joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431ee0
Capabilities:
Create process on windows
Read file via mapping
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
pop ebp
jmp fcn.00431ef0

Function at 0x433ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b47f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004e3fac
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x433d6b
push eax
push esi
call fcn.004e42d1
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004e3551
int3

Function at 0x435ac0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0x10
jb 0x435ad4
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x435b18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x435b11
cmp dword [esi + 0x14], 0x10
jb 0x435af6
mov esi, dword [esi]
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.004f5ae0
add esp, 8
test eax, eax
js 0x435b11
mov eax, dword [ebp - 0x32]
shr eax, 0xe
and al, 1
jne 0x435b18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4363a0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x4363b1
mov eax, dword [eax]
push esi
push 0xffffffffffffffff
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4363d9
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436720
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 0x5e6ea9af
mul ebx
push esi
mov esi, dword [ebp + 8]
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
sub edx, eax
mov dword [ebp + 8], esi
mov dword [ebp - 4], edx
test edi, edi
jne 0x436760
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x436884
xor ebx, ebx
cmp edx, 7
jbe 0x4367d1
mov eax, 7
sub eax, edi
mov dword [ebp + 8], eax
lea esp, [esp]
movzx eax, byte [edi]
add ebx, 8
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add edi, 8
add ecx, eax
mov eax, dword [ebp + 8]
add eax, edi
add esi, ecx
cmp eax, edx
jb 0x436780
mov dword [ebp + 8], esi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], 0
cmp ebx, eax
jae 0x436846
sub eax, ebx
cmp eax, 2
jb 0x436832
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov esi, ebx
mov edi, edi
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebx, ecx
add edi, 2
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x436800
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jae 0x43683e
movzx eax, byte [edi]
mov edx, dword [ebp + 0xc]
add ecx, eax
add esi, ecx
inc edi
jmp 0x436841
movzx eax, byte [edi]
mov ebx, edx
add ecx, eax
add esi, ecx
inc edi
jmp 0x436841
mov edx, dword [ebp + 0xc]
lea eax, [edx + ebx]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, 0x15b0
add esi, eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], edx
jne 0x436768
shl esi, 0x10
pop edi
lea eax, [ecx + esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436c10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 4
jb 0x436c87
push edi
mov edi, esi
shr edi, 2
lea ebx, [ebx]
movzx ecx, byte [edx]
sub esi, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51d168]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51d168]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51d168]
movzx ecx, byte [edx + 3]
add edx, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51d168]
sub edi, 1
jne 0x436c30
pop edi
test esi, esi
je 0x436caa
jmp 0x436c90
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51d168]
sub esi, 1
jne 0x436c90
not eax
pop esi
pop ebp
ret
Function at 0x437530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call fcn.004f159c
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x48]
add esp, 4
mov edi, dword [ebp + 0x10]
add ecx, dword [eax + 0x40]
adc edi, dword [eax + 0x44]
js 0x437596
jg 0x437560
test ecx, ecx
jb 0x437596
cmp ebx, ecx
jne 0x437568
cmp edx, edi
je 0x43757b
push 0
push edi
push ecx
push dword [eax + 0x3c]
call fcn.004f0ef0
add esp, 0x10
test eax, eax
jne 0x437596
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
call fcn.004f17dc
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
mov dword [esi + 0x1c], 0x16
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x443840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x50b655
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x44386d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x443892
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x443880
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.004011b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4438c2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x443a28
lea eax, [ebx + 4]
mov dword [ebp - 0x24], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.004e5c9b
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004054a0
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 8]
fld dword [ebx]
mov dword [ebp - 0x10], eax
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
mov dword [ebp - 4], 1
jns 0x443924
fadd dword [0x5199b0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x14], eax
fild dword [ebp + 0xc]
test eax, eax
jns 0x443940
fadd dword [0x5199b0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcompi st(2)
ja 0x443958
mov edx, dword [ebp - 0x1c]
fstp st(0)
mov eax, dword [ebp - 0x10]
