joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, byte [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, byte [ecx]
mov ebx, esi
xor ebx, edx
mov eax, edx
lock cmpxchg byte [ecx], bl
cmp dl, al
jne 0x10001ec0
pop ebx
pop esi
pop ebp
ret

Function at 0x10001ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, word [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, word [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg word [ecx], bx
cmp dx, ax
jne 0x10002000
pop ebx
pop esi
pop ebp
ret

Function at 0x10002140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ebx
nop
lea esi, [esi]
mov edx, dword [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg dword [ecx], ebx
cmp edx, eax
jne 0x10002150
pop ebx
pop esi
pop ebp
ret

Function at 0x10002300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
mov ecx, eax
add ecx, dword [ebp + 0xc]
adc ebx, dword [ebp + 0x10]
mov dword [esp + 4], ebx
mov ebx, ecx
mov dword [esp], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x10002310
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10002360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
and ecx, edx
and ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x10002380
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100023c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, ebx
mov eax, dword [esp]
imul edx, edi
imul eax, esi
lea ecx, [edx + eax]
mov eax, ebx
mov ebx, esi
mov esi, edi
mul ebx
mov dword [esp + 8], ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov edx, esi
mov dword [esp + 0x10], eax
mov eax, ebx
mov ebx, dword [esp + 0x10]
add dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x100023e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10002450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
or ecx, edx
or ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x10002470
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100024b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
xor ecx, edx
xor ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x100024d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10002510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0xc]
setne byte [esp + 4]
mov esi, esi
lea edi, [edi]
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
mov dword [esp + 0x10], edx
or eax, ecx
mov dword [esp + 0x14], ecx
mov eax, edx
mov edx, ecx
mov ecx, dword [esp + 0xc]
setne bl
and ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x10002530
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10002620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
addsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x10002638
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x10002690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
mulsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x100026a8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x10002900
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10007058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x10002959
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x10007058]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
leave
ret
Function at 0x10002960
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0xc
mov eax, dword [eax]
mov dword [eax + 0x18], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret

Function at 0x10002a00
Capabilities:
Get process heap flags
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ebx
sub esp, 0x10
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x10002a51
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [ebx]
sub esp, 4
mov dword [eax + 0x18], str._home_runner_build_wine_wine_dlls_vcomp_main.c:_critsect
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
test byte [0x10007064], 2
jne 0x10002a67
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_allocate_critical_section_n
mov dword [esp + 8], str.alloc_critsect
mov dword [esp + 4], 0x10007064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10002a5a
Function at 0x10002a90
Capabilities:
Get process heap flags
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x10007058]
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 4], edi
mov dword [ebp - 0x18], eax
call eax
sub esp, 8
test byte [0x10007064], 8
jne 0x10002c39
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [esp], 0x10007040
lea esi, [edi + 0x14]
mov dword [ebp - 0x14], eax
call eax
lea eax, [edi + 0x1c]
mov ebx, dword [edi]
mov dword [ebp - 0x10], eax
sub esp, 4
lea esi, [esi]
test ebx, ebx
jne 0x10002b2c
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], 0x1388
mov dword [esp + 4], 0x10007040
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SleepConditionVariableCS]
sub esp, 0xc
test eax, eax
jne 0x10002bb8
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x5b4
mov ebx, dword [edi]
jne 0x10002ae8
test ebx, ebx
je 0x10002bc0
mov dword [esp], 0x10007040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x14]
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym.__vcomp_fork_call_wrapper
mov eax, dword [ebp - 0x14]
mov dword [esp], 0x10007040
call eax
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov dword [edi], 0
sub esp, 4
mov dword [edx + 4], eax
mov edx, dword [edi + 0x14]
mov dword [eax], edx
mov eax, dword [0x10007060]
mov dword [edi + 0x14], 0x1000705c
mov dword [edi + 0x18], eax
mov dword [eax], esi
mov eax, dword [ebx + 8]
mov dword [0x10007060], esi
add eax, 1
mov dword [ebx + 8], eax
cmp eax, dword [ebx + 4]
jl 0x10002aec
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WakeAllConditionVariable]
sub esp, 4
jmp 0x10002aec
mov ebx, dword [edi]
jmp 0x10002ae8
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 0x14]
mov dword [eax], ecx
mov dword [esp], 0x10007040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test byte [0x10007064], 8
jne 0x10002c66
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x10007058]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], 0
call eax
mov eax, dword [0x1000d010]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibraryAndExitThread]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.starting_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x10007064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10002ac2
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.terminating_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x10007064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10002be7
Function at 0x10002ca0
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov eax, dword [0x10007058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x10002cd0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop edi
pop ebp
ret
mov dword [esp + 8], 0x60
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x10002d5f
mov dword [eax + 0x38], 0
lea eax, [eax + 0x38]
movdqu xmm0, xmmword [0x100097e0]
mov dword [eax + 4], 0
mov dword [eax + 0x10], 0
mov dword [eax - 0x38], 0
mov dword [ebx + 4], eax
mov eax, dword [0x10007058]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
movups xmmword [ebx + 0x20], xmm0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, ebx
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
test byte [0x10007064], 2
jne 0x10002d75
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_create_thread_data_n
mov dword [esp + 8], str.vcomp_init_thread_data
mov dword [esp + 4], 0x10007064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10002d68

Function at 0x10003150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
call sym.___divdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x10003160
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100031c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
call sym.___udivdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x100031d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10003230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
xor edi, edi
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov eax, ebx
mov edx, esi
mov dword [esp + 8], ebx
shld edx, ebx, cl
shl eax, cl
test cl, 0x20
mov dword [esp + 0xc], esi
cmovne edx, eax
cmovne eax, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x10003240
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100032a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
mov dword [esp + 8], ebx
sar edx, cl
shrd eax, esi, cl
mov dword [esp + 0xc], esi
mov edi, edx
sar edi, 0x1f
test cl, 0x20
cmovne eax, edx
cmovne edx, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x100032b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10003310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
xor edi, edi
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
mov dword [esp + 8], ebx
shrd eax, esi, cl
shr edx, cl
test cl, 0x20
mov dword [esp + 0xc], esi
cmovne eax, edx
cmovne edx, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x10003320
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10003380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
mov ecx, eax
sub ecx, dword [ebp + 0xc]
sbb ebx, dword [ebp + 0x10]
mov dword [esp + 4], ebx
mov ebx, ecx
mov dword [esp], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x10003390
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100034c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
divsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x100034d8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x10003530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
subsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x10003548
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x10005870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
test byte [0x10007064], 8
jne 0x100058b0
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlIsCriticalSectionLockedByThread]
sub esp, 4
test eax, eax
jne 0x100058da
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 4], 0x10007064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10005883
test byte [0x10007064], 2
jne 0x100058f0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [ebx]
mov dword [esp + 0xc], str.omp_set_lock_called_while_holding_lock__p_n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10007064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x100058e3

Function at 0x10005ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10006048
cmp byte [esi + ebx - 1], 0xa
je 0x1000601c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1000d0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10006670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10006848
mov edi, dword [0x1000d0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10006757
test byte [0x10007088], 8
jne 0x100067f0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10007098], 8
jne 0x100067b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100066f9
cmp esi, 3
jbe 0x10006768
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000670a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100098a8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100066f9
mov dword [esp], 0x10007098
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100066d0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100066d0
mov dword [esp], 0x10007088
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100066bb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x100066c3
mov eax, 0xffffffff
jmp 0x10006757