joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1013e010
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
cmp dword [0x101d4d40], 0
je 0x1013e0c5
mov ebx, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1013e09e
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x1013e0b1
mov edi, dword [ebp - 0x14]
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x24]
cmp eax, esi
je 0x1013e08c
test eax, eax
jne 0x1013e077
cmp dword [ebx + 0x18], 0
je 0x1013e08c
inc dword [ebx + 0x14]
push 0xffffffffffffffff
push dword [ebx + 0x1c]
call sym.nss3.dll_PR_WaitCondVar
add esp, 8
dec dword [ebx + 0x14]
jmp 0x1013e066
inc dword [ebx + 0x10]
push dword [ebx]
call sym.nss3.dll_PR_Unlock
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x1013e03b
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x1013e053
call sym.nss3.dll_PR_Init
jmp 0x1013e026

Function at 0x1013e0d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
mov ebx, dword [edi]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1013e12d
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
mov eax, dword [edi + 0x10]
test eax, eax
jle 0x1013e11e
dec eax
mov dword [edi + 0x10], eax
jne 0x1013e11e
cmp dword [edi + 0x24], 0
jne 0x1013e11e
cmp dword [edi + 0x18], 0
je 0x1013e11e
push dword [edi + 0x20]
call sym.nss3.dll_PR_NotifyCondVar
add esp, 4
push dword [edi]
call sym.nss3.dll_PR_Unlock
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x1013e0ed
Function at 0x1013e140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
cmp dword [0x101d4d40], 0
je 0x1013e1f8
mov ebx, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1013e1d1
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x1013e1e4
mov edi, dword [ebp - 0x14]
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x24]
cmp eax, esi
je 0x1013e1bc
test eax, eax
jne 0x1013e1a7
cmp dword [ebx + 0x10], 0
je 0x1013e1bc
inc dword [ebx + 0x18]
push 0xffffffffffffffff
push dword [ebx + 0x20]
call sym.nss3.dll_PR_WaitCondVar
add esp, 8
dec dword [ebx + 0x18]
jmp 0x1013e196
mov dword [ebx + 0x24], esi
inc dword [ebx + 0xc]
push dword [ebx]
call sym.nss3.dll_PR_Unlock
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x1013e16b
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov dword [ebp - 0x10], eax
jmp 0x1013e183
call sym.nss3.dll_PR_Init
jmp 0x1013e156

Function at 0x1013e210
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp dword [0x101d4d40], 0
je 0x1013e2db
mov edi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1013e2af
mov ebx, dword [edi]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
test eax, eax
je 0x1013e2c5
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
mov dword [ebx + 8], edi
cmp dword [eax + 0x24], esi
mov esi, eax
je 0x1013e272
push dword [esi]
call sym.nss3.dll_PR_Unlock
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0xc]
test eax, eax
jle 0x1013e263
dec eax
mov dword [esi + 0xc], eax
jne 0x1013e263
mov dword [esi + 0x24], 0
cmp dword [esi + 0x18], 0
je 0x1013e29c
cmp dword [esi + 0x10], 0
jne 0x1013e263
push dword [esi + 0x20]
call sym.nss3.dll_PR_NotifyCondVar
jmp 0x1013e2aa
cmp dword [esi + 0x14], 0
je 0x1013e263
push dword [esi + 0x1c]
call sym.nss3.dll_PR_NotifyAllCondVar
add esp, 4
jmp 0x1013e263
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x1013e238
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov edi, eax
jmp 0x1013e24c
call sym.nss3.dll_PR_Init
jmp 0x1013e223
Function at 0x10145660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 8
mov eax, dword [0x101d2014]
mov ecx, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ecx + 8]
test eax, eax
je 0x1014569e
mov ecx, dword [ecx + 4]
xor edx, edx
mov bl, byte [ecx + edx]
mov esi, edx
inc edx
and esi, 3
xor byte [ebp + esi - 0x10], bl
cmp eax, edx
jne 0x10145688
mov esi, dword [ebp - 0x10]
jmp 0x101456a0
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 8
pop esi
pop ebx
pop ebp
ret

Function at 0x101463a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
js 0x101463c2
xor ecx, ecx
inc ecx
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
mov ecx, eax
test eax, eax
jne 0x101463ea
cmp dword [0x101d4d40], 0
je 0x101463ff
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101463ee
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, ecx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x101463db
call sym.nss3.dll_PR_Init
jmp 0x101463cb

Function at 0x10146410
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x101d4d40], 0
je 0x1014644f
mov esi, dword [ebp + 8]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1014643e
xor ecx, ecx
mov dword [eax + 0x28], esi
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
pop esi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10146430
call sym.nss3.dll_PR_Init
jmp 0x1014641d

Function at 0x10146460
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x1014647d
push eax
push dword [ebp + 8]
call dword [sym.imp.mozglue.dll_realloc]
add esp, 8
mov ecx, eax
test eax, eax
jne 0x101464a5
cmp dword [0x101d4d40], 0
je 0x101464ba
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101464a9
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, ecx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10146496
call sym.nss3.dll_PR_Init
jmp 0x10146486
Function at 0x101464d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
js 0x101464f4
xor ecx, ecx
inc ecx
test eax, eax
cmovne ecx, eax
push ecx
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
mov ecx, eax
test eax, eax
jne 0x1014651c
cmp dword [0x101d4d40], 0
je 0x10146531
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10146520
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, ecx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1014650d
call sym.nss3.dll_PR_Init
jmp 0x101464fd

Function at 0x10146540
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [ebp + 0x10], eax
ja 0x10146618
mov ebx, dword [ebp + 0xc]
lea edi, [ebx - 1]
test ebx, edi
sete cl
test ebx, ebx
setne dl
test dl, cl
je 0x1014659f
xor ecx, ecx
inc ecx
test eax, eax
cmove eax, ecx
add eax, edi
js 0x101465c5
test eax, eax
cmovne ecx, eax
push ecx
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
test eax, eax
je 0x101465c5
add edi, eax
neg ebx
and ebx, edi
je 0x10146618
mov ecx, dword [ebp + 0x10]
mov esi, ebx
mov dword [ebx + ecx], eax
jmp 0x10146618
cmp dword [0x101d4d40], 0
je 0x10146652
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1014661f
mov dword [eax + 0x28], 0xffffe005
jmp 0x10146610
cmp dword [0x101d4d40], 0
je 0x1014665c
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10146630
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101d4d40], ecx
je 0x10146666
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10146641
mov dword [eax + 0x28], 0xffffe013
xor esi, esi
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x101465bc
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x101465e2
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10146609
call sym.nss3.dll_PR_Init
jmp 0x101465ac
call sym.nss3.dll_PR_Init
jmp 0x101465d2
call sym.nss3.dll_PR_Init
jmp 0x101465f9
Function at 0x10146670
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov esi, eax
inc esi
js 0x101466ac
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
test eax, eax
je 0x101466ac
mov edi, eax
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x101466d4
cmp dword [0x101d4d40], 0
je 0x101466ec
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101466db
xor edi, edi
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], edi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x101466c5
call sym.nss3.dll_PR_Init
jmp 0x101466b5

Function at 0x10146700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x101d4d40], 0
je 0x10146732
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10146721
mov eax, dword [eax + 0x28]
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1014671c
call sym.nss3.dll_PR_Init
jmp 0x1014670c

