joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c370
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x5e6ea9af
mul dword [ebp + 0x10]
push ebx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, dword [ebp + 0x10]
mov ebx, edx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub ebx, eax
movzx ecx, di
shr edi, 0x10
mov dword [ebp + 8], edi
mov dword [ebp - 4], ebx
test esi, esi
jne 0x43c3b1
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x43c4c5
lea esp, [esp]
xor edx, edx
mov dword [ebp + 0xc], edx
cmp ebx, 7
jbe 0x43c428
mov eax, 7
sub eax, esi
mov dword [ebp + 8], eax
movzx eax, byte [esi]
add edx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp + 8]
add eax, esi
add edi, ecx
cmp eax, ebx
jb 0x43c3d4
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], edi
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
cmp dword [ebp + 0xc], eax
jae 0x43c487
sub eax, dword [ebp + 0xc]
cmp eax, 2
jb 0x43c47a
mov edx, dword [ebp - 4]
mov edi, ebx
mov eax, dword [ebp + 0xc]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [ebp - 0xc], eax
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x43c452
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x43c482
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
lea eax, [edx + ebx]
add edi, eax
mov eax, 0x80078071
mov ebx, 0x15b0
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ebx
jne 0x43c3c0
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43c870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 4
jb 0x43c8e7
push edi
mov edi, esi
shr edi, 2
lea ebx, [ebx]
movzx ecx, byte [edx]
sub esi, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5338f8]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5338f8]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5338f8]
movzx ecx, byte [edx + 3]
add edx, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5338f8]
sub edi, 1
jne 0x43c890
pop edi
test esi, esi
je 0x43c90a
jmp 0x43c8f0
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x5338f8]
sub esi, 1
jne 0x43c8f0
not eax
pop esi
pop ebp
ret
Function at 0x43d1b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call fcn.0050646c
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x48]
add esp, 4
mov edi, dword [ebp + 0x10]
add ecx, dword [eax + 0x40]
adc edi, dword [eax + 0x44]
test edi, edi
jl 0x43d218
jg 0x43d1e2
test ecx, ecx
jb 0x43d218
cmp ebx, ecx
jne 0x43d1ea
cmp edx, edi
je 0x43d1fd
push 0
push edi
push ecx
push dword [eax + 0x3c]
call fcn.00505dc0
add esp, 0x10
test eax, eax
jne 0x43d218
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
call fcn.005066ac
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
mov dword [esi + 0x1c], 0x16
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x444500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, dword [edx + 0x10]
jbe 0x444513
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x444531
mov edi, edi
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x444520
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x44abc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x51f8f5
push eax
mov dword fs:[0], esp
sub esp, 0x14
cmp dword [edx + 0x14], 0xf
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x44abed
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x44ac12
lea esp, [esp]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x44ac00
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00401280
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x44ac42
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x44ad9e
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.004fa223
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00405420
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 8]
fld dword [ebx]
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
mov dword [ebp - 4], 1
jns 0x44aca1
fadd dword [0x530074]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x18], eax
fild dword [ebp + 0xc]
test eax, eax
jns 0x44acbd
fadd dword [0x530074]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcompi st(2)
jbe 0x44ad3d
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.005067e0
