joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406090
Capabilities:
Create directory
Set file attributes

Disassembly:
sub esp, 0x48
push ebp
mov ebp, dword [esp + 0x50]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4060a9
mov ecx, dword [ecx + 0xf74]
test ecx, ecx
jne 0x4060b2
xor al, al
pop ebp
add esp, 0x48
ret 4
cmp dword [ebp + 0x18], 0x10
jb 0x4060bd
mov eax, dword [ebp + 4]
jmp 0x4060c0
lea eax, [ebp + 4]
push esi
lea edx, [esp + 0x14]
push edx
push eax
push ecx
call fcn.0040afd0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4060e0
pop esi
xor al, al
pop ebp
add esp, 0x48
ret 4
push ebx
push edi
push esi
mov dword [esp + 0x14], 0
call fcn.0040b380
mov edi, eax
push edi
mov dword [esp + 0x1c], edi
call fcn.0043c539
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push esi
mov dword [esp + 0x30], ebx
call fcn.0040b3b0
push esi
call fcn.0040b330
mov eax, dword [esp + 0x2c]
add esp, 0x1c
cmp eax, edi
jne 0x4062ae
push 1
push 0
lea ecx, [esp + 0x64]
push ecx
mov ecx, ebp
mov byte [esp + 0x68], 0x2f
call fcn.004053b0
mov ebx, dword [ebp + 0x14]
mov esi, eax
cmp esi, 0xffffffff
je 0x406236
push ebx
inc esi
push esi
lea edx, [esp + 0x44]
push edx
mov ecx, ebp
call fcn.00405fe0
push 1
push 0
lea ecx, [esp + 0x64]
push ecx
mov ecx, eax
mov byte [esp + 0x68], 0x2f
call fcn.004053b0
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00403d40
cmp edi, 0xffffffff
je 0x406232
nop
lea esi, [esi + edi + 1]
lea edx, [esi - 1]
push edx
push 0
lea eax, [esp + 0x28]
push eax
mov ecx, ebp
call fcn.00405fe0
mov ecx, dword [eax + 0x18]
mov edi, 0x10
cmp ecx, edi
jb 0x4061a7
mov eax, dword [eax + 4]
jmp 0x4061aa
add eax, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [esp + 0x38], edi
jb 0x4061c6
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0043c53e
add esp, 4
push ebx
push esi
lea edx, [esp + 0x44]
push edx
mov ecx, ebp
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.00405fe0
push 1
push 0
lea ecx, [esp + 0x64]
push ecx
mov ecx, eax
mov byte [esp + 0x68], 0x2f
call fcn.004053b0
mov edi, eax
cmp dword [esp + 0x54], 0x10
jb 0x406214
mov edx, dword [esp + 0x40]
push edx
call fcn.0043c53e
add esp, 4
cmp edi, 0xffffffff
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
jne 0x406180
mov edi, dword [esp + 0x14]
mov eax, dword [ebp + 0x18]
mov ebx, 0x10
cmp eax, ebx
lea esi, [ebp + 4]
jb 0x406249
mov eax, dword [esi]
jmp 0x40624b
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp dword [ebp + 0x18], ebx
jb 0x40625e
mov esi, dword [esi]
push 0x448300
push esi
call fcn.0042acb6
mov esi, eax
add esp, 8
test esi, esi
jne 0x40628b
mov eax, dword [esp + 0x18]
push eax
call fcn.0043c53e
add esp, 4
pop edi
pop ebx
pop esi
xor al, al
pop ebp
add esp, 0x48
ret 4
mov ebx, dword [esp + 0x18]
push esi
push edi
push 1
push ebx
call fcn.0042b054
push esi
mov dword [esp + 0x30], eax
call fcn.0042a859
mov eax, dword [esp + 0x30]
add esp, 0x14
cmp eax, edi
je 0x4062c3
push ebx
call fcn.0043c53e
add esp, 4
pop edi
pop ebx
pop esi
xor al, al
pop ebp
add esp, 0x48
ret 4
pop edi
pop ebx
pop esi
mov al, 1
pop ebp
add esp, 0x48
ret 4
Function at 0x409c20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
test edx, edx
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
jle 0x409c54
mov ecx, dword [esp + 0xc]
push ebx
push edi
movzx ebx, byte [ecx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [edi*4 + 0x458520]
shr eax, 8
xor eax, ebx
inc ecx
dec edx
jne 0x409c35
pop edi
pop ebx
mov dword [esi], eax
pop esi
ret

Function at 0x409e80
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov ecx, dword [esi + 0x108]
push ebx
push ebp
push edi
mov edi, dword [esi + 0x14c]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 0x110]
mov dword [esp + 0xc], eax
mov edx, dword [edi + 0x16]
mov dword [esi + 0x118], edx
mov eax, dword [edi + 0x1a]
mov ebx, dword [esi + 0x118]
mov edx, dword [esi + 0x114]
add ebx, ecx
mov dword [esi + 0x11c], eax
adc eax, edx
mov dword [esi + 0x118], ebx
mov ebp, ebx
mov ebx, eax
mov dword [esi + 0x11c], eax
mov eax, dword [esp + 0x10]
cmp ebx, eax
jl 0x409eea
jg 0x409f24
cmp ebp, dword [esp + 0xc]
ja 0x409f24
mov ebp, dword [edi + 0x1e]
mov dword [esi + 0x120], ebp
mov ebp, dword [edi + 0x22]
mov dword [esi + 0x124], ebp
mov ebp, dword [esi + 0x120]
add ebp, ecx
adc dword [esi + 0x124], edx
mov edx, dword [esi + 0x124]
cmp edx, eax
mov dword [esi + 0x120], ebp
mov ecx, ebp
jl 0x409f30
jg 0x409f24
cmp ecx, dword [esp + 0xc]
jbe 0x409f30
pop edi
pop ebp
mov eax, 0xb
pop ebx
add esp, 8
ret
mov eax, dword [edi + 0x26]
mov ebp, dword [esi + 0x118]
lea ecx, [eax + eax*2]
shl ecx, 2
xor eax, eax
add ecx, ebp
adc eax, ebx
cmp eax, dword [esi + 0x134]
jl 0x409f63
jg 0x409f57
cmp ecx, dword [esi + 0x130]
jbe 0x409f63
mov dword [esi + 0x130], ecx
mov dword [esi + 0x134], eax
mov edi, dword [edi + 0x2a]
mov ebx, dword [esi + 0x120]
lea ecx, [edi + edi*4]
shl ecx, 2
xor eax, eax
add ecx, ebx
adc eax, edx
cmp eax, dword [esi + 0x134]
jl 0x409f96
jg 0x409f8a
cmp ecx, dword [esi + 0x130]
jbe 0x409f96
mov dword [esi + 0x130], ecx
mov dword [esi + 0x134], eax
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x40ab70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
mov ecx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 4]
mov dword [esp + 8], 0
mov eax, dword [edi + 0x128]
cmp eax, ecx
mov dword [esp + 0x10], edi
jne 0x40ab9e
mov ecx, dword [edi + 0x12c]
cmp ecx, dword [esi + 0x1c]
je 0x40abc7
mov eax, dword [esi + 0x18]
mov ecx, dword [edi + 0x108]
push 0
lea edx, [esi + 0x1c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 0x18]
mov dword [edi + 0x128], edx
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x12c], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
cmp ecx, edx
jae 0x40acc6
mov ecx, dword [esi + 0x34]
test ecx, ecx
jne 0x40ac99
push ebx
mov ecx, edx
push ebp
mov dword [esp + 0x14], ecx
mov ebp, dword [eax + 8]
push ecx
call fcn.0042a10c
push ebp
mov dword [esi + 0x34], eax
call fcn.0042a10c
mov ecx, dword [esp + 0x1c]
mov edi, dword [esi + 0x34]
mov edx, ecx
shr ecx, 2
mov ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
add esp, 8
test ebx, ebx
rep stosb byte es:[edi], al
je 0x40ac97
mov eax, dword [esi + 0x34]
test eax, eax
je 0x40ac8e
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x108]
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
test ch, 2
je 0x40ac70
mov edx, dword [esi + 0x34]
push ebp
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.0040f450
add esp, 0x10
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x10]
test ch, 1
je 0x40ac8e
mov edx, dword [esi + 0x34]
push ebp
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.0040fbf0
add esp, 0x10
push ebx
call fcn.0042a11e
add esp, 4
pop ebp
pop ebx
mov esi, dword [esi + 0x34]
test esi, esi
je 0x40ace4
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add esi, edx
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [edi + 0x108]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x40b3b0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push esi
xor eax, eax
test ebx, ebx
push edi
je 0x40b3bf
mov dword [ebx], eax
mov esi, dword [esp + 0x10]
test esi, esi
mov edi, dword [esp + 0x18]
je 0x40b43c
mov edx, dword [esp + 0x14]
test edx, edx
je 0x40b43c
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x40b400
push 0
lea eax, [esp + 0x20]
push eax
mov esi, edi
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
cmp eax, esi
jb 0x40b440
test ebx, ebx
je 0x40b3fa
mov dword [ebx], eax
pop edi
pop esi
mov al, 1
pop ebx
ret
test edi, edi
jbe 0x40b436
mov ecx, dword [esi + 0x14]
push edi
push edx
push ecx
mov eax, esi
call fcn.0040acf0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40b42a
push 0x3eb
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor al, al
pop ebx
ret
mov edx, dword [esi + 4]
mov dword [edx + 0x13c], esi
add dword [esi + 0x14], eax
test ebx, ebx
je 0x40b43c
mov dword [ebx], eax
cmp eax, edi
jae 0x40b3fa
push 0x26
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x40bb60
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x14c]
mov ecx, dword [eax + 0x2a]
mov eax, dword [eax + 0x26]
lea ecx, [ecx + ecx*4]
lea edx, [eax + eax*2]
shl ecx, 2
shl edx, 2
cmp edx, ecx
push ebp
push esi
mov dword [esp + 0xc], 0
jbe 0x40bb9c
mov eax, dword [ebx + 0x14c]
mov esi, dword [eax + 0x26]
lea esi, [esi + esi*2]
jmp 0x40bba8
mov ecx, dword [ebx + 0x14c]
mov esi, dword [ecx + 0x2a]
lea esi, [esi + esi*4]
shl esi, 2
push esi
call fcn.0042a10c
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40bbc7
mov dword [esp + 0xc], 8
jmp 0x40bd0c
push edi
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x14c]
mov edx, dword [ebx + 0x108]
mov esi, dword [eax + 4]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebx + 0x14c]
mov edx, dword [ebx + 0x108]
push 0
lea eax, [esp + 0x20]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx + 0x14c]
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [eax + 4]
jne 0x40bd03
mov eax, dword [eax + 0x26]
mov esi, dword [ebx + 0x150]
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
shr eax, 2
push eax
mov ecx, edx
and ecx, 3
push str._hashkey_table_
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.0040ec90
mov ecx, dword [ebx + 0x118]
mov edx, dword [ebx + 0x108]
add esp, 0xc
push 0
lea eax, [ebx + 0x11c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [esp + 0x14]
mov ecx, dword [ebx + 0x108]
push 0
lea eax, [esp + 0x20]
push eax
push esi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x1c], esi
jne 0x40bd03
mov edx, dword [ebx + 0x14c]
mov eax, dword [edx + 0x2a]
mov esi, dword [ebx + 0x154]
lea eax, [eax + eax*4]
