joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a0f0
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, dword [0x4c3264]
sub esp, 0x454
test eax, eax
je 0x40a101
call eax
push esi
push edi
mov edi, dword [esp + 0x460]
mov ecx, dword [edi]
add ecx, 0x28
call fcn.0040c770
mov ecx, dword [0x4c397c]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov byte [eax + 0x24], 1
mov eax, dword [edi + 0x24]
cmp eax, 2
jne 0x40a1e5
push 0x400
lea eax, [esp + 0x60]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a1a3
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00457250
add esp, 0xc
mov dword [esp + 0x18], 0x44
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [edi + 0x20]
lea esi, [edi + 0xc]
cmp eax, 0x10
jb 0x40a1b9
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00401a60
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40a1cf
mov esi, dword [esi]
push 0x28
push edi
mov byte [esi], 0
call fcn.00453cc4
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [edi + 0xc]
cmp eax, 1
mov eax, dword [esi + 0x14]
jne 0x40a22c
cmp eax, 0x10
jb 0x40a200
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00401a60
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40a216
mov esi, dword [esi]
push 0x28
push edi
mov byte [esi], 0
call fcn.00453cc4
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
cmp eax, 0x10
jb 0x40a23c
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.00401a60
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x40a1cf
jmp 0x40a1cd
Function at 0x40c6b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486edb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
call fcn.0040c0f0
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.sync_o::mutex.0
call fcn.004059c0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 4], eax
test eax, eax
jne 0x40c710
push str.CreateMutex
lea ecx, [esi + 4]
call fcn.0040bf50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40c732
push 0x48bdbd
lea ecx, [esi + 8]
call fcn.00406620
test al, al
je 0x40c732
mov byte [esi + 0x20], 1
push 0
push 0
push 0
push 0
push 4
push 6
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d790
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.00412eb0
mov dword [esi], vtable.tcp_socket.0
mov byte [esi + 0x3c], 1
mov eax, dword [0x4c330c]
test eax, eax
jne 0x40d7d5
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
inc dword [0x4c330c]
mov eax, esi
pop esi
add esp, 0x194
ret
inc eax
mov dword [0x4c330c], eax
mov eax, esi
pop esi
add esp, 0x194
ret

Function at 0x40d810
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov bh, byte [ebp + 8]
xor eax, eax
push esi
test bh, bh
mov esi, ecx
push edi
sete al
lea ecx, [ebp - 0x24]
push str.changing_socket_mode_to
mov dword [ebp + 8], eax
call fcn.004056a0
mov eax, str.non_blocking
mov dword [ebp - 4], 0
test bh, bh
lea ecx, [ebp - 0x24]
mov edi, str.blocking
cmove edi, eax
push edi
call fcn.00406760
lea ecx, [ebp - 0x24]
call fcn.004059d0
push eax
lea eax, [ebp + 8]
push eax
push 0x8004667e
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
mov ecx, esi
call fcn.0040dd70
mov bl, al
test bl, bl
je 0x40d8ab
mov edx, dword [esi + 0x24]
test edx, edx
je 0x40d8a8
mov ecx, dword [edx]
push edi
push str.socket_mode_is_set_to__s_n
push edx
call dword [ecx + 0x18]
add esp, 0xc
mov byte [esi + 0x3c], bh
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x40d8c0
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00401a60
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40d970
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
push ebx
push esi
mov esi, dword [esp + 0x21c]
mov eax, 0x10624dd3
mul esi
push edi
shr edx, 6
mov edi, ecx
imul eax, edx, 0x3e8
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], edx
push ecx
push 0
sub esi, eax
mov dword [esp + 0x124], 1
imul eax, esi, 0x3e8
lea ecx, [esp + 0x124]
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x38]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x28], eax
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x40d9f9
lea eax, [esp + 0x14]
push eax
push dword [edi + 0x38]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x40d9f9
xor bl, bl
jmp 0x40d9fb
mov bl, 1
lea eax, [esp + 0x118]
push eax
push dword [edi + 0x38]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x40da21
test bl, bl
jne 0x40da21
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x210
ret 4
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x210
ret 4

Function at 0x40da30
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov esi, dword [esp + 0x118]
mov eax, 0x10624dd3
mul esi
push edi
shr edx, 6
mov ebx, ecx
imul eax, edx, 0x3e8
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], edx
mov edi, dword [ebx + 0x38]
mov dword [esp + 0x18], edi
sub esi, eax
imul eax, esi, 0x3e8
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
lea eax, [esp + 0x14]
push eax
push dword [ebx + 0x38]
call sub.WS2_32.dll___WSAFDIsSet
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x10c
ret 4

Function at 0x40dbe0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
push edi
push dword [esp + 0x24]
mov eax, 2
mov edi, ecx
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
call fcn.00407550
mov esi, dword [esp + 0x20]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], edx
test esi, esi
je 0x40dc82
mov ecx, str.BROADCAST
mov eax, esi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40dc40
test dl, dl
je 0x40dc3c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40dc40
add eax, 2
add ecx, 2
test dl, dl
jne 0x40dc20
xor eax, eax
jmp 0x40dc45
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40dc53
mov dword [esp + 0xc], 0xffffffff
jmp 0x40dc5e
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0xc], eax
push 0x10
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
push 0
push dword [eax + 0xc]
push dword [eax + 8]
push dword [edi + 0x38]
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
pop esi
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x1c]
push 0
push dword [eax + 0xc]
push dword [eax + 8]
push dword [edi + 0x38]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x40dca0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
push esi
mov dword [esp + 0x14], 0x10
call fcn.00454697
add esp, 4
mov ebp, eax
call fcn.00407550
mov dword [ebx + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [ebx + 0x14], edx
push eax
push 0
push esi
push ebp
push dword [ebx + 0x38]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test edi, edi
jne 0x40dcff
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x40dd33
mov ecx, dword [eax]
push str.Connection_has_been_gracefully_closed_n
push eax
call dword [ecx + 0x18]
add esp, 8
jmp 0x40dd33
push str.receiving_from_socket
push edi
mov ecx, ebx
call fcn.0040dd70
test al, al
jne 0x40dd28
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x40dd33
mov eax, dword [ecx]
push edi
push str.recvfrom___return__d_n
push ecx
call dword [eax + 8]
add esp, 0xc
jmp 0x40dd33
mov ecx, dword [esp + 0x28]
push edi
push ebp
call fcn.0040cbd0
push ebp
call fcn.004546a0
mov esi, dword [esp + 0x34]
add esp, 4
test esi, esi
je 0x40dd5d
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
sub esi, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x40dd50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc

Function at 0x40ded0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x487008
push eax
mov dword fs:[0], esp
sub esp, 0x18
push edi
mov edi, ecx
cmp dword [edi + 0x4c], 0
je 0x40dfa5
cmp dword [edi + 0x1c], 0xffffffff
je 0x40dfa5
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x24]
push ebx
push esi
push 0xffffffffffffffff
call dword [eax]
mov esi, dword [ebp + 8]
test esi, esi
je 0x40df9b
push dword [edi + 0x4c]
call fcn.0046a724
add esp, 4
cmp esi, eax
jge 0x40df9b
push dword [edi + 0x4c]
call fcn.0046815b
push str..bak
lea esi, [edi + 4]
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.00406910
add esp, 0x10
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.004059c0
push eax
call fcn.0046a72f
add esp, 4
lea ecx, [ebp - 0x24]
call fcn.004059d0
push eax
mov ecx, esi
call fcn.004059d0
push eax
call fcn.0046abdf
add esp, 8
mov ecx, esi
push dword [edi + 0x20]
call fcn.004059d0
push eax
call fcn.0046829c
add esp, 8
mov dword [edi + 0x4c], eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00401820
lea ecx, [edi + 0x24]
call fcn.0040c770
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e4a0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov eax, dword [edi + 0x48]
cmp eax, dword [esp + 0xc]
jl 0x40e4f6
push dword [edi + 0x1c]
call fcn.0040ded0
cmp dword [edi + 0x4c], ebx
jne 0x40e4c3
pop edi
xor eax, eax
pop ebx
ret 0xc
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x24]
push esi
push 0xffffffffffffffff
call dword [eax]
push dword [edi + 0x4c]
push dword [esp + 0x1c]
push 1
push dword [esp + 0x20]
call fcn.004684eb
push dword [edi + 0x4c]
mov ebx, eax
call fcn.0046a90a
add esp, 0x14
lea ecx, [edi + 0x24]
call fcn.0040c770
pop esi
pop edi
mov eax, ebx
pop ebx
ret 0xc

Function at 0x40e860
Capabilities:
Terminate thread

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call fcn.0040e810
test al, al
je 0x40e876
mov al, 1
pop esi
ret 8
push ebx
push dword [esp + 0x10]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
mov ecx, esi
setne bl
call fcn.0040e7d0
mov al, bl
pop ebx
pop esi
ret 8

Function at 0x40eab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4870ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00407950
add esp, 4
push 0x48cc04
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.004059c0
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00408c60
add esp, 0xc
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00405700
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x40eb1f
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00401a60
push 0x48cc08
lea ecx, [ebp - 0x3c]
call fcn.004059d0
push eax
call fcn.0046829c
mov esi, eax
add esp, 8
test esi, esi
je 0x40eb5b
push dword [ebp + 0xc]
call fcn.00407c50
push eax
push dword [ebp + 8]
push str.Thread__s_catch_unexpected_error__n_s_n
push esi
call fcn.0040bf20
push esi
call fcn.0046815b
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x413020
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0040d790
push 0x10
mov dword [ebp - 4], 0
mov dword [esi], vtable.ip_socket.0
call fcn.00453c80
add esp, 4
mov dword [esi + 0x40], eax
cmp dword [esi + 0x38], 0xffffffff
jne 0x413097
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x276d
jne 0x413097
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x38], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x413140
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x413151
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 1
push 4
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.0040d8f0
test al, al
jne 0x413184
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x413184
mov eax, dword [ecx]
push str.SO_REUSEADDR_is_off_n
push ecx
call dword [eax + 0x18]
add esp, 8
mov ecx, dword [esi + 0x24]
pop esi
test ecx, ecx
je 0x41319c
mov eax, dword [ecx]
push str._socket_reset_n
push 3
push ecx
call dword [eax + 0x14]
add esp, 0xc
ret

Function at 0x4131a0
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov esi, ecx
call fcn.00413140
mov eax, dword [esi + 0x40]
mov ecx, 2
push dword [esp + 0x10]
mov word [eax], cx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esi + 0x40]
mov ebx, dword [esp + 0xc]
push ebx
mov word [ecx + 2], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [esi + 0x40]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x4131f2
push dword [esp + 0x10]
mov eax, dword [ecx]
push ebx
push str._connecting_to__s:_d..._n
push 3
push ecx
call dword [eax + 0x14]
add esp, 0x14
push 0
push 0x10
push dword [esi + 0x40]
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_connect]
push eax
mov ecx, esi
call fcn.0040dd70
mov bl, al
test bl, bl
je 0x413225
mov edx, dword [esi + 0x24]
test edx, edx
je 0x413225
mov ecx, dword [edx]
push str._connected_n
push edx
call dword [ecx + 0x18]
add esp, 8
call fcn.00407550
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov al, bl
mov dword [esi + 0x1c], edx
mov dword [esi + 0x14], edx
pop esi
pop ebx
ret 8
Function at 0x413fc0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x413fd0
mov dword [edi], 0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x41418e
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x13c4], 0
test ecx, ecx
je 0x41418e
mov eax, dword [esp + 0x18]
test eax, eax
js 0x41418e
cmp byte [esi + 0x1390], 0
je 0x414022
test edi, edi
je 0x414011
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
xor eax, eax
pop esi
ret 0x10
test eax, eax
jne 0x41403d
test edi, edi
je 0x41402c
mov dword [edi], eax
pop edi
mov dword [esi + 0x13c4], 0
xor eax, eax
pop esi
ret 0x10
push ebx
push ebp
push dword [esi]
mov dword [esi + 0x13a8], eax
mov dword [esi + 0x13a4], ecx
call fcn.0046c831
add esp, 4
test eax, eax
jne 0x4140fa
nop dword [eax]
cmp dword [esi + 0x1398], 0
jne 0x4140ab
push dword [esi]
call fcn.00415180
add esp, 4
test al, al
jne 0x4140ab
push dword [esi]
lea ebp, [esi + 4]
push 0x1388
push 1
push ebp
call fcn.0046ab2f
push dword [esi]
mov ebx, eax
call fcn.0046c831
add esp, 0x14
test eax, eax
jne 0x4140fa
mov dword [esi + 0x138c], ebx
mov dword [esi + 0x1398], ebx
mov dword [esi + 0x1394], ebp
lea eax, [esi + 0x1394]
push eax
call fcn.00413b30
test eax, eax
jne 0x414153
push dword [esi]
call fcn.00415180
add esp, 4
test al, al
je 0x4140df
cmp dword [esi + 0x1398], 0
jne 0x4140df
cmp dword [esi + 0x13a8], 0
ja 0x414117
cmp dword [esi + 0x13a8], 0
je 0x414134
push dword [esi]
call fcn.0046c831
add esp, 4
test eax, eax
je 0x414060
test edi, edi
je 0x414104
mov dword [edi], 0xfffffffa
pop ebp
pop ebx
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
xor eax, eax
pop esi
ret 0x10
test edi, edi
je 0x414121
mov dword [edi], 0xfffffff9
pop ebp
pop ebx
pop edi
mov dword [esi + 0x13c4], 0xfffffff9
xor eax, eax
pop esi
ret 0x10
test edi, edi
je 0x41413e
mov dword [edi], 0
mov eax, dword [esp + 0x20]
pop ebp
pop ebx
pop edi
mov dword [esi + 0x13c4], 0
pop esi
ret 0x10
cmp eax, 4
jne 0x414179
test edi, edi
je 0x41415e
mov dword [edi], eax
mov eax, dword [esp + 0x20]
sub eax, dword [esi + 0x13a8]
pop ebp
pop ebx
pop edi
mov dword [esi + 0x13c4], 4
pop esi
ret 0x10
test edi, edi
je 0x41417f
mov dword [edi], eax
pop ebp
pop ebx
mov dword [esi + 0x13c4], eax
xor eax, eax
pop edi
pop esi
ret 0x10
test edi, edi
je 0x414198
mov dword [edi], 0xfffffffe
test esi, esi
je 0x4141a6
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x414a40
Capabilities:
Terminate process

Disassembly:
call fcn.004148d0
push eax
push dword [esp + 8]
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_acm.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__30_December_2001._n_n
push 2
call fcn.0046c767
add esp, 4
push eax
call fcn.0040bf20
add esp, 0x10
cmp dword [esp + 4], 0x3ef
jne 0x414a84
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 2
call fcn.0046c767
add esp, 4
push eax
call fcn.0040bf20
add esp, 8
push 3
call fcn.0046c689
int3
Function at 0x414b10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [eax + 0x38]
mov bl, byte [eax + 0x34]
test esi, esi
jle 0x414b4d
mov edx, dword [eax + 0x260]
push edi
movzx edi, bl
nop word [eax + eax]
mov ecx, edx
shl edx, 8
shr ecx, 0x18
xor ecx, edi
xor edx, dword [ecx*4 + 0x4bf848]
mov dword [eax + 0x260], edx
sub esi, 1
jne 0x414b30
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], 1
mov edx, dword [eax + 0x38]
mov ecx, edx
sub ecx, 1
je 0x414ba4
sub ecx, 1
je 0x414bda
sub ecx, 1
je 0x414bb3
mov byte [edx + eax + 0x54], 1
mov edx, dword [eax + 0x24]
mov ecx, dword [eax + 0x44]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov bl, byte [eax + 0x38]
sub bl, 4
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
pop esi
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
mov edx, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [edx + ecx], bl
inc dword [eax + 0x44]
pop ebx
ret
Function at 0x41b380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [edi + 0x24]
nop word [eax + eax]
mov ebx, dword [edi + 0x34]
mov ecx, dword [edi + 0x64]
sub ebx, ecx
mov eax, dword [edi + 0x6c]
sub ebx, eax
jne 0x41b3ae
test ecx, ecx
jne 0x41b3ba
test eax, eax
jne 0x41b3ba
mov ebx, esi
jmp 0x41b42c
cmp ebx, 0xffffffff
jne 0x41b3ba
mov ebx, 0xfffffffe
jmp 0x41b42c
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, esi
cmp ecx, eax
jb 0x41b42c
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00455640
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
nop dword [eax + eax]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x41b3ff
sub eax, esi
jmp 0x41b401
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x41b3f0
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x41b420
sub eax, esi
jmp 0x41b422
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x41b411
add ebx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x41b484
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.0041b720
add dword [edi + 0x6c], eax
add esp, 0xc
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x41b470
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x41b484
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x41b390
pop edi
pop esi
pop ebx
ret