joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436750
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 0x5e6ea9af
mul ebx
push esi
mov esi, dword [ebp + 8]
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
sub edx, eax
mov dword [ebp + 8], esi
mov dword [ebp - 4], edx
test edi, edi
jne 0x436790
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4368b4
xor ebx, ebx
cmp edx, 7
jbe 0x436801
mov eax, 7
sub eax, edi
mov dword [ebp + 8], eax
lea esp, [esp]
movzx eax, byte [edi]
add ebx, 8
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add edi, 8
add ecx, eax
mov eax, dword [ebp + 8]
add eax, edi
add esi, ecx
cmp eax, edx
jb 0x4367b0
mov dword [ebp + 8], esi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], 0
cmp ebx, eax
jae 0x436876
sub eax, ebx
cmp eax, 2
jb 0x436862
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov esi, ebx
mov edi, edi
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebx, ecx
add edi, 2
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x436830
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0xc], esi
mov esi, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jae 0x43686e
movzx eax, byte [edi]
mov edx, dword [ebp + 0xc]
add ecx, eax
add esi, ecx
inc edi
jmp 0x436871
movzx eax, byte [edi]
mov ebx, edx
add ecx, eax
add esi, ecx
inc edi
jmp 0x436871
mov edx, dword [ebp + 0xc]
lea eax, [edx + ebx]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, 0x15b0
add esi, eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], edx
jne 0x436798
shl esi, 0x10
pop edi
lea eax, [ecx + esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436c40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 4
jb 0x436cb7
push edi
mov edi, esi
shr edi, 2
lea ebx, [ebx]
movzx ecx, byte [edx]
sub esi, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51e168]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51e168]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51e168]
movzx ecx, byte [edx + 3]
add edx, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51e168]
sub edi, 1
jne 0x436c60
pop edi
test esi, esi
je 0x436cda
jmp 0x436cc0
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x51e168]
sub esi, 1
jne 0x436cc0
not eax
pop esi
pop ebp
ret
Function at 0x437560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call fcn.004f1594
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x48]
add esp, 4
mov edi, dword [ebp + 0x10]
add ecx, dword [eax + 0x40]
adc edi, dword [eax + 0x44]
js 0x4375c6
jg 0x437590
test ecx, ecx
jb 0x4375c6
cmp ebx, ecx
jne 0x437598
cmp edx, edi
je 0x4375ab
push 0
push edi
push ecx
push dword [eax + 0x3c]
call fcn.004f0ef1
add esp, 0x10
test eax, eax
jne 0x4375c6
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
call fcn.004f17d4
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
mov dword [esi + 0x1c], 0x16
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x4436f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x50c285
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x44371d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x443742
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x443730
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.004011b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x443772
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x4438d8
lea eax, [ebx + 4]
mov dword [ebp - 0x24], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.004e5c9b
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004054a0
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 8]
fld dword [ebx]
mov dword [ebp - 0x10], eax
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
mov dword [ebp - 4], 1
jns 0x4437d4
fadd dword [0x51a9b0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x14], eax
fild dword [ebp + 0xc]
test eax, eax
jns 0x4437f0
fadd dword [0x51a9b0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcompi st(2)
ja 0x443808
mov edx, dword [ebp - 0x1c]
fstp st(0)
mov eax, dword [ebp - 0x10]
fstp st(0)
jmp 0x44387d
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.004f1910
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ecx, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
add esp, 8
or eax, 0xc00
mov dword [ebp - 0x10], eax
fldcw word [ebp - 0x10]
fistp qword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x14]
fldcw word [ebp + 0xe]
cmp eax, ecx
jae 0x443860
cmp eax, 0x200
jae 0x44385e
shl eax, 3
cmp eax, ecx
jae 0x443860
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0044b530
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004011b0
mov edx, dword [eax]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4438a6
mov dword [ecx + eax*8], edi
jmp 0x4438b8
cmp esi, edx
jne 0x4438af
mov dword [ecx + eax*8], edi
jmp 0x4438bc
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4438bc
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004e3511
int3
Function at 0x4484f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 8], ecx
mov dword [ebp - 8], eax
cmp ecx, eax
je 0x44856c
push ebx
push esi
push edi
mov edi, edi
mov ecx, dword [ecx + 0x2c]
test ecx, ecx
je 0x44857c
mov eax, dword [ecx]
call dword [eax + 8]
mov ebx, dword [0x5b1338]
test ebx, ebx
je 0x44855b
mov edi, str.HEARTBEAT_n
mov esi, 0xa
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44855b
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x44855b
mov eax, dword [ebp - 4]
test eax, eax
je 0x44855b
add edi, eax
sub esi, eax
jne 0x448530
mov ecx, dword [ebp + 8]
add ecx, 0x30
mov dword [ebp + 8], ecx
cmp ecx, dword [ebp - 8]
jne 0x448510
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
call fcn.004594b0
mov esp, ebp
pop ebp
ret 4
call fcn.004e34d4
int3

Function at 0x4499f0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [0x5b1340]
lea eax, [esi + 1]
mov dword [0x5b1340], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
lea eax, [ebp - 0x104]
push str..PipeFossilize._08lx._08x
push eax
call fcn.00428b60
movzx eax, byte [ebp + 0x14]
add esp, 0x10
shl eax, 0x1e
or eax, 1
push dword [ebp + 0x10]
push 0x2710
push 0x1000
push 0x1000
push 1
push 6
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x449a8e
push 0
push 0x80
push 3
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x449a95
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44ac10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
call fcn.00401ac0
mov ebx, eax
mov esi, str.module
mov edx, ebx
lea esp, [esp]
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x44ac50
test cl, cl
je 0x44ac4c
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x44ac50
add edx, 2
add esi, 2
test al, al
jne 0x44ac30
xor eax, eax
jmp 0x44ac55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44ac69
mov eax, dword [edi + 4]
mov dword [eax], 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, str.pipeline
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44ac90
test dl, dl
je 0x44ac8c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44ac90
add eax, 2
add ecx, 2
test dl, dl
jne 0x44ac70
xor eax, eax
jmp 0x44ac95
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44aca9
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0xc0
pop ebp
ret 4
push 0x10
push 0
push ebx
call fcn.004ee2df
mov ecx, dword [edi + 4]
add esp, 0xc
mov dword [ecx], eax
mov eax, dword [edi + 4]
cmp dword [eax], 0
jne 0x44ac62
push ebx
push str.Fossilize_ERROR:_Invalid___on_disk_replay_whitelist_mask:__s_n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x14
call fcn.0044b450
push 1
call fcn.004ea988
int3

Function at 0x44b390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.00401ac0
mov edi, eax
lea eax, [ebp + 8]
push 0x10
push eax
push edi
call fcn.004ee2df
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [ecx + 0xc8], eax
mov dword [ecx + 0xcc], edx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x44b3cd
pop edi
pop esi
pop ebp
ret 4
push edi
push str.Fossilize_ERROR:_Not_a_valid_pipeline_hash:___s_
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x14
push 1
call fcn.004ea988
int3
Function at 0x44d070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5b1178
lea ecx, [ebp - 4]
call fcn.004452b0
call fcn.00452180
push str.Fossilize_ERROR:_Crashed_or_hung_while_replaying._n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x44ec70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50c8ed
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov ecx, dword [esi + 0x930]
test ecx, ecx
je 0x44ee6e
mov edx, dword [esi + 0x2a4]
push edi
mov edi, dword [esi + 0x2a0]
mov eax, edi
or eax, edx
je 0x44ee6d
cmp dword [esi + 0x1c], 0
je 0x44ee3c
mov eax, dword [0x5b1534]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push edi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x44ee3b
mov eax, dword [ebp - 0x14]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x44ed63
cmp eax, 0x7fffffff
ja 0x44ee82
cmp eax, 0x1000
jb 0x44ed37
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x44ee87
push ecx
call fcn.004e5c9b
add esp, 4
test eax, eax
je 0x44ee7d
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x44ed42
push eax
call fcn.004e5c9b
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push edi
lea ebx, [edi + ecx]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
call fcn.004e7c10
add esp, 0xc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], edi
mov eax, dword [esi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5b1534]
push edi
push edx
push dword [esi + 0x2a4]
mov dword [ebp - 4], 0
push dword [esi + 0x2a0]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x44ee07
cmp dword [esi + 0x20], 0x10
lea eax, [esi + 0xc]
jb 0x44ed9b
mov eax, dword [eax]
push 0x519bb0
push eax
call fcn.004f0937
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x44edcd
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push edi
mov dword [ebp - 0x10], eax
call fcn.004f17d4
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x44edfb
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x44ee07
jmp 0x44edfe
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f07fc
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x44ee3b
sub ebx, eax
cmp ebx, 0x1000
jb 0x44ee31
mov ecx, dword [eax - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44ee7d
mov eax, ecx
push ebx
push eax
call fcn.004e5ccb
add esp, 8
pop ebx
mov eax, dword [esi + 0x930]
push 0
push dword [esi + 0x2a4]
push dword [esi + 0x2a0]
push dword [eax + 0xc]
call dword [0x5b14a8]
mov dword [esi + 0x2a0], 0
mov dword [esi + 0x2a4], 0
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004ea5cf
call fcn.00402640
call fcn.00401930
int3
Function at 0x44ee90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50c8ed
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
mov ecx, dword [esi + 0x930]
test ecx, ecx
je 0x44f08e
mov edx, dword [esi + 0x2ac]
push edi
mov edi, dword [esi + 0x2a8]
mov eax, edi
or eax, edx
je 0x44f08d
cmp dword [esi + 0x34], 0
je 0x44f05c
mov eax, dword [0x5b1864]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push edi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x44f05b
mov eax, dword [ebp - 0x14]
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x44ef83
cmp eax, 0x7fffffff
ja 0x44f0a2
cmp eax, 0x1000
jb 0x44ef57
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x44f0a7
push ecx
call fcn.004e5c9b
add esp, 4
test eax, eax
je 0x44f09d
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x44ef62
push eax
call fcn.004e5c9b
add esp, 4
mov edi, eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push edi
lea ebx, [edi + ecx]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
call fcn.004e7c10
add esp, 0xc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], edi
mov eax, dword [esi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5b1864]
push edi
push edx
push dword [esi + 0x2ac]
mov dword [ebp - 4], 0
push dword [esi + 0x2a8]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x44f027
cmp dword [esi + 0x38], 0x10
lea eax, [esi + 0x24]
jb 0x44efbb
mov eax, dword [eax]
push 0x519bb0
push eax
call fcn.004f0937
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x44efed
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push edi
mov dword [ebp - 0x10], eax
call fcn.004f17d4
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x44f01b
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x44f027
jmp 0x44f01e
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f07fc
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x44f05b
sub ebx, eax
cmp ebx, 0x1000
jb 0x44f051
mov ecx, dword [eax - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44f09d
mov eax, ecx
push ebx
push eax
call fcn.004e5ccb
add esp, 8
pop ebx
mov eax, dword [esi + 0x930]
push 0
push dword [esi + 0x2ac]
push dword [esi + 0x2a8]
push dword [eax + 0xc]
call dword [0x5b1860]
mov dword [esi + 0x2a8], 0
mov dword [esi + 0x2ac], 0
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004ea5cf
call fcn.00402640
call fcn.00401930
int3
Function at 0x450970
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, dword [ebp - 4]
push 2
call fcn.004ee3fb
push esi
push str.Fossilize_ERROR:_Error:__s_n
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x451210
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
jne 0x451251
push str.Fossilize_ERROR:_Failed_to_open_file_mapping_in_replayer._n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x10
xor al, al
pop edi
pop ebp
ret
push esi
push 0
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x451292
push str.Fossilize_ERROR:_Failed_to_map_view_of_file_in_replayer._n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x10
xor al, al
pop esi
pop edi
pop ebp
ret
cmp dword [esi], 0x19bcde1d
mov dword [0x5b12dc], esi
jne 0x4512bd
cmp dword [esi + 0xca4], 0xcac
jb 0x4512bd
mov ecx, dword [esi + 0xca8]
test ecx, ecx
je 0x4512bd
lea eax, [ecx - 1]
test ecx, eax
je 0x4512fa
push str.Fossilize_ERROR:_Control_block_is_corrupt._n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5b12dc], 0
push dword [ebp + 0xc]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
mov dword [0x5b12e8], eax
pop esi
setne al
pop edi
pop ebp
ret
Function at 0x457c90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
xor edx, edx
push 0xffffffffffffffff
push 0x50cd15
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x2b0]
mov dword [esi + 0x2d8], 0
test eax, eax
je 0x457d05
xor edi, edi
jmp 0x457cd0
mov ecx, dword [esi + 0x3b0]
lea edi, [edi + 0xd0]
mov eax, dword [esi + 0xd8]
inc edx
mov dword [ecx + edi + 8], eax
mov eax, dword [esi + 0xe0]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [esi + 0xe8]
mov dword [ecx + edi + 0x10], eax
mov eax, dword [esi + 0x2b0]
cmp edx, eax
jb 0x457cd0
xor edi, edi
test eax, eax
je 0x457dbe
nop
push 0xc
call fcn.004e5c9b
add esp, 4
test eax, eax
je 0x457d2f
lea ecx, [edi + 1]
mov dword [eax + 4], esi
mov dword [eax], ecx
mov dword [eax + 8], 0x4599b0
jmp 0x457d31
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x440b50
push 0
push 0
call fcn.004f1c29
mov edx, eax
add esp, 0x18
mov dword [ebp - 0x18], edx
test edx, edx
je 0x457e22
mov ecx, dword [esi + 0x3a8]
mov dword [ebp - 4], 1
cmp ecx, dword [esi + 0x3ac]
je 0x457d94
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ecx], edx
mov dword [ecx + 4], eax
add dword [esi + 0x3a8], 8
jmp 0x457da4
lea eax, [ebp - 0x18]
push eax
push ecx
lea ecx, [esi + 0x3a4]
call fcn.004403d0
cmp dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
jne 0x457e1d
inc edi
cmp edi, dword [esi + 0x2b0]
jb 0x457d10
lea edi, [esi + 0x3bc]
push edi
call fcn.004e387d
add esp, 4
test eax, eax
jne 0x457e17
mov eax, dword [esi + 0x2d8]
lea ebx, [esi + 0x304]
cmp eax, dword [esi + 0x2b0]
je 0x457dfd
push edi
push ebx
call fcn.004e3eba
mov eax, dword [esi + 0x2d8]
add esp, 8
cmp eax, dword [esi + 0x2b0]
jne 0x457de5
push edi
call fcn.004e38a2
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.004e395b
call fcn.004f1a91
push 6
mov dword [ebp - 0x14], 0
call fcn.004e3988
int3
Function at 0x4595c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5b1334]
push esi
test eax, eax
je 0x4595d7
cmp byte [eax + 0x948], 0
je 0x4595d7
mov cl, 1
jmp 0x4595d9
xor cl, cl
mov eax, 1
mov edx, 0x5b133c
xchg dword [edx], eax
test eax, eax
jne 0x45965d
test cl, cl
je 0x45962b
push str.CRASH_n
push dword [0x5b1338]
call fcn.00459f10
add esp, 8
test al, al
je 0x459623
mov esi, dword [0x5b1334]
test esi, esi
je 0x459623
lea ecx, [esi + 0x3b0]
call fcn.0044cad0
push eax
push esi
call fcn.0044cdf0
add esp, 8
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00452180
push str.Fossilize_ERROR:_Pipeline_compilation_timed_out._n
push 2
call fcn.004ee3fb
add esp, 4
push eax
call fcn.00401df0
push 2
call fcn.004ee3fb
push eax
call fcn.004ee7b8
add esp, 0x10
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
ret

Function at 0x459f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x459f20
sub esi, ecx
je 0x459f5b
mov ebx, dword [ebp + 8]
mov edi, edi
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x459f64
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x459f64
mov eax, dword [ebp - 4]
test eax, eax
je 0x459f64
add edi, eax
sub esi, eax
jne 0x459f30
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret