Function at 0x10012dd0
Capabilities:
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov eax, dword [0x100a400c]
xor eax, ebp
mov dword [esp + 0xf0], eax
cmp byte [ecx + 0x14], 0
je 0x100139db
mov esi, edx
mov dword [esp + 0xc], ecx
test byte [ecx + 0x10], 4
jne 0x10012e2e
mov edx, esi
mov edi, edx
movzx eax, byte [edx]
cmp eax, 0xff
je 0x1001390d
mov edx, edi
cmp eax, 0xeb
je 0x10013923
cmp edi, edx
jne 0x10012e05
cmp edi, esi
jne 0x10013ae5
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], 0
mov eax, dword [0x100a5a68]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x10012e98
push 0x100a5a68
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a68], 0xffffffff
jne 0x10012e98
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x100a5a64], eax
push 0x100a5a68
call fcn.1004f02e
add esp, 4
mov eax, dword [0x100a5a64]
mov dword [esp], eax
xor edi, edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], edi
mov eax, dword [0x100a5a70]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10013469
push 0x100a5a74
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp byte [esp + 0x48], 0
jne 0x100139f0
mov dword [esp + 4], 0
mov esi, dword [0x100a5a60]
test esi, esi
jne 0x10012f17
mov ebx, 0xc
push ebx
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], ebx
mov dword [0x100a5a60], esi
cmp byte [esp + 0x48], 0
jne 0x10013a27
cmp dword [esi + 4], 0
jne 0x10012f7c
push 0x14
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x10012f4d
mov ecx, esi
call fcn.10014220
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
mov ecx, dword [esi]
mov dword [ecx + eax*4 + 4], edi
mov edx, dword [esp + 4]
mov dword [ecx + eax*4], edx
mov dword [ecx + eax*4 + 8], ebx
inc dword [esi + 4]
mov esi, dword [0x100a5a60]
test esi, esi
je 0x100139c6
cmp dword [esi + 4], 0
je 0x100139c6
mov ebx, dword [esi]
mov edi, dword [ebx + 8]
test edi, edi
je 0x10013df6
cmp dword [esp], 0
je 0x10013df6
cmp dword [edi + 4], 0
jne 0x10013461
mov eax, dword [0x100a5a68]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jle 0x10012ff3
push 0x100a5a68
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a68], 0xffffffff
jne 0x10012ff3
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x100a5a64], eax
push 0x100a5a68
call fcn.1004f02e
add esp, 4
mov esi, dword [0x100a5a64]
mov ecx, dword [esp]
mov eax, ecx
xor edx, edx
div esi
sub esi, edx
test edx, edx
cmove esi, edx
add esi, ecx
lea ebx, [edi + 8]
mov dword [edi + 8], esi
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
cmp byte [esp + 0x48], 0
jne 0x10013d25
push 1
push 0x2000
push esi
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
je 0x10013de9
mov dword [edi + 4], eax
cmp dword [ebx], 0
je 0x10013df6
push 0x100a5a74
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [0x100a5a70]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100134b1
push 0x100a5a74
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [edi + 4]
test eax, eax
je 0x10013df6
mov esi, dword [edi + 0x10]
shl esi, 7
mov edx, esi
or edx, 0x7f
mov ecx, dword [edi + 0xc]
cmp edx, ecx
jb 0x10013112
cmp ecx, dword [edi + 8]
jae 0x10013df6
mov eax, dword [0x100a5a5c]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10013877
mov eax, dword [edi + 4]
add eax, dword [edi + 0xc]
push 0x20
push 0x1000
push dword [0x100a5a58]
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
je 0x10013df6
mov eax, dword [0x100a5a5c]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100138b9
mov eax, dword [0x100a5a58]
add dword [edi + 0xc], eax
mov eax, dword [edi + 4]
add esi, eax
lea eax, [esp + 0x9c]
mov dword [eax - 4], edi
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, 0x80
mov dword [eax + 0x14], ecx
mov byte [eax + 0x18], 1
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x10013af6
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0xa4]
test ecx, ecx
je 0x10013b06
mov esi, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov bl, byte [esp + 0xb4]
mov byte [esp + 4], bl
mov dword [esp], eax
test eax, eax
mov dword [esp + 0x10], esi
je 0x10013199
test edx, edx
je 0x10013199
test esi, esi
je 0x10013199
cmp byte [esp + 4], 0
je 0x10013199
inc dword [edi + 0x10]
mov dword [esp + 0x40], ecx
mov esi, dword [esp]
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edx
mov edi, dword [esp + 0xa8]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xac]
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], eax
mov ebx, dword [esp + 0xb0]
mov dword [esp + 0x58], ebx
mov byte [esp + 0x60], 1
push 0x100a5a74
mov dword [esp + 0x20], edx
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], ebx
mov ebx, eax
mov al, byte [esp + 4]
mov byte [esp + 0x3c], al
xor esi, esi
mov dword [esp + 0x44], esi
mov byte [esp + 0x5c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test ebx, ebx
je 0x10013b2b
cmp dword [esp], 0
mov edi, dword [esp + 0x14]
je 0x100137dc
test edx, edx
je 0x100137dc
test ecx, ecx
je 0x100137dc
cmp byte [esp + 4], 0
je 0x100137dc
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_EncodePointer]
lea ecx, [edi + 4]
cmp ecx, dword [esp + 0x18]
ja 0x10013b62
mov ecx, dword [esp]
mov dword [ecx + edi], eax
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x30]
add edi, 4
mov dword [esp + 0x30], edi
mov dword [esp + 4], eax
test eax, eax
je 0x10013b7a
mov al, byte [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x100137dc
test edx, edx
je 0x100137dc
test ecx, ecx
je 0x100137dc
test al, al
je 0x100137dc
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x70]
mov dword [esp], eax
add eax, ebx
push eax
call dword [sym.imp.kernel32.dll_EncodePointer]
lea esi, [edi + 4]
cmp dword [esp + 4], 0
je 0x10013b87
cmp esi, dword [esp + 0x38]
ja 0x10013bca
mov ecx, dword [esp + 0x28]
mov dword [ecx + edi], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add esi, 4
mov dword [esp + 0x30], esi
mov dword [esp + 4], eax
test eax, eax
je 0x10013b8b
mov al, byte [esp + 0x3c]
cmp dword [esp + 0x28], 0
je 0x100137d0
cmp dword [esp + 0x2c], 0
je 0x100137d0
cmp dword [esp + 0x24], 0
je 0x100137d0
test al, al
je 0x100137d0
mov dword [esp + 0x34], esi
xor eax, eax
dec eax
cmp ebx, 4
ja 0x100134f9
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, ebx
mov ecx, dword [esp]
movzx ecx, byte [ecx + edi]
cmp ecx, 0x65
jg 0x10013395
lea edx, [ecx - 0x2e]
cmp edx, 0x10
ja 0x10013388
mov ebx, 0x10101
bt ebx, edx
jb 0x100138fb
add ecx, 0xffffff9c
cmp ecx, 2
jae 0x100133bb
jmp 0x100138fb
cmp ecx, 0x66
je 0x100139a8
cmp ecx, 0x67
je 0x100139b7
add ecx, 0xffffff10
cmp ecx, 3
ja 0x100133bb
cmp ecx, 1
jne 0x10013d0f
test al, 0xc
jne 0x100137d0
mov edx, dword [esp]
movzx eax, byte [edx + edi]
mov ecx, eax
and cl, 0xfc
cmp cl, 0x88
jne 0x10013400
movzx eax, byte [edx + edi + 1]
mov ebx, eax
shr ebx, 6
xor edx, edx
inc edx
cmp ebx, 3
jne 0x1001396b
lea ebx, [edx + edi]
inc ebx
mov dword [esp + 0x70], ebx
cmp ebx, 5
jb 0x10013362
jmp 0x100134fd
cmp eax, 0xa0
jg 0x1001341a
cmp eax, 0xf
je 0x10013e08
cmp eax, 0x33
jne 0x10013430
jmp 0x10013e33
cmp eax, 0xa1
je 0x10013963
cmp eax, 0xb8
je 0x10013963
mov ecx, eax
and cl, 0xf8
cmp cl, 0x40
je 0x1001345c
cmp eax, 0x68
je 0x10013963
cmp eax, 0x83
je 0x10013c25
mov ecx, eax
and cl, 0xf0
cmp cl, 0x50
jne 0x10013c3c
inc edi
mov ebx, edi
jmp 0x100133ee
lea ebx, [edi + 8]
jmp 0x1001303d
push 0x100a5a70
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a70], 0xffffffff
jne 0x10012ecf
push 0x1000000
push 0xfa0
push 0x100a5a74
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionEx]
mov byte [0x100a5a6c], 1
push 0x100a5a70
call fcn.1004f02e
add esp, 4
jmp 0x10012ecf
push 0x100a5a70
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a70], 0xffffffff
jne 0x10013072
push 0x1000000
push 0xfa0
push 0x100a5a74
call dword [sym.imp.kernel32.dll_InitializeCriticalSectionEx]
mov byte [0x100a5a6c], 1
push 0x100a5a70
call fcn.1004f02e
add esp, 4
jmp 0x10013072
mov dword [esp + 0xc], eax
lea eax, [ebx + esi]
cmp dword [esp + 4], 0
je 0x10013bd8
cmp eax, dword [esp + 0x38]
ja 0x10013bfc
add esi, dword [esp + 0x28]
push ebx
push dword [esp + 4]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, dword [esp + 0x30]
add esi, ebx
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
mov eax, esi
je 0x10013bdc
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100137d0
cmp dword [esp + 0x2c], 0
je 0x100137d0
cmp dword [esp + 0x24], 0
je 0x100137d0
cmp byte [esp + 0x3c], 0
je 0x100137d0
cmp ebx, 0x64
ja 0x100137d0
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x10013c5d
mov ecx, dword [esp + 0x38]
cmp esi, ecx
jae 0x10013c7a
mov byte [eax + esi], 0xe9
mov esi, dword [esp + 0x30]
inc esi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
je 0x10013bf0
mov ecx, dword [esp + 0x38]
lea eax, [esi + 4]
cmp eax, ecx
ja 0x10013c70
mov eax, dword [esp]
add eax, ebx
mov ecx, dword [esp + 0x2c]
add ecx, esi
sub eax, ecx
add eax, 0xfffffffc
mov ecx, dword [esp + 0x28]
mov dword [ecx + esi], eax
add dword [esp + 0x30], 4
cmp byte [esp + 0x3c], 0
je 0x100137d0
cmp dword [esp + 0x20], 0
je 0x100137d0
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
je 0x100137d0
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0xb8]
mov dword [ecx - 0x20], edx
mov eax, dword [esp]
mov dword [ecx - 0x1c], eax
mov dword [ecx - 0x18], ebx
xor edi, edi
mov dword [ecx - 0x14], edi
mov dword [ecx - 0x10], edi
mov dword [ecx - 8], edi
mov dword [ecx - 4], 0x10
mov dword [ecx - 0xc], ecx
mov byte [ecx + 0x10], 1
lea esi, [esp + 0xcc]
mov ecx, esi
push ebx
push eax
call fcn.100140f0
add esp, 8
cmp dword [esi + 8], edi
je 0x10013749
cmp byte [esp + 0xc8], 0
je 0x10013749
lea esi, [esp + 0xac]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x10013ca2
mov ecx, dword [esp + 0xac]
mov byte [ecx + eax], 0xe9
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
inc eax
mov dword [esp + 0xb0], eax
inc ebx
mov dword [esp + 0xa4], ebx
add ebx, dword [esp + 0x9c]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 0xb4]
ja 0x10013cc0
mov ecx, dword [ebp + 8]
sub ecx, ebx
add ecx, 0xfffffffc
mov edx, dword [esp + 0xac]
mov dword [edx + eax], ecx
add dword [esp + 0xb0], 4
mov eax, dword [esp + 0xa4]
add eax, 4
mov dword [esp + 0xa4], eax
cmp eax, dword [esp + 0xa0]
jb 0x10013ce0
cmp dword [esp + 0xd4], 0
je 0x10013749
cmp byte [esp + 0xc8], 0
je 0x10013749
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x10013740
mov ecx, dword [esp + 0xa8]
add ecx, dword [esp + 0x9c]
push eax
push dword [esp + 0xb0]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
xor esi, esi
push esi
push esi
push eax
call dword [sym.imp.kernel32.dll_FlushInstructionCache]
mov eax, dword [esp + 0xb0]
add dword [esp + 0xa8], eax
mov dword [esp + 0xb0], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [0x100a5a5c]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10013838
mov esi, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x100137a4
mov ebx, dword [0x100a5a58]
lea edi, [esi + eax*8]
lea eax, [esp + 0x74]
push eax
push dword [esi]
push ebx
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_VirtualProtect]
add esi, 8
cmp esi, edi
jne 0x10013785
mov esi, dword [esp + 0xd0]
lea eax, [esp + 0xdc]
mov dword [eax - 8], 0
cmp esi, eax
jne 0x10013c84
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0xb8]
cmp eax, ecx
jne 0x10013c93
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x10013b98
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
setne bl
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10013805
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10013805
lea edx, [esp + 0x24]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
cmp byte [esp + 0x60], 0
je 0x10013820
mov eax, dword [esp + 0x48]
test eax, eax
je 0x10013820
mov ecx, dword [esp + 0x44]
test ecx, ecx
jne 0x10013b4d
mov ecx, dword [esp + 0xf0]
xor ecx, ebp
call fcn.1004f020
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a5c], 0xffffffff
jne 0x1001376a
lea esi, [esp + 0x74]
push esi
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x100a5a58], eax
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
jmp 0x1001376a
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a5c], 0xffffffff
jne 0x100130c4
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x100a5a58], eax
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
jmp 0x100130c4
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a5c], 0xffffffff
jne 0x10013107
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x100a5a58], eax
push 0x100a5a5c
call fcn.1004f02e
add esp, 4
jmp 0x10013107
mov cl, 2
test al, 2
jne 0x100137d0
or al, cl
inc edi
jmp 0x10013366
cmp byte [edi + 1], 0x25
mov edx, edi
jne 0x10012e22
mov eax, dword [edi + 2]
mov edx, dword [eax]
jmp 0x10012e22
movsx eax, byte [edi + 1]
add eax, edi
add eax, 2
mov ecx, eax
sub ecx, edi
shl ecx, 0x18
add ecx, 0xfe000000
mov edx, edi
test ecx, ecx
jle 0x10012e22
sar ecx, 0x18
xor edx, edx
cmp byte [edx + edi + 2], 0x90
jne 0x10013d1e
inc dl
movsx edx, dl
cmp ecx, edx
jg 0x10013948
mov edx, eax
jmp 0x10012e22
add edi, 5
jmp 0x1001345d
test ebx, ebx
jne 0x10013c06
mov ecx, eax
and ecx, 7
cmp ecx, 5
je 0x10013c15
cmp ecx, 4
jne 0x10013e85
mov ecx, dword [esp]
mov cl, byte [ecx + edi + 2]
and cl, 7
xor edx, edx
cmp cl, 5
sete dl
lea ecx, [edx*4 + 1]
jmp 0x10013c15
mov cl, 4
test al, 4
je 0x10013905
jmp 0x100137d0
mov cl, 8
test al, 8
je 0x10013905
jmp 0x100137d0
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_mPolicies___mPolicies__empty___
int3
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_isSome___
int3
lea esi, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], esi
mov dword [ecx + 4], 0
call fcn.1004e790
mov dword [esp + 4], eax
cmp byte [esi + 8], 0
je 0x10012eed
lea ecx, [esp + 0x40]
call fcn.10081500
mov edi, eax
jmp 0x10012eed
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov eax, ecx
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x10013a74
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 8], edx
mov ecx, dword [esp + 4]
shr edx, 1
lea eax, [edx + edx*2]
lea eax, [ebx + eax*4]
cmp dword [eax], ecx
jae 0x10013a6b
add eax, 0xc
not edx
add edx, dword [esp + 8]
mov ebx, eax
mov dword [esp + 8], edx
test edx, edx
jg 0x10013a4a
jmp 0x10013a74
jne 0x10013a61
cmp dword [eax + 4], edi
jb 0x10013a56
jmp 0x10013a61
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*2]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax*4]
cmp ebx, eax
je 0x10013a97
mov eax, dword [esp + 4]
cmp dword [ebx], eax
ja 0x10013a97
cmp dword [ebx + 4], edi
jae 0x10012f7e
lea ecx, [esp + 0x98]
mov dword [ecx + 4], edi
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov edi, ecx
push 0x14
call sym.mozglue.dll_moz_xmalloc
add esp, 4
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov dword [edi + 8], eax
mov ecx, esi
mov edx, ebx
push edi
call fcn.100813b0
add esp, 4
mov ebx, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x10012f7e
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x10012f7e
mov ecx, edi
call fcn.100526b0
test al, al
cmovne esi, edi
jmp 0x10012e2e
mov dword [esp + 0x9c], 0
jmp 0x1001314d
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
mov al, byte [esp + 0xb4]
mov byte [esp + 4], al
jmp 0x10013196
mov dword [esp + 4], 0
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_EncodePointer]
mov edi, dword [esp + 0x14]
add edi, 4
mov dword [esp + 0x30], edi
jmp 0x100132d3
lea edx, [esp + 0x44]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
jmp 0x10013820
mov byte [esp + 0x3c], 0
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [esp + 4], ebx
mov edx, ecx
mov esi, dword [esp]
jmp 0x100132b3
mov dword [esp + 4], 0
jmp 0x100132d3
mov dword [esp + 0x30], esi
mov dword [esp + 4], 0
jmp 0x1001334e
xor esi, esi
mov dword [esp + 0x30], esi
push esi
call dword [sym.imp.kernel32.dll_EncodePointer]
cmp dword [esp + 0x20], esi
je 0x100140ce
cmp dword [esp + 0x38], 3
jbe 0x100140db
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
add dword [esp + 0x30], 4
jmp 0x100137dc
mov byte [esp + 0x3c], 0
xor eax, eax
mov esi, edi
jmp 0x10013325
mov dword [esp + 0x30], eax
cmp ebx, 0x64
ja 0x100137d0
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x10013c5d
inc eax
mov esi, eax
add esi, 4
mov dword [esp + 0x30], esi
jmp 0x100135cf
mov byte [esp + 0x3c], 0
jmp 0x1001353e
mov ecx, 2
cmp ebx, 1
je 0x10013c15
mov ecx, 5
and al, 7
xor edx, edx
cmp al, 4
sete dl
add edx, ecx
jmp 0x100133ea
mov eax, dword [esp]
mov al, byte [eax + edi + 1]
cmp al, 0xc0
jb 0x10013e49
add edi, 3
jmp 0x1001345d
cmp al, 0xff
je 0x10013e99
cmp eax, 0xe9
je 0x10013e8d
cmp eax, 0x6a
je 0x10013e41
jmp 0x100137d0
mov eax, dword [esp + 0x34]
add ecx, eax
add ecx, 5
cmp ecx, dword [esp + 0x38]
jbe 0x10013e69
mov byte [esp + 0x3c], 0
jmp 0x100135cf
mov byte [esp + 0x3c], 0
jmp 0x100135a8
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x100137ba
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x100137d0
xor edx, edx
inc edx
mov ecx, esi
call fcn.10081290
test al, al
je 0x10014059
mov eax, dword [esp + 0xb0]
jmp 0x10013664
mov ecx, esi
mov edx, 4
call fcn.10081290
test al, al
je 0x10014074
mov eax, dword [esp + 0xb0]
jmp 0x100136a4
lea esi, [esp + 0x98]
lea ebx, [esp + 0x74]
mov byte [esp + 0x74], 0x90
mov ecx, esi
mov edx, ebx
call fcn.100817b0
mov eax, dword [esp + 0xa4]
cmp eax, dword [esp + 0xa0]
jae 0x100136dc
jmp 0x10013ceb
mov cl, 1
test al, 1
je 0x10013905
jmp 0x100137d0
mov edx, edi
jmp 0x10012e22
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], eax
mov dword [ecx + 4], 0
call fcn.1004e790
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
cmp byte [eax + 8], 0
je 0x10014088
lea ecx, [esp + 0x40]
call fcn.10081500
mov dword [esp], eax
mov eax, dword [0x100a5a94]
mov ecx, dword [0x100a43c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1001409d
mov ecx, dword [0x100a5a90]
test ecx, ecx
je 0x10013eaf
lea eax, [esp + 0x74]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [esp]
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
movaps xmm0, xmmword [0x10093170]
movups xmmword [esp + 0x98], xmm0
mov dword [esp + 0xa0], eax
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea edx, [esp + 0x9c]
push edx
push eax
push 0x2000
push esi
xor eax, eax
push eax
push dword [esp + 0x1c]
call ecx
mov dword [edi + 4], eax
test eax, eax
jne 0x1001303d
jmp 0x10013df6
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [edi + 4], 0
push 0x100a5a74
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
xor ebx, ebx
jmp 0x10013820
mov eax, dword [esp]
mov al, byte [eax + edi + 1]
and al, 0xfe
cmp al, 0x10
jne 0x100137d0
lea eax, [edi + 2]
lea ecx, [esp + 0x68]
mov dword [ecx + 8], eax
call fcn.10081740
lea ebx, [edi + eax]
add ebx, 2
jmp 0x100133ee
mov eax, dword [esp]
cmp byte [eax + edi + 1], 0xc0
jb 0x100137d0
add edi, 2
jmp 0x1001345d
mov ecx, eax
and cl, 0xc0
cmp cl, 0x40
jne 0x100137d0
and al, 7
cmp al, 4
je 0x100137d0
add edi, 4
jmp 0x1001345d
mov ecx, dword [esp + 0xc]
add ecx, eax
inc ecx
mov edx, dword [esp + 0x28]
add eax, dword [esp + 0x2c]
mov esi, dword [esp]
sub esi, eax
add dword [edx + ecx], esi
jmp 0x100135cf
xor ecx, ecx
inc ecx
jmp 0x10013c15
lea ebx, [edi + 5]
mov dword [esp + 0xc], edi
jmp 0x100133ee
mov eax, dword [esp]
cmp byte [eax + edi + 1], 0x25
jne 0x100137d0
add edi, 6
jmp 0x1001345d
mov eax, dword [esp]
inc eax
mov ecx, dword [esp + 4]
mov edx, esi
mov dword [esp], eax
push eax
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
mov ecx, dword [esp + 4]
mov edx, esi
push dword [esp]
push dword [esp + 0xc]
call fcn.10081550
add esp, 8
test eax, eax
je 0x10013def
push 1
push 0x2000
push esi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
test eax, eax
jne 0x1001303a
jmp 0x10013022
mov byte [esp + 0xc8], 0
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
jmp 0x1001368d
mov byte [esp + 0xc8], 0
mov eax, dword [esp + 0xa4]
jmp 0x100136cf
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_isSome___
int3
push 0x100a5a94
call fcn.1004f02e
add esp, 4
cmp dword [0x100a5a94], 0xffffffff
jne 0x10013d81
call fcn.100816f0
push 0x100a5a94
call fcn.1004f02e
add esp, 4
jmp 0x10013d81
mov dword [esp + 0x30], 4
jmp 0x100137dc
mov byte [esp + 0x3c], 0
jmp 0x100137dc