joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fa41eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, byte [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, byte [ecx]
mov ebx, esi
xor ebx, edx
mov eax, edx
lock cmpxchg byte [ecx], bl
cmp dl, al
jne 0x6fa41ec0
pop ebx
pop esi
pop ebp
ret

Function at 0x6fa41ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, word [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, word [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg word [ecx], bx
cmp dx, ax
jne 0x6fa42000
pop ebx
pop esi
pop ebp
ret

Function at 0x6fa42140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ebx
nop
lea esi, [esi]
mov edx, dword [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg dword [ecx], ebx
cmp edx, eax
jne 0x6fa42150
pop ebx
pop esi
pop ebp
ret

Function at 0x6fa42300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [esp]
mov ebx, dword [esp + 4]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add ecx, eax
mov dword [esp + 0x10], eax
adc ebx, edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov ebx, ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], edx
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x6fa42320
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa42370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
and ecx, edx
and ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x6fa42390
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6fa423d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, ebx
mov eax, dword [esp]
imul edx, edi
imul eax, esi
lea ecx, [edx + eax]
mov eax, ebx
mov ebx, esi
mov esi, edi
mul ebx
mov dword [esp + 8], ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov edx, esi
mov dword [esp + 0x10], eax
mov eax, ebx
mov ebx, dword [esp + 0x10]
add dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x6fa423f0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa42460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
or ecx, edx
or ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x6fa42480
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa424c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov ecx, dword [esp]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
xor ecx, edx
xor ebx, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov esi, eax
mov edx, ebx
xor edx, edi
xor esi, ecx
or edx, esi
jne 0x6fa424e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6fa42520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0xc]
setne byte [esp + 4]
mov esi, esi
lea edi, [edi]
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
mov dword [esp + 0x10], edx
or eax, ecx
mov dword [esp + 0x14], ecx
mov eax, edx
mov edx, ecx
mov ecx, dword [esp + 0xc]
setne bl
and ebx, dword [esp + 4]
mov dword [esp + 8], ebx
lock cmpxchg8b qword [edi]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov esi, eax
mov edi, edx
mov eax, ecx
mov edx, ebx
xor edx, edi
xor eax, esi
or edx, eax
jne 0x6fa42540
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa42630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
addsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x6fa42648
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x6fa426a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
mulsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x6fa426b8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x6fa42910
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6fa48058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x6fa42969
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x6fa48058]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
sub esp, 8
leave
ret
Function at 0x6fa42970
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x18], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_DeleteCriticalSection]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret

Function at 0x6fa42a10
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov eax, dword fs:[0x18]
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x6fa42a61
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, dword [ebx]
sub esp, 4
mov dword [eax + 0x18], str._home_builder_build_wine_wine_dlls_vcomp_main.c:_critsect
mov eax, ebx
mov ebx, dword [ebp - 4]
leave
ret
test byte [0x6fa48064], 2
jne 0x6fa42a77
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_allocate_critical_section_n
mov dword [esp + 8], str.alloc_critsect
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x6fa42a6a
Function at 0x6fa42aa0
Capabilities:
Get process heap flags
Set thread local storage value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [0x6fa48058]
mov edi, dword [ecx]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 4], edi
mov dword [ebp - 0x24], eax
call eax
sub esp, 8
test byte [0x6fa48064], 8
jne 0x6fa42c59
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [esp], 0x6fa48040
lea esi, [edi + 0x14]
mov dword [ebp - 0x20], eax
call eax
lea eax, [edi + 0x1c]
mov ebx, dword [edi]
mov dword [ebp - 0x1c], eax
sub esp, 4
nop
lea esi, [esi]
test ebx, ebx
jne 0x6fa42b44
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0x1388
mov dword [esp + 4], 0x6fa48040
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SleepConditionVariableCS]
sub esp, 0xc
test eax, eax
jne 0x6fa42bd0
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x5b4
mov ebx, dword [edi]
jne 0x6fa42b00
test ebx, ebx
je 0x6fa42be0
mov dword [esp], 0x6fa48040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x14]
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym.__vcomp_fork_call_wrapper
mov eax, dword [ebp - 0x20]
mov dword [esp], 0x6fa48040
call eax
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0x14]
mov dword [edi], 0
sub esp, 4
mov dword [edx + 4], eax
mov edx, dword [edi + 0x14]
mov dword [eax], edx
mov eax, dword [0x6fa48060]
mov dword [edi + 0x14], 0x6fa4805c
mov dword [edi + 0x18], eax
mov dword [eax], esi
mov eax, dword [ebx + 8]
mov dword [0x6fa48060], esi
add eax, 1
mov dword [ebx + 8], eax
cmp eax, dword [ebx + 4]
jl 0x6fa42b04
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WakeAllConditionVariable]
sub esp, 4
jmp 0x6fa42b04
mov ebx, dword [edi]
jmp 0x6fa42b00
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 0x14]
mov dword [eax], ecx
mov dword [esp], 0x6fa48040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test byte [0x6fa48064], 8
jne 0x6fa42c86
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x6fa48058]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0
call eax
mov eax, dword [0x6fa4d010]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibraryAndExitThread]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.starting_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6fa42adc
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.terminating_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6fa42c07
Function at 0x6fa42cc0
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value
Terminate process

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov eax, dword [0x6fa48058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x6fa42d00
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
mov dword [esp + 8], 0x60
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x6fa42d93
mov dword [eax + 0x38], 0
lea eax, [eax + 0x38]
movdqu xmm0, xmmword [0x6fa4a7e0]
mov dword [eax + 4], 0
mov dword [eax + 0x10], 0
mov dword [eax - 0x38], 0
mov dword [ebx + 4], eax
mov eax, dword [0x6fa48058]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
movups xmmword [ebx + 0x20], xmm0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, ebx
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test byte [0x6fa48064], 2
jne 0x6fa42da9
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_create_thread_data_n
mov dword [esp + 8], str.vcomp_init_thread_data
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x6fa42d9c

Function at 0x6fa431b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call sym.___divdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x6fa431d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6fa43240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov esi, edx
mov ebx, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
call sym.___udivdi3
mov edi, dword [ebp + 8]
mov ebx, eax
mov ecx, edx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lock cmpxchg8b qword [edi]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov ebx, edx
mov ecx, eax
mov edx, edi
xor edx, ebx
xor esi, ecx
or edx, esi
jne 0x6fa43260
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa432d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
xor edi, edi
mov ebx, dword [eax]
mov esi, dword [eax + 4]
mov eax, ebx
mov edx, esi
mov dword [esp + 8], ebx
shld edx, ebx, cl
shl eax, cl
test cl, 0x20
mov dword [esp + 0xc], esi
cmovne edx, eax
cmovne eax, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x6fa432e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa43340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
mov dword [esp + 8], ebx
sar edx, cl
shrd eax, esi, cl
mov dword [esp + 0xc], esi
mov edi, edx
sar edi, 0x1f
test cl, 0x20
cmovne eax, edx
cmovne edx, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x6fa43350
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6fa433b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xc]
xor edi, edi
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov edx, esi
mov eax, ebx
mov dword [esp + 8], ebx
shrd eax, esi, cl
shr edx, cl
test cl, 0x20
mov dword [esp + 0xc], esi
cmovne eax, edx
cmovne edx, edi
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, ebx
mov ebx, dword [esp]
mov dword [esp + 4], edx
mov ecx, dword [esp + 4]
mov edx, esi
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x6fa433c0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa43420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], edx
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
mov ecx, eax
sub ecx, dword [esp]
sbb ebx, dword [esp + 4]
mov dword [esp + 0xc], ebx
mov ebx, ecx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor eax, ebx
xor edx, esi
or edx, eax
jne 0x6fa43440
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6fa43570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
divsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x6fa43588
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x6fa435e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
nop
lea esi, [esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mov dword [esp + 8], eax
subsd xmm1, xmm0
mov dword [esp + 0xc], edx
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, eax
mov ebx, edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor eax, ecx
xor edx, ebx
or edx, eax
jne 0x6fa435f8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x6fa45a90
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x6fa48064], 8
jne 0x6fa45ae0
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.ntdll.dll_RtlIsCriticalSectionLockedByThread]
sub esp, 4
test eax, eax
jne 0x6fa45b0a
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
sub esp, 4
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6fa45aad
test byte [0x6fa48064], 2
jne 0x6fa45b20
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [ebx]
mov dword [esp + 0xc], str.omp_set_lock_called_while_holding_lock__p_n
mov dword [esp + 8], str.omp_set_lock
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x6fa45b13

Function at 0x6fa460e0
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov edi, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
test byte [0x6fa48064], 8
jne 0x6fa46130
cmp ebx, 1
je 0x6fa46165
cmp ebx, 3
je 0x6fa461f0
test ebx, ebx
mov ebx, 1
je 0x6fa461b8
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.__p___ld___p__n
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
cmp ebx, 1
jne 0x6fa4610a
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x6fa48058], eax
cmp eax, 0xffffffff
je 0x6fa46210
lea eax, [ebp - 0x3c]
mov ebx, 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov dword [0x6fa4d010], edi
sub esp, 4
mov dword [0x6fa4d00c], eax
mov dword [0x6fa4d008], eax
mov dword [0x6fa4d004], eax
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test esi, esi
jne 0x6fa46120
cmp dword [0x6fa48058], 0xffffffff
je 0x6fa46120
call sym._vcomp_free_thread_data
mov eax, dword [0x6fa48058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsFree]
sub esp, 4
jmp 0x6fa46120
call sym._vcomp_free_thread_data
lea esp, [ebp - 0x10]
mov ebx, 1
pop ecx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test byte [0x6fa48064], 2
jne 0x6fa46220
xor ebx, ebx
jmp 0x6fa46120
mov dword [esp + 0xc], str.Failed_to_allocate_TLS_index_n
xor ebx, ebx
mov dword [esp + 8], str.DllMain
mov dword [esp + 4], 0x6fa48064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x6fa46120
Function at 0x6fa462e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6fa4633b
cmp byte [esi + ebx - 1], 0xa
je 0x6fa4630f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6fa4d0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret