joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eda60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x100eda74
cmp dword [esi + 0x18], 0
je 0x100edab0
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100edaaa
mov ecx, dword [esi]
test ecx, ecx
je 0x100eda9a
push ecx
call fcn.100d9b50
add esp, 4
mov dword [esi], 0
mov eax, dword [esi + 0x18]
push 0
push eax
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
jmp 0x100edaac
xor eax, eax
pop esi
pop edi
pop ebp
ret
mov edi, dword [ebp + 0xc]
cmp dword [esi + 8], 0x1a
jne 0x100edaea
cmp dword [esi + 0x24], 1
jne 0x100edaea
cmp byte [edi], 2
jne 0x100edaea
push 2
push 0x101c53c4
push eax
call fcn.100d7e50
add esp, 0xc
test eax, eax
je 0x100edae1
mov dword [esi + 0x24], 0
jmp 0x100edb06
mov dword [esi + 0x28], 1
mov eax, dword [esi]
push dword [ebp + 0x10]
push edi
push eax
call fcn.100d7e50
add esp, 0xc
mov dword [esi + 0x24], 0
test eax, eax
je 0x100eda7b
cmp dword [0x101f4f80], 0
je 0x100edb4b
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100edb33
mov eax, dword [eax + 0x28]
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, eax
mov dword [esi + 0x18], ecx
jmp 0x100eda7b
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100edb1f
call fcn.1001b2e0
jmp 0x100edb0f
Function at 0x100ee660
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
movups xmm0, xmmword [ebp + 0x1c]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x30]
sub esp, 0x1c
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
call fcn.100ef490
add esp, 0x1c
push 0x2c
call sym.nss3.dll_PORT_ZAlloc_Util
add esp, 4
test eax, eax
je 0x100ee6e4
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x1c], eax
mov dword [esi + 0xc], 0
push ebx
call sym.nss3.dll_NSS_CMSContentInfo_GetContentTypeTag
add esp, 4
mov edi, eax
add eax, 0xffffffe6
cmp eax, 4
ja case.0x100ee6d3.28
jmp dword [eax*4 + 0x101c5430]
push dword [ebx + 0xc]
call fcn.100efcb0
jmp 0x100ee72c
push 0
push 0xffffe013
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x100ee73d
push dword [ebx + 0xc]
call fcn.100eef90
jmp 0x100ee72c
push edi
call fcn.100f1180
add esp, 4
test eax, eax
je 0x100ee733
push dword [esi + 0x10]
push edi
call fcn.100f11c0
add esp, 8
jmp 0x100ee72f
push dword [ebx + 0xc]
call fcn.100edeb0
jmp 0x100ee72c
push dword [ebx + 0xc]
call fcn.100ee4b0
add esp, 4
test eax, eax
je 0x100ee746
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, esi
add eax, 0x14
push eax
push 0x100ee7c0
push 0x101c4bd0
push ebx
call fcn.100dab40
add esp, 0x10
mov dword [esi], eax
test eax, eax
je 0x100ee733
mov dword [esi + 4], 0
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x100ee779
cmp dword [ecx + 8], 0
jne 0x100ee782
mov dword [eax + 0xc], 1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x100ee850
mov dword [eax + 0x18], esi
mov dword [esi + 4], 1
xor edi, edi
push edi
push edi
push dword [esi]
call fcn.100da130
add esp, 0xc
test eax, eax
je 0x100ee7b1
push esi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
jmp 0x100ee73f
mov edi, esi
jmp 0x100ee73f
Function at 0x100f0a90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x100f0ad9
add eax, 0x14
push eax
call sym.nss3.dll_SECOID_FindOID_Util
add esp, 4
mov ecx, eax
xor eax, eax
test ecx, ecx
je case.0x100f0ad2.197
mov eax, dword [ecx + 0xc]
cmp eax, 0xc1
jle 0x100f0aec
cmp eax, 0x115
jg 0x100f0b02
lea ecx, [eax - 0xc2]
cmp ecx, 7
ja case.0x100f0ad2.197
jmp dword [ecx*4 + 0x101c54f0]
push 0
push 0xffffe005
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
jmp case.0x100f0ad2.197
cmp eax, 0x13
jg 0x100f0b1e
cmp eax, 0x11
je 0x100f0b3d
cmp eax, 0x13
jne case.0x100f0ad2.197
mov ecx, 3
jmp 0x100f0b40
cmp eax, 0x116
je case.0x100f0ad2.194
cmp eax, 0x117
je case.0x100f0ad2.195
cmp eax, 0x118
jne case.0x100f0ad2.197
mov ecx, 0xc1
jmp 0x100f0b40
cmp eax, 0x14
je case.0x100f0ad2.201
cmp eax, 0x7d
jne case.0x100f0ad2.197
mov ecx, 4
jmp 0x100f0b40
mov ecx, 0xbf
jmp 0x100f0b40
mov ecx, 0xc0
jmp 0x100f0b40
xor ecx, ecx
inc ecx
cmp ecx, eax
je case.0x100f0ad2.197
push ecx
call sym.nss3.dll_SECOID_FindOIDByTag_Util
add esp, 4
mov ecx, eax
mov eax, 0
test ecx, ecx
je case.0x100f0ad2.197
mov eax, dword [ecx + 0xc]
pop ebp
ret
Function at 0x100f0fe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, dword [ebp + 8]
xor esi, esi
dec esi
cmp dword [edi + 0x70], 1
jne 0x100f1127
mov ebx, dword [0x101f5014]
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x100f1046
cmp dword [eax], 0
je 0x100f1046
push 1
push 0xb6
push eax
call fcn.100ec8b0
add esp, 0xc
test eax, eax
je 0x100f1046
push eax
call fcn.100ec2f0
add esp, 4
test eax, eax
je 0x100f1127
push eax
push ebx
call fcn.100f18f0
add esp, 8
test eax, eax
je 0x100f1127
mov edi, eax
xor ebx, ebx
jmp 0x100f106a
mov edi, dword [edi + 0x5c]
test edi, edi
je 0x100f10e0
mov eax, dword [edi + 0x118]
test eax, eax
je 0x100f1127
mov bl, 1
cmp byte [eax], 0
je 0x100f1127
cmp dword [0x101f4f80], 0
je 0x100f1172
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100f1157
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
xor eax, eax
test ecx, ecx
je 0x100f10fe
cmp dword [ecx], 0
mov esi, 0
je 0x100f1100
xor eax, eax
inc eax
push eax
push 0x28
push ecx
call fcn.100ec8b0
add esp, 0xc
push eax
call fcn.100ec2f0
add esp, 4
mov esi, eax
xor eax, eax
inc eax
push eax
push 0x23
mov eax, dword [ebp + 8]
push dword [eax + 0x2c]
call fcn.100ec8b0
add esp, 0xc
push eax
call fcn.100ec2f0
add esp, 4
jmp 0x100f1100
test ebx, ebx
je 0x100f1127
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100f1131
cmp eax, 1
jne 0x100f114e
push dword [edi + 0x10]
push ebx
call fcn.1007e480
jmp 0x100f113a
xor esi, esi
push eax
push esi
push edi
call sym.nss3.dll_CERT_SaveSMimeProfile
add esp, 0xc
mov esi, eax
test bl, bl
jne 0x100f111a
push edi
call sym.nss3.dll_CERT_DestroyCertificate
add esp, 4
push 0
push dword [ebp - 0x10]
call sym.nss3.dll_PR_SetError
add esp, 8
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [edi + 0x10]
push ebx
call sym.nss3.dll_CERT_FindCertByIssuerAndSN
add esp, 8
mov ecx, edi
mov edi, eax
mov dword [ecx + 0x5c], eax
test eax, eax
jne 0x100f1051
jmp 0x100f1127
mov dword [edi + 0x5c], 0
jmp 0x100f1127
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100f108b
call fcn.1001b2e0
jmp 0x100f1077
Function at 0x100f4470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [esi + 0x170]
call sym.nss3.dll_PR_GetMonitorEntryCount
add esp, 4
mov byte [ebp - 0x12], bl
mov ecx, edi
mov byte [ebp - 0x11], cl
mov ebx, eax
test eax, eax
jg 0x100f44bc
test byte [esi + 0x1d], 4
jne 0x100f44bc
push dword [esi + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
cmp dword [ebp + 0xc], 2
jne 0x100f44d4
cmp dword [esi + 0xc4], 0
je 0x100f44d4
push esi
call fcn.1010e6a0
add esp, 4
push esi
call fcn.1011f780
add esp, 4
test eax, eax
je 0x100f4508
mov edi, eax
test ebx, ebx
jg 0x100f4658
test byte [esi + 0x1d], 4
jne 0x100f4658
push dword [esi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
jmp 0x100f4658
test byte [esi + 0x1d], 4
jne 0x100f451c
push dword [esi + 0x168]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
cmp dword [esi + 0xa24], 1
jne 0x100f4537
push 0x40000000
push esi
call fcn.100f27c0
add esp, 8
mov edi, eax
jmp 0x100f45b5
mov eax, dword [esi + 0xa0]
test eax, eax
je 0x100f45b9
mov ecx, dword [esi + 0xa4]
test ecx, ecx
je 0x100f45b9
push 0x40000000
push ecx
push eax
push 0x16
push 0
push esi
call fcn.100f5910
add esp, 0x18
test eax, eax
js 0x100f456f
xor edi, edi
cmp eax, dword [esi + 0xa4]
jb 0x100f4599
jmp 0x100f45ab
cmp dword [0x101f4f80], 0
je 0x100f4687
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100f466c
cmp dword [eax + 0x28], 0xffffe892
jne 0x100f45a8
push 0
push 0xffffe001
call sym.nss3.dll_PR_SetError
add esp, 8
xor edi, edi
dec edi
mov dword [esi + 0xa4], 0
test edi, edi
jne 0x100f45e0
xor eax, eax
cmp dword [ebp + 0x10], 0x29
sete al
shl eax, 0x1e
lea ecx, [ebp - 0x12]
push eax
push 2
push ecx
push 0x15
push 0
push esi
call fcn.100f5910
add esp, 0x18
mov edi, eax
sar edi, 0x1f
and edi, eax
cmp dword [ebp + 0xc], 2
jne 0x100f45f0
mov dword [esi + 0x6bc], 1
test byte [esi + 0x1d], 4
jne 0x100f4604
push dword [esi + 0x168]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
test ebx, ebx
jg 0x100f461c
test byte [esi + 0x1d], 4
jne 0x100f461c
push dword [esi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
test edi, edi
jne 0x100f4658
mov ecx, dword [esi + 0xfc]
xor edi, edi
test ecx, ecx
je 0x100f4658
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov byte [edx], al
mov eax, dword [ebp + 0x10]
mov byte [edx + 1], al
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
mov ebx, dword [esi + 0x100]
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 0x18]
call ecx
add esp, 0xc
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100f4590
call fcn.1001b2e0
jmp 0x100f457c
Function at 0x100f62e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x100f6379
mov edi, dword [ebp + 0x10]
test edi, edi
js 0x100f6379
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1fc], 0x401
jb 0x100f631e
push edx
call fcn.10116900
mov edx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x100f64ad
mov dword [ebp - 0x18], 0
test edi, edi
je 0x100f633c
mov eax, dword [edx + 0x50]
test eax, eax
je 0x100f633c
cmp byte [ebx], al
jne 0x100f6379
inc ebx
dec edi
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp edi, 2
jb 0x100f6385
test byte [edx + 0x1e], 2
je 0x100f6390
movzx eax, word [edx + 0x58]
cmp eax, 0x302
jae 0x100f6390
mov eax, dword [edx + 0x3b8]
mov ecx, dword [eax + 0x14]
lea eax, [edx + 0x168]
mov dword [ebp - 0x14], eax
mov eax, 0x4000
cmp edi, eax
cmovl eax, edi
cmp dword [ecx + 0x10], 1
jne 0x100f63a3
xor eax, eax
inc eax
jmp 0x100f63a3
push 0
push 0xffffe89d
jmp 0x100f64b4
xor esi, esi
cmp edi, 1
jne 0x100f6482
lea eax, [edx + 0x168]
mov dword [ebp - 0x14], eax
mov eax, 0x4000
cmp edi, eax
cmovl eax, edi
push dword [ebp + 0x14]
push eax
push ebx
push 0x17
push 0
push edx
call fcn.100f5910
add esp, 0x18
test eax, eax
js 0x100f64bc
mov esi, eax
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1fc], 0
jne 0x100f648e
jmp 0x100f6442
test esi, esi
jle 0x100f640e
test byte [edx + 0x1d], 4
jne 0x100f63eb
mov eax, dword [ebp - 0x14]
push dword [eax]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
push 0
call sym.nss3.dll_PR_Sleep
add esp, 4
mov edx, dword [ebp + 8]
test byte [edx + 0x1d], 4
jne 0x100f640e
mov eax, dword [ebp - 0x14]
push dword [eax]
call sym.nss3.dll_PR_EnterMonitor
mov edx, dword [ebp + 8]
add esp, 4
mov eax, 0x4000
cmp ebx, eax
cmovge ebx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
push dword [ebp + 0x14]
push ebx
push eax
push 0x17
push 0
push edx
mov ebx, edx
call fcn.100f5910
add esp, 0x18
test eax, eax
js 0x100f644d
add esi, eax
cmp dword [ebx + 0x1fc], 0
mov edx, ebx
jne 0x100f648e
mov ebx, edi
sub ebx, esi
jg 0x100f63d4
mov ebx, dword [ebp - 0x10]
jmp 0x100f6482
test esi, esi
jle 0x100f64bc
cmp dword [0x101f4f80], 0
mov edi, 0xffffffff
je 0x100f64f5
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
mov ebx, dword [ebp - 0x10]
je 0x100f64dd
cmp dword [eax + 0x28], 0xffffe892
mov edx, dword [ebp + 8]
jne 0x100f64bf
cmp dword [edx + 0x1fc], 0
je 0x100f64cf
mov dword [ebp - 0x10], ebx
test esi, esi
jle 0x100f64a2
mov eax, dword [ebp - 0x10]
movzx eax, byte [esi + eax - 1]
or eax, 0x100
mov dword [edx + 0x50], eax
mov ecx, dword [ebp - 0x18]
lea eax, [esi + ecx]
cmp eax, 1
jg 0x100f64c9
push 0
push 0xffffe892
call sym.nss3.dll_PR_SetError
add esp, 8
xor edi, edi
dec edi
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
lea edi, [esi + ecx]
dec edi
jmp 0x100f64bf
mov dword [edx + 0x50], 0
add esi, dword [ebp - 0x18]
mov edi, esi
jmp 0x100f64bf
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100f6476
call fcn.1001b2e0
jmp 0x100f6463
Function at 0x100f6500
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0xa24], 1
jne 0x100f6517
pop esi
pop ebp
jmp fcn.100f27c0
mov ecx, dword [esi + 0xa0]
xor eax, eax
test ecx, ecx
je 0x100f65af
mov edx, dword [esi + 0xa4]
test edx, edx
je 0x100f65af
mov eax, dword [ebp + 0xc]
test eax, 0xbfffffff
je 0x100f654f
push 0
push 0xffffe005
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
jmp 0x100f65af
push eax
push edx
push ecx
push 0x16
push 0
push esi
call fcn.100f5910
add esp, 0x18
test eax, eax
js 0x100f6571
mov ecx, eax
xor eax, eax
cmp ecx, dword [esi + 0xa4]
jb 0x100f6593
jmp 0x100f65a5
cmp dword [0x101f4f80], 0
je 0x100f65ca
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100f65b2
cmp dword [eax + 0x28], 0xffffe892
jne 0x100f65a2
push 0
push 0xffffe001
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
mov dword [esi + 0xa4], 0
pop esi
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100f658a
call fcn.1001b2e0
jmp 0x100f657a

Function at 0x100f6860
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0xd], 1
cmp dword [edi + 0xa24], 1
jne 0x100f6895
push 0x40000000
push edi
call fcn.100f27c0
add esp, 8
jmp 0x100f691d
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x100f6944
mov ecx, dword [edi + 0xa4]
test ecx, ecx
je 0x100f6944
push 0x40000000
push ecx
push eax
push 0x16
push 0
push edi
call fcn.100f5910
add esp, 0x18
test eax, eax
js 0x100f68d7
mov ecx, eax
xor eax, eax
cmp ecx, dword [edi + 0xa4]
jb 0x100f6901
jmp 0x100f6913
cmp dword [0x101f4f80], 0
je 0x100f6995
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100f697a
cmp dword [eax + 0x28], 0xffffe892
jne 0x100f6910
push 0
push 0xffffe001
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
mov dword [edi + 0xa4], 0
xor esi, esi
dec esi
test eax, eax
jne 0x100f6967
cmp dword [edi + 0xa24], 1
jne 0x100f6944
lea eax, [ebp - 0xd]
push 1
push eax
push 0x14
push edi
call fcn.100f2650
add esp, 0x10
test eax, eax
jne 0x100f6967
jmp 0x100f6960
lea eax, [ebp - 0xd]
push 0x40000000
push 1
push eax
push 0x14
push 0
push edi
call fcn.100f5910
add esp, 0x18
test eax, eax
js 0x100f6964
xor esi, esi
jmp 0x100f6967
xor esi, esi
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10157a00
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x100f68f8
call fcn.1001b2e0
jmp 0x100f68e4
Function at 0x100f8c50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov edi, dword [0x101f5a4c]
test edi, edi
je 0x100f8d5b
mov eax, dword [0x101f45d4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
test eax, eax
je 0x100f8d64
lea eax, [edi + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [edi + 8], esi
mov esi, 0xfffffe98
mov eax, dword [esi + 0x101f5bb8]
test eax, eax
je 0x100f8cb4
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f5bb8], 0
mov eax, dword [esi + 0x101f5bbc]
test eax, eax
je 0x100f8cd0
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f5bbc], 0
mov eax, dword [esi + 0x101f5bc0]
test eax, eax
je 0x100f8cec
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f5bc0], 0
mov eax, dword [esi + 0x101f5bc4]
test eax, eax
je 0x100f8d08
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f5bc4], 0
mov eax, dword [esi + 0x101f5bc8]
test eax, eax
je 0x100f8d24
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f5bc8], 0
mov eax, dword [esi + 0x101f5bcc]
test eax, eax
je 0x100f8d40
mov dword [esp], eax
call sym.nss3.dll_PK11_FreeSymKey
mov dword [esi + 0x101f5bcc], 0
add esi, 0x18
jne 0x100f8c98
mov eax, dword [0x101f5a4c]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
call fcn.1010d1f0
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
mov esi, eax
jmp 0x100f8c81
Function at 0x100fcab0
Capabilities:
Get thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xdc
mov eax, dword [0x101f1014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x101f6070], 0
je 0x100fcadf
mov edi, dword [ebp + 0x10]
push edi
call sym.nss3.dll_PK11_ExtractKeyValue
add esp, 4
test eax, eax
je 0x100fcaf4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10157a00
add esp, 0xdc
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x100fcadf
mov ebx, dword [ebp + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, dword [edi + 0x20]
lea eax, [eax + ecx*2]
add eax, 0x43
cmp eax, 0xc8
ja 0x100fcadf
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xdc], ecx
lea eax, [ecx + ecx]
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0xd8]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [ebp - 0xe0], eax
lea edx, [eax + ebp]
add edx, 0xffffff29
add byte [edx - 1], 0x20
xor ecx, ecx
mov edi, dword [ebp + 8]
movzx edi, byte [edi + ecx + 0x410]
mov ebx, edi
shr ebx, 4
mov bl, byte [ebx + 0x101c5feb]
mov byte [edx + ecx*2], bl
and edi, 0xf
mov bl, byte [edi + 0x101c5feb]
mov byte [edx + ecx*2 + 1], bl
inc ecx
cmp ecx, 0x20
jne 0x100fcb5a
add eax, 0x42
lea ecx, [ebp - 0xd8]
mov edx, dword [ebp - 0xe0]
mov byte [edx + ecx + 0x41], 0x20
cmp dword [ebp - 0xdc], 0
je 0x100fcbd8
lea ecx, [eax + ebp]
add ecx, 0xffffff28
xor edx, edx
movzx edi, byte [esi + edx]
shr edi, 4
mov bl, byte [edi + 0x101c5feb]
mov byte [ecx + edx*2], bl
movzx edi, byte [esi + edx]
and edi, 0xf
mov bl, byte [edi + 0x101c5feb]
mov byte [ecx + edx*2 + 1], bl
inc edx
cmp dword [ebp - 0xdc], edx
jne 0x100fcbae
add eax, dword [ebp - 0xe4]
mov byte [ebp + eax - 0xd8], 0xa
mov edi, dword [0x101f6074]
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x100fcc50
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
push dword [0x101f6070]
push 1
push dword [ebp - 0xe8]
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x100fcc3d
push dword [0x101f6070]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
add esp, 4
push dword [0x101f6074]
call sym.nss3.dll_PR_Unlock
add esp, 4
jmp 0x100fcadf
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
mov esi, eax
jmp 0x100fcbfe
Function at 0x1010b4f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov ebx, dword [eax + 0x150]
mov esi, dword [ecx + 8]
mov eax, dword [esi]
mov ecx, dword [eax + 0x44]
mov edi, dword [ebp + 0x14]
call dword [section..00cfg]
push ebx
push edi
mov edi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push esi
call ecx
add esp, 0x14
mov esi, eax
test eax, eax
js 0x1010b535
cmp esi, edi
jle 0x1010b567
xor esi, esi
dec esi
mov ecx, 0xffffe8b6
jmp 0x1010b55c
cmp dword [0x101f4f80], 0
je 0x1010b586
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1010b56e
mov ecx, 0xffffe8b7
cmp dword [eax + 0x28], 0xffffe8d7
jne 0x1010b567
push 0
push ecx
call sym.nss3.dll_PR_SetError
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x1010b54e
call fcn.1001b2e0
jmp 0x1010b53e

Function at 0x1010b590
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [eax + 0x48]
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x18], eax
sub esi, edi
mov eax, dword [ebp + 0xc]
add eax, edi
mov dword [ebp - 0x14], eax
call dword [section..00cfg]
push dword [ebp - 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call ecx
add esp, 0x14
mov esi, eax
test eax, eax
js 0x1010b603
add edi, esi
cmp dword [ebx + 0xa24], 1
mov esi, dword [ebp + 0x10]
jne 0x1010b5f4
cmp edi, esi
jl 0x1010b5ff
cmp edi, esi
jl 0x1010b5a9
mov dword [ebx + 0x44], 0
mov esi, edi
jmp 0x1010b655
cmp dword [0x101f4f80], 0
je 0x1010b677
push dword [0x101f45d4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1010b65f
mov eax, dword [eax + 0x28]
cmp eax, 0xffffe892
jne 0x1010b638
mov dword [ebx + 0x44], 1
xor esi, esi
cmp edi, 1
sbb esi, esi
or esi, edi
jmp 0x1010b655
mov dword [ebx + 0x44], 0
cmp eax, 0xffffe8d8
jne 0x1010b655
push 0
push 0xffffe8b7
call sym.nss3.dll_PR_SetError
add esp, 8
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101b11e0]
movups xmmword [esp], xmm0
call fcn.1006e720
add esp, 0x10
jmp 0x1010b61c
call fcn.1001b2e0
jmp 0x1010b60c