joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010aec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
cmp dword [0x101f2f50], 0
je 0x1010af55
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1010af43
mov esi, dword [eax + 0x28]
cmp esi, 0xffffe022
jg 0x1010af14
lea eax, [esi + 0x2000]
cmp eax, 3
jb 0x1010af28
lea eax, [esi + 0x2ffa]
cmp eax, 2
jb 0x1010af28
cmp esi, 0xffffd05a
je 0x1010af28
jmp 0x1010af3b
cmp esi, 0xffffe023
je 0x1010af28
test esi, esi
je 0x1010af28
cmp esi, 0xffffe899
jne 0x1010af3b
mov esi, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], 0
call sym.nss3.dll_PR_SetError
mov eax, esi
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x1010aee9
call fcn.100029d0
jmp 0x1010aed4

Function at 0x1010bb80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x1010bbea
cmp dword [eax], 0
mov edi, dword [eax + 4]
je 0x1010bbc3
lea eax, [edi + 1]
cmp eax, 1
jbe 0x1010bbea
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x1010bc00
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x1010bbfc
cmp ecx, 0x80
je 0x1010bbfc
push 0
push 0xffffe896
jmp 0x1010bbf1
test edi, edi
je 0x1010bbea
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1010bc11
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
xor eax, eax
jmp 0x1010bbfc
push 0
push 0xffffe89d
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.101283b0
add esp, 4
jmp 0x1010bbf9
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1010bbd9
Function at 0x1010bd50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call sym.nss3.dll_PR_NewLock
mov esi, eax
mov dword [0x101f3a1c], eax
call sym.nss3.dll_PR_NewLock
mov dword [0x101f3ebc], eax
test esi, esi
je 0x1010bd7b
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1010be1f
cmp dword [0x101f2f50], 0
je 0x1010be3e
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1010be23
mov esi, dword [eax + 0x28]
mov edi, dword [0x101f3a1c]
test edi, edi
je 0x1010bdc9
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov dword [0x101f3a1c], 0
jmp 0x1010bdd8
push 0
push 0xffffe09a
call sym.nss3.dll_PR_SetError
add esp, 8
mov edi, dword [0x101f3ebc]
test edi, edi
je 0x1010be02
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
push edi
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov dword [0x101f3ebc], 0
jmp 0x1010be11
push 0
push 0xffffe09a
call sym.nss3.dll_PR_SetError
add esp, 8
push 0
push esi
call sym.nss3.dll_PR_SetError
add esp, 8
xor eax, eax
dec eax
pop esi
pop edi
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x1010bd9c
call fcn.100029d0
jmp 0x1010bd88

Function at 0x1010bf40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1010bfab
cmp byte [0x101f3eac], 0
jne 0x1010bf68
push 0x1010bd20
push 0x101f3eb0
call sym.nss3.dll_PR_CallOnce
add esp, 8
mov ebx, dword [0x101f3ebc]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1010bfb0
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
dec dword [edi + 8]
jne 0x1010bf9d
push 1
push edi
call fcn.1010be50
add esp, 8
push dword [0x101f3ebc]
call sym.nss3.dll_PR_Unlock
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1010bf80

Function at 0x1010bfd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
cmp byte [0x101f3eac], 0
jne 0x1010bff6
mov dword [esp + 4], 0x1010bd20
mov dword [esp], 0x101f3eb0
call sym.nss3.dll_PR_CallOnce
mov esi, dword [ebp + 8]
mov ebx, dword [0x101f3ebc]
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
test eax, eax
je 0x1010c042
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
mov dword [ebx + 8], edi
inc dword [esi + 8]
mov eax, dword [0x101f3ebc]
mov dword [esp], eax
call sym.nss3.dll_PR_Unlock
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
mov edi, eax
jmp 0x1010c016
Function at 0x1010c060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cmp dword [ebp + 0x1c], 0
je 0x1010c188
cmp byte [0x101f3eac], 0
jne 0x1010c08b
push 0x1010bd20
push 0x101f3eb0
call sym.nss3.dll_PR_CallOnce
add esp, 8
mov edi, dword [0x101f3ebc]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1010c19f
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
mov esi, dword [0x101f3ec0]
test esi, esi
je 0x1010c176
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, 0x101f3ec0
mov eax, dword [esi + 0x5c]
cmp dword [esi + 0x58], edi
sbb eax, ecx
jge 0x1010c0fd
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [esi + 4], 3
dec dword [esi + 8]
jne 0x1010c144
push 1
push esi
call fcn.1010be50
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
add esp, 8
jmp 0x1010c144
movdqu xmm0, xmmword [esi + 0x38]
movdqu xmm1, xmmword [edx]
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x1010c142
movzx eax, word [ebp + 0x14]
cmp word [esi + 0x48], ax
jne 0x1010c142
mov eax, dword [esi + 0x24]
cmp dword [ebp + 0x18], 0
je 0x1010c13e
test eax, eax
je 0x1010c142
push dword [ebp + 0x18]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
add esp, 8
test eax, eax
je 0x1010c14c
mov ebx, esi
mov esi, dword [ebx]
test esi, esi
jne 0x1010c0d0
jmp 0x1010c176
cmp byte [esi + 0xce], 0
je 0x1010c142
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1010c142
push eax
push dword [ebp + 0x1c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x1010c191
mov ebx, esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1010c144
xor esi, esi
push dword [0x101f3ebc]
call sym.nss3.dll_PR_Unlock
add esp, 4
jmp 0x1010c18a
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x14], eax
inc dword [esi + 8]
jmp 0x1010c178
sub esp, 0x10
movdqa xmm0, xmmword [0x101af1a0]
movdqu xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1010c0a7
Function at 0x1010d0e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test byte [eax + 0x1c], 0x80
jne 0x1010d113
mov edi, dword [eax + 0xc4]
test edi, edi
je 0x1010d113
cmp dword [eax + 0x60], 0
je 0x1010d10a
push edi
call fcn.1010fda0
add esp, 4
jmp 0x1010d113
cmp dword [eax + 0x138], 0
je 0x1010d118
pop esi
pop edi
pop ebx
pop ebp
ret
cmp byte [0x101f3eac], 0
jne 0x1010d133
push 0x1010bd20
push 0x101f3eb0
call sym.nss3.dll_PR_CallOnce
add esp, 8
mov ebx, dword [0x101f3ebc]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1010d19a
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [ebx + 8], esi
cmp dword [edi + 4], 1
jne 0x1010d18a
mov ecx, 0x101f3ec0
mov eax, ecx
mov ecx, dword [ecx]
test ecx, ecx
je 0x1010d18a
cmp ecx, edi
jne 0x1010d163
mov ecx, dword [edi]
mov dword [eax], ecx
mov dword [edi + 4], 3
dec dword [edi + 8]
jne 0x1010d18a
push 1
push edi
call fcn.1010be50
add esp, 8
push dword [0x101f3ebc]
call sym.nss3.dll_PR_Unlock
jmp 0x1010d105
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1010d14b

Function at 0x1010d1c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
cmp byte [0x101f3eac], 0
jne 0x1010d1e0
push 0x1010bd20
push 0x101f3eb0
call sym.nss3.dll_PR_CallOnce
add esp, 8
mov edi, dword [0x101f3ebc]
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test eax, eax
je 0x1010d254
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [edi + 8], esi
mov eax, dword [0x101f3ec0]
test eax, eax
je 0x1010d242
cmp dword [eax + 4], 1
jne 0x1010d205
mov edx, 0x101f3ec0
mov ecx, edx
mov edx, dword [edx]
test edx, edx
je 0x1010d205
cmp edx, eax
jne 0x1010d219
mov edx, dword [eax]
mov dword [ecx], edx
mov dword [eax + 4], 3
dec dword [eax + 8]
jne 0x1010d205
push 1
push eax
call fcn.1010be50
add esp, 8
jmp 0x1010d205
push dword [0x101f3ebc]
call sym.nss3.dll_PR_Unlock
add esp, 4
pop esi
pop edi
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
mov esi, eax
jmp 0x1010d1f8
Function at 0x1010e670
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push dword [ebp + 8]
call fcn.10111390
add esp, 4
xor ebx, ebx
dec ebx
test eax, eax
je 0x1010e70c
mov esi, eax
xor edi, edi
test byte [eax + 0x1c], 1
je 0x1010e807
push esi
call fcn.10115340
add esp, 4
test eax, eax
jne 0x1010e755
test byte [esi + 0x1d], 4
jne 0x1010e6bf
push dword [esi + 0x168]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [esi + 0x1fc]
test eax, eax
je 0x1010e741
push 0
push eax
push dword [esi + 0x1f8]
push esi
call fcn.10109fd0
add esp, 0x10
test eax, eax
js 0x1010e713
mov edx, dword [esi + 0x1fc]
mov ecx, edx
sub ecx, eax
mov dword [esi + 0x1fc], ecx
test eax, eax
je 0x1010e741
cmp edx, eax
je 0x1010e741
mov edx, dword [esi + 0x1f8]
add eax, edx
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
jmp 0x1010e741
mov edi, ebx
jmp 0x1010e807
cmp dword [0x101f2f50], 0
je 0x1010e83c
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1010e821
cmp dword [eax + 0x28], 0xffffe892
jne 0x1010e80e
test byte [esi + 0x1d], 4
jne 0x1010e755
push dword [esi + 0x168]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
test byte [esi + 0x1d], 4
jne 0x1010e769
push dword [esi + 0x16c]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
movzx eax, word [esi + 0x58]
cmp eax, 0x300
jb 0x1010e7c7
test byte [esi + 0x1d], 4
jne 0x1010e788
push dword [esi + 0x164]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
push 0
push esi
call fcn.10107cc0
add esp, 8
mov ebx, eax
test byte [esi + 0x1d], 4
jne 0x1010e7a9
push dword [esi + 0x164]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
xor edi, edi
test ebx, ebx
jg 0x1010e7f1
xor edi, edi
dec edi
test ebx, ebx
jne 0x1010e7f1
push 0
push 0xffffe8ce
call sym.nss3.dll_PR_SetError
add esp, 8
jmp 0x1010e7f1
mov ecx, dword [esi + 0xcc]
test ecx, ecx
je 0x1010e7ef
call dword [section..00cfg]
push esi
call ecx
add esp, 4
mov edi, eax
mov ecx, dword [esi + 0xcc]
test ecx, ecx
je 0x1010e7f1
test edi, edi
je 0x1010e7d1
jmp 0x1010e7f1
xor edi, edi
test byte [esi + 0x1d], 4
jne 0x1010e807
add esi, 0x16c
push dword [esi]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
test byte [esi + 0x1d], 4
mov edi, ebx
jne 0x1010e807
add esi, 0x168
xor edi, edi
dec edi
jmp 0x1010e7fd
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x1010e734
call fcn.100029d0
jmp 0x1010e720
Function at 0x10111390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f3f98]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x101113b6
mov ecx, dword [eax + 4]
mov dword [ecx], eax
jmp 0x101113e3
cmp dword [0x101f2f50], 0
je 0x101113fc
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101113ea
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, ecx
add esp, 0x10
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x101113d4
call fcn.100029d0
jmp 0x101113bf

Function at 0x101118a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x100
mov eax, dword [ebp + 8]
mov ecx, dword [0x101ef014]
xor ecx, ebp
mov dword [esp + 0xf8], ecx
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov dword [esp + 0x10], 0xd
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x74]
test ecx, ecx
je 0x101118f9
call dword [section..00cfg]
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], esi
call ecx
mov esi, eax
jmp 0x10111929
cmp dword [0x101f2f50], 0
je 0x10111951
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1011193f
mov dword [eax + 0x28], 0xffffe898
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [esp + 0xf8]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10111917
call fcn.100029d0
jmp 0x10111902
Function at 0x10112470
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x101124a7
mov edi, dword [ebp + 8]
call fcn.10112720
dec edi
cmp edi, 0x28
ja case.0x10112495.4
xor eax, eax
xor ecx, ecx
jmp dword [edi*4 + 0x101c7190]
mov ecx, dword [0x101f1d2c]
jmp 0x101126cb
cmp dword [0x101f2f50], 0
je 0x10112701
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101126d7
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
jmp 0x101126d0
mov ecx, dword [0x101f1d2c]
shr ecx, 0x1b
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x16
jmp 0x101126cb
mov ecx, dword [0x101f1d30]
jmp 0x101125d3
mov ecx, dword [0x101f1d2c]
shr ecx, 0x1f
jmp case.0x10112495.2
mov ecx, dword [0x101f1d2c]
shr ecx, 0x15
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0xf
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0xa
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x1c
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0xc
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x10
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x14
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x17
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 6
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x12
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 8
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x18
jmp 0x101126cb
movzx ecx, word [0x101f1d24]
jmp case.0x10112495.2
mov ecx, dword [0x101f1d2c]
shr ecx, 2
jmp 0x101126cb
movzx edx, word [0x101f1d10]
xor ecx, ecx
cmp edx, 0x300
sete cl
jmp case.0x10112495.2
mov ecx, dword [0x101f1d2c]
shr ecx, 0x11
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 5
jmp 0x101126cb
cmp dword [0x101f2f50], 0
je 0x1011270b
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x101126ec
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
jmp case.0x10112495.2
mov ecx, dword [0x101f1d2c]
shr ecx, 0xd
jmp 0x1011265f
mov ecx, dword [0x101f1d2c]
shr ecx, 3
and ecx, 3
jmp case.0x10112495.2
mov ecx, dword [0x101f1d30]
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x13
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x1a
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 7
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x1d
jmp 0x101126cb
movzx edx, word [0x101f1d12]
xor ecx, ecx
cmp edx, 0x301
setae cl
jmp case.0x10112495.2
mov ecx, dword [0x101f1d2c]
shr ecx, 9
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0xb
jmp 0x101126cb
mov ecx, dword [0x101f1d2c]
shr ecx, 0x1e
and ecx, 1
mov dword [esi], ecx
add esp, 0x10
pop esi
pop edi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x101124cd
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10112634
call fcn.100029d0
jmp 0x101124b4
call fcn.100029d0
jmp 0x1011261b
Function at 0x10112720
Capabilities:
Get thread local storage value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x101f403c], 0
jne 0x1011289b
mov byte [0x101f403c], 1
mov dword [0x101f4040], 0
push str.SSLKEYLOGFILE
call sym.nss3.dll_PR_GetEnv
add esp, 4
test eax, eax
je 0x101127bb
cmp byte [eax], 0
je 0x101127bb
push 0x101cffda
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [0x101f4040], eax
test eax, eax
je 0x101127bb
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
test eax, eax
jne 0x10112794
push dword [0x101f4040]
push 1
push 0x2d
push str._SSL_TLS_secrets_log_file__generated_by_NSS_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
call sym.nss3.dll_PR_NewLock
mov dword [0x101f4044], eax
test eax, eax
jne 0x101127bb
push dword [0x101f4040]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov dword [0x101f4040], 0
push str.SSLFORCELOCKS
call sym.nss3.dll_PR_GetEnv
add esp, 4
test eax, eax
je 0x101127df
cmp byte [eax], 0x31
jne 0x101127df
mov byte [0x101f3f9c], 1
and byte [0x101f1d2d], 0xfb
push str.NSS_SSL_ENABLE_RENEGOTIATION
call sym.nss3.dll_PR_GetEnv
add esp, 4
test eax, eax
je case.0x10112812.111
movzx eax, byte [eax]
lea ecx, [eax - 0x30]
cmp ecx, 3
jbe switch.0x10112819
lea ecx, [eax - 0x4e]
cmp ecx, 7
ja case.default.0x10112803
jmp dword [ecx*4 + 0x101c7244]
add eax, 0xffffff92
cmp eax, 7
ja case.0x10112812.111
jmp dword [eax*4 + 0x101c7264]
jmp dword [ecx*4 + 0x101c7234]
mov eax, 0xffff9fff
and eax, dword [0x101f1d2c]
jmp 0x1011285c
mov eax, 0xffff9fff
and eax, dword [0x101f1d2c]
or eax, 0x2000
jmp 0x1011285c
mov eax, 0xffff9fff
and eax, dword [0x101f1d2c]
or eax, 0x4000
jmp 0x1011285c
mov eax, 0x6000
or eax, dword [0x101f1d2c]
mov dword [0x101f1d2c], eax
push str.NSS_SSL_REQUIRE_SAFE_NEGOTIATION
call sym.nss3.dll_PR_GetEnv
add esp, 4
test eax, eax
je 0x1011287e
cmp byte [eax], 0x31
jne 0x1011287e
or byte [0x101f1d2d], 0x80
push str.NSS_SSL_CBC_RANDOM_IV
call sym.nss3.dll_PR_GetEnv
add esp, 4
test eax, eax
je 0x1011289b
cmp byte [eax], 0x30
jne 0x1011289b
and byte [0x101f1d2e], 0xfd
pop ebp
ret
Function at 0x10112ce0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [0x101ef014]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
push dword [0x101f3f98]
push eax
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x10112d30
mov ebx, dword [ebp + 0xc]
mov edi, dword [eax + 4]
mov dword [edi], eax
lea eax, [ebp - 0x14]
push eax
push 0xd
call sym.nss3.dll_NSS_OptionGet
add esp, 8
test eax, eax
je 0x10112d5d
lea eax, [ebx - 0x1f]
xor esi, esi
cmp eax, 0xfffffffc
jbe 0x10112d6f
jmp 0x10112d81
cmp dword [0x101f2f50], 0
je 0x10112dad
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10112d95
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
jmp 0x10112d81
lea eax, [ebx - 0x1f]
xor esi, esi
cmp eax, 0xfffffffc
ja 0x10112d81
mov eax, dword [ebp - 0x14]
and eax, 1
jne 0x10112d81
movzx eax, bx
push dword [ebp + 0x10]
push eax
push edi
call fcn.10101a20
add esp, 0xc
mov esi, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x10112d49
call fcn.100029d0
jmp 0x10112d39

Function at 0x10112dc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x101f3f98]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.nss3.dll_PR_GetIdentitiesLayer
test eax, eax
je 0x10112e10
mov ecx, dword [eax + 4]
mov dword [ecx], eax
test esi, esi
je 0x10112e4d
mov eax, dword [ebp + 0xc]
lea edx, [eax - 0x1f]
cmp edx, 0xfffffffd
jae 0x10112e7f
mov dword [esp + 8], esi
mov dword [esp], ecx
movzx eax, ax
mov dword [esp + 4], eax
call fcn.10101a80
jmp 0x10112e87
cmp dword [0x101f2f50], 0
je 0x10112eb1
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10112e8d
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
test esi, esi
je 0x10112e4d
mov dword [esi], 0
jmp 0x10112e7a
cmp dword [0x101f2f50], 0
je 0x10112ebb
mov eax, dword [0x101f25a4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10112e9f
mov dword [eax + 0x28], 0xffffe005
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
jmp 0x10112e87
mov dword [esi], 0
xor eax, eax
add esp, 0x10
pop esi
pop ebp
ret
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10112e32
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
jmp 0x10112e6b
call fcn.100029d0
jmp 0x10112e1d
call fcn.100029d0
jmp 0x10112e56
Function at 0x10113300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x101ef014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0x159
call sym.nss3.dll_NSS_GetAlgorithmPolicy
add esp, 8
test eax, eax
jne 0x1011332e
test byte [ebp - 0x14], 0x10
jne 0x10113372
mov ax, 0x1301
mov edi, 0x101c4732
movzx ebx, ax
lea eax, [ebx - 0x1f]
cmp eax, 0xfffffffc
ja 0x10113363
call fcn.1010b980
test eax, eax
jne 0x10113377
cmp byte [0x101f39c0], 1
je 0x1011337b
push 1
push ebx
call fcn.10101990
add esp, 8
test eax, eax
jne 0x10113377
movzx eax, word [edi]
add edi, 2
test ax, ax
jne 0x10113337
xor esi, esi
jmp 0x101133a6
call fcn.1010b980
mov esi, eax
jmp 0x101133a6
cmp dword [0x101f2f50], 0
je 0x101133d2
push dword [0x101f25a4]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x101133ba
mov dword [eax + 0x28], 0xffffe0b4
xor ecx, ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor esi, esi
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10156ff0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
sub esp, 0x10
movaps xmm0, xmmword [0x101af1a0]
movups xmmword [esp], xmm0
call fcn.1006d800
add esp, 0x10
jmp 0x10113394
call fcn.100029d0
jmp 0x10113384