joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ec4a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x100ec4b4
cmp dword [esi + 0x18], 0
je 0x100ec4f0
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100ec4ea
mov ecx, dword [esi]
test ecx, ecx
je 0x100ec4da
push ecx
call fcn.100d8590
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 0x18]
push 0
push eax
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
jmp 0x100ec4ec
xor eax, eax
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp + 0xc]
cmp dword [esi + 8], 0x1a
jne 0x100ec52a
cmp dword [esi + 0x24], 1
jne 0x100ec52a
cmp byte [edi], 2
jne 0x100ec52a
push 2
push 0x101c31e4
push eax
call fcn.100d6890
add esp, 0xc
test eax, eax
je 0x100ec521
mov dword [esi + 0x24], 0
jmp 0x100ec546
mov dword [esi + 0x28], 1
mov eax, dword [esi]
push dword [ebp + 0x10]
push edi
push eax
call fcn.100d6890
add esp, 0xc
mov dword [esi + 0x24], 0
test eax, eax
je 0x100ec4bb
cmp dword [0x101f2f50], 0
je 0x100ec58b
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100ec573
mov eax, dword [eax + 0x28]
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, eax
mov dword [esi + 0x18], ecx
jmp 0x100ec4bb
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x100ec55f
call fcn.100029d0
jmp 0x100ec54f
Function at 0x100ed0a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0x1c]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x30]
sub esp, 0x1c
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call fcn.100eded0
add esp, 0x1c
push 0x2c
call sym.nss3.dll_PORT_ZAlloc_Util
add esp, 4
test eax, eax
je 0x100ed124
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x1c], eax
mov dword [esi + 0xc], 0
push ebx
call sym.nss3.dll_NSS_CMSContentInfo_GetContentTypeTag
add esp, 4
mov edi, eax
add eax, 0xffffffe6
cmp eax, 4
ja case.0x100ed113.28
jmp dword [eax*4 + 0x101c3250]
push dword [ebx + 0xc]
call fcn.100ee6f0
jmp 0x100ed16c
push 0
push 0xffffe013
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x100ed17d
push dword [ebx + 0xc]
call fcn.100ed9d0
jmp 0x100ed16c
push edi
call fcn.100efbc0
add esp, 4
test eax, eax
je 0x100ed173
push dword [esi + 0x10]
push edi
call fcn.100efc00
add esp, 8
jmp 0x100ed16f
push dword [ebx + 0xc]
call fcn.100ec8f0
jmp 0x100ed16c
push dword [ebx + 0xc]
call fcn.100ecef0
add esp, 4
test eax, eax
je 0x100ed186
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esi
add eax, 0x14
push eax
push 0x100ed200
push 0x101c29f0
push ebx
call fcn.100d9580
add esp, 0x10
mov dword [esi], eax
test eax, eax
je 0x100ed173
mov dword [esi + 4], 0
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x100ed1b9
cmp dword [ecx + 8], 0
jne 0x100ed1c2
mov dword [eax + 0xc], 1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x100ed290
mov dword [eax + 0x18], esi
mov dword [esi + 4], 1
xor edi, edi
push edi
push edi
push dword [esi]
call fcn.100d8b70
add esp, 0xc
test eax, eax
je 0x100ed1f1
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x100ed17f
mov edi, esi
jmp 0x100ed17f
Function at 0x100ef4d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x100ef519
add eax, 0x14
push eax
call sym.nss3.dll_SECOID_FindOID_Util
add esp, 4
mov ecx, eax
xor eax, eax
test ecx, ecx
je case.0x100ef512.197
mov eax, dword [ecx + 0xc]
cmp eax, 0xc1
jle 0x100ef52c
cmp eax, 0x115
jg 0x100ef542
lea ecx, [eax - 0xc2]
cmp ecx, 7
ja case.0x100ef512.197
jmp dword [ecx*4 + 0x101c3310]
push 0
push 0xffffe005
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
jmp case.0x100ef512.197
cmp eax, 0x13
jg 0x100ef55e
cmp eax, 0x11
je 0x100ef57d
cmp eax, 0x13
jne case.0x100ef512.197
mov ecx, 3
jmp 0x100ef580
cmp eax, 0x116
je case.0x100ef512.194
cmp eax, 0x117
je case.0x100ef512.195
cmp eax, 0x118
jne case.0x100ef512.197
mov ecx, 0xc1
jmp 0x100ef580
cmp eax, 0x14
je case.0x100ef512.201
cmp eax, 0x7d
jne case.0x100ef512.197
mov ecx, 4
jmp 0x100ef580
mov ecx, 0xbf
jmp 0x100ef580
mov ecx, 0xc0
jmp 0x100ef580
xor ecx, ecx
inc ecx
cmp ecx, eax
je case.0x100ef512.197
push ecx
call sym.nss3.dll_SECOID_FindOIDByTag_Util
add esp, 4
mov ecx, eax
mov eax, 0
test ecx, ecx
je case.0x100ef512.197
mov eax, dword [ecx + 0xc]
pop ebp
ret
Function at 0x100efa20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, dword [ebp + 8]
xor esi, esi
dec esi
cmp dword [edi + 0x70], 1
jne 0x100efb67
mov ebx, dword [0x101f2fe4]
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x100efa86
cmp dword [eax], 0
je 0x100efa86
push 1
push 0xb6
push eax
call fcn.100eb2f0
add esp, 0xc
test eax, eax
je 0x100efa86
push eax
call fcn.100ead30
add esp, 4
test eax, eax
je 0x100efb67
push eax
push ebx
call fcn.100f0330
add esp, 8
test eax, eax
je 0x100efb67
mov edi, eax
xor ebx, ebx
jmp 0x100efaaa
mov edi, dword [edi + 0x5c]
test edi, edi
je 0x100efb20
mov eax, dword [edi + 0x118]
test eax, eax
je 0x100efb67
mov bl, 1
cmp byte [eax], 0
je 0x100efb67
cmp dword [0x101f2f50], 0
je 0x100efbb2
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100efb97
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
xor eax, eax
test ecx, ecx
je 0x100efb3e
cmp dword [ecx], 0
mov esi, 0
je 0x100efb40
xor eax, eax
inc eax
push eax
push 0x28
push ecx
call fcn.100eb2f0
add esp, 0xc
push eax
call fcn.100ead30
add esp, 4
mov esi, eax
xor eax, eax
inc eax
push eax
push 0x23
mov eax, dword [ebp + 8]
push dword [eax + 0x2c]
call fcn.100eb2f0
add esp, 0xc
push eax
call fcn.100ead30
add esp, 4
jmp 0x100efb40
test ebx, ebx
je 0x100efb67
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100efb71
cmp eax, 1
jne 0x100efb8e
push dword [edi + 0x10]
push ebx
call fcn.1007cee0
jmp 0x100efb7a
xor esi, esi
push eax
push esi
push edi
call sym.nss3.dll_CERT_SaveSMimeProfile
add esp, 0xc
mov esi, eax
test bl, bl
jne 0x100efb5a
push edi
call sym.nss3.dll_CERT_DestroyCertificate
add esp, 4
push 0
push dword [ebp - 0x10]
call sym.nss3.dll_PR_SetError
add esp, 8
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [edi + 0x10]
push ebx
call sym.nss3.dll_CERT_FindCertByIssuerAndSN
add esp, 8
mov ecx, edi
mov edi, eax
mov dword [ecx + 0x5c], eax
test eax, eax
jne 0x100efa91
jmp 0x100efb67
mov dword [edi + 0x5c], 0
jmp 0x100efb67
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x100efacb
call fcn.100029d0
jmp 0x100efab7
Function at 0x100f2eb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [esi + 0x170]
call sym.nss3.dll_PR_GetMonitorEntryCount
add esp, 4
mov byte [ebp - 0x12], bl
mov ecx, edi
mov byte [ebp - 0x11], cl
mov ebx, eax
test eax, eax
jg 0x100f2efc
test byte [esi + 0x1d], 4
jne 0x100f2efc
push dword [esi + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
cmp dword [ebp + 0xc], 2
jne 0x100f2f14
cmp dword [esi + 0xc4], 0
je 0x100f2f14
push esi
call fcn.1010d0e0
add esp, 4
push esi
call fcn.1011e1c0
add esp, 4
test eax, eax
je 0x100f2f48
mov edi, eax
test ebx, ebx
jg 0x100f3098
test byte [esi + 0x1d], 4
jne 0x100f3098
push dword [esi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
jmp 0x100f3098
test byte [esi + 0x1d], 4
jne 0x100f2f5c
push dword [esi + 0x168]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
cmp dword [esi + 0xa24], 1
jne 0x100f2f77
push 0x40000000
push esi
call fcn.100f1200
add esp, 8
mov edi, eax
jmp 0x100f2ff5
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x100f2ff9
mov ecx, dword [esi + 0xa4]
test ecx, ecx
je 0x100f2ff9
push 0x40000000
push ecx
push eax
push 0x16
push 0
push esi
call fcn.100f4350
add esp, 0x18
test eax, eax
js 0x100f2faf
xor edi, edi
cmp eax, dword [esi + 0xa4]
jb 0x100f2fd9
jmp 0x100f2feb
cmp dword [0x101f2f50], 0
je 0x100f30c7
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100f30ac
cmp dword [eax + 0x28], 0xffffe892
jne 0x100f2fe8
push 0
push 0xffffe001
call sym.nss3.dll_PR_SetError
add esp, 8
xor edi, edi
dec edi
mov dword [esi + 0xa4], 0
test edi, edi
jne 0x100f3020
xor eax, eax
cmp dword [ebp + 0x10], 0x29
sete al
shl eax, 0x1e
lea ecx, [ebp - 0x12]
push eax
push 2
push ecx
push 0x15
push 0
push esi
call fcn.100f4350
add esp, 0x18
mov edi, eax
sar edi, 0x1f
and edi, eax
cmp dword [ebp + 0xc], 2
jne 0x100f3030
mov dword [esi + 0x6bc], 1
test byte [esi + 0x1d], 4
jne 0x100f3044
push dword [esi + 0x168]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
test ebx, ebx
jg 0x100f305c
test byte [esi + 0x1d], 4
jne 0x100f305c
push dword [esi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
test edi, edi
jne 0x100f3098
mov ecx, dword [esi + 0xfc]
xor edi, edi
test ecx, ecx
je 0x100f3098
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov byte [edx], al
mov eax, dword [ebp + 0x10]
mov byte [edx + 1], al
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ebx, dword [esi + 0x100]
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x18]
call ecx
add esp, 0xc
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10156ff0
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x100f2fd0
call fcn.100029d0
jmp 0x100f2fbc
Function at 0x100f4d20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x100f4db9
mov edi, dword [ebp + 0x10]
test edi, edi
js 0x100f4db9
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1fc], 0x401
jb 0x100f4d5e
push edx
call fcn.10115340
mov edx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x100f4eed
mov dword [ebp - 0x18], 0
test edi, edi
je 0x100f4d7c
mov eax, dword [edx + 0x50]
test eax, eax
je 0x100f4d7c
cmp byte [ebx], al
jne 0x100f4db9
inc ebx
dec edi
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp edi, 2
jb 0x100f4dc5
test byte [edx + 0x1e], 2
je 0x100f4dd0
movzx eax, word [edx + 0x58]
cmp eax, 0x302
jae 0x100f4dd0
mov eax, dword [edx + 0x3b8]
mov ecx, dword [eax + 0x14]
lea eax, [edx + 0x168]
mov dword [ebp - 0x14], eax
mov eax, 0x4000
cmp edi, eax
cmovl eax, edi
cmp dword [ecx + 0x10], 1
jne 0x100f4de3
xor eax, eax
inc eax
jmp 0x100f4de3
push 0
push 0xffffe89d
jmp 0x100f4ef4
xor esi, esi
cmp edi, 1
jne 0x100f4ec2
lea eax, [edx + 0x168]
mov dword [ebp - 0x14], eax
mov eax, 0x4000
cmp edi, eax
cmovl eax, edi
push dword [ebp + 0x14]
push eax
push ebx
push 0x17
push 0
push edx
call fcn.100f4350
add esp, 0x18
test eax, eax
js 0x100f4efc
mov esi, eax
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1fc], 0
jne 0x100f4ece
jmp 0x100f4e82
test esi, esi
jle 0x100f4e4e
test byte [edx + 0x1d], 4
jne 0x100f4e2b
mov eax, dword [ebp - 0x14]
push dword [eax]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
push 0
call sym.nss3.dll_PR_Sleep
add esp, 4
mov edx, dword [ebp + 8]
test byte [edx + 0x1d], 4
jne 0x100f4e4e
mov eax, dword [ebp - 0x14]
push dword [eax]
call sym.nss3.dll_PR_EnterMonitor
mov edx, dword [ebp + 8]
add esp, 4
mov eax, 0x4000
cmp ebx, eax
cmovge ebx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
push dword [ebp + 0x14]
push ebx
push eax
push 0x17
push 0
push edx
mov ebx, edx
call fcn.100f4350
add esp, 0x18
test eax, eax
js 0x100f4e8d
add esi, eax
cmp dword [ebx + 0x1fc], 0
mov edx, ebx
jne 0x100f4ece
mov ebx, edi
sub ebx, esi
jg 0x100f4e14
mov ebx, dword [ebp - 0x10]
jmp 0x100f4ec2
test esi, esi
jle 0x100f4efc
cmp dword [0x101f2f50], 0
mov edi, 0xffffffff
je 0x100f4f35
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
mov ebx, dword [ebp - 0x10]
je 0x100f4f1d
cmp dword [eax + 0x28], 0xffffe892
mov edx, dword [ebp + 8]
jne 0x100f4eff
cmp dword [edx + 0x1fc], 0
je 0x100f4f0f
mov dword [ebp - 0x10], ebx
test esi, esi
jle 0x100f4ee2
mov eax, dword [ebp - 0x10]
movzx eax, byte [esi + eax - 1]
or eax, 0x100
mov dword [edx + 0x50], eax
mov ecx, dword [ebp - 0x18]
lea eax, [esi + ecx]
cmp eax, 1
jg 0x100f4f09
push 0
push 0xffffe892
call sym.nss3.dll_PR_SetError
add esp, 8
xor edi, edi
dec edi
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esi + ecx]
dec edi
jmp 0x100f4eff
mov dword [edx + 0x50], 0
add esi, dword [ebp - 0x18]
mov edi, esi
jmp 0x100f4eff
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x100f4eb6
call fcn.100029d0
jmp 0x100f4ea3
Function at 0x100f4f40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa24], 1
jne 0x100f4f57
pop esi
pop ebp
jmp fcn.100f1200
mov ecx, dword [esi + 0xa0]
xor eax, eax
test ecx, ecx
je 0x100f4fef
mov edx, dword [esi + 0xa4]
test edx, edx
je 0x100f4fef
mov eax, dword [ebp + 0xc]
test eax, 0xbfffffff
je 0x100f4f8f
push 0
push 0xffffe005
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
jmp 0x100f4fef
push eax
push edx
push ecx
push 0x16
push 0
push esi
call fcn.100f4350
add esp, 0x18
test eax, eax
js 0x100f4fb1
mov ecx, eax
xor eax, eax
cmp ecx, dword [esi + 0xa4]
jb 0x100f4fd3
jmp 0x100f4fe5
cmp dword [0x101f2f50], 0
je 0x100f500a
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100f4ff2
cmp dword [eax + 0x28], 0xffffe892
jne 0x100f4fe2
push 0
push 0xffffe001
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
mov dword [esi + 0xa4], 0
pop esi
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x100f4fca
call fcn.100029d0
jmp 0x100f4fba

Function at 0x100f52a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0xd], 1
cmp dword [edi + 0xa24], 1
jne 0x100f52d5
push 0x40000000
push edi
call fcn.100f1200
add esp, 8
jmp 0x100f535d
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x100f5384
mov ecx, dword [edi + 0xa4]
test ecx, ecx
je 0x100f5384
push 0x40000000
push ecx
push eax
push 0x16
push 0
push edi
call fcn.100f4350
add esp, 0x18
test eax, eax
js 0x100f5317
mov ecx, eax
xor eax, eax
cmp ecx, dword [edi + 0xa4]
jb 0x100f5341
jmp 0x100f5353
cmp dword [0x101f2f50], 0
je 0x100f53d5
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100f53ba
cmp dword [eax + 0x28], 0xffffe892
jne 0x100f5350
push 0
push 0xffffe001
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
mov dword [edi + 0xa4], 0
xor esi, esi
dec esi
test eax, eax
jne 0x100f53a7
cmp dword [edi + 0xa24], 1
jne 0x100f5384
lea eax, [ebp - 0xd]
push 1
push eax
push 0x14
push edi
call fcn.100f1090
add esp, 0x10
test eax, eax
jne 0x100f53a7
jmp 0x100f53a0
lea eax, [ebp - 0xd]
push 0x40000000
push 1
push eax
push 0x14
push 0
push edi
call fcn.100f4350
add esp, 0x18
test eax, eax
js 0x100f53a4
xor esi, esi
jmp 0x100f53a7
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x100f5338
call fcn.100029d0
jmp 0x100f5324
Function at 0x100f7690
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [0x101f3a1c]
test edi, edi
je 0x100f779b
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x100f77a4
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [edi + 8], esi
mov esi, 0xfffffe98
mov eax, dword [esi + 0x101f3b88]
test eax, eax
je 0x100f76f4
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f3b88], 0
mov eax, dword [esi + 0x101f3b8c]
test eax, eax
je 0x100f7710
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f3b8c], 0
mov eax, dword [esi + 0x101f3b90]
test eax, eax
je 0x100f772c
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f3b90], 0
mov eax, dword [esi + 0x101f3b94]
test eax, eax
je 0x100f7748
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f3b94], 0
mov eax, dword [esi + 0x101f3b98]
test eax, eax
je 0x100f7764
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f3b98], 0
mov eax, dword [esi + 0x101f3b9c]
test eax, eax
je 0x100f7780
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f3b9c], 0
add esi, 0x18
jne 0x100f76d8
mov eax, dword [0x101f3a1c]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
call fcn.1010bc30
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov esi, eax
jmp 0x100f76c1
Function at 0x100fb4f0
Capabilities:
Get thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xdc
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x101f4040], 0
je 0x100fb51f
mov edi, dword [ebp + 0x10]
push edi
call sym.nss3.dll_PK11_ExtractKeyValue
add esp, 4
test eax, eax
je 0x100fb534
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10156ff0
add esp, 0xdc
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x100fb51f
mov ebx, dword [ebp + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, dword [edi + 0x20]
lea eax, [eax + ecx*2]
add eax, 0x43
cmp eax, 0xc8
ja 0x100fb51f
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xdc], ecx
lea eax, [ecx + ecx]
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0xd8]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [ebp - 0xe0], eax
lea edx, [eax + ebp]
add edx, 0xffffff29
add byte [edx - 1], 0x20
xor ecx, ecx
mov edi, dword [ebp + 8]
movzx edi, byte [edi + ecx + 0x410]
mov ebx, edi
shr ebx, 4
mov bl, byte [ebx + 0x101c3e0b]
mov byte [edx + ecx*2], bl
and edi, 0xf
mov bl, byte [edi + 0x101c3e0b]
mov byte [edx + ecx*2 + 1], bl
inc ecx
cmp ecx, 0x20
jne 0x100fb59a
add eax, 0x42
lea ecx, [ebp - 0xd8]
mov edx, dword [ebp - 0xe0]
mov byte [edx + ecx + 0x41], 0x20
cmp dword [ebp - 0xdc], 0
je 0x100fb618
lea ecx, [eax + ebp]
add ecx, 0xffffff28
xor edx, edx
movzx edi, byte [esi + edx]
shr edi, 4
mov bl, byte [edi + 0x101c3e0b]
mov byte [ecx + edx*2], bl
movzx edi, byte [esi + edx]
and edi, 0xf
mov bl, byte [edi + 0x101c3e0b]
mov byte [ecx + edx*2 + 1], bl
inc edx
cmp dword [ebp - 0xdc], edx
jne 0x100fb5ee
add eax, dword [ebp - 0xe4]
mov byte [ebp + eax - 0xd8], 0xa
mov edi, dword [0x101f4044]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100fb690
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
push dword [0x101f4040]
push 1
push dword [ebp - 0xe8]
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x100fb67d
push dword [0x101f4040]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
push dword [0x101f4044]
call sym.nss3.dll_PR_Unlock
add esp, 4
jmp 0x100fb51f
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x100fb63e
Function at 0x10109f30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ebx, dword [eax + 0x150]
mov esi, dword [ecx + 8]
mov eax, dword [esi]
mov ecx, dword [eax + 0x44]
mov edi, dword [ebp + 0x14]
call dword [section..00cfg]
push ebx
push edi
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push esi
call ecx
add esp, 0x14
mov esi, eax
test eax, eax
js 0x10109f75
cmp esi, edi
jle 0x10109fa7
xor esi, esi
dec esi
mov ecx, 0xffffe8b6
jmp 0x10109f9c
cmp dword [0x101f2f50], 0
je 0x10109fc6
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10109fae
mov ecx, 0xffffe8b7
cmp dword [eax + 0x28], 0xffffe8d7
jne 0x10109fa7
push 0
push ecx
call sym.nss3.dll_PR_SetError
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x10109f8e
call fcn.100029d0
jmp 0x10109f7e

Function at 0x10109fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [eax + 0x48]
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x18], eax
sub esi, edi
mov eax, dword [ebp + 0xc]
add eax, edi
mov dword [ebp - 0x14], eax
call dword [section..00cfg]
push dword [ebp - 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call ecx
add esp, 0x14
mov esi, eax
test eax, eax
js 0x1010a043
add edi, esi
cmp dword [ebx + 0xa24], 1
mov esi, dword [ebp + 0x10]
jne 0x1010a034
cmp edi, esi
jl 0x1010a03f
cmp edi, esi
jl 0x10109fe9
mov dword [ebx + 0x44], 0
mov esi, edi
jmp 0x1010a095
cmp dword [0x101f2f50], 0
je 0x1010a0b7
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1010a09f
mov eax, dword [eax + 0x28]
cmp eax, 0xffffe892
jne 0x1010a078
mov dword [ebx + 0x44], 1
xor esi, esi
cmp edi, 1
sbb esi, esi
or esi, edi
jmp 0x1010a095
mov dword [ebx + 0x44], 0
cmp eax, 0xffffe8d8
jne 0x1010a095
push 0
push 0xffffe8b7
call sym.nss3.dll_PR_SetError
add esp, 8
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x1010a05c
call fcn.100029d0
jmp 0x1010a04c