joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1017f2d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push dword [0x101d6710]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1017f352
mov ecx, dword [eax + 4]
test ecx, ecx
mov dword [ecx], eax
je 0x1017f37a
cmp dword [ecx + 0x9f8], 1
jne 0x1017f37a
mov eax, dword [ebp + 0x10]
cmp eax, 5
jae 0x1017f37a
test eax, eax
mov word [ecx + 0x69a], 0
je 0x1017f37a
mov edx, dword [ebp + 0xc]
movzx esi, word [edx]
lea edi, [esi - 1]
cmp di, 1
ja 0x1017f33e
movzx edi, word [ecx + 0x69a]
lea ebx, [edi + 1]
mov word [ecx + 0x69a], bx
mov word [ecx + edi*2 + 0x692], si
add edx, 2
dec eax
jne 0x1017f319
xor eax, eax
cmp word [ecx + 0x69a], 0
jne 0x1017f3a5
jmp 0x1017f37a
cmp dword [0x101d4d40], 0
je 0x1017f3d3
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017f3bb
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe891
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101d4d40], 0
je 0x1017f3cc
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017f3aa
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017f393
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017f36b
call sym.nss3.dll_PR_Init
jmp 0x1017f383
call sym.nss3.dll_PR_Init
jmp 0x1017f35b

Function at 0x1017f3e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x101d6710]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1017f417
mov ecx, dword [eax + 4]
test ecx, ecx
mov dword [ecx], eax
je 0x1017f43f
movzx eax, word [ecx + 0x9a0]
test ax, ax
je 0x1017f43f
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
xor eax, eax
jmp 0x1017f46a
cmp dword [0x101d4d40], 0
je 0x1017f495
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017f47d
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe891
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
cmp dword [0x101d4d40], 0
je 0x1017f48e
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017f46c
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
dec eax
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017f458
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017f430
call sym.nss3.dll_PR_Init
jmp 0x1017f448
call sym.nss3.dll_PR_Init
jmp 0x1017f420
Function at 0x1017f550
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, 0xfffffe80
push dword [esi + 0x101aa6b0]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x1017f59f
add esi, 8
jne 0x1017f55d
cmp dword [0x101d4d40], 0
je 0x1017f5bc
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017f5ab
xor ecx, ecx
mov dword [eax + 0x28], 0xffffd0a4
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x1017f5a5
mov ecx, dword [esi + 0x101aa6b4]
mov eax, ecx
pop esi
pop edi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017f58e
call sym.nss3.dll_PR_Init
jmp 0x1017f57e

Function at 0x1017f8a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x101d6710]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1017f8d2
mov ecx, dword [eax + 4]
test ecx, ecx
mov dword [ecx], eax
je 0x1017f8f6
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x1017f8fa
add eax, 0xf8
jmp 0x1017f924
cmp dword [0x101d4d40], 0
je 0x1017f94c
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
test eax, eax
je 0x1017f926
mov dword [ecx + 0x28], 0xffffe891
jmp 0x1017f91c
xor eax, eax
jmp 0x1017f924
cmp dword [0x101d4d40], 0
je 0x1017f953
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
test eax, eax
je 0x1017f939
mov dword [ecx + 0x28], 0xffffe09a
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov ecx, eax
jmp 0x1017f8ed
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov ecx, eax
jmp 0x1017f915
call sym.nss3.dll_PR_Init
jmp 0x1017f8db
call sym.nss3.dll_PR_Init
jmp 0x1017f903
Function at 0x1017f960
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x101d2014]
mov edi, dword [ebp + 0xc]
xor eax, ebp
test edi, edi
mov dword [ebp - 0xc], eax
je 0x1017f98b
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x1017f9bf
cmp ecx, 1
jne 0x1017f98b
mov ax, 0x302
jmp 0x1017f9c3
cmp dword [0x101d4d40], 0
je 0x1017fa53
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017fa3f
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x1017fa05
mov ax, 0x300
lea edx, [ebp - 0x10]
mov word [edi], ax
mov word [edi + 2], 0x304
call fcn.1017f5d0
cmp eax, 0xffffffff
je 0x1017f9f8
movzx ecx, word [edi]
mov eax, dword [ebp - 0x10]
movzx edx, word [edi + 2]
cmp cx, ax
cmova eax, ecx
movzx ecx, word [ebp - 0xe]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1017fa19
xor esi, esi
mov word [edi + 2], 0
mov word [edi], 0
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
mov word [edi], ax
mov word [edi + 2], cx
movzx ecx, cx
xor esi, esi
cmp ecx, 0x304
jb 0x1017fa06
movzx ecx, ax
mov edx, 0x301
cmp ecx, edx
cmovbe eax, edx
mov word [edi], ax
jmp 0x1017fa06
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017f9ac
call sym.nss3.dll_PR_Init
jmp 0x1017f998

Function at 0x1017fa60
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, dword [0x101d2014]
mov ecx, dword [ebp + 8]
xor eax, ebp
cmp ecx, 1
mov dword [ebp - 8], eax
ja 0x1017fac9
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1017fac9
test ecx, ecx
mov eax, 0x101d43e4
mov edx, 0x101d43e8
cmove edx, eax
mov eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [esi], eax
call fcn.1017f5d0
cmp eax, 0xffffffff
je 0x1017fabf
movzx ecx, word [esi]
mov eax, dword [ebp - 0xc]
movzx edx, word [esi + 2]
cmp cx, ax
cmova eax, ecx
movzx ecx, word [ebp - 0xa]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1017fb06
mov dword [esi], 0
xor esi, esi
jmp 0x1017faf3
cmp dword [0x101d4d40], 0
je 0x1017fb22
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017fb11
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 8
pop esi
pop ebp
ret
mov word [esi], ax
mov word [esi + 2], cx
xor esi, esi
jmp 0x1017faf4
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017fae2
call sym.nss3.dll_PR_Init
jmp 0x1017fad2
Function at 0x1017fb30
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov ecx, dword [0x101d2014]
mov eax, dword [ebp + 0xc]
xor ecx, ebp
test eax, eax
mov dword [ebp - 0xc], ecx
je 0x1017fb79
mov edi, dword [ebp + 8]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
mov ecx, edi
mov dword [edx], eax
call fcn.1017fbd0
mov esi, eax
test eax, eax
jne 0x1017fba4
mov edx, dword [ebp - 0x10]
test edi, edi
mov eax, 0x101d43e4
mov ecx, 0x101d43e8
cmove ecx, eax
xor esi, esi
mov dword [ecx], edx
jmp 0x1017fba4
cmp dword [0x101d4d40], 0
je 0x1017fbc8
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017fbb7
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017fb92
call sym.nss3.dll_PR_Init
jmp 0x1017fb82

Function at 0x1017fbd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x101d2014]
mov esi, edx
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx edx, word [edx]
movzx eax, word [esi + 2]
cmp dx, ax
ja 0x1017fc3c
test ecx, ecx
je 0x1017fc11
cmp ecx, 1
jne 0x1017fc3c
mov edi, 0xfffffcfe
add edx, edi
cmp dx, 2
ja 0x1017fc3c
add eax, edi
cmp ax, 3
jb 0x1017fc83
jmp 0x1017fc3c
mov edi, 0xfffffd00
lea ebx, [edx + edi]
cmp bx, 4
ja 0x1017fc3c
add edi, eax
cmp di, 4
ja 0x1017fc3c
movzx edx, dx
cmp edx, 0x300
ja 0x1017fc83
movzx eax, ax
cmp eax, 0x304
jb 0x1017fc83
cmp dword [0x101d4d40], 0
je 0x1017fcf3
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017fcdf
xor ecx, ecx
xor edi, edi
mov dword [eax + 0x28], 0xffffd078
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebp - 0x14]
call fcn.1017f5d0
cmp eax, 0xffffffff
je 0x1017fcaf
movzx ecx, word [esi]
mov eax, dword [ebp - 0x14]
movzx edx, word [esi + 2]
cmp cx, ax
cmova eax, ecx
movzx ecx, word [ebp - 0x12]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1017fcb9
xor edi, edi
mov dword [esi], 0
jmp 0x1017fc6e
mov word [esi], ax
mov word [esi + 2], cx
movzx ecx, cx
xor edi, edi
cmp ecx, 0x304
jb 0x1017fc6f
movzx ecx, ax
mov edx, 0x301
cmp ecx, edx
cmovbe eax, edx
mov word [esi], ax
jmp 0x1017fc6f
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017fc5d
call sym.nss3.dll_PR_Init
jmp 0x1017fc49
Function at 0x1017fd00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x101d2014]
mov eax, dword [ebp + 8]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
push dword [0x101d6710]
push eax
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1017fde6
mov ebx, dword [eax + 4]
xor esi, esi
dec esi
test ebx, ebx
mov dword [ebx], eax
je 0x1017fe4a
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1017fe17
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x1017fd63
push dword [ebx + 0x16c]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x1017fd77
push dword [ebx + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [ebx + 0x24]
mov dword [edi], eax
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x1017fd96
push dword [ebx + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x1017fdaa
push dword [ebx + 0x16c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
mov ecx, dword [ebx + 0x9f8]
lea edx, [ebp - 0x14]
call fcn.1017f5d0
cmp eax, 0xffffffff
je 0x1017fddc
movzx ecx, word [edi]
mov eax, dword [ebp - 0x14]
movzx edx, word [edi + 2]
cmp cx, ax
cmova eax, ecx
movzx ecx, word [ebp - 0x12]
cmp dx, cx
cmovb ecx, edx
cmp cx, ax
jae 0x1017fe41
xor esi, esi
mov dword [edi], 0
jmp 0x1017fe14
cmp dword [0x101d4d40], 0
je 0x1017fe80
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017fe5e
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x28], 0xffffe891
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
jmp 0x1017fe4a
cmp dword [0x101d4d40], 0
je 0x1017fe8a
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1017fe6f
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
jmp 0x1017fe4a
xor esi, esi
mov word [edi], ax
mov word [edi + 2], cx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017fe03
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017fe30
call sym.nss3.dll_PR_Init
jmp 0x1017fdf3
call sym.nss3.dll_PR_Init
jmp 0x1017fe20
Function at 0x1017fea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x101d2014]
mov esi, dword [ebp + 0xc]
xor eax, ebp
test esi, esi
mov dword [ebp - 0x10], eax
je 0x1017ffad
push dword [0x101d6710]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1017ffd7
mov edi, dword [eax + 4]
xor ebx, ebx
dec ebx
test edi, edi
mov dword [edi], eax
je 0x1017ffa9
mov eax, dword [esi]
lea edx, [ebp - 0x14]
mov dword [edx], eax
mov ecx, dword [edi + 0x9f8]
call fcn.1017fbd0
mov esi, eax
test eax, eax
jne 0x10180006
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1017ff1d
push dword [edi + 0x16c]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1017ff31
push dword [edi + 0x170]
call sym.nss3.dll_PR_EnterMonitor
add esp, 4
movzx eax, word [edi + 0x6f4]
test ax, ax
je 0x1018001a
cmp word [edi + 0x26], ax
jbe 0x1018001a
cmp dword [0x101d4d40], 0
je 0x101800a2
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1018007a
xor ecx, ecx
mov dword [eax + 0x28], 0xffffd078
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1017ff95
push dword [edi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1017ffa9
push dword [edi + 0x16c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
mov esi, ebx
jmp 0x10180006
cmp dword [0x101d4d40], 0
je 0x1018008e
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10180052
mov dword [eax + 0x28], 0xffffe005
jmp 0x1017fffb
cmp dword [0x101d4d40], 0
je 0x10180098
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10180066
mov dword [eax + 0x28], 0xffffe891
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov dword [edi + 0x24], eax
mov eax, dword [edi + 0x1c]
bt eax, 0xa
jb 0x1018003a
push dword [edi + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
mov eax, dword [edi + 0x1c]
xor esi, esi
bt eax, 0xa
jb 0x10180006
push dword [edi + 0x16c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
jmp 0x10180006
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017ffce
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017fff4
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1017ff6c
call sym.nss3.dll_PR_Init
jmp 0x1017ffba
call sym.nss3.dll_PR_Init
jmp 0x1017ffe4
call sym.nss3.dll_PR_Init
jmp 0x1017ff58
Function at 0x101800b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x101d2014]
mov eax, dword [ebp + 8]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
push dword [0x101d6710]
push eax
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x101801bf
mov ebx, dword [eax + 4]
xor esi, esi
dec esi
test ebx, ebx
mov dword [ebx], eax
je 0x10180265
movzx ecx, word [ebp + 0xc]
test cx, cx
je 0x10180149
mov edi, dword [ebx + 0x9f8]
lea edx, [ebp - 0x14]
mov ecx, edi
call fcn.1017f5d0
cmp eax, 0xffffffff
je 0x1018023d
movzx ecx, word [ebp + 0xc]
cmp word [ebp - 0x14], cx
ja 0x1018023d
cmp word [ebp - 0x12], cx
jb 0x1018023d
test edi, edi
je 0x1018022d
cmp edi, 1
jne 0x1018023d
lea eax, [ecx - 0x302]
cmp ax, 3
jae 0x1018023d
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x10180167
push dword [ebx + 0x16c]
mov esi, ecx
call sym.nss3.dll_PR_EnterMonitor
mov ecx, esi
add esp, 4
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x1018017f
push dword [ebx + 0x170]
mov esi, ecx
call sym.nss3.dll_PR_EnterMonitor
mov ecx, esi
add esp, 4
test cx, cx
je 0x101801f4
cmp word [ebx + 0x26], cx
jbe 0x101801f4
cmp dword [0x101d4d40], 0
je 0x101802c3
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1018029e
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
jmp 0x101801fd
cmp dword [0x101d4d40], 0
je 0x101802b2
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10180279
xor ecx, ecx
xor esi, esi
mov dword [eax + 0x28], 0xffffe891
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
dec esi
jmp 0x10180265
xor esi, esi
mov word [ebx + 0x6f4], cx
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x10180217
push dword [ebx + 0x170]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
mov eax, dword [ebx + 0x1c]
bt eax, 0xa
jb 0x10180265
push dword [ebx + 0x16c]
call sym.nss3.dll_PR_ExitMonitor
add esp, 4
jmp 0x10180265
lea eax, [ecx - 0x300]
cmp ax, 5
jb 0x10180149
cmp dword [0x101d4d40], 0
je 0x101802bc
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1018028d
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe005
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x101801e0
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10180256
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x101801ab
call sym.nss3.dll_PR_Init
jmp 0x101801cc
call sym.nss3.dll_PR_Init
jmp 0x10180246
call sym.nss3.dll_PR_Init
jmp 0x10180197
Function at 0x101802d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x101d6710]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x10180300
mov ecx, dword [eax + 4]
test ecx, ecx
mov dword [ecx], eax
je 0x10180324
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x10180328
add eax, 0x1c
jmp 0x10180352
cmp dword [0x101d4d40], 0
je 0x1018037a
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
test eax, eax
je 0x10180354
mov dword [ecx + 0x28], 0xffffe891
jmp 0x1018034a
xor eax, eax
jmp 0x10180352
cmp dword [0x101d4d40], 0
je 0x10180381
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
test eax, eax
je 0x10180367
mov dword [ecx + 0x28], 0xffffe09a
xor eax, eax
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov ecx, eax
jmp 0x1018031b
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov ecx, eax
jmp 0x10180343
call sym.nss3.dll_PR_Init
jmp 0x10180309
call sym.nss3.dll_PR_Init
jmp 0x10180331

Function at 0x10180390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [0x101d2014]
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
mov ebx, esp
xor eax, ebp
mov dword [esp + 0x78], eax
mov eax, dword [edi]
mov esi, dword [eax + 8]
movaps xmmword [ebx + 0x60], xmm0
movaps xmmword [ebx + 0x50], xmm0
movaps xmmword [ebx + 0x40], xmm0
movaps xmmword [ebx + 0x30], xmm0
movaps xmmword [ebx + 0x20], xmm0
movaps xmmword [ebx + 0x10], xmm0
movaps xmmword [ebx], xmm0
mov eax, dword [esi]
mov ecx, dword [eax + 0x64]
call dword [section..00cfg]
push ebx
push esi
call ecx
add esp, 8
xor esi, esi
dec esi
test eax, eax
js 0x1018047e
mov dword [edi + 0x4c], 1
movzx eax, word [esp]
cmp ax, 0x17
je 0x1018042a
cmp ax, 2
jne 0x10180456
mov eax, dword [esp + 4]
xor esi, esi
mov dword [edi + 0xb8], 0xffff0000
mov dword [edi + 0xb4], esi
mov dword [edi + 0xb0], esi
mov dword [edi + 0xbc], eax
jmp 0x10180448
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
xor esi, esi
movsd qword [edi + 0xb8], xmm1
movsd qword [edi + 0xb0], xmm0
movzx eax, word [esp + 2]
mov word [edi + 0xc0], ax
jmp 0x1018047e
cmp dword [0x101d4d40], 0
je 0x101804a4
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10180493
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe89f
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.10192ef0
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x1018046f
call sym.nss3.dll_PR_Init
jmp 0x1018045f
Function at 0x101804b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push dword [0x101d6710]
push dword [ebp + 8]
call sym.nss3.dll_PR_GetIdentitiesLayer
add esp, 8
test eax, eax
je 0x1018050e
mov edi, dword [eax + 4]
test edi, edi
mov dword [edi], eax
je 0x10180536
mov eax, dword [edi + 0xd0]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x101804f4
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov dword [edi + 0xd0], 0
test esi, esi
je 0x1018053a
push esi
call sym.nss3.dll_PORT_Strdup_Util
add esp, 4
test eax, eax
mov dword [edi + 0xd0], eax
setne al
jmp 0x1018053c
cmp dword [0x101d4d40], 0
je 0x1018055c
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x1018054b
xor ecx, ecx
mov dword [eax + 0x28], 0xffffe891
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
xor eax, eax
jmp 0x10180546
xor eax, eax
test esi, esi
sete cl
or cl, al
movzx eax, cl
dec eax
pop esi
pop edi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
jmp 0x10180527
call sym.nss3.dll_PR_Init
jmp 0x10180517

Function at 0x101805d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x101805ff
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x101805ff
push 0xc
call sym.nss3.dll_PORT_ZAlloc_Util
add esp, 4
test eax, eax
je 0x1018062b
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [eax + 8], 1
jmp 0x1018062d
cmp dword [0x101d4d40], 0
je 0x10180644
push dword [0x101d4d30]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, eax
test eax, eax
je 0x10180631
xor eax, eax
mov dword [ecx + 0x28], 0xffffe89d
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
jmp 0x1018062d
xor eax, eax
pop esi
pop edi
pop ebp
ret
xor eax, eax
push eax
push eax
push 1
push eax
call fcn.100e2c70
add esp, 0x10
mov ecx, eax
jmp 0x1018061a
call sym.nss3.dll_PR_Init
jmp 0x10180608