Function at 0x10146740
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
test edi, edi
js 0x10146785
push 0x24
push 1
call dword [sym.imp.mozglue.dll_calloc]
add esp, 8
test eax, eax
je 0x10146785
mov esi, eax
mov dword [eax + 0x1c], 0xb8ac9bdf
call sym.nss3.dll_PR_NewLock
test eax, eax
mov dword [esi + 0x20], eax
je 0x101467b3
push 8
push edi
push str.security
push esi
call sym.nss3.dll_PL_InitArenaPool
add esp, 0x10
jmp 0x101467ad
cmp dword [0x101d4d40], 0
je 0x101467d2
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101467c1
xor esi, esi
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
pop esi
pop edi
pop ebp
ret
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
xor esi, esi
jmp 0x101467ad
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1014679e
call sym.nss3.dll_PR_Init
jmp 0x1014678e
Function at 0x10146810
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
test eax, eax
cmovne ebx, eax
test ebx, ebx
js 0x101468ca
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1c], 0xb8ac9bdf
jne 0x1014688b
mov edi, dword [edi + 0x20]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10146911
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
mov edi, dword [ebp + 8]
xor esi, esi
mov eax, dword [edi + 0x18]
lea ecx, [eax + ebx]
not eax
and eax, ecx
cmp eax, ebx
jb 0x101468bb
mov ecx, dword [edi + 0x10]
mov esi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
sub edx, esi
cmp eax, edx
jbe 0x101468b6
push eax
push edi
call sym.nss3.dll_PL_ArenaAllocate
add esp, 8
mov esi, eax
jmp 0x101468bb
mov eax, dword [edi + 0x18]
lea ecx, [eax + ebx]
not eax
and eax, ecx
cmp eax, ebx
jb 0x101468ca
mov ecx, dword [edi + 0x10]
mov esi, dword [ecx + 0xc]
mov edx, dword [ecx + 8]
sub edx, esi
cmp eax, edx
jbe 0x101468f9
push eax
push edi
call sym.nss3.dll_PL_ArenaAllocate
add esp, 8
mov esi, eax
jmp 0x101468c6
add eax, esi
mov dword [ecx + 0xc], eax
push dword [edi + 0x20]
call sym.nss3.dll_PR_Unlock
add esp, 4
test esi, esi
jne 0x101468f2
cmp dword [0x101d4d40], 0
je 0x10146927
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10146900
xor esi, esi
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
add eax, esi
mov dword [ecx + 0xc], eax
jmp 0x101468c6
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x101468e3
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x1014684e
call sym.nss3.dll_PR_Init
jmp 0x101468d3
Function at 0x10146930
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x101469da
xor edi, edi
mov eax, dword [ebp + 0xc]
cmp dword [ebx + 0x1c], 0xb8ac9bdf
jne 0x10146974
mov edi, dword [ebx + 0x20]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x101469df
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], esi
test eax, eax
je 0x10146983
push 0
push ebx
call sym.nss3.dll_PL_ClearArenaPool
add esp, 8
push 0x10146a00
push 0x101d6144
call sym.nss3.dll_PR_CallOnce
add esp, 8
cmp dword [0x101d6150], 0
je 0x101469a6
push ebx
call sym.nss3.dll_PL_FreeArenaPool
jmp 0x101469ac
push ebx
call sym.nss3.dll_PL_FinishArenaPool
add esp, 4
push ebx
call dword [sym.imp.mozglue.dll_free]
add esp, 4
test edi, edi
je 0x101469da
push edi
call sym.nss3.dll_PR_Unlock
add esp, 4
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x10146964
Function at 0x10146a70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
test ebx, ebx
js 0x10146b0d
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1c], 0xb8ac9bdf
jne 0x10146b3b
mov edi, dword [edx + 0x20]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10146bb8
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov edx, dword [ebp + 8]
mov dword [edi + 8], esi
mov eax, dword [ebp + 0x10]
xor esi, esi
mov ecx, dword [edx + 0x18]
sub ebx, eax
mov edi, ecx
lea eax, [ecx + ebx]
not edi
and eax, edi
cmp eax, ebx
jb 0x10146b89
add ecx, dword [ebp + 0x10]
mov edx, dword [edx + 0x10]
and ecx, edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edx + 0xc]
add ecx, edi
cmp esi, ecx
jne 0x10146af6
mov ecx, dword [edx + 8]
sub ecx, esi
cmp eax, ecx
jbe 0x10146b7f
push ebx
push dword [ebp + 0x10]
push edi
mov esi, dword [ebp + 8]
push esi
call sym.nss3.dll_PL_ArenaGrow
mov edx, esi
add esp, 0x10
mov esi, eax
jmp 0x10146b89
cmp dword [0x101d4d40], 0
je 0x10146bce
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10146ba4
xor esi, esi
mov dword [eax + 0x28], 0xffffe013
mov dword [eax + 0x2c], esi
mov dword [eax + 0x30], esi
jmp 0x10146b94
mov ecx, dword [edx + 0x18]
sub ebx, dword [ebp + 0x10]
xor esi, esi
mov edi, ecx
lea eax, [ecx + ebx]
not edi
and eax, edi
cmp eax, ebx
jb 0x10146b94
add ecx, dword [ebp + 0x10]
mov edx, dword [edx + 0x10]
and ecx, edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edx + 0xc]
add ecx, edi
cmp esi, ecx
jne 0x10146b6d
mov ecx, dword [edx + 8]
sub ecx, esi
cmp eax, ecx
jbe 0x10146b9b
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sym.nss3.dll_PL_ArenaGrow
add esp, 0x10
jmp 0x10146b96
add esi, eax
mov dword [edx + 0xc], esi
mov edx, dword [ebp + 8]
mov esi, edi
push dword [edx + 0x20]
call sym.nss3.dll_PR_Unlock
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
add esi, eax
mov dword [edx + 0xc], esi
mov esi, edi
jmp 0x10146b94
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10146b2a
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x10146aaa
call sym.nss3.dll_PR_Init
jmp 0x10146b1a

Function at 0x10146be0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x1c], 0xb8ac9bdf
jne 0x10146c27
mov ebx, dword [edi + 0x20]
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x10146c34
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
mov eax, dword [edi + 0x10]
mov esi, dword [eax + 0xc]
push dword [edi + 0x20]
call sym.nss3.dll_PR_Unlock
add esp, 4
jmp 0x10146c2d
mov eax, dword [edi + 0x10]
mov esi, dword [eax + 0xc]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov esi, eax
jmp 0x10146c07
Function at 0x10146c70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
cmp dword [ecx + 0x1c], 0xb8ac9bdf
mov edi, edx
mov ebx, ecx
jne 0x10146cdf
mov esi, dword [ebx + 0x20]
mov dword [ebp - 0x10], ebx
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
test eax, eax
je 0x10146dda
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
cmp dword [ebp + 8], 0
mov dword [esi + 8], ebx
je 0x10146d0e
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x10]
cmp dword [eax + 4], edi
ja 0x10146cc5
mov eax, dword [eax + 0xc]
sub eax, edi
jae 0x10146d13
mov esi, dword [ebx]
test esi, esi
je 0x10146d1f
cmp dword [esi + 4], edi
ja 0x10146cdb
mov eax, dword [esi + 0xc]
sub eax, edi
jae 0x10146d96
mov esi, dword [esi]
jmp 0x10146cc7
cmp dword [ebp + 8], 0
je 0x10146d63
mov eax, dword [ebx + 0x10]
cmp dword [eax + 4], edi
ja 0x10146cf4
mov eax, dword [eax + 0xc]
sub eax, edi
jae 0x10146d57
mov esi, dword [ebx]
test esi, esi
je 0x10146d63
cmp dword [esi + 4], edi
ja 0x10146d0a
mov eax, dword [esi + 0xc]
sub eax, edi
jae 0x10146dba
mov esi, dword [esi]
jmp 0x10146cf6
mov ebx, dword [ebp - 0x10]
jmp 0x10146d1f
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebx + 0x10]
mov esi, edi
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0xc]
sub esi, ecx
sub edx, ecx
cmp esi, edx
jbe 0x10146d3e
push edi
push ebx
call sym.nss3.dll_PL_ArenaRelease
add esp, 8
jmp 0x10146d4a
mov ecx, dword [ebx + 0x18]
add edi, ecx
not ecx
and ecx, edi
mov dword [eax + 0xc], ecx
push dword [ebx + 0x20]
call sym.nss3.dll_PR_Unlock
add esp, 8
jmp 0x10146d91
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebx + 0x10]
mov esi, edi
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0xc]
sub esi, ecx
sub edx, ecx
cmp esi, edx
jbe 0x10146d82
push edi
push ebx
call sym.nss3.dll_PL_ArenaRelease
add esp, 0xc
jmp 0x10146d91
mov ecx, dword [ebx + 0x18]
add edi, ecx
not ecx
and ecx, edi
mov dword [eax + 0xc], ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, dword [esi]
test esi, esi
je 0x10146d1f
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
sub ecx, eax
push ecx
push 0
push eax
jmp 0x10146d9a
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov esi, dword [esi]
test esi, esi
je 0x10146d63
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
sub ecx, eax
push ecx
push 0
push eax
jmp 0x10146dbe
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov ebx, eax
jmp 0x10146ca0

Function at 0x10146e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10146e39
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
mov bl, byte [edx + edi]
xor bl, byte [esi + edi]
inc edi
movzx ebx, bl
or eax, ebx
cmp ecx, edi
jne 0x10146e27
jmp 0x10146e3b
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret