joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446888
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ec4
xor eax, eax
push ebp
push 0x446a16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d10
test eax, eax
je 0x4468cd
mov eax, dword [ebp - 4]
call fcn.00403d10
cmp eax, 0x101
jl 0x446901
push 0x446a2c
push dword [ebp - 4]
push 0x446a4c
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403dd0
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x444248]
call fcn.0040afec
call fcn.004034ec
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00407fb8
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.004085ac
cmp byte [0x456c18], 0
jne 0x446933
mov eax, 0x446a60
call fcn.00445560
mov al, byte [ebp - 0x109]
call fcn.004454d0
test al, al
je 0x4469ac
lea eax, [ebp - 0x109]
push eax
call sub.wsock32.dll_inet_addr
cmp eax, 0xffffffff
jne 0x4469a7
mov edx, 0x446a6c
lea eax, [ebp - 0x109]
call fcn.004085f0
test eax, eax
jne 0x446973
mov dword [ebp - 8], 0xffffffff
jmp 0x4469f5
push 0x446a2c
push dword [ebp - 4]
push 0x446a84
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.00403dd0
mov ecx, dword [ebp - 0x110]
mov dl, 1
mov eax, dword [0x444248]
call fcn.0040afec
call fcn.004034ec
mov dword [ebp - 8], eax
jmp 0x4469f5
lea eax, [ebp - 0x109]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4469eb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x114], 0xb
lea eax, [ebp - 0x118]
push eax
push 0
mov ecx, 0x446aa4
mov dl, 1
mov eax, dword [0x444248]
call fcn.0040b028
call fcn.004034ec
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446a1d
lea eax, [ebp - 0x110]
call fcn.00403a94
lea eax, [ebp - 4]
call fcn.00403a94
ret

Function at 0x4473a0
Capabilities:
Set socket configuration

Disassembly:
push ebx
push ecx
mov ebx, eax
cmp byte [ebx + 0x484], 2
je 0x44740a
cmp dword [ebx + 0x44c], 0xffffffff
jne 0x4473c5
mov edx, 0x447418
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x54]
pop edx
pop ebx
ret
xor eax, eax
mov al, byte [ebx + 0x484]
mov word [esp], ax
mov ax, word [ebx + 0x488]
mov word [esp + 2], ax
push 4
lea eax, [esp + 4]
push eax
push 0x80
push 0xffff
mov eax, dword [ebx + 0x44c]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x44740a
mov edx, 0x447448
mov eax, ebx
call fcn.004483d8
pop edx
pop ebx
ret
Function at 0x448188
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffc0
mov ebx, eax
cmp byte [0x456c18], 0
jne 0x4481a1
mov eax, 0x4481d8
call fcn.00445560
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
je 0x4481c7
mov ecx, 0x4481ec
mov dl, 1
mov eax, dword [0x444248]
call fcn.0040afec
call fcn.004034ec
mov edx, ebx
mov eax, esp
call fcn.004086f8
add esp, 0x40
pop ebx
ret

Function at 0x44ddec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403ec4
xor eax, eax
push ebp
push 0x44de6a
push dword fs:[eax]
mov dword fs:[eax], esp
inc word [ebx + 0x30]
push 0
push 1
push 1
push 0
push 0
push 0
lea edx, [ebx + 0x32]
mov cx, word [ebx + 0x30]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x30]
push 0xf
push 1
lea edx, [ebx + 0x3e]
mov ecx, dword [ebp - 4]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x34]
mov dword [ebx + 0x234], eax
add dword [ebx + 0x234], 0xc
movzx esi, word [ebx + 0x30]
mov eax, ebx
call fcn.0044de78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44de71
lea eax, [ebp - 4]
call fcn.00403a94
ret

Function at 0x44ebc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403ec4
xor eax, eax
push ebp
push 0x44ecb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403d10
mov ecx, 3
cdq
idiv ecx
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.00403a94
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle 0x44ec51
mov edi, 1
lea eax, [ebp - 0x14]
push eax
mov eax, edi
dec eax
lea edx, [eax + eax*2]
inc edx
mov ecx, 3
mov eax, dword [ebp - 4]
call fcn.00403f14
mov eax, dword [ebp - 0x14]
call fcn.0040809c
mov edx, eax
xor dl, 0xff
lea eax, [ebp - 0x10]
call fcn.00403c38
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00403d18
inc edi
dec ebx
jne 0x44ec16
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.00403b2c
mov eax, esi
call fcn.00403a94
mov ebx, dword [ebp - 0xc]
test ebx, ebx
jle 0x44ec8f
mov edi, 1
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
sub edx, edi
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + edx]
call fcn.00403c38
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.00403d18
inc edi
dec ebx
jne 0x44ec6e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ecbe
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403ab8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403ab8
ret
Function at 0x452540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], eax
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x45266c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004504c4
mov dword [ebp - 4], eax
mov dword [edi], 0x128
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004504e4
jmp 0x45263d
mov si, 0x1e0
mov ebx, 0x456cdc
lea eax, [ebp - 0x130]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00403cc0
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x134]
call fcn.004083f4
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00407e74
mov eax, dword [ebp - 0x130]
mov edx, dword [ebx]
call fcn.00403e20
je 0x452612
lea eax, [ebp - 0x134]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00403cc0
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00407e74
mov eax, dword [ebp - 0x130]
mov edx, dword [ebx]
call fcn.00403e20
jne 0x452627
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
add ebx, 4
dec si
jne 0x45259b
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00450504
test eax, eax
jne 0x452592
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452673
lea eax, [ebp - 0x134]
mov edx, 2
call fcn.00403ab8
ret

Function at 0x453650
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov eax, dword [ebp - 4]
call fcn.00403ec4
mov eax, dword [ebp + 8]
call fcn.00403ec4
xor eax, eax
push ebp
push 0x4536be
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp + 8]
call fcn.00403ed4
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00403ed4
push eax
call sub.KERNEL32.DLL_CopyFileA
test esi, esi
je 0x4536a0
push 2
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4536c5
lea eax, [ebp - 4]
call fcn.00403a94
lea eax, [ebp + 8]
call fcn.00403a94
ret
Function at 0x453964
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x453b49
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x453b33
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
call fcn.004026b0
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x453b2c
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x453a0e
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 0x10]
call fcn.004026c8
mov eax, dword [ebp - 0xc]
call fcn.004026b0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
je 0x453b0d
test eax, eax
je 0x453a22
call fcn.0040af90
mov esi, dword [ebp - 0x10]
cmp dword [ebp - 8], 0
jbe 0x4539bc
mov edi, dword [ebx + 0x2c]
cmp dword [esi + 0x14], 0
je 0x453a4c
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x14]
call fcn.004086f8
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x28]
call fcn.00403ae8
jmp 0x453a54
lea eax, [ebx + 0x28]
call fcn.00403a94
test byte [esi + 0xc], 1
je 0x453aec
cmp dword [esi + 4], 1
jne 0x453aec
cmp dword [esi + 8], 3
jne 0x453aec
mov edx, dword [ebx + 0x28]
mov eax, 0x453b60
call fcn.00403f9c
test eax, eax
jne 0x453aec
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x28]
call fcn.00403d10
push eax
mov eax, dword [ebx + 0x28]
call fcn.00403d10
mov edx, eax
dec edx
mov eax, dword [ebx + 0x28]
pop ecx
call fcn.00403f14
mov eax, dword [ebp - 0x14]
mov edx, 0x453b74
call fcn.00403e20
je 0x453aec
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x28]
call fcn.00403d10
push eax
mov eax, dword [ebx + 0x28]
call fcn.00403d10
mov edx, eax
dec edx
mov eax, dword [ebx + 0x28]
pop ecx
call fcn.00403f14
mov eax, dword [ebp - 0x14]
mov edx, 0x453b80
call fcn.00403e20
je 0x453aec
mov edx, dword [ebx + 0x28]
mov eax, dword [0x458b24]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, esi
mov eax, ebx
call fcn.00453964
mov dword [ebx + 0x2c], edi
add esi, 0x20
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
ja 0x453a2b
jmp 0x4539bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453b33
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
mov eax, dword [ebp - 0x10]
call fcn.004026c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453b50
lea eax, [ebp - 0x14]
call fcn.00403a94
ret
Function at 0x455890
Capabilities:
Hide graphical window

Disassembly:
push ebx
push 0
mov eax, dword [0x4578b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x4578b8]
mov eax, dword [eax]
mov ebx, dword [eax + 0x24]
push ebx
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x4578b8]
push ebx
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x4578b8]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x10001eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, byte [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, byte [ecx]
mov ebx, esi
xor ebx, edx
mov eax, edx
lock cmpxchg byte [ecx], bl
cmp dl, al
jne 0x10001ec0
pop ebx
pop esi
pop ebp
ret

Function at 0x10002000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
movzx esi, word [ebp + 0xc]
push ebx
lea esi, [esi]
movzx edx, word [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg word [ecx], bx
cmp dx, ax
jne 0x10002010
pop ebx
pop esi
pop ebp
ret

Function at 0x10002160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push ebx
lea esi, cs:[esi]
mov edx, dword [ecx]
mov ebx, edx
mov eax, edx
xor ebx, esi
lock cmpxchg dword [ecx], ebx
jne 0x10002170
pop ebx
pop esi
pop ebp
ret

Function at 0x10002370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
mov ecx, eax
add ecx, dword [ebp + 0xc]
adc ebx, dword [ebp + 0x10]
mov esi, ebx
mov dword [esp], ecx
mov ebx, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov edx, ebx
xor eax, ecx
xor edx, edi
or eax, edx
jne 0x10002380
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100023d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
and ebx, dword [ebp + 0x10]
mov ecx, eax
and ecx, dword [ebp + 0xc]
mov esi, ebx
mov dword [esp], ecx
mov ebx, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov edx, ebx
xor eax, ecx
xor edx, edi
or eax, edx
jne 0x100023e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10002430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
lea esi, [esi]
mov eax, dword [ebp + 8]
mov ebx, dword [esp + 4]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, ebx
mov eax, dword [esp]
imul edx, edi
imul eax, esi
lea ecx, [edx + eax]
mov eax, ebx
mov ebx, esi
mov esi, edi
mul ebx
mov dword [esp + 8], ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov edx, esi
mov dword [esp + 0x10], eax
mov eax, ebx
mov ebx, dword [esp + 0x10]
add dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
lock cmpxchg8b qword [edi]
mov ebx, eax
mov esi, edx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
xor eax, esi
xor edx, ebx
or edx, eax
jne 0x10002450
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100024c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
or ebx, dword [ebp + 0x10]
mov ecx, eax
or ecx, dword [ebp + 0xc]
mov esi, ebx
mov dword [esp], ecx
mov ebx, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov edx, ebx
xor eax, ecx
xor edx, edi
or eax, edx
jne 0x100024d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10002520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov ebx, edx
xor ebx, dword [ebp + 0x10]
mov ecx, eax
xor ecx, dword [ebp + 0xc]
mov esi, ebx
mov dword [esp], ecx
mov ebx, ecx
mov dword [esp + 4], esi
mov ecx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lock cmpxchg8b qword [edi]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edi, edx
mov edx, ebx
xor eax, ecx
xor edx, edi
or eax, edx
jne 0x10002530
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10002580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
setne byte [esp + 4]
lea esi, cs:[esi]
nop
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, esi
mov dword [esp + 0x10], esi
or eax, edx
mov eax, dword [esp + 4]
mov dword [esp + 0x14], edx
setne bl
mov edx, dword [esp + 0x14]
and ebx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], ebx
lock cmpxchg8b qword [edi]
mov esi, eax
mov edi, edx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor eax, edi
xor edx, esi
or edx, eax
jne 0x100025a0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100026b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
lea esi, cs:[esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
addsd xmm1, xmm0
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
mov dword [esp], eax
mov ebx, dword [esp + 4]
mov eax, dword [esp]
xor ecx, ebx
xor eax, edx
or eax, ecx
jne 0x100026c8
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x10002720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x10
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp + 0xc]
lea esi, cs:[esi]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm0
movsd qword [esp], xmm1
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
lock cmpxchg8b qword [esi]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [esp + 8]
mov dword [esp], eax
mov ebx, dword [esp + 4]
mov eax, dword [esp]
xor ecx, ebx
xor eax, edx
or eax, ecx
jne 0x10002738
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x10002ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test byte [0x10008064], 2
jne 0x10002ad0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_allocate_critical_section_n
mov dword [esp + 8], str.alloc_critsect
mov dword [esp + 4], 0x10008064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
jmp 0x10002abf
Function at 0x10002b00
Capabilities:
Get process heap flags
Get thread local storage value
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov eax, dword [0x10008058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x10002b30
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop edi
pop ebp
ret
mov dword [esp + 8], 0x60
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x10002bbd
movdqu xmm0, xmmword [0x1000a7e0]
mov dword [eax], 0
lea eax, [eax + 0x38]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0x10], 0
mov dword [ebx + 4], eax
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
movups xmmword [ebx + 0x20], xmm0
mov dword [esp + 4], ebx
mov eax, dword [0x10008058]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, ebx
sub esp, 8
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
test byte [0x10008064], 2
jne 0x10002bd3
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.could_not_create_thread_data_n
mov dword [esp + 8], str.vcomp_init_thread_data
mov dword [esp + 4], 0x10008064
mov dword [esp], 1
call sym._wine_dbg_log.constprop.1
jmp 0x10002bc6
Function at 0x10002c60
Capabilities:
Get process heap flags
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [0x10008058]
mov edi, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 4], edi
mov dword [ebp - 0x18], eax
call eax
sub esp, 8
test byte [0x10008064], 8
jne 0x10002e0e
mov eax, dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov dword [esp], 0x10008040
lea esi, [edi + 0x14]
mov dword [ebp - 0x14], eax
call eax
lea eax, [edi + 0x1c]
mov ebx, dword [edi]
mov dword [ebp - 0x10], eax
sub esp, 4
lea esi, [esi]
test ebx, ebx
jne 0x10002ced
lea esi, [esi]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], 0x1388
mov dword [esp + 4], 0x10008040
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SleepConditionVariableCS]
sub esp, 0xc
test eax, eax
je 0x10002d78
mov ebx, dword [edi]
test ebx, ebx
je 0x10002cc0
mov dword [esp], 0x10008040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 0x14]
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym.__vcomp_fork_call_wrapper
mov eax, dword [ebp - 0x14]
mov dword [esp], 0x10008040
call eax
mov edx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [edi], 0
sub esp, 4
mov dword [edx + 4], eax
mov edx, dword [edi + 0x14]
mov dword [eax], edx
mov eax, dword [0x10008060]
mov dword [edi + 0x14], 0x1000805c
mov dword [edi + 0x18], eax
mov dword [eax], esi
mov eax, dword [ebx + 8]
mov dword [0x10008060], esi
add eax, 1
mov dword [ebx + 8], eax
cmp eax, dword [ebx + 4]
jl 0x10002cc0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_WakeAllConditionVariable]
sub esp, 4
jmp 0x10002cc0
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0x5b4
mov ebx, dword [edi]
jne 0x10002cb8
test ebx, ebx
jne 0x10002ced
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ecx + 4], eax
mov ecx, dword [edi + 0x14]
mov dword [eax], ecx
mov dword [esp], 0x10008040
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
test byte [0x10008064], 8
jne 0x10002e3b
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x10008058]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], 0
call eax
mov eax, dword [0x1000e010]
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibraryAndExitThread]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.starting_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x10008064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10002c92
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.terminating_worker_thread_for__p_n
mov dword [esp + 8], str._vcomp_fork_worker
mov dword [esp + 4], 0x10008064
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10002dbc