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ecx, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
add esp, 8
or eax, 0xc00
mov dword [ebp - 0x10], eax
fldcw word [ebp - 0x10]
fistp qword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x18]
fldcw word [ebp + 0xe]
cmp eax, ecx
jae 0x44ad21
cmp eax, 0x200
jae 0x44ad1f
shl eax, 3
cmp eax, ecx
jae 0x44ad21
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00455430
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00401280
mov edx, dword [eax]
jmp 0x44ad44
mov edx, dword [ebp - 0x14]
fstp st(0)
fstp st(0)
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x44ad6c
mov dword [ecx + eax*8], edi
jmp 0x44ad7e
cmp esi, edx
jne 0x44ad75
mov dword [ecx + eax*8], edi
jmp 0x44ad82
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x44ad82
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004f7e11
int3
Function at 0x453ad0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [0x5d14d0]
lea eax, [esi + 1]
mov dword [0x5d14d0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
lea eax, [ebp - 0x104]
push str..PipeFossilize._08lx._08x
push eax
call fcn.0042e720
movzx eax, byte [ebp + 0x14]
add esp, 0x10
shl eax, 0x1e
or eax, 1
push dword [ebp + 0x10]
push 0x2710
push 0x1000
push 0x1000
push 1
push 6
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x453b6e
push 0
push 0x80
push 3
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x453b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x454cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
call fcn.00401a10
mov ebx, eax
mov esi, str.module
mov edx, ebx
lea esp, [esp]
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x454d30
test cl, cl
je 0x454d2c
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x454d30
add edx, 2
add esi, 2
test al, al
jne 0x454d10
xor eax, eax
jmp 0x454d35
sbb eax, eax
or eax, 1
test eax, eax
jne 0x454d49
mov eax, dword [edi + 4]
mov dword [eax], 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, str.pipeline
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x454d70
test dl, dl
je 0x454d6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x454d70
add eax, 2
add ecx, 2
test dl, dl
jne 0x454d50
xor eax, eax
jmp 0x454d75
sbb eax, eax
or eax, 1
test eax, eax
jne 0x454d89
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0xc0
pop ebp
ret 4
push 0x10
push 0
push ebx
call fcn.00503211
mov ecx, dword [edi + 4]
add esp, 0xc
mov dword [ecx], eax
mov eax, dword [edi + 4]
cmp dword [eax], 0
jne 0x454d42
push ebx
push str.Fossilize_ERROR:_Invalid___on_disk_replay_whitelist_mask:__s_n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x14
call fcn.00455370
push 1
call fcn.004ff85b
int3

Function at 0x4552c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.00401a10
mov edi, eax
lea eax, [ebp + 8]
push 0x10
push eax
push edi
call fcn.00503211
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [ecx + 0xc8], eax
mov dword [ecx + 0xcc], edx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x4552fd
pop edi
pop esi
pop ebp
ret 4
push edi
push str.Fossilize_ERROR:_Not_a_valid_pipeline_hash:___s_
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x14
push 1
call fcn.004ff85b
int3
Function at 0x456e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5c3098
lea ecx, [ebp - 4]
call fcn.0044d660
call fcn.0045bab0
push str.Fossilize_ERROR:_Crashed_or_hung_while_replaying._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4588a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x52000d
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [edi + 0x930]
test ecx, ecx
je 0x458a9d
mov edx, dword [edi + 0x2a4]
push esi
mov esi, dword [edi + 0x2a0]
mov eax, esi
or eax, edx
je 0x458a9c
cmp dword [edi + 0x1c], 0
je 0x458a6b
mov eax, dword [0x5d16c4]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push esi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x458a6a
mov eax, dword [ebp - 0x14]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x458995
cmp eax, 0x7fffffff
ja 0x458aac
cmp eax, 0x1000
jb 0x458967
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x458ab1
push ecx
call fcn.004fa223
add esp, 4