shl eax, 2
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
shr eax, 2
push eax
mov ecx, edx
and ecx, 3
push str._block_table_
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.0040ec90
mov esi, dword [esp + 0x20]
mov ecx, dword [ebx + 0x108]
add esp, 0xc
push 0
lea eax, [esp + 0x20]
push eax
push esi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x1c], esi
je 0x40bd0b
mov dword [esp + 0x10], 0x70
pop edi
test ebp, ebp
je 0x40bd19
push ebp
call fcn.0042a11e
add esp, 4
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x40d460
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x45bb34]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x130], eax
mov eax, dword [esi + 0x194]
push edi
xor edi, edi
cmp eax, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
jne 0x40d4a9
xor eax, eax
mov ecx, dword [esp + 0x134]
call fcn.004296f9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0x4000000
push 2
push ebx
push ebx
push 0xc0000000
push str._list_
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40d4d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 0x14c]
mov eax, dword [eax + 0x26]
mov edx, dword [esi + 0x150]
lea ecx, [eax + eax*2]
lea eax, [edx + ecx*4]
push ebx
push esi
mov dword [esp + 0x28], eax
call fcn.0040f170
mov ebx, eax
add esp, 8
test ebx, ebx
mov dword [esp + 0x14], ebx
jne 0x40d50b
mov ebx, dword [esi + 0x150]
mov dword [esp + 0x14], ebx
test edi, edi
jne 0x40d62e
mov ecx, dword [ebx]
cmp ecx, dword [esp + 0x1c]
je 0x40d5ab
mov eax, dword [ebx + 4]
cmp eax, dword [esp + 0x18]
je 0x40d5ab
cmp dword [ebx + 8], 0xfffffffe
jae 0x40d5ab
mov edx, dword [esi + 0x150]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov ecx, ebx
sub ecx, edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esi + 0x194]
mov eax, dword [edx + ecx*4]
cmp eax, 0xfffffffe
jae 0x40d5ab
mov ecx, dword [eax + 4]
mov edx, ecx
shr ecx, 2
lea esi, [eax + 8]
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax + 4]
mov byte [esp + ecx + 0x28], 0xd
mov edx, dword [eax + 4]
push 0
mov byte [esp + edx + 0x2d], 0xa
mov edx, dword [eax + 4]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
add edx, 2
push edx
lea eax, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x20]
add ebx, 0xc
cmp ebx, eax
jb 0x40d5bc
mov ebx, dword [esi + 0x150]
cmp ebx, dword [esp + 0x14]
jne 0x40d513
push str._list_
push esi
call fcn.0040f170
mov ebx, dword [esp + 0x18]
add esp, 8
test eax, eax
jne 0x40d610
mov edx, dword [str._list_]
mov ax, word [0x44835c]
push 0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], edx
push 8
lea edx, [esp + 0x34]
push edx
push ebx
mov word [esp + 0x40], ax
mov byte [esp + 0x42], 0xd
mov byte [esp + 0x43], 0xa
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
push 0x80020100
push str._list_
push ebx
push esi
call fcn.0040c6c0
add esp, 0x1c
mov edi, eax
jmp 0x40d632
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
je 0x40d63e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x134]
mov eax, edi
call fcn.004296f9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dca0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x190]
test eax, eax
jne 0x40dcb3
xor eax, eax
pop esi
ret
push ebx
push edi
push 0
push 0x4000000
push 2
push 0
push 0
push 0xc0000000
push str._attr_
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40dce9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x40ddd6
mov ecx, dword [esi + 0x190]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x18]
push eax
push 8
push ecx
push edi
call ebp
cmp dword [esp + 0x14], 8
je 0x40dd14
mov ebx, 0x70
jmp 0x40ddc9
mov edx, dword [esi + 0x190]
mov eax, dword [edx + 8]
test eax, eax
je 0x40dd49
mov ecx, dword [esi + 0x14c]
mov ebx, dword [ecx + 0x2a]
push 0
lea edx, [esp + 0x18]
push edx
shl ebx, 2
push ebx
push eax
push edi
call ebp
cmp dword [esp + 0x14], ebx
je 0x40dd49
mov ebx, 0x70
jmp 0x40ddc9
mov eax, dword [esi + 0x190]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x40dd7b
mov ecx, dword [esi + 0x14c]
mov ebx, dword [ecx + 0x2a]
push 0
lea edx, [esp + 0x18]
push edx
shl ebx, 3
push ebx
push eax
push edi
call ebp
cmp dword [esp + 0x14], ebx
je 0x40dd7b
mov ebx, 0x70
jmp 0x40ddc9
mov eax, dword [esi + 0x190]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x40ddad
mov ecx, dword [esi + 0x14c]
mov ebx, dword [ecx + 0x2a]
push 0
lea edx, [esp + 0x18]
push edx
shl ebx, 4
push ebx
push eax
push edi
call ebp
cmp dword [esp + 0x14], ebx
je 0x40ddad
mov ebx, 0x70
jmp 0x40ddc9
push 0
push 0
push 0
push 0x80000100
push str._attr_
push edi
push esi
call fcn.0040c6c0
add esp, 0x1c
mov ebx, eax
cmp edi, 0xffffffff
pop ebp
je 0x40ddd6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x40ec90
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov al, byte [ebx]
test al, al
push esi
push edi
mov esi, 0x7fed7fed
mov edi, 0xeeeeeeee
je 0x40ecce
movzx eax, al
push eax
call fcn.0042ba4c
mov ecx, dword [eax*4 + 0x45d6a8]
add esi, edi
imul edi, edi, 0x21
add esp, 4
inc ebx
add edi, eax
mov al, byte [ebx]
xor esi, ecx
test al, al
lea edi, [edi + esi + 3]
jne 0x40eca7
mov edi, dword [esp + 0x18]
test edi, edi
mov eax, 0xeeeeeeee
jbe 0x40ed19
mov edx, dword [esp + 0x10]
nop
mov ecx, esi
and ecx, 0xff
mov ebx, dword [ecx*4 + 0x45daa8]
mov ecx, dword [edx]
add eax, ebx
lea ebx, [eax + esi]
imul eax, eax, 0x21
xor ebx, ecx
mov dword [edx], ebx
mov ebx, esi
not ebx
shl ebx, 0x15
add ebx, 0x11111111
shr esi, 0xb
add edx, 4
or esi, ebx
dec edi
lea eax, [eax + ecx + 3]
jne 0x40ece0
pop edi
pop esi
pop ebx
ret
Function at 0x40ed20
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov al, byte [ebx]
test al, al
push esi
push edi
mov esi, 0x7fed7fed
mov edi, 0xeeeeeeee
je 0x40ed5e
movzx eax, al
push eax
call fcn.0042ba4c
mov ecx, dword [eax*4 + 0x45d6a8]
add esi, edi
imul edi, edi, 0x21
add esp, 4
inc ebx
add edi, eax
mov al, byte [ebx]
xor esi, ecx
test al, al
lea edi, [edi + esi + 3]
jne 0x40ed37
mov edi, dword [esp + 0x18]
test edi, edi
mov eax, 0xeeeeeeee
jbe 0x40eda7
mov edx, dword [esp + 0x10]
nop
mov ecx, esi
and ecx, 0xff
add eax, dword [ecx*4 + 0x45daa8]
mov ebx, dword [edx]
lea ecx, [eax + esi]
imul eax, eax, 0x21
xor ecx, ebx
mov ebx, esi
not ebx
shl ebx, 0x15
add ebx, 0x11111111
shr esi, 0xb
mov dword [edx], ecx
or esi, ebx
add edx, 4
dec edi
lea eax, [eax + ecx + 3]
jne 0x40ed70
pop edi
pop esi
pop ebx
ret

Function at 0x40ef60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
shr edi, 2