fstp st(0)
jmp 0x4439cd
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.004f1910
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ecx, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
add esp, 8
or eax, 0xc00
mov dword [ebp - 0x10], eax
fldcw word [ebp - 0x10]
fistp qword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x14]
fldcw word [ebp + 0xe]
cmp eax, ecx
jae 0x4439b0
cmp eax, 0x200
jae 0x4439ae
shl eax, 3
cmp eax, ecx
jae 0x4439b0
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0044b500
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004011b0
mov edx, dword [eax]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4439f6
mov dword [ecx + eax*8], edi
jmp 0x443a08
cmp esi, edx
jne 0x4439ff
mov dword [ecx + eax*8], edi
jmp 0x443a0c
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x443a0c
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004e3511
int3
Function at 0x4484c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
cmp ecx, eax
je 0x44853c
push ebx
push esi
push edi
mov edi, edi
mov ecx, dword [ecx + 0x2c]
test ecx, ecx
je 0x44854c
mov eax, dword [ecx]
call dword [eax + 8]
mov ebx, dword [0x5b0228]
test ebx, ebx
je 0x44852b
mov edi, str.HEARTBEAT_n
mov esi, 0xa
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44852b
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x44852b
mov eax, dword [ebp - 4]
test eax, eax
je 0x44852b
add edi, eax
sub esi, eax
jne 0x448500
mov ecx, dword [ebp + 8]
add ecx, 0x30
mov dword [ebp + 8], ecx
cmp ecx, dword [ebp - 8]
jne 0x4484e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
call fcn.00459580
mov esp, ebp
pop ebp
ret 4
call fcn.004e34d4
int3

Function at 0x4499c0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [0x5b0230]
lea eax, [esi + 1]
mov dword [0x5b0230], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
lea eax, [ebp - 0x104]
push str..PipeFossilize._08lx._08x
push eax
call fcn.00428b40
movzx eax, byte [ebp + 0x14]
add esp, 0x10
shl eax, 0x1e
or eax, 1
push dword [ebp + 0x10]
push 0x2710
push 0x1000
push 0x1000
push 1
push 6
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x449a5e
push 0
push 0x80
push 3
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x449a65
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44abe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
call fcn.00401ac0
mov ebx, eax
mov esi, str.module
mov edx, ebx
lea esp, [esp]
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x44ac20
test cl, cl
je 0x44ac1c
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x44ac20
add edx, 2
add esi, 2
test al, al
jne 0x44ac00
xor eax, eax
jmp 0x44ac25
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44ac39
mov eax, dword [edi + 4]
mov dword [eax], 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, str.pipeline
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44ac60
test dl, dl
je 0x44ac5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44ac60
add eax, 2
add ecx, 2
test dl, dl
jne 0x44ac40
xor eax, eax
jmp 0x44ac65
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44ac79
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0xc0
pop ebp
ret 4
push 0x10
push 0
push ebx
call fcn.004ee341
mov ecx, dword [edi + 4]
add esp, 0xc
mov dword [ecx], eax
mov eax, dword [edi + 4]
cmp dword [eax], 0
jne 0x44ac32
push ebx
push str.Fossilize_ERROR:_Invalid___on_disk_replay_whitelist_mask:__s_n
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
add esp, 0x14
call fcn.0044b420
push 1
call fcn.004ea988
int3

Function at 0x44b360
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.00401ac0
mov edi, eax
lea eax, [ebp + 8]
push 0x10
push eax
push edi
call fcn.004ee341
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [ecx + 0xc8], eax
mov dword [ecx + 0xcc], edx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x44b39d
pop edi
pop esi
pop ebp
ret 4
push edi
push str.Fossilize_ERROR:_Not_a_valid_pipeline_hash:___s_
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
add esp, 0x14
push 1
call fcn.004ea988
int3
Function at 0x44d040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5b0068
lea ecx, [ebp - 4]
call fcn.00445400
call fcn.00452150
push str.Fossilize_ERROR:_Crashed_or_hung_while_replaying._n
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x44ec40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50bcbd
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov ecx, dword [esi + 0x930]
test ecx, ecx
je 0x44ee3e
mov edx, dword [esi + 0x2a4]
push edi
mov edi, dword [esi + 0x2a0]
mov eax, edi
or eax, edx
je 0x44ee3d
cmp dword [esi + 0x1c], 0
je 0x44ee0c
mov eax, dword [0x5b0424]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push edi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x44ee0b
mov eax, dword [ebp - 0x14]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x44ed33
cmp eax, 0x7fffffff
ja 0x44ee52
cmp eax, 0x1000
jb 0x44ed07
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x44ee57
push ecx
call fcn.004e5c9b
add esp, 4
test eax, eax
je 0x44ee4d
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x44ed12
push eax
call fcn.004e5c9b
