x28], 0xffffe891
jmp 0x1011ba1b
cmp dword [0x101de200], 0
je 0x1011ba72
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011ba56
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
mov word [esi], ax
mov word [esi + 2], cx
xor esi, esi
jmp 0x1011ba26
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011b9ed
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011ba14
call fcn.100745e0
jmp 0x1011b9d8
call fcn.100745e0
jmp 0x1011b9ff
Function at 0x1011ba80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 0xc]
mov eax, dword [0x101db014]
xor eax, ebp
mov dword [ebp - 0xc], eax
test esi, esi
je 0x1011bb7a
mov eax, dword [ebp + 8]
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011bba9
mov edi, dword [eax + 4]
mov dword [edi], eax
mov eax, dword [esi]
lea edx, [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [edi + 0x9f8]
call fcn.1011b7b0
mov esi, eax
test eax, eax
jne 0x1011bbdd
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011baf5
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011bb09
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
movzx eax, word [edi + 0x6f4]
test ax, ax
je 0x1011bbf0
cmp word [edi + 0x26], ax
jbe 0x1011bbf0
cmp dword [0x101de200], 0
je 0x1011bc7b
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011bc52
mov dword [eax + 0x28], 0xffffd078
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011bb72
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov eax, dword [edi + 0x1c]
xor esi, esi
dec esi
jmp 0x1011bc12
cmp dword [0x101de200], 0
je 0x1011bc67
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011bc28
mov dword [eax + 0x28], 0xffffe005
jmp 0x1011bbd2
cmp dword [0x101de200], 0
je 0x1011bc71
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011bc3d
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x24], eax
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011bc10
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov eax, dword [edi + 0x1c]
xor esi, esi
bt eax, 0xa
jb 0x1011bbdd
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
jmp 0x1011bbdd
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011bba0
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011bbcb
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011bb49
call fcn.100745e0
jmp 0x1011bb87
call fcn.100745e0
jmp 0x1011bbb6
call fcn.100745e0
jmp 0x1011bb30
Function at 0x1011bc90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [0x101db014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, dword [0x101dfbd0]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011bd90
movzx ebx, word [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
test bx, bx
je 0x1011bd1d
mov esi, dword [edi + 0x9f8]
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.1011b150
cmp eax, 0xffffffff
je 0x1011be08
cmp word [ebp - 0x14], bx
ja 0x1011be08
cmp word [ebp - 0x12], bx
jb 0x1011be08
test esi, esi
je 0x1011bdf8
cmp esi, 1
jne 0x1011be08
lea eax, [ebx - 0x302]
cmp ax, 3
jae 0x1011be08
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011bd37
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011bd4b
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
test bx, bx
je 0x1011bdbf
cmp word [edi + 0x26], bx
jbe 0x1011bdbf
cmp dword [0x101de200], 0
je 0x1011bea0
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011be77
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x1011bdc8
cmp dword [0x101de200], 0
je 0x1011be8c
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011be50
mov dword [eax + 0x28], 0xffffe891
jmp 0x1011be31
mov word [edi + 0x6f4], bx
xor esi, esi
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011bde2
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011be3c
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
jmp 0x1011be3c
lea eax, [ebx - 0x300]
cmp ax, 5
jb 0x1011bd1d
cmp dword [0x101de200], 0
je 0x1011be96
mov eax, dword [0x101de1f0]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011be65
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014dc80
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011bdb6
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011be2a
movaps xmm0, xmmword [0x1019c190]
movups xmmword [esp], xmm0
call fcn.10072140
jmp 0x1011bd7c
call fcn.100745e0
jmp 0x1011bd9d
call fcn.100745e0
jmp 0x1011be15
call fcn.100745e0
jmp 0x1011bd63