joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e6bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
lea ebx, [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0x20]
mov dword [ebp - 0x20], 0x63756224
lea edx, [esi + 1]
mov dword [ebp - 0x1c], 0x6474656b
mov word [ebp - 0x18], 0x7269
mov byte [ebp - 0x16], 0
mov al, byte [esi]
inc esi
test al, al
jne 0x42fc54
mov eax, 0xa
sub esi, edx
cmp ecx, eax
cmovb eax, ecx
cmp dword [ebx + 0x14], 0xf
mov dword [ebp - 0x10], eax
mov ecx, ebx
jbe 0x42fc74
mov ecx, dword [ebx]
push edi
cmp esi, eax
lea edx, [ebp - 0x20]
mov edi, eax
cmovb edi, esi
sub edi, 4
jb 0x42fc95
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x42fc9a
add ecx, 4
add edx, 4
sub edi, 4
jae 0x42fc84
cmp edi, 0xfffffffc
je 0x42fcce
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x42fcc7
cmp edi, 0xfffffffd
je 0x42fcce
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x42fcc7
cmp edi, 0xfffffffe
je 0x42fcce
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x42fcc7
cmp edi, 0xffffffff
je 0x42fcce
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x42fcce
sbb eax, eax
or eax, 1
jmp 0x42fcd0
xor eax, eax
pop edi
test eax, eax
jne 0x42fdb7
cmp dword [ebp - 0x10], esi
jb 0x42fdb7
ja 0x42fdb7
mov esi, dword [ebp - 0x14]
cmp dword [esi + 0x20], 0xa
jbe 0x42fdb7
cmp dword [ebx + 0x14], 0xf
jbe 0x42fcfd
mov ebx, dword [ebx]
cmp byte [ebx + 0xa], 0x2f
je 0x42fd18
cmp dword [esi + 0x24], 0xf
lea eax, [esi + 0x10]
jbe 0x42fd0e
mov eax, dword [eax]
cmp byte [eax + 0xa], 0x5c
jne 0x42fdb7
xor eax, eax
lea ecx, [esi + 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x10]
cmp eax, 0xb
jb 0x42fdc9
add eax, 0xfffffff5
or edx, 0xffffffff
cmp eax, 0xffffffff
cmovb edx, eax
cmp dword [ecx + 0x14], 0xf
jbe 0x42fd4f
mov ecx, dword [ecx]
lea eax, [ecx + 0xb]
push edx
push eax
lea ecx, [ebp - 0x38]
call fcn.004011f0
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
call fcn.00436dd0
add esp, 0xc
lea ecx, [esi + 0x10]
push eax
call fcn.0042c270
lea ecx, [ebp - 0x50]
call fcn.00401790
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x42fdb7
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x42fdad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42fdce
push ecx
push edx
call fcn.004e9693
add esp, 8
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.0042c920
call fcn.004ee89f
int3
Function at 0x432dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
pop ebp
jmp fcn.00432dd0
Function at 0x433050
Capabilities:
Create process on windows
Read file via mapping
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
pop ebp
jmp fcn.00433060

Function at 0x434be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e9df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.004e7ce5
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x434c6b
push eax
push esi
call fcn.004e7ff0
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004e7311
int3

Function at 0x436b80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [ebp + 8]
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x436b94
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x436bde
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x436bd7
cmp dword [esi + 0x14], 0xf
jbe 0x436bb6
mov esi, dword [esi]
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.004f9df0
add esp, 8
test eax, eax
js 0x436bd7
mov eax, dword [ebp - 0x32]
shr eax, 0xe
test al, 1
pop esi
setne al
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4374a0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp dword [eax + 0x14], 0xf
jbe 0x4374b1
mov eax, dword [eax]
push esi
push 0xffffffffffffffff
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4374d9
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437850
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x5e6ea9af
mul dword [ebp + 0x10]
push ebx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, dword [ebp + 0x10]
mov ebx, edx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub ebx, eax
movzx ecx, di
shr edi, 0x10
mov dword [ebp + 8], edi
mov dword [ebp - 4], ebx
test esi, esi
jne 0x437891
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x4379a5
lea esp, [esp]
xor edx, edx
mov dword [ebp + 0xc], edx
cmp ebx, 7
jbe 0x437908
mov eax, 7
sub eax, esi
mov dword [ebp + 8], eax
movzx eax, byte [esi]
add edx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp + 8]
add eax, esi
add edi, ecx
cmp eax, ebx
jb 0x4378b4
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], edi
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
cmp dword [ebp + 0xc], eax
jae 0x437967
sub eax, dword [ebp + 0xc]
cmp eax, 2
jb 0x43795a
mov edx, dword [ebp - 4]
mov edi, ebx
mov eax, dword [ebp + 0xc]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [ebp - 0xc], eax
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x437932
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x437962
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
lea eax, [edx + ebx]
add edi, eax
mov eax, 0x80078071
mov ebx, 0x15b0
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ebx
jne 0x4378a0
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 4
jb 0x437dc7
push edi
mov edi, esi
shr edi, 2
lea ebx, [ebx]
movzx ecx, byte [edx]
sub esi, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x521148]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x521148]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x521148]
movzx ecx, byte [edx + 3]
add edx, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x521148]
sub edi, 1
jne 0x437d70
pop edi
test esi, esi
je 0x437dea
jmp 0x437dd0
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x521148]
sub esi, 1
jne 0x437dd0
not eax
pop esi
pop ebp
ret
Function at 0x438690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
call fcn.004f58ac
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x48]
add esp, 4
mov edi, dword [ebp + 0x10]
add ecx, dword [eax + 0x40]
adc edi, dword [eax + 0x44]
test edi, edi
jl 0x4386f8
jg 0x4386c2
test ecx, ecx
jb 0x4386f8
cmp ebx, ecx
jne 0x4386ca
cmp edx, edi
je 0x4386dd
push 0
push edi
push ecx
push dword [eax + 0x3c]
call fcn.004f5200
add esp, 0x10
test eax, eax
jne 0x4386f8
mov eax, dword [esi + 0x48]
push dword [eax + 0x3c]
push dword [ebp + 0x18]
push 1
push dword [ebp + 0x14]
call fcn.004f5aec
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
mov dword [esi + 0x1c], 0x16
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x444d40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x50ec55
push eax
mov dword fs:[0], esp
sub esp, 0x14
cmp dword [edx + 0x14], 0xf
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x444d6d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x444d92
lea esp, [esp]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x444d80
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00401280
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x444dc2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x444f1e
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.004e9663
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00405450
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 8]
fld dword [ebx]
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
mov dword [ebp - 4], 1
jns 0x444e21
fadd dword [0x51d990]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x18], eax
fild dword [ebp + 0xc]
test eax, eax
jns 0x444e3d
fadd dword [0x51d990]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcompi st(2)
jbe 0x444ebd
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.004f5c20
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ecx, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
add esp, 8
or eax, 0xc00
mov dword [ebp - 0x10], eax
fldcw word [ebp - 0x10]
fistp qword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x18]
fldcw word [ebp + 0xe]
cmp eax, ecx
jae 0x444ea1
cmp eax, 0x200
jae 0x444e9f
shl eax, 3
cmp eax, ecx
jae 0x444ea1
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0044d530
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00401280
mov edx, dword [eax]
jmp 0x444ec4
mov edx, dword [ebp - 0x14]
fstp st(0)
fstp st(0)
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x444eec
mov dword [ecx + eax*8], edi
jmp 0x444efe
cmp esi, edx
jne 0x444ef5
mov dword [ecx + eax*8], edi
jmp 0x444f02
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x444f02
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004e72d1
int3
Function at 0x44ba20
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [0x5b0138]
lea eax, [esi + 1]
mov dword [0x5b0138], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
push eax
lea eax, [ebp - 0x104]
push str..PipeFossilize._08lx._08x
push eax
call fcn.00429c00
movzx eax, byte [ebp + 0x14]
add esp, 0x10
shl eax, 0x1e
or eax, 1
push dword [ebp + 0x10]
push 0x2710
push 0x1000
push 0x1000
push 1
push 6
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esi, dword [ebp + 8]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x44babe
push 0
push 0x80
push 3
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x44bac5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44cbe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
call fcn.00401a40
mov ebx, eax
mov esi, str.module
mov edx, ebx
lea esp, [esp]
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x44cc20
test cl, cl
je 0x44cc1c
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x44cc20
add edx, 2
add esi, 2
test al, al
jne 0x44cc00
xor eax, eax
jmp 0x44cc25
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44cc39
mov eax, dword [edi + 4]
mov dword [eax], 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, str.pipeline
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x44cc60
test dl, dl
je 0x44cc5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x44cc60
add eax, 2
add ecx, 2
test dl, dl
jne 0x44cc40
xor eax, eax
jmp 0x44cc65
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44cc79
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0xc0
pop ebp
ret 4
push 0x10
push 0
push ebx
call fcn.004f2651
mov ecx, dword [edi + 4]
add esp, 0xc
mov dword [ecx], eax
mov eax, dword [edi + 4]
cmp dword [eax], 0
jne 0x44cc32
push ebx
push str.Fossilize_ERROR:_Invalid___on_disk_replay_whitelist_mask:__s_n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x14
call fcn.0044d450
push 1
call fcn.004eec9b
int3

Function at 0x44d390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
call fcn.00401a40
mov edi, eax
lea eax, [ebp + 8]
push 0x10
push eax
push edi
call fcn.004f2651
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [ecx + 0xc8], eax
mov dword [ecx + 0xcc], edx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
jne 0x44d3cd
pop edi
pop esi
pop ebp
ret 4
push edi
push str.Fossilize_ERROR:_Not_a_valid_pipeline_hash:___s_
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x14
push 1
call fcn.004eec9b
int3
Function at 0x44ed40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x5a2098
lea ecx, [ebp - 4]
call fcn.00446e50
call fcn.004539e0
push str.Fossilize_ERROR:_Crashed_or_hung_while_replaying._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4507e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50f24d
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [edi + 0x930]
test ecx, ecx
je 0x4509dd
mov edx, dword [edi + 0x2a4]
push esi
mov esi, dword [edi + 0x2a0]
mov eax, esi
or eax, edx
je 0x4509dc
cmp dword [edi + 0x1c], 0
je 0x4509ab
mov eax, dword [0x5b032c]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push esi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x4509aa
mov eax, dword [ebp - 0x14]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x4508d5
cmp eax, 0x7fffffff
ja 0x4509ec
cmp eax, 0x1000
jb 0x4508a7
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4509f1
push ecx
call fcn.004e9663
add esp, 4
test eax, eax
je 0x4509f6
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x4508b2
push eax
call fcn.004e9663
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push esi
lea ebx, [eax + esi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call fcn.004eb750
mov ecx, ebx
mov dword [ebp - 0x18], esi
add esp, 0xc
mov dword [ebp - 0x24], ecx
mov eax, dword [edi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5b032c]
push esi
push edx
push dword [edi + 0x2a4]
mov dword [ebp - 4], 0
push dword [edi + 0x2a0]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x450979
cmp dword [edi + 0x20], 0xf
lea eax, [edi + 0xc]
jbe 0x45090d
mov eax, dword [eax]
push 0x51cb90
push eax
call fcn.004f4c46
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x45093f
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push esi
mov dword [ebp - 0x10], eax
call fcn.004f5aec
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x45096d
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x450979
jmp 0x450970
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f4b0b
add esp, 4
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4509aa
sub ebx, esi
mov eax, esi
cmp ebx, 0x1000
jb 0x4509a0
mov esi, dword [eax - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4509f6
push ebx
push esi
call fcn.004e9693
add esp, 8
pop ebx
mov eax, dword [edi + 0x930]
push 0
push dword [edi + 0x2a4]
push dword [edi + 0x2a0]
push dword [eax + 0xc]
call dword [0x5b02a0]
mov dword [edi + 0x2a0], 0
mov dword [edi + 0x2a4], 0
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00402550
call fcn.00401a00
call fcn.004ee89f
int3
Function at 0x450a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50f24d
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
mov edi, ecx
mov ecx, dword [edi + 0x930]
test ecx, ecx
je 0x450bfd
mov edx, dword [edi + 0x2ac]
push esi
mov esi, dword [edi + 0x2a8]
mov eax, esi
or eax, edx
je 0x450bfc
cmp dword [edi + 0x34], 0
je 0x450bcb
mov eax, dword [0x5b065c]
push ebx
push 0
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push ebx
push edx
push esi
push dword [ecx + 0xc]
call eax
test eax, eax
jne 0x450bca
mov eax, dword [ebp - 0x14]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x450af5
cmp eax, 0x7fffffff
ja 0x450c0c
cmp eax, 0x1000
jb 0x450ac7
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x450c11
push ecx
call fcn.004e9663
add esp, 4
test eax, eax
je 0x450c16
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x450ad2
push eax
call fcn.004e9663
add esp, 4
mov esi, eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
push esi
lea ebx, [eax + esi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
call fcn.004eb750
mov ecx, ebx
mov dword [ebp - 0x18], esi
add esp, 0xc
mov dword [ebp - 0x24], ecx
mov eax, dword [edi + 0x930]
lea edx, [ebp - 0x14]
mov ecx, dword [0x5b065c]
push esi
push edx
push dword [edi + 0x2ac]
mov dword [ebp - 4], 0
push dword [edi + 0x2a8]
push dword [eax + 0xc]
call ecx
test eax, eax
jne 0x450b99
cmp dword [edi + 0x38], 0xf
lea eax, [edi + 0x24]
jbe 0x450b2d
mov eax, dword [eax]
push 0x51cb90
push eax
call fcn.004f4c46
mov ecx, eax
add esp, 8
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x450b5f
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push ecx
push eax
push 1
push esi
mov dword [ebp - 0x10], eax
call fcn.004f5aec
add esp, 0x10
cmp eax, dword [ebp - 0x10]
je 0x450b8d
push str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
mov eax, dword [ebp - 0x1c]
add esp, 0x10
test eax, eax
je 0x450b99
jmp 0x450b90
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004f4b0b
add esp, 4
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x450bca
sub ebx, esi
mov eax, esi
cmp ebx, 0x1000
jb 0x450bc0
mov esi, dword [eax - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x450c16
push ebx
push esi
call fcn.004e9693
add esp, 8
pop ebx
mov eax, dword [edi + 0x930]
push 0
push dword [edi + 0x2ac]
push dword [edi + 0x2a8]
push dword [eax + 0xc]
call dword [0x5b0658]
mov dword [edi + 0x2a8], 0
mov dword [edi + 0x2ac], 0
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00402550
call fcn.00401a00
call fcn.004ee89f
int3
Function at 0x4521d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, dword [ebp - 4]
push 2
call fcn.004f2743
push esi
push str.Fossilize_ERROR:_Error:__s_n
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x452a70
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
jne 0x452ab1
push str.Fossilize_ERROR:_Failed_to_open_file_mapping_in_replayer._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x10
xor al, al
pop edi
pop ebp
ret
push esi
push 0
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x452af2
push str.Fossilize_ERROR:_Failed_to_map_view_of_file_in_replayer._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x10
xor al, al
pop esi
pop edi
pop ebp
ret
cmp dword [esi], 0x19bcde1d
mov dword [0x5b00d4], esi
jne 0x452b1d
cmp dword [esi + 0xca4], 0xcac
jb 0x452b1d
mov ecx, dword [esi + 0xca8]
test ecx, ecx
je 0x452b1d
lea eax, [ecx - 1]
test ecx, eax
je 0x452b5a
push str.Fossilize_ERROR:_Control_block_is_corrupt._n
push 2
call fcn.004f2743
add esp, 4
push eax
call fcn.00401d60
push 2
call fcn.004f2743
push eax
call fcn.004f2b00
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5b00d4], 0
push dword [ebp + 0xc]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
mov dword [0x5b00e0], eax
pop esi
setne al
pop edi
pop ebp
ret