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push edi
lea ebx, [edi + ecx]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
call fcn.004e7c10
add esp, 0xc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], edi
mov eax, dword [esi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5b0424]
push edi
push edx
push dword [esi + 0x2a4]
mov dword [ebp - 4], 0
push dword [esi + 0x2a0]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x44edd7
cmp dword [esi + 0x20], 0x10
lea eax, [esi + 0xc]
jb 0x44ed6b
mov eax, dword [eax]
push 0x518bb0
push eax
call fcn.004f0936
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x44ed9d
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push edi
mov dword [ebp - 0x10], eax
call fcn.004f17dc
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x44edcb
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x44edd7
jmp 0x44edce
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f07fb
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x44ee0b
sub ebx, eax
cmp ebx, 0x1000
jb 0x44ee01
mov ecx, dword [eax - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44ee4d
mov eax, ecx
push ebx
push eax
call fcn.004e5ccb
add esp, 8
pop ebx
mov eax, dword [esi + 0x930]
push 0
push dword [esi + 0x2a4]
push dword [esi + 0x2a0]
push dword [eax + 0xc]
call dword [0x5b0398]
mov dword [esi + 0x2a0], 0
mov dword [esi + 0x2a4], 0
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004ea5cf
call fcn.00402640
call fcn.00401930
int3
Function at 0x44ee60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50bcbd
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov ecx, dword [esi + 0x930]
test ecx, ecx
je 0x44f05e
mov edx, dword [esi + 0x2ac]
push edi
mov edi, dword [esi + 0x2a8]
mov eax, edi
or eax, edx
je 0x44f05d
cmp dword [esi + 0x34], 0
je 0x44f02c
mov eax, dword [0x5b0754]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push edi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x44f02b
mov eax, dword [ebp - 0x14]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x44ef53
cmp eax, 0x7fffffff
ja 0x44f072
cmp eax, 0x1000
jb 0x44ef27
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x44f077
push ecx
call fcn.004e5c9b
add esp, 4
test eax, eax
je 0x44f06d
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x44ef32
push eax
call fcn.004e5c9b
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push edi
lea ebx, [edi + ecx]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
call fcn.004e7c10
add esp, 0xc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], edi
mov eax, dword [esi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5b0754]
push edi
push edx
push dword [esi + 0x2ac]
mov dword [ebp - 4], 0
push dword [esi + 0x2a8]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x44eff7
cmp dword [esi + 0x38], 0x10
lea eax, [esi + 0x24]
jb 0x44ef8b
mov eax, dword [eax]
push 0x518bb0
push eax
call fcn.004f0936
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x44efbd
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push edi
mov dword [ebp - 0x10], eax
call fcn.004f17dc
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x44efeb
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x44eff7
jmp 0x44efee
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f07fb
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x44f02b
sub ebx, eax
cmp ebx, 0x1000
jb 0x44f021
mov ecx, dword [eax - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f06d
mov eax, ecx
push ebx
push eax
call fcn.004e5ccb
add esp, 8
pop ebx
mov eax, dword [esi + 0x930]
push 0
push dword [esi + 0x2ac]
push dword [esi + 0x2a8]
push dword [eax + 0xc]
call dword [0x5b0750]
mov dword [esi + 0x2a8], 0
mov dword [esi + 0x2ac], 0
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004ea5cf
call fcn.00402640
call fcn.00401930
int3
Function at 0x450940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, dword [ebp - 4]
push 2
call fcn.004ee433
push esi
push str.Fossilize_ERROR:_Error:__s_n
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4511e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
jne 0x451221
push str.Fossilize_ERROR:_Failed_to_open_file_mapping_in_replayer._n
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
add esp, 0x10
xor al, al
pop edi
pop ebp
ret
push esi
push 0
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x451262
push str.Fossilize_ERROR:_Failed_to_map_view_of_file_in_replayer._n
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
add esp, 0x10
xor al, al
pop esi
pop edi
pop ebp
ret
cmp dword [esi], 0x19bcde1d
mov dword [0x5b01cc], esi
jne 0x45128d
cmp dword [esi + 0xca4], 0xcac
jb 0x45128d
mov ecx, dword [esi + 0xca8]
test ecx, ecx
je 0x45128d
lea eax, [ecx - 1]
test ecx, eax
je 0x4512ca
push str.Fossilize_ERROR:_Control_block_is_corrupt._n
push 2
call fcn.004ee433
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee433
push eax
call fcn.004ee7f0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5b01cc], 0
push dword [ebp + 0xc]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
mov dword [0x5b01d8], eax
pop esi
setne al
pop edi
pop ebp
ret