test edi, edi
mov ecx, 0xeeeeeeee
jbe 0x40efbb
mov eax, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x40ef80
mov edx, eax
and edx, 0xff
mov ebx, dword [edx*4 + 0x45daa8]
mov edx, dword [esi]
add ecx, ebx
lea ebx, [ecx + eax]
imul ecx, ecx, 0x21
xor ebx, edx
mov dword [esi], ebx
mov ebx, eax
not ebx
shl ebx, 0x15
add ebx, 0x11111111
shr eax, 0xb
add esi, 4
or eax, ebx
dec edi
lea ecx, [ecx + edx + 3]
jne 0x40ef80
pop esi
pop ebx
pop edi
ret

Function at 0x40efc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
shr edi, 2
test edi, edi
mov edx, 0xeeeeeeee
jbe 0x40f018
mov ecx, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x40efe0
mov eax, ecx
and eax, 0xff
add edx, dword [eax*4 + 0x45daa8]
mov ebx, dword [esi]
lea eax, [edx + ecx]
imul edx, edx, 0x21
xor eax, ebx
mov ebx, ecx
not ebx
shl ebx, 0x15
add ebx, 0x11111111
shr ecx, 0xb
mov dword [esi], eax
or ecx, ebx
add esi, 4
dec edi
lea edx, [edx + eax + 3]
jne 0x40efe0
pop esi
pop ebx
pop edi
ret

Function at 0x40f020
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov al, byte [ebx]
test al, al
push esi
push edi
mov esi, 0x7fed7fed
mov edi, 0xeeeeeeee
je 0x40f05e
movzx eax, al
push eax
call fcn.0042ba4c
mov ecx, dword [eax*4 + 0x45caa8]
add esi, edi
imul edi, edi, 0x21
add esp, 4
inc ebx
add edi, eax
mov al, byte [ebx]
xor esi, ecx
test al, al
lea edi, [edi + esi + 3]
jne 0x40f037
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x14c]
mov eax, dword [ecx + 0x26]
dec eax
pop edi
and eax, esi
pop esi
pop ebx
ret

Function at 0x40f080
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov al, byte [ebx]
test al, al
push esi
push edi
mov esi, 0x7fed7fed
mov edi, 0xeeeeeeee
je 0x40f0be
movzx eax, al
push eax
call fcn.0042ba4c
mov ecx, dword [eax*4 + 0x45cea8]
add esi, edi
imul edi, edi, 0x21
add esp, 4
inc ebx
add edi, eax
mov al, byte [ebx]
xor esi, ecx
test al, al
lea edi, [edi + esi + 3]
jne 0x40f097
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x40f0d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov al, byte [ebx]
test al, al
push esi
push edi
mov esi, 0x7fed7fed
mov edi, 0xeeeeeeee
je 0x40f10e
movzx eax, al
push eax
call fcn.0042ba4c
mov ecx, dword [eax*4 + 0x45d2a8]
add esi, edi
imul edi, edi, 0x21
add esp, 4
inc ebx
add edi, eax
mov al, byte [ebx]
xor esi, ecx
test al, al
lea edi, [edi + esi + 3]
jne 0x40f0e7
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40f120
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov al, byte [ebx]
test al, al
push esi
push edi
mov esi, 0x7fed7fed
mov edi, 0xeeeeeeee
je 0x40f15e
movzx eax, al
push eax
call fcn.0042ba4c
mov ecx, dword [eax*4 + 0x45d6a8]
add esi, edi
imul edi, edi, 0x21
add esp, 4
inc ebx
add edi, eax
mov al, byte [ebx]
xor esi, ecx
test al, al
lea edi, [edi + esi + 3]
jne 0x40f137
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x417260
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push str.1.0.3__15_Feb_2005
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__15_February_2005._n_n
push 0x45bbe0
call fcn.0042c0e8
add esp, 0x10
cmp esi, 0x3ef
pop esi
jne 0x417298
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
push 0x45bbe0
call fcn.0042c0e8
add esp, 8
push 3
call fcn.0042b227
int3