joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101149a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10114a81
mov edx, dword [eax + 4]
mov dword [edx], eax
mov esi, 0xffffe005
cmp dword [ebp + 0xc], 0
je 0x10114ab7
mov edi, dword [ebp + 0x10]
cmp edi, 0x1f
ja 0x10114ab7
xorps xmm0, xmm0
movups xmmword [edx + 0x398], xmm0
movups xmmword [edx + 0x38c], xmm0
movups xmmword [edx + 0x37c], xmm0
movups xmmword [edx + 0x36c], xmm0
movups xmmword [edx + 0x35c], xmm0
movups xmmword [edx + 0x34c], xmm0
movups xmmword [edx + 0x33c], xmm0
movups xmmword [edx + 0x32c], xmm0
test edi, edi
je 0x10114a7d
xor esi, esi
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + esi*4]
xor ecx, ecx
cmp dword [ecx + 0x101c81a0], ebx
je 0x10114a4d
add ecx, 0x14
cmp ecx, 0x26c
jne 0x10114a36
xor ebx, ebx
jmp 0x10114a6a
lea ebx, [ecx + 0x101c81a0]
xor ecx, ecx
mov eax, dword [edx + ecx*4 + 0x32c]
test eax, eax
je 0x10114a64
cmp ebx, eax
je 0x10114a78
inc ecx
cmp ecx, 0x1f
jne 0x10114a55
mov eax, dword [ebp - 0x10]
mov dword [edx + eax*4 + 0x32c], ebx
inc eax
mov dword [ebp - 0x10], eax
inc esi
cmp esi, edi
jne 0x10114a2e
xor eax, eax
jmp 0x10114ae3
cmp dword [0x101f4f80], 0
je 0x10114b16
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10114afd
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov esi, 0xffffe09a
cmp dword [0x101f4f80], 0
je 0x10114b0f
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10114aeb
mov dword [eax + 0x28], esi
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10114ad5
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10114aa3
call fcn.1001b2e0
jmp 0x10114ac0
call fcn.1001b2e0
jmp 0x10114a8e
Function at 0x10114d40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 2
call sym.nss3.dll_NSS_OptionGet
test eax, eax
jne 0x10114d74
mov eax, dword [ebp - 0x14]
test eax, eax
jg 0x10114d80
mov dword [ebp - 0x14], 0x80
mov eax, 0x80
mov ecx, dword [ebp + 0xc]
cmp dword [esi + 0x6c0], 0
je 0x10114db3
movzx edx, word [esi + 0x58]
cmp edx, 0x303
ja 0x10114db3
cmp dword [esi + 0x980], 0
jne 0x10114db3
cmp eax, 0x400
ja 0x10114db3
mov dword [ecx], 0x101c8498
jmp 0x10114e37
mov edx, dword [esi + 0x6c4]
test edx, edx
je 0x10114ddb
xor edi, edi
mov ebx, dword [esi + edi*4 + 0x32c]
test ebx, ebx
je 0x10114dce
cmp ebx, edx
je 0x10114dd6
inc edi
cmp edi, 0x1f
jne 0x10114dbf
jmp 0x10114ddb
cmp dword [edx + 4], eax
jae 0x10114e35
xor edx, edx
mov edi, dword [esi + edx*4 + 0x32c]
test edi, edi
je 0x10114df3
cmp dword [edi + 8], 2
jne 0x10114df3
cmp dword [edi + 4], eax
jae 0x10114e31
inc edx
cmp edx, 0x1f
jne 0x10114ddd
mov dword [ecx], 0
cmp dword [0x101f4f80], 0
je 0x10114e5f
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10114e4d
mov dword [eax + 0x28], 0xffffd002
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x10114e39
mov dword [ecx], edi
jmp 0x10114e37
mov dword [ecx], edx
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10114e1d
call fcn.1001b2e0
jmp 0x10114e08
Function at 0x10114e90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, edx
mov edi, ecx
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [esp + 0x70], eax
call fcn.1010cf40
xor ebx, ebx
test eax, eax
jne 0x10114f80
mov edx, dword [ebp + 8]
test edi, edi
je 0x10114eef
push dword [0x101f5fc8]
push edi
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x10114f50
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [ecx + 0xa24], eax
jne 0x10114f80
call fcn.101179d0
jmp 0x10114f01
xor ecx, ecx
bt dword [0x101f3d54], 0xa
setae cl
call fcn.101175a0
mov edi, eax
test eax, eax
je 0x10114f80
push 0x10117e40
push 0x101f5fd0
call sym.nss3.dll_PR_CallOnce
add esp, 8
test eax, eax
je 0x10114f95
push edi
call fcn.101129d0
add esp, 4
cmp dword [0x101f4f80], 0
je 0x10115036
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10115000
mov dword [eax + 0x28], 0xffffe001
jmp 0x10114f78
cmp dword [0x101f4f80], 0
je 0x10115040
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1011501b
mov dword [eax + 0x28], 0xffffe891
xor ebx, ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov ecx, dword [esp + 0x70]
xor ecx, ebp
call fcn.10157a00
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101f5fdc
push dword [0x101f5fc8]
call sym.nss3.dll_PR_CreateIOLayerStub
add esp, 8
test eax, eax
je 0x10114f1d
mov ebx, eax
mov dword [eax + 4], edi
push eax
push 0xfffffffffffffffe
push esi
call sym.nss3.dll_PR_PushIOLayer
add esp, 0xc
test eax, eax
je 0x10114fd9
mov ecx, dword [ebx + 0x10]
call dword [section..00cfg]
push ebx
call ecx
add esp, 4
jmp 0x10114f1d
mov dword [edi], esi
mov ebx, dword [esi + 8]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x64]
call dword [section..00cfg]
mov eax, esp
push eax
push ebx
call ecx
add esp, 8
xor ecx, ecx
test eax, eax
sete cl
mov dword [edi + 0x4c], ecx
mov ebx, esi
jmp 0x10114f80
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x10114f47
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x10114f71
call fcn.1001b2e0
jmp 0x10114f33
call fcn.1001b2e0
jmp 0x10114f5d
Function at 0x10115070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push dword [0x101f5fc8]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x10115183
mov ebx, dword [ebp + 0x10]
mov edi, dword [eax + 4]
mov dword [edi], eax
test ebx, ebx
je 0x101150af
push ebx
push dword [ebp + 0xc]
call fcn.10107370
add esp, 8
test eax, eax
jne 0x101151ab
lea esi, [edi + 8]
test byte [edi + 0x1d], 4
jne 0x101150c6
push dword [edi + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
push 0
push esi
call sym.nss3.dll_SECITEM_FreeItem_Util
add esp, 8
test ebx, ebx
je 0x1011510f
push ebx
push esi
push 0
call sym.nss3.dll_SECITEM_AllocItem_Util
add esp, 0xc
mov edx, dword [ebp + 0xc]
movzx esi, byte [edx]
lea eax, [esi + 1]
sub ebx, eax
mov ecx, dword [edi + 0xc]
add ecx, ebx
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, esi
inc eax
push ebx
push eax
push dword [edi + 0xc]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
test byte [edi + 0x1d], 4
jne 0x10115123
push dword [edi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
push dword [0x101f5fc8]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x10115183
mov edi, dword [eax + 4]
mov dword [edi], eax
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10115157
push dword [edi + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [edi + 0x1c]
mov dword [edi + 0x120], 0x101151e0
mov dword [edi + 0x124], 0
xor esi, esi
bt eax, 0xa
jb 0x101151ae
push dword [edi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
jmp 0x101151ae
cmp dword [0x101f4f80], 0
je 0x101151cd
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101151b5
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x1011519c
call fcn.1001b2e0
jmp 0x1011518c
Function at 0x10115370
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10115424
mov ecx, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
test ecx, ecx
je 0x1011544f
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1011544f
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x1011544f
mov edx, dword [edi + 0x9c4]
mov dword [ecx], edx
xor esi, esi
cmp dword [edi + 0x9c4], 0
mov edx, 0
je 0x1011549b
mov ecx, dword [edi + 0x9bc]
test ecx, ecx
je 0x1011549b
mov edx, dword [edi + 0x9c0]
cmp edx, dword [ebp + 0x18]
jbe 0x10115485
cmp dword [0x101f4f80], 0
je 0x101154f4
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101154cb
mov dword [eax + 0x28], 0xffffe003
jmp 0x10115478
cmp dword [0x101f4f80], 0
je 0x101154e0
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101154a7
mov dword [eax + 0x28], 0xffffe891
jmp 0x10115478
cmp dword [0x101f4f80], 0
je 0x101154ea
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101154b9
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x1011549d
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [edi + 0x9c0]
mov dword [ebx], edx
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10115446
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10115471
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x1011541b
call fcn.1001b2e0
jmp 0x10115431
call fcn.1001b2e0
jmp 0x1011545c
call fcn.1001b2e0
jmp 0x10115402
Function at 0x10115500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10115592
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ecx], eax
cmp edx, 4
ja 0x101155c3
cmp dword [ecx + 0xa24], 1
jne 0x101155c3
mov word [ecx + 0x6ba], 0
test edx, edx
je 0x101155c3
mov eax, dword [ebp + 0xc]
xor esi, esi
movzx edi, word [eax + esi*2]
lea ebx, [edi - 1]
cmp bx, 1
ja 0x1011557f
movzx ebx, word [ecx + 0x6ba]
mov eax, edx
lea edx, [ebx + 1]
mov word [ecx + 0x6ba], dx
mov edx, eax
mov eax, dword [ebp + 0xc]
mov word [ecx + ebx*2 + 0x6b2], di
inc esi
cmp edx, esi
jne 0x10115552
xor eax, eax
cmp word [ecx + 0x6ba], 0
jne 0x101155f3
jmp 0x101155c3
cmp dword [0x101f4f80], 0
je 0x10115626
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011560d
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101f4f80], 0
je 0x1011561f
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101155fb
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101155e1
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101155b4
call fcn.1001b2e0
jmp 0x101155cc
call fcn.1001b2e0
jmp 0x1011559f

Function at 0x10115630
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011566a
mov ecx, dword [eax + 4]
mov dword [ecx], eax
movzx eax, word [ecx + 0x9c8]
test ax, ax
je 0x101156cf
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
xor eax, eax
jmp 0x101156ca
cmp dword [0x101f4f80], 0
je 0x10115703
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101156f1
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101f4f80], ecx
je 0x101156d8
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101156df
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
add esp, 0x10
pop ebp
ret
cmp dword [0x101f4f80], 0
jne 0x101156a3
call fcn.1001b2e0
jmp 0x101156a3
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101156b8
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x1011568c
call fcn.1001b2e0
jmp 0x10115677
Function at 0x101157c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, 0xfffffe70
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x101c863c]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1011581a
add esi, 8
jne 0x101157d0
cmp dword [0x101f4f80], 0
je 0x1011583b
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115829
mov dword [eax + 0x28], 0xffffd0a4
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x10115820
mov ecx, dword [esi + 0x101c8640]
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10115809
call fcn.1001b2e0
jmp 0x101157f4

Function at 0x10115b30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10115b65
mov ecx, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x10115b8e
add eax, 0xf8
jmp 0x10115bbd
cmp dword [0x101f4f80], 0
je 0x10115bea
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x10115bc2
mov dword [ecx + 0x28], 0xffffe891
jmp 0x10115bb5
cmp dword [0x101f4f80], 0
je 0x10115bf4
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ecx, eax
test eax, eax
je 0x10115bd6
mov dword [ecx + 0x28], 0xffffe09a
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov ecx, eax
jmp 0x10115b85
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov ecx, eax
jmp 0x10115bae
call fcn.1001b2e0
jmp 0x10115b6e
call fcn.1001b2e0
jmp 0x10115b97
Function at 0x10115c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 0xc]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0xc], eax
test edi, edi
je 0x10115c2b
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10115c62
cmp ecx, 1
jne 0x10115c2b
mov ax, 0x302
jmp 0x10115c66
cmp dword [0x101f4f80], 0
je 0x10115cf6
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115ce1
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x10115ca1
mov ax, 0x300
mov word [edi], ax
mov word [edi + 2], 0x304
lea edx, [ebp - 0x10]
call fcn.10115850
cmp eax, 0xffffffff
je 0x10115c9b
movzx ecx, word [edi]
mov eax, dword [ebp - 0x10]
cmp cx, ax
cmova eax, ecx
movzx edx, word [edi + 2]
movzx ecx, word [ebp - 0xe]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x10115cb7
mov dword [edi], 0
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
mov word [edi], ax
mov word [edi + 2], cx
movzx ecx, cx
xor esi, esi
cmp ecx, 0x304
jb 0x10115ca4
movzx ecx, ax
cmp ecx, 0x302
mov ecx, 0x301
cmovae ecx, eax
mov word [edi], cx
jmp 0x10115ca4
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10115c51
call fcn.1001b2e0
jmp 0x10115c38

Function at 0x10115d00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 8], eax
cmp ecx, 1
ja 0x10115d67
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10115d67
test ecx, ecx
mov eax, 0x101f3d38
mov edx, 0x101f3d3c
cmove edx, eax
mov eax, dword [edx]
mov dword [esi], eax
lea edx, [ebp - 0xc]
call fcn.10115850
cmp eax, 0xffffffff
je 0x10115d5f
movzx ecx, word [esi]
mov eax, dword [ebp - 0xc]
cmp cx, ax
cmova eax, ecx
movzx edx, word [esi + 2]
movzx ecx, word [ebp - 0xa]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x10115da9
mov dword [esi], 0
jmp 0x10115d94
cmp dword [0x101f4f80], 0
je 0x10115dc6
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115db4
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop ebp
ret
mov word [esi], ax
mov word [esi + 2], cx
xor esi, esi
jmp 0x10115d97
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10115d85
call fcn.1001b2e0
jmp 0x10115d70
Function at 0x10115dd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x101f1014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x10115e9c
mov ebx, dword [eax]
mov edi, ebx
shr edi, 0x10
cmp bx, di
ja 0x10115efd
mov esi, dword [ebp + 8]
test esi, esi
je 0x10115ecb
cmp esi, 1
jne 0x10115efd
mov eax, 0xfffffcfe
lea ecx, [ebx + eax]
cmp cx, 2
ja 0x10115efd
add eax, edi
cmp ax, 3
jae 0x10115efd
lea edx, [ebp - 0x14]
mov ecx, esi
call fcn.10115850
cmp eax, 0xffffffff
je 0x10115f2a
mov eax, dword [ebp - 0x14]
cmp bx, ax
cmovbe ebx, eax
movzx eax, word [ebp - 0x12]
cmp di, ax
cmovae edi, eax
cmp di, bx
jb 0x10115f2a
movzx ecx, di
movzx eax, bx
cmp eax, 0x302
mov eax, 0x301
cmovae eax, ebx
cmp ecx, 0x304
cmovb eax, ebx
test esi, esi
mov ecx, 0x101f3d38
mov edx, 0x101f3d3c
cmove edx, ecx
shl edi, 0x10
movzx eax, ax
or eax, edi
mov dword [edx], eax
xor esi, esi
jmp 0x10115f2d
cmp dword [0x101f4f80], 0
je 0x10115f6f
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115f53
mov dword [eax + 0x28], 0xffffe005
jmp 0x10115f22
mov eax, 0xfffffd00
lea ecx, [ebx + eax]
cmp cx, 4
ja 0x10115efd
add eax, edi
cmp ax, 4
ja 0x10115efd
movzx eax, bx
cmp eax, 0x300
ja 0x10115e31
movzx eax, di
cmp eax, 0x304
jb 0x10115e31
cmp dword [0x101f4f80], 0
je 0x10115f68
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10115f41
mov dword [eax + 0x28], 0xffffd078
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10115f1b
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x10115ec2
call fcn.1001b2e0
jmp 0x10115f06
call fcn.1001b2e0
jmp 0x10115ea9
Function at 0x10115f80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f1014]
xor ecx, ebp
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x101f5fc8]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x1011605b
mov esi, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
test esi, esi
je 0x10116086
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10115fda
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10115fee
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_EnterMonitor
mov eax, dword [edi + 0x24]
mov dword [esi], eax
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1011600d
mov eax, dword [edi + 0x170]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x10116021
mov eax, dword [edi + 0x16c]
mov dword [esp], eax
call sym.nss3.dll_PR_ExitMonitor
mov ecx, dword [edi + 0xa24]
lea edx, [ebp - 0x10]
call fcn.10115850
cmp eax, 0xffffffff
je 0x10116053
movzx ecx, word [esi]
mov eax, dword [ebp - 0x10]
cmp cx, ax
cmova eax, ecx
movzx edx, word [esi + 2]
movzx ecx, word [ebp - 0xe]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x101160c9
mov dword [esi], 0
jmp 0x101160b3
cmp dword [0x101f4f80], 0
je 0x101160f8
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101160d4
mov dword [eax + 0x28], 0xffffe891
jmp 0x101160ab
cmp dword [0x101f4f80], 0
je 0x10116102
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101160e6
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebp
ret
mov word [esi], ax
mov word [esi + 2], cx
xor esi, esi
jmp 0x101160b6
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x1011607d
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
jmp 0x101160a4
call fcn.1001b2e0
jmp 0x10116068
call fcn.1001b2e0
jmp 0x1011608f