Function at 0x1000d500
Capabilities:
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xf8
mov eax, dword [0x1009a00c]
xor eax, ebp
mov dword [esp + 0xf0], eax
cmp byte [ecx + 0x14], 0
je 0x1000e113
mov esi, edx
mov dword [esp + 0xc], ecx
test byte [ecx + 0x10], 4
jne 0x1000d55e
mov edx, esi
mov edi, edx
movzx eax, byte [edx]
cmp eax, 0xff
je 0x1000e045
mov edx, edi
cmp eax, 0xeb
je 0x1000e05b
cmp edi, edx
jne 0x1000d535
cmp edi, esi
jne 0x1000e21d
mov eax, dword [esp + 0xc]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], 0
mov eax, dword [0x1009ba64]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000db2e
mov esi, dword [0x1009ba60]
xor edi, edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], edi
mov eax, dword [0x1009ba6c]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000db70
push 0x1009ba70
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [esp + 0x48], 0
mov dword [esp], esi
jne 0x1000e128
mov dword [esp + 4], 0
mov esi, dword [0x1009ba5c]
test esi, esi
jne 0x1000d613
mov ebx, 0xc
push ebx
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov esi, eax
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], ebx
mov dword [0x1009ba5c], esi
cmp byte [esp + 0x48], 0
jne 0x1000e15f
cmp dword [esi + 4], 0
jne 0x1000d678
push 0x14
call sym.mozglue.dll_moz_xmalloc
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x1000d649
mov ecx, esi
call fcn.1000e920
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
mov ecx, dword [esi]
mov dword [ecx + eax*4 + 4], edi
mov edx, dword [esp + 4]
mov dword [ecx + eax*4], edx
mov dword [ecx + eax*4 + 8], ebx
inc dword [esi + 4]
mov esi, dword [0x1009ba5c]
test esi, esi
je 0x1000e0fe
cmp dword [esi + 4], 0
je 0x1000e0fe
mov ebx, dword [esi]
mov edi, dword [ebx + 8]
test edi, edi
mov esi, dword [esp]
je 0x1000e4ff
test esi, esi
je 0x1000e4ff
cmp dword [edi + 4], 0
jne 0x1000db26
mov eax, dword [0x1009ba64]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000df2b
mov ebx, dword [0x1009ba60]
mov eax, esi
xor edx, edx
div ebx
sub ebx, edx
test edx, edx
cmove ebx, edx
add ebx, esi
lea esi, [edi + 8]
mov dword [edi + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp byte [esp + 0x48], 0
jne 0x1000e42e
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1000e4f2
mov dword [edi + 4], eax
cmp dword [esi], 0
je 0x1000e4ff
push 0x1009ba70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1009ba6c]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000dbb8
push 0x1009ba70
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 4]
test eax, eax
je 0x1000e4ff
mov esi, dword [edi + 0x10]
shl esi, 7
mov edx, esi
or edx, 0x7f
mov ecx, dword [edi + 0xc]
cmp edx, ecx
jb 0x1000d7d7
cmp ecx, dword [edi + 8]
jae 0x1000e4ff
mov eax, dword [0x1009ba58]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000dfaf
mov eax, dword [edi + 4]
add eax, dword [edi + 0xc]
push 0x20
push 0x1000
push dword [0x1009ba54]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1000e4ff
mov eax, dword [0x1009ba58]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000dff1
mov eax, dword [0x1009ba54]
add dword [edi + 0xc], eax
mov eax, dword [edi + 4]
add esi, eax
lea eax, [esp + 0x9c]
mov dword [eax - 4], edi
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ecx, 0x80
mov dword [eax + 0x14], ecx
mov byte [eax + 0x18], 1
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000e22e
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0xa4]
test ecx, ecx
je 0x1000e23e
mov esi, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
mov bl, byte [esp + 0xb4]
mov byte [esp + 4], bl
mov dword [esp], eax
test eax, eax
mov dword [esp + 0x10], esi
je 0x1000d85e
test edx, edx
je 0x1000d85e
test esi, esi
je 0x1000d85e
cmp byte [esp + 4], 0
je 0x1000d85e
inc dword [edi + 0x10]
mov dword [esp + 0x40], ecx
mov esi, dword [esp]
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], edx
mov ebx, dword [esp + 0xa8]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xac]
mov dword [esp + 0x18], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], eax
mov edi, dword [esp + 0xb0]
mov dword [esp + 0x58], edi
mov byte [esp + 0x60], 1
push 0x1009ba70
mov dword [esp + 0x20], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x38], edi
mov edi, eax
mov al, byte [esp + 4]
mov byte [esp + 0x3c], al
xor esi, esi
mov dword [esp + 0x44], esi
mov byte [esp + 0x5c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
test edi, edi
je 0x1000e263
cmp dword [esp], 0
mov ebx, dword [esp + 0x14]
je 0x1000decf
test edx, edx
je 0x1000decf
test ecx, ecx
je 0x1000decf
cmp byte [esp + 4], 0
je 0x1000decf
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
lea ecx, [ebx + 4]
cmp ecx, dword [esp + 0x18]
ja 0x1000e29a
mov ecx, dword [esp]
mov dword [ecx + ebx], eax
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x30]
add ebx, 4
mov dword [esp + 0x30], ebx
mov dword [esp + 4], eax
test eax, eax
je 0x1000e2b2
mov al, byte [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x1000decf
test edx, edx
je 0x1000decf
test ecx, ecx
je 0x1000decf
test al, al
je 0x1000decf
mov eax, dword [esp + 0x6c]
mov edi, dword [esp + 0x70]
mov dword [esp], eax
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_EncodePointer]
lea esi, [ebx + 4]
cmp dword [esp + 4], 0
je 0x1000e2bf
cmp esi, dword [esp + 0x38]
ja 0x1000e302
mov ecx, dword [esp + 0x28]
mov dword [ecx + ebx], eax
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add esi, 4
mov dword [esp + 0x30], esi
mov dword [esp + 4], eax
test eax, eax
je 0x1000e2c3
mov al, byte [esp + 0x3c]
cmp dword [esp + 0x28], 0
je 0x1000dec3
cmp dword [esp + 0x2c], 0
je 0x1000dec3
cmp dword [esp + 0x24], 0
je 0x1000dec3
test al, al
je 0x1000dec3
mov dword [esp + 0x34], esi
xor eax, eax
dec eax
cmp edi, 4
ja 0x1000dc00
mov dword [esp + 0xc], eax
xor eax, eax
mov ebx, edi
mov ecx, dword [esp]
movzx ecx, byte [ecx + ebx]
cmp ecx, 0x65
jg 0x1000da5a
lea edx, [ecx - 0x2e]
cmp edx, 0x10
ja 0x1000da4d
mov edi, 0x10101
bt edi, edx
jb 0x1000e033
add ecx, 0xffffff9c
cmp ecx, 2
jae 0x1000da80
jmp 0x1000e033
cmp ecx, 0x66
je 0x1000e0e0
cmp ecx, 0x67
je 0x1000e0ef
add ecx, 0xffffff10
cmp ecx, 3
ja 0x1000da80
cmp ecx, 1
jne 0x1000e418
test al, 0xc
jne 0x1000dec3
mov edx, dword [esp]
movzx eax, byte [edx + ebx]
mov ecx, eax
and cl, 0xfc
cmp cl, 0x88
jne 0x1000dac5
movzx eax, byte [edx + ebx + 1]
mov edi, eax
shr edi, 6
xor edx, edx
inc edx
cmp edi, 3
jne 0x1000e0a3
lea edi, [edx + ebx]
inc edi
mov dword [esp + 0x70], edi
cmp edi, 5
jb 0x1000da27
jmp 0x1000dc04
cmp eax, 0xa0
jg 0x1000dadf
cmp eax, 0xf
je 0x1000e511
cmp eax, 0x33
jne 0x1000daf5
jmp 0x1000e53c
cmp eax, 0xa1
je 0x1000e09b
cmp eax, 0xb8
je 0x1000e09b
mov ecx, eax
and cl, 0xf8
cmp cl, 0x40
je 0x1000db21
cmp eax, 0x68
je 0x1000e09b
cmp eax, 0x83
je 0x1000e35d
mov ecx, eax
and cl, 0xf0
cmp cl, 0x50
jne 0x1000e374
inc ebx
mov edi, ebx
jmp 0x1000dab3
lea esi, [edi + 8]
jmp 0x1000d702
push 0x1009ba64
call fcn.10046148
add esp, 4
cmp dword [0x1009ba64], 0xffffffff
jne 0x1000d593
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x1009ba60], eax
push 0x1009ba64
call fcn.100460fe
add esp, 4
jmp 0x1000d593
push 0x1009ba6c
call fcn.10046148
add esp, 4
cmp dword [0x1009ba6c], 0xffffffff
jne 0x1000d5c8
push 0x1000000
push 0xfa0
push 0x1009ba70
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x1009ba68], 1
push 0x1009ba6c
call fcn.100460fe
add esp, 4
jmp 0x1000d5c8
push 0x1009ba6c
call fcn.10046148
add esp, 4
cmp dword [0x1009ba6c], 0xffffffff
jne 0x1000d737
push 0x1000000
push 0xfa0
push 0x1009ba70
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x1009ba68], 1
push 0x1009ba6c
call fcn.100460fe
add esp, 4
jmp 0x1000d737
mov dword [esp + 0xc], eax
lea eax, [edi + esi]
cmp dword [esp + 4], 0
je 0x1000e310
cmp eax, dword [esp + 0x38]
ja 0x1000e334
add esi, dword [esp + 0x28]
push edi
push dword [esp + 4]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, dword [esp + 0x30]
add esi, edi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
mov eax, esi
je 0x1000e314
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1000dec3
cmp dword [esp + 0x2c], 0
je 0x1000dec3
cmp dword [esp + 0x24], 0
je 0x1000dec3
cmp byte [esp + 0x3c], 0
je 0x1000dec3
cmp edi, 0x64
ja 0x1000dec3
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x1000e395
mov ecx, dword [esp + 0x38]
cmp esi, ecx
jae 0x1000e3b2
mov byte [eax + esi], 0xe9
mov esi, dword [esp + 0x30]
inc esi
mov dword [esp + 0x30], esi
cmp dword [esp + 0x20], 0
je 0x1000e328
mov ecx, dword [esp + 0x38]
lea eax, [esi + 4]
cmp eax, ecx
ja 0x1000e3a8
mov eax, dword [esp]
add eax, edi
mov ecx, dword [esp + 0x2c]
add ecx, esi
sub eax, ecx
add eax, 0xfffffffc
mov ecx, dword [esp + 0x28]
mov dword [ecx + esi], eax
add dword [esp + 0x30], 4
cmp byte [esp + 0x3c], 0
je 0x1000dec3
cmp dword [esp + 0x20], 0
je 0x1000dec3
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
je 0x1000dec3
mov edx, dword [esp + 0x68]
lea ecx, [esp + 0xb8]
mov dword [ecx - 0x20], edx
mov eax, dword [esp]
mov dword [ecx - 0x1c], eax
mov dword [ecx - 0x18], edi
xor ebx, ebx
mov dword [ecx - 0x14], ebx
mov dword [ecx - 0x10], ebx
mov dword [ecx - 8], ebx
mov dword [ecx - 4], 0x10
mov dword [ecx - 0xc], ecx
mov byte [ecx + 0x10], 1
lea esi, [esp + 0xcc]
mov ecx, esi
push edi
push eax
call fcn.1000e7f0
add esp, 8
cmp dword [esi + 8], ebx
je 0x1000de3c
cmp byte [esp + 0xc8], 0
je 0x1000de3c
lea esi, [esp + 0xac]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x1000e3da
mov ecx, dword [esp + 0xac]
mov byte [ecx + eax], 0xe9
mov edi, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
inc eax
mov dword [esp + 0xb0], eax
inc edi
mov dword [esp + 0xa4], edi
add edi, dword [esp + 0x9c]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 0xb4]
ja 0x1000e3f8
mov ecx, dword [ebp + 8]
sub ecx, edi
add ecx, 0xfffffffc
mov edx, dword [esp + 0xac]
mov dword [edx + eax], ecx
mov eax, dword [esp + 0xb0]
add eax, 4
mov dword [esp + 0xb0], eax
add dword [esp + 0xa4], 4
cmp dword [esp + 0xd4], 0
je 0x1000de3c
cmp byte [esp + 0xc8], 0
je 0x1000de3c
test eax, eax
je 0x1000de33
mov ecx, dword [esp + 0xa8]
add ecx, dword [esp + 0x9c]
push eax
push dword [esp + 0xb0]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [esp + 0xb0]
add dword [esp + 0xa8], eax
mov dword [esp + 0xb0], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 4]
mov dword [eax], ecx
mov eax, dword [0x1009ba58]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000df70
mov esi, dword [esp + 0xd0]
mov eax, dword [esp + 0xd4]
test eax, eax
je 0x1000de97
mov edi, dword [0x1009ba54]
lea ebx, [esi + eax*8]
lea eax, [esp + 0x74]
push eax
push dword [esi]
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 8
cmp esi, ebx
jne 0x1000de78
mov esi, dword [esp + 0xd0]
lea eax, [esp + 0xdc]
mov dword [eax - 8], 0
cmp esi, eax
jne 0x1000e3bc
mov eax, dword [esp + 0xac]
lea ecx, [esp + 0xb8]
cmp eax, ecx
jne 0x1000e3cb
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x1000e2d0
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
setne bl
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1000def8
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1000def8
lea edx, [esp + 0x24]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [esp + 0x60], 0
je 0x1000df13
mov eax, dword [esp + 0x48]
test eax, eax
je 0x1000df13
mov ecx, dword [esp + 0x44]
test ecx, ecx
jne 0x1000e285
mov ecx, dword [esp + 0xf0]
xor ecx, ebp
call fcn.100468e0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1009ba64
call fcn.10046148
add esp, 4
cmp dword [0x1009ba64], 0xffffffff
jne 0x1000d6bb
lea esi, [esp + 0x98]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov esi, dword [esp]
mov dword [0x1009ba60], eax
push 0x1009ba64
call fcn.100460fe
add esp, 4
jmp 0x1000d6bb
push 0x1009ba58
call fcn.10046148
add esp, 4
cmp dword [0x1009ba58], 0xffffffff
jne 0x1000de5d
lea esi, [esp + 0x74]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x1009ba54], eax
push 0x1009ba58
call fcn.100460fe
add esp, 4
jmp 0x1000de5d
push 0x1009ba58
call fcn.10046148
add esp, 4
cmp dword [0x1009ba58], 0xffffffff
jne 0x1000d789
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x1009ba54], eax
push 0x1009ba58
call fcn.100460fe
add esp, 4
jmp 0x1000d789
push 0x1009ba58
call fcn.10046148
add esp, 4
cmp dword [0x1009ba58], 0xffffffff
jne 0x1000d7cc
lea ebx, [esp + 0x98]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebx + 4]
mov dword [0x1009ba54], eax
push 0x1009ba58
call fcn.100460fe
add esp, 4
jmp 0x1000d7cc
mov cl, 2
test al, 2
jne 0x1000dec3
or al, cl
inc ebx
jmp 0x1000da2b
cmp byte [edi + 1], 0x25
mov edx, edi
jne 0x1000d552
mov eax, dword [edi + 2]
mov edx, dword [eax]
jmp 0x1000d552
movsx eax, byte [edi + 1]
add eax, edi
add eax, 2
mov ecx, eax
sub ecx, edi
shl ecx, 0x18
add ecx, 0xfe000000
mov edx, edi
test ecx, ecx
jle 0x1000d552
sar ecx, 0x18
xor edx, edx
cmp byte [edx + edi + 2], 0x90
jne 0x1000e427
inc dl
movsx edx, dl
cmp ecx, edx
jg 0x1000e080
mov edx, eax
jmp 0x1000d552
add ebx, 5
jmp 0x1000db22
test edi, edi
jne 0x1000e33e
mov ecx, eax
and ecx, 7
cmp ecx, 5
je 0x1000e34d
cmp ecx, 4
jne 0x1000e58e
mov ecx, dword [esp]
mov cl, byte [ecx + ebx + 2]
and cl, 7
xor edx, edx
cmp cl, 5
sete dl
lea ecx, [edx*4 + 1]
jmp 0x1000e34d
mov cl, 4
test al, 4
je 0x1000e03d
jmp 0x1000dec3
mov cl, 8
test al, 8
je 0x1000e03d
jmp 0x1000dec3
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_mPolicies___mPolicies__empty___
int3
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_isSome___
int3
lea esi, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], esi
mov dword [ecx + 4], 0
call fcn.10045fe0
mov dword [esp + 4], eax
cmp byte [esi + 8], 0
je 0x1000d5e9
lea ecx, [esp + 0x40]
call fcn.10076bb0
mov edi, eax
jmp 0x1000d5e9
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov eax, ecx
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x1000e1ac
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov dword [esp + 8], edx
mov ecx, dword [esp + 4]
shr edx, 1
lea eax, [edx + edx*2]
lea eax, [ebx + eax*4]
cmp dword [eax], ecx
jae 0x1000e1a3
add eax, 0xc
not edx
add edx, dword [esp + 8]
mov ebx, eax
mov dword [esp + 8], edx
test edx, edx
jg 0x1000e182
jmp 0x1000e1ac
jne 0x1000e199
cmp dword [eax + 4], edi
jb 0x1000e18e
jmp 0x1000e199
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*2]
mov ecx, dword [esp + 0x14]
lea eax, [ecx + eax*4]
cmp ebx, eax
je 0x1000e1cf
mov eax, dword [esp + 4]
cmp dword [ebx], eax
ja 0x1000e1cf
cmp dword [ebx + 4], edi
jae 0x1000d67a
lea ecx, [esp + 0x98]
mov dword [ecx + 4], edi
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov edi, ecx
push 0x14
call sym.mozglue.dll_moz_xmalloc
add esp, 4
xorps xmm0, xmm0
movups xmmword [eax + 4], xmm0
mov dword [edi + 8], eax
mov ecx, esi
mov edx, ebx
push edi
call fcn.10076a60
add esp, 4
mov ebx, eax
mov eax, dword [edi + 8]
test eax, eax
je 0x1000d67a
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x1000d67a
mov ecx, edi
call fcn.1004b4a0
test al, al
cmovne esi, edi
jmp 0x1000d55e
mov dword [esp + 0x9c], 0
jmp 0x1000d812
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
mov dword [esp], eax
mov al, byte [esp + 0xb4]
mov byte [esp + 4], al
jmp 0x1000d85b
mov dword [esp + 4], 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov ebx, dword [esp + 0x14]
add ebx, 4
mov dword [esp + 0x30], ebx
jmp 0x1000d998
lea edx, [esp + 0x44]
push edx
push ecx
push dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000df13
mov byte [esp + 0x3c], 0
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [esp + 4], edi
mov edx, ecx
mov esi, dword [esp]
jmp 0x1000d978
mov dword [esp + 4], 0
jmp 0x1000d998
mov dword [esp + 0x30], esi
mov dword [esp + 4], 0
jmp 0x1000da13
xor esi, esi
mov dword [esp + 0x30], esi
push esi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
cmp dword [esp + 0x20], esi
je 0x1000e7d0
cmp dword [esp + 0x38], 3
jbe 0x1000e7dd
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
add dword [esp + 0x30], 4
jmp 0x1000decf
mov byte [esp + 0x3c], 0
xor eax, eax
mov esi, ebx
jmp 0x1000d9ea
mov dword [esp + 0x30], eax
cmp edi, 0x64
ja 0x1000dec3
mov ecx, dword [esp + 0xc]
test ecx, ecx
jns 0x1000e395
inc eax
mov esi, eax
add esi, 4
mov dword [esp + 0x30], esi
jmp 0x1000dcd6
mov byte [esp + 0x3c], 0
jmp 0x1000dc45
mov ecx, 2
cmp edi, 1
je 0x1000e34d
mov ecx, 5
and al, 7
xor edx, edx
cmp al, 4
sete dl
add edx, ecx
jmp 0x1000daaf
mov eax, dword [esp]
mov al, byte [eax + ebx + 1]
cmp al, 0xc0
jb 0x1000e552
add ebx, 3
jmp 0x1000db22
cmp al, 0xff
je 0x1000e5a2
cmp eax, 0xe9
je 0x1000e596
cmp eax, 0x6a
je 0x1000e54a
jmp 0x1000dec3
mov eax, dword [esp + 0x34]
add ecx, eax
add ecx, 5
cmp ecx, dword [esp + 0x38]
jbe 0x1000e572
mov byte [esp + 0x3c], 0
jmp 0x1000dcd6
mov byte [esp + 0x3c], 0
jmp 0x1000dcaf
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x1000dead
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
jmp 0x1000dec3
xor edx, edx
inc edx
mov ecx, esi
call fcn.10076940
test al, al
je 0x1000e762
mov eax, dword [esp + 0xb0]
jmp 0x1000dd6b
mov ecx, esi
mov edx, 4
call fcn.10076940
test al, al
je 0x1000e77d
mov eax, dword [esp + 0xb0]
jmp 0x1000ddab
mov cl, 1
test al, 1
je 0x1000e03d
jmp 0x1000dec3
mov edx, edi
jmp 0x1000d552
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x98]
mov dword [ecx], eax
mov dword [ecx + 4], 0
call fcn.10045fe0
mov dword [esp + 8], eax
lea eax, [esp + 0x40]
cmp byte [eax + 8], 0
je 0x1000e78a
lea ecx, [esp + 0x40]
call fcn.10076bb0
mov dword [esp], eax
mov eax, dword [0x1009ba90]
mov ecx, dword [0x1009a3c8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000e79f
mov ecx, dword [0x1009ba8c]
test ecx, ecx
je 0x1000e5b8
lea eax, [esp + 0x74]
mov edx, dword [esp + 8]
mov dword [eax], edx
mov edx, dword [esp]
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], edx
movaps xmm0, xmmword [0x100892c0]
movups xmmword [esp + 0x98], xmm0
mov dword [esp + 0xa0], eax
call dword [section..00cfg]
xor eax, eax
inc eax
push eax
lea edx, [esp + 0x9c]
push edx
push eax
push 0x2000
push ebx
xor eax, eax
push eax
push dword [esp + 0x1c]
call ecx
mov dword [edi + 4], eax
test eax, eax
jne 0x1000d702
jmp 0x1000e4ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 4], 0
push 0x1009ba70
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
jmp 0x1000df13
mov eax, dword [esp]
mov al, byte [eax + ebx + 1]
and al, 0xfe
cmp al, 0x10
jne 0x1000dec3
lea eax, [ebx + 2]
lea ecx, [esp + 0x68]
mov dword [ecx + 8], eax
call fcn.10076df0
lea edi, [ebx + eax]
add edi, 2
jmp 0x1000dab3
mov eax, dword [esp]
cmp byte [eax + ebx + 1], 0xc0
jb 0x1000dec3
add ebx, 2
jmp 0x1000db22
mov ecx, eax
and cl, 0xc0
cmp cl, 0x40
jne 0x1000dec3
and al, 7
cmp al, 4
je 0x1000dec3
add ebx, 4
jmp 0x1000db22
mov ecx, dword [esp + 0xc]
add ecx, eax
inc ecx
mov edx, dword [esp + 0x28]
add eax, dword [esp + 0x2c]
mov esi, dword [esp]
sub esi, eax
add dword [edx + ecx], esi
jmp 0x1000dcd6
xor ecx, ecx
inc ecx
jmp 0x1000e34d
lea edi, [ebx + 5]
mov dword [esp + 0xc], ebx
jmp 0x1000dab3
mov eax, dword [esp]
cmp byte [eax + ebx + 1], 0x25
jne 0x1000dec3
add ebx, 6
jmp 0x1000db22
mov eax, dword [esp]
inc eax
mov ecx, dword [esp + 4]
mov edx, ebx
mov dword [esp], eax
push eax
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
mov ecx, dword [esp + 4]
mov edx, ebx
push dword [esp]
push dword [esp + 0xc]
call fcn.10076c00
add esp, 8
test eax, eax
je 0x1000e4f8
push 1
push 0x2000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1000d6ff
jmp 0x1000d6e7
mov byte [esp + 0xc8], 0
mov edi, dword [esp + 0xa4]
mov eax, dword [esp + 0xb0]
jmp 0x1000dd94
mov byte [esp + 0xc8], 0
jmp 0x1000de3c
mov dword [sym.mozglue.dll_gMozCrashReason], str.MOZ_RELEASE_ASSERT_isSome___
int3
push 0x1009ba90
call fcn.10046148
add esp, 4
cmp dword [0x1009ba90], 0xffffffff
jne 0x1000e48a
call fcn.10076da0
push 0x1009ba90
call fcn.100460fe
add esp, 4
jmp 0x1000e48a
mov dword [esp + 0x30], 4
jmp 0x1000decf
mov byte [esp + 0x3c], 0
jmp 0x1000decf