test eax, eax
je 0x458ab6
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x458972
push eax
call fcn.004fa223
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push esi
lea ebx, [eax + esi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call fcn.004fc310
mov ecx, ebx
mov dword [ebp - 0x18], esi
add esp, 0xc
mov dword [ebp - 0x24], ecx
mov eax, dword [edi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5d16c4]
push esi
push edx
push dword [edi + 0x2a4]
mov dword [ebp - 4], 0
push dword [edi + 0x2a0]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x458a39
cmp dword [edi + 0x20], 0xf
lea eax, [edi + 0xc]
jbe 0x4589cd
mov eax, dword [eax]
push 0x52db98
push eax
call fcn.00505806
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x4589ff
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push esi
mov dword [ebp - 0x10], eax
call fcn.005066ac
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x458a2d
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x458a39
jmp 0x458a30
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005056cb
add esp, 4
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x458a6a
sub ebx, esi
mov eax, esi
cmp ebx, 0x1000
jb 0x458a60
mov esi, dword [eax - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x458ab6
push ebx
push esi
call fcn.004fa253
add esp, 8
pop ebx
mov eax, dword [edi + 0x930]
push 0
push dword [edi + 0x2a4]
push dword [edi + 0x2a0]
push dword [eax + 0xc]
call dword [0x5d1638]
mov dword [edi + 0x2a0], 0
mov dword [edi + 0x2a4], 0
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00402520
call fcn.004019d0
call fcn.004ff45f
int3
Function at 0x458ac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x52000d
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [edi + 0x930]
test ecx, ecx
je 0x458cbd
mov edx, dword [edi + 0x2ac]
push esi
mov esi, dword [edi + 0x2a8]
mov eax, esi
or eax, edx
je 0x458cbc
cmp dword [edi + 0x34], 0
je 0x458c8b
mov eax, dword [0x5d19f4]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push esi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x458c8a
mov eax, dword [ebp - 0x14]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x458bb5
cmp eax, 0x7fffffff
ja 0x458ccc
cmp eax, 0x1000
jb 0x458b87
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x458cd1
push ecx
call fcn.004fa223
add esp, 4
test eax, eax
je 0x458cd6
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x458b92
push eax
call fcn.004fa223
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push esi
lea ebx, [eax + esi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call fcn.004fc310
mov ecx, ebx
mov dword [ebp - 0x18], esi
add esp, 0xc
mov dword [ebp - 0x24], ecx
mov eax, dword [edi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5d19f4]
push esi
push edx
push dword [edi + 0x2ac]
mov dword [ebp - 4], 0
push dword [edi + 0x2a8]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x458c59
cmp dword [edi + 0x38], 0xf
lea eax, [edi + 0x24]
jbe 0x458bed
mov eax, dword [eax]
push 0x52db98
push eax
call fcn.00505806
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x458c1f
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push esi
mov dword [ebp - 0x10], eax
call fcn.005066ac
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x458c4d
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x458c59
jmp 0x458c50
mov eax, dword [ebp - 0x1c]
push eax
call fcn.005056cb
add esp, 4
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x458c8a
sub ebx, esi
mov eax, esi
cmp ebx, 0x1000
jb 0x458c80
mov esi, dword [eax - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x458cd6
push ebx
push esi
call fcn.004fa253
add esp, 8
pop ebx
mov eax, dword [edi + 0x930]
push 0
push dword [edi + 0x2ac]
push dword [edi + 0x2a8]
push dword [eax + 0xc]
call dword [0x5d19f0]
mov dword [edi + 0x2a8], 0
mov dword [edi + 0x2ac], 0
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00402520
call fcn.004019d0
call fcn.004ff45f
int3
Function at 0x45a2a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, dword [ebp - 4]
push 2
call fcn.00503303
push esi
push str.Fossilize_ERROR:_Error:__s_n
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x45ab40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
jne 0x45ab81
push str.Fossilize_ERROR:_Failed_to_open_file_mapping_in_replayer._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x10
xor al, al
pop edi
pop ebp
ret
push esi
push 0
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x45abc2
push str.Fossilize_ERROR:_Failed_to_map_view_of_file_in_replayer._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x10
xor al, al
pop esi
pop edi
pop ebp
ret
cmp dword [esi], 0x19bcde1d
mov dword [0x5d146c], esi
jne 0x45abed
cmp dword [esi + 0xca4], 0xcac
jb 0x45abed
mov ecx, dword [esi + 0xca8]
test ecx, ecx
je 0x45abed
lea eax, [ecx - 1]
test ecx, eax
je 0x45ac2a
push str.Fossilize_ERROR:_Control_block_is_corrupt._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5d146c], 0
push dword [ebp + 0xc]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
mov dword [0x5d1478], eax
pop esi
setne al
pop edi
pop ebp
ret
Function at 0x461500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x520415
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x2b0]
mov dword [esi + 0x2d8], 0
test eax, eax
je 0x461575
xor edx, edx
jmp 0x461540
mov ecx, dword [esi + 0x3b0]
lea edx, [edx + 0xd0]
mov eax, dword [esi + 0xd8]
inc edi
mov dword [ecx + edx + 8], eax
mov eax, dword [esi + 0xe0]
mov dword [ecx + edx + 0xc], eax
mov eax, dword [esi + 0xe8]
mov dword [ecx + edx + 0x10], eax
mov eax, dword [esi + 0x2b0]
cmp edi, eax
jb 0x461540
xor edi, edi
test eax, eax
je 0x46162b
nop
push 0xc
call fcn.004fa223
add esp, 4
inc edi
test eax, eax
je 0x46159d
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], 0x4630e0
jmp 0x46159f
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x446d50
push 0
push 0
call fcn.00506b68
mov edx, eax
add esp, 0x18
mov dword [ebp - 0x18], edx
test edx, edx
je 0x46169e
mov ecx, dword [esi + 0x3a8]
mov dword [ebp - 4], 1
cmp ecx, dword [esi + 0x3ac]
je 0x461602
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ecx], edx
mov dword [ecx + 4], eax
add dword [esi + 0x3a8], 8
jmp 0x461612
lea eax, [ebp - 0x18]
push eax
push ecx
lea ecx, [esi + 0x3a4]
call fcn.00446620
cmp dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
jne 0x461699
cmp edi, dword [esi + 0x2b0]
jb 0x461580
lea edi, [esi + 0x3bc]
push edi
call fcn.004f7e77
add esp, 4
test eax, eax
jne 0x461692
mov eax, dword [edi + 0x2c]
cmp eax, 0x7fffffff
je 0x4616ac
mov eax, dword [esi + 0x2d8]
lea ebx, [esi + 0x304]
cmp eax, dword [esi + 0x2b0]
je 0x461678
lea esp, [esp]
push edi
push ebx
call fcn.004f8436
mov eax, dword [esi + 0x2d8]
add esp, 8
cmp eax, dword [esi + 0x2b0]
jne 0x461660
push edi
call fcn.004f7e88
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.004f80b2
call fcn.005069d0
push 6
mov dword [ebp - 0x14], 0
call fcn.004f80b2
dec eax
push 6
mov dword [edi + 0x2c], eax
call fcn.004f80b2
int3
Function at 0x462d70
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x5d14c4]
push esi
test eax, eax
je 0x462d87
cmp byte [eax + 0x948], 0
je 0x462d87
mov cl, 1
jmp 0x462d89
xor cl, cl
mov eax, 1
mov edx, 0x5d14cc
xchg dword [edx], eax
test eax, eax
jne 0x462e0d
test cl, cl
je 0x462ddb
push str.CRASH_n
push dword [0x5d14c8]
call fcn.00463980
add esp, 8
test al, al
je 0x462dd3
mov esi, dword [0x5d14c4]
test esi, esi
je 0x462dd3
lea ecx, [esi + 0x3b0]
call fcn.00456750
push eax
push esi
call fcn.00456c10
add esp, 8
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0045bab0
push str.Fossilize_ERROR:_Pipeline_compilation_timed_out._n
push 2
call fcn.00503303
add esp, 4
push eax
call fcn.00401d30
push 2
call fcn.00503303
push eax
call fcn.005036c0
add esp, 0x10
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
ret

Function at 0x463980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x463990
sub esi, ecx
je 0x4639cb
mov ebx, dword [ebp + 8]
mov edi, edi
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4639d4
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x4639d4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4639d4
add edi, eax
sub esi, eax
jne 0x4639a0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret