joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021d20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002cce4
call fcn.1002a133
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e65
cmp dword [ebp - 0x18], 1
jne 0x10021e65
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10017bb7
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x10021e65
push dword [ebp - 0x14]
push ebx
push esi
call fcn.10017bb7
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10021e5a
cmp dword [ebp - 0x18], 1
jne 0x10021e5a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10017bb7
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10021e5a
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.10017bb7
lea eax, [ebp - 0x20]
push eax
push 0x10032338
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10021e3e
push ebx
call fcn.10017bb7
pop ecx
test al, al
je 0x10021e3e
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10021e5a
push dword [edi]
call fcn.1002a647
and dword [edi], 0
pop ecx
jmp 0x10021e5a
test esi, esi
je 0x10021e65
push esi
call fcn.1002a647
pop ecx
call fcn.1002a091
ret

Function at 0x100225b9
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10032094
xor esi, esi
call fcn.10017bb7
pop ecx
test eax, eax
jne 0x100225da
push 0x100320ac
call fcn.10017bb7
pop ecx
test eax, eax
je 0x100225dd
xor esi, esi
inc esi
cmp byte [0x1003cde0], 0
je 0x1002260c
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d628
push edi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002260b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100246d8
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cde0], 0
je 0x10024738
movzx eax, bl
mov esi, 0x1003e190
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10024738
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cde0], 0
je 0x10024768
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e190
push esi
call fcn.10017bb7
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10024768
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, 1
pop esi
ret
Function at 0x10025de4
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x1002ce82
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003e190
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xad0], eax
je 0x10025e33
push str._ACTWinBrowser__SendAcroIPCMessage
push ebx
call fcn.10017bb7
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025e33
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10025dc7
mov eax, dword [ebp - 0xacc]
lea edi, [ebp - 0xac8]
test eax, eax
cmovne edi, eax
test esi, esi
je 0x1002602b
cmp dword [esi + 0x400], ebx
jne 0x10025e8a
push ebx
push ebx
push ebx
push ebx
call fcn.10022610
add esp, 0x10
test eax, eax
je 0x1002602b
push dword [esi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10017bb7
add esp, 0x18
test eax, eax
jle 0x1002602b
lea ecx, [ebp - 0x6bc]
call fcn.10025da7
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.10017bb7
add esp, 0x18
test eax, eax
jne 0x10026002
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10029305
push dword [esi + 0x400]
lea eax, [ebp - 0x6bc]
mov dword [ebp - 4], ebx
push 0x1388
push edi
push eax
lea ecx, [ebp - 0x2ac]
call fcn.1002952a
test eax, eax
jne 0x10025f6a
cmp dword [edi + 4], eax
sete bl
cmp byte [0x1003cde0], al
je 0x10025ff5
push dword [edi + 4]
mov esi, 0x1003e190
push str._ACTWinBrowser__SendAcroIPCMessage_IPC_call_success_status___lu
push esi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025ff5
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10025ff5
cmp byte [0x1003cde0], 0
mov esi, 0x1003e190
je 0x10025f95
push str.IPC_Error:_AIPC_ERR
push esi
call fcn.10017bb7
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025f95
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xacc], ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageA]
cmp byte [0x1003cde0], 0
je 0x10025fe9
push dword [ebp - 0xacc]
push str._ACTWinBrowser__IPC_Error_:__s
push esi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025fe9
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0xacc]
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2ac]
call fcn.10017bb7
jmp 0x1002602b
cmp byte [0x1003cde0], bl
je 0x1002602b
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x1003e190
push esi
call fcn.10017bb7
pop ecx
pop ecx
cmp byte [0x1003cde0], bl
je 0x1002602b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.1002a0a6
ret
Function at 0x100277eb
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10027808
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278ec
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5e0
push edi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Uns32____d
push edi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_void____d
push edi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1002795e
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002cf70
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov edi, dword [ebp + 8]
je 0x1002799d
lea eax, [edi + 4]
mov esi, 0x1003e5e0
push eax
push str.ASM_Release__s
push esi
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002799d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100279d3
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.10017bb7
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002a0a6
ret
Function at 0x100279e9
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002cf9d
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
je 0x10027a48
call fcn.10017bb7
test al, al
mov edx, 0x1002ea51
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5e0
call fcn.10017bb7
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10027a48
push 0x1003e5e0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.10017bb7
test ebx, ebx
jne 0x10027aae
cmp byte [0x1003cde0], bl
je 0x10027b0f
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5e0
push ebx
call fcn.10017bb7
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10027b0f
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10027b0f
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10027ad5
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10027a8f
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10027aff
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10027a8f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002a0a6
ret
Function at 0x67f426a0
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
test byte [0x67f48048], 8
jne 0x67f426f0
cmp ebx, 1
je 0x67f42725
cmp ebx, 3
je 0x67f427b0
test ebx, ebx
mov ebx, 1
je 0x67f42778
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__p___ld___p__n
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x67f48048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
cmp ebx, 1
jne 0x67f426ca
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x67f48140], eax
cmp eax, 0xffffffff
je 0x67f427d0
lea eax, [ebp - 0x3c]
mov ebx, 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov dword [0x67f48150], edi
sub esp, 4
mov dword [0x67f4814c], eax
mov dword [0x67f4815c], eax
mov dword [0x67f48158], eax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test esi, esi
jne 0x67f426e0
cmp dword [0x67f48140], 0xffffffff
je 0x67f426e0
call sym._vcomp_free_thread_data
mov eax, dword [0x67f48140]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
sub esp, 4
jmp 0x67f426e0
call sym._vcomp_free_thread_data
lea esp, [ebp - 0x10]
mov ebx, 1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test byte [0x67f48048], 2
jne 0x67f427e0
xor ebx, ebx
jmp 0x67f426e0
mov dword [esp + 0xc], str.Failed_to_allocate_TLS_index_n
xor ebx, ebx
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x67f48048
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x67f426e0

Function at 0x67f42a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [esp]
mov ebx, dword [esp + 4]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add ecx, eax
mov dword [esp + 0x10], eax
adc ebx, edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov ebx, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], edx
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x67f42a50
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x67f42ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
lea esi, [esi]
nop
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
addsd xmm1, xmm0
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x67f42ae8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x67f42bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
and ecx, edx
and ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x67f42be0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67f42cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0xc]
setne byte [esp + 4]
lea esi, [esi]
nop
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
mov dword [esp + 0x10], edx
or eax, ecx
mov dword [esp + 0x14], ecx
mov eax, edx
mov edx, ecx
mov ecx, dword [esp + 0xc]
setne bl
and ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x67f42cf0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67f43120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call sym.___divdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x67f43140
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x67f431e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
lea esi, [esi]
nop
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
divsd xmm1, xmm0
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x67f431f8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x67f432d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call sym.___udivdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x67f432f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67f433f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, ebx
mov eax, dword [esp]
imul edx, edi
imul eax, esi
lea ecx, [edx + eax]
mov eax, ebx
mov ebx, esi
mov esi, edi
mul ebx
mov dword [esp + 8], ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov edx, esi
mov dword [esp + 0x10], eax
mov eax, ebx
mov ebx, dword [esp + 0x10]
add dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x67f43410
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x67f434b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
lea esi, [esi]
nop
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm0
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x67f434c8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x67f435a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
or ecx, edx
or ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x67f435c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67f43690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
xor edi, edi
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov eax, ebx
mov edx, esi
mov dword [esp + 8], ebx
shld edx, ebx, cl
shl eax, cl
test cl, 0x20
mov dword [esp + 0xc], esi
cmovne edx, eax
cmovne eax, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x67f436a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67f43790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
mov dword [esp + 8], ebx
sar edx, cl
shrd eax, esi, cl
mov dword [esp + 0xc], esi
mov edi, edx
sar edi, 0x1f
test cl, 0x20
cmovne eax, edx
cmovne edx, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x67f437a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret