joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472e3e
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x472e66
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call fcn.004a4b87
add esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
je 0x472e80
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
call sub.msvcrt.dll_fclose
add esp, 0x10
mov eax, dword [ebp + 8]
mov al, byte [eax + 4]
shr al, 2
and eax, 0xff
and eax, 1
test eax, eax
je 0x472fb2
mov eax, dword [ebp + 8]
mov al, byte [eax + 4]
shr al, 4
and eax, 0xff
and eax, 1
test eax, eax
jne 0x472fb2
mov eax, dword [ebp + 8]
cmp dword [eax + 0x20], 0
je 0x472f0b
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call sub.msvcrt.dll__unlink
add esp, 0x10
cmp eax, 0xffffffff
jne 0x472f0b
sub esp, 0xc
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0x10
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
push 0x4edbea
push str.WARNING:_unable_to_remove_tempfile___s____s:__s_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0
je 0x472f64
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x24]
call sub.msvcrt.dll__unlink
add esp, 0x10
cmp eax, 0xffffffff
jne 0x472f64
sub esp, 0xc
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0x10
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x24]
push 0x4edc22
push str.WARNING:_unable_to_remove_tempfile___s____s:__s_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call sub.msvcrt.dll__rmdir
add esp, 0x10
cmp eax, 0xffffffff
jne 0x472fb2
sub esp, 4
sub esp, 8
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
push str.WARNING:_unable_to_remove_temp_directory___s:__s_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x18]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x20]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
mov eax, dword [ebp + 8]
push dword [eax + 0x24]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
push dword [ebp + 8]
call fcn.004a2f78
add esp, 0x10
mov eax, dword [ebp - 4]
leave
ret
Function at 0x475d84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x475e0d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x475dd5
mov eax, dword [ebp + 8]
push dword [eax + 4]
push 1
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, 1
je 0x475dd5
sub esp, 4
push str.md_write
push 0x13c
push str._home_wk_src_gpg4win_build_gpg4win_1.1.3_src_playground_build_gnupg_1.4.7_cipher_md.c
call fcn.0049d962
cmp dword [ebp + 0x10], 0
je 0x475e0d
mov eax, dword [ebp + 8]
push dword [eax + 4]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp eax, 1
je 0x475e0d
sub esp, 4
push str.md_write
push 0x13e
push str._home_wk_src_gpg4win_build_gpg4win_1.1.3_src_playground_build_gnupg_1.4.7_cipher_md.c
call fcn.0049d962
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x475e63
sub esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
mov eax, dword [ebp - 4]
add eax, 0x30
push eax
mov eax, dword [edx + 0x1c]
call eax
add esp, 0x10
sub esp, 4
mov edx, dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
add eax, 0x30
push eax
mov eax, dword [edx + 0x1c]
call eax
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x475e16
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0
leave
ret
Function at 0x484d43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1098
call fcn.004cbf60
mov eax, dword [str.BLOWFISH]
mov dword [ebp - 0x1068], eax
mov eax, dword [0x4f08ec]
mov dword [ebp - 0x1064], eax
mov al, byte [0x4f08f0]
mov byte [ebp - 0x1060], al
mov byte [ebp - 0x1078], 0xfe
mov byte [ebp - 0x1077], 0xdc
mov byte [ebp - 0x1076], 0xba
mov byte [ebp - 0x1075], 0x98
mov byte [ebp - 0x1074], 0x76
mov byte [ebp - 0x1073], 0x54
mov byte [ebp - 0x1072], 0x32
mov byte [ebp - 0x1071], 0x10
mov byte [ebp - 0x1080], 0x41
mov byte [ebp - 0x107f], 0x79
mov byte [ebp - 0x107e], 0x6e
mov byte [ebp - 0x107d], 0xa0
mov byte [ebp - 0x107c], 0x52
mov byte [ebp - 0x107b], 0x61
mov byte [ebp - 0x107a], 0x6e
mov byte [ebp - 0x1079], 0xe4
mov byte [ebp - 0x1088], 0xe1
mov byte [ebp - 0x1087], 0x13
mov byte [ebp - 0x1086], 0xf4
mov byte [ebp - 0x1085], 0x10
mov byte [ebp - 0x1084], 0x2c
mov byte [ebp - 0x1083], 0xfc
mov byte [ebp - 0x1082], 0xce
mov byte [ebp - 0x1081], 0x43
sub esp, 4
push 0x1a
push str.abcdefghijklmnopqrstuvwxyz
lea eax, [ebp - 0x1058]
push eax
call fcn.00485388
add esp, 0x10
sub esp, 4
lea eax, [ebp - 0x1068]
push eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1058]
push eax
call fcn.00484bec
add esp, 0x10
lea eax, [ebp - 0x1070]
sub esp, 4
push 8
push 0x4f090c
push eax
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
je 0x484e7e
mov dword [ebp - 0x108c], str.Blowfish_selftest_failed__1_.
jmp 0x484f87
sub esp, 4
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1058]
push eax
call fcn.00484d1d
add esp, 0x10
lea eax, [ebp - 0x1068]
lea edx, [ebp - 0x1070]
sub esp, 4
push 8
push eax
push edx
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
je 0x484ecc
mov dword [ebp - 0x108c], str.Blowfish_selftest_failed__2_.
jmp 0x484f87
sub esp, 4
push 8
lea eax, [ebp - 0x1080]
push eax
lea eax, [ebp - 0x1058]
push eax
call fcn.00485388
add esp, 0x10
sub esp, 4
lea eax, [ebp - 0x1078]
push eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1058]
push eax
call fcn.00484bec
add esp, 0x10
lea eax, [ebp - 0x1088]
lea edx, [ebp - 0x1070]
sub esp, 4
push 8
push eax
push edx
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
je 0x484f32
mov dword [ebp - 0x108c], str.Blowfish_selftest_failed__3_.
jmp 0x484f87
sub esp, 4
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1058]
push eax
call fcn.00484d1d
add esp, 0x10
lea eax, [ebp - 0x1078]
lea edx, [ebp - 0x1070]
sub esp, 4
push 8
push eax
push edx
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
je 0x484f7d
mov dword [ebp - 0x108c], str.Blowfish_selftest_failed__4_.
jmp 0x484f87
mov dword [ebp - 0x108c], 0
mov eax, dword [ebp - 0x108c]
leave
ret
Function at 0x4866d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov byte [ebp - 0x68], 1
mov byte [ebp - 0x67], 0x23
mov byte [ebp - 0x66], 0x45
mov byte [ebp - 0x65], 0x67
mov byte [ebp - 0x64], 0x12
mov byte [ebp - 0x63], 0x34
mov byte [ebp - 0x62], 0x56
mov byte [ebp - 0x61], 0x78
mov byte [ebp - 0x60], 0x23
mov byte [ebp - 0x5f], 0x45
mov byte [ebp - 0x5e], 0x67
mov byte [ebp - 0x5d], 0x89
mov byte [ebp - 0x5c], 0x34
mov byte [ebp - 0x5b], 0x56
mov byte [ebp - 0x5a], 0x78
mov byte [ebp - 0x59], 0x9a
mov byte [ebp - 0x70], 1
mov byte [ebp - 0x6f], 0x23
mov byte [ebp - 0x6e], 0x45
mov byte [ebp - 0x6d], 0x67
mov byte [ebp - 0x6c], 0x89
mov byte [ebp - 0x6b], 0xab
mov byte [ebp - 0x6a], 0xcd
mov byte [ebp - 0x69], 0xef
mov byte [ebp - 0x78], 0x23
mov byte [ebp - 0x77], 0x8b
mov byte [ebp - 0x76], 0x4f
mov byte [ebp - 0x75], 0xe5
mov byte [ebp - 0x74], 0x84
mov byte [ebp - 0x73], 0x7e
mov byte [ebp - 0x72], 0x44
mov byte [ebp - 0x71], 0xb2
sub esp, 4
push 0x10
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004878e1
add esp, 0x10
sub esp, 4
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00485d91
add esp, 0x10
lea eax, [ebp - 0x78]
lea edx, [ebp - 0x80]
sub esp, 4
push 8
push eax
push edx
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
je 0x4867b3
mov dword [ebp - 0x84], 0x4f29a0
jmp 0x4867f9
sub esp, 4
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004866b3
add esp, 0x10
lea eax, [ebp - 0x70]
lea edx, [ebp - 0x80]
sub esp, 4
push 8
push eax
push edx
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
je 0x4867ef
mov dword [ebp - 0x84], 0x4f29a2
jmp 0x4867f9
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
leave
ret
Function at 0x48c7e8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [0x4fd7b0], 0
jne 0x48c803
call fcn.0048bac4
mov eax, dword [ebp + 0xc]
add dword [0x4fd8c0], eax
inc dword [0x4fd8c4]
lea eax, [ebp + 0xc]
dec dword [eax]
cmp dword [ebp + 0xc], 0xffffffff
je 0x48c899
mov eax, dword [0x4fd7f0]
inc dword [0x4fd7f0]
mov edx, eax
mov ebx, dword [0x4fd7c0]
mov ecx, dword [0x4fd7c0]
mov eax, dword [ebp - 8]
mov al, byte [eax]
xor al, byte [edx + ecx]
mov byte [edx + ebx], al
lea eax, [ebp - 8]
inc dword [eax]
cmp dword [0x4fd7f0], 0x257
jbe 0x48c812
cmp dword [ebp + 0x10], 1
jle 0x48c862
mov dword [0x4fd800], 1
mov dword [0x4fd7f0], 0
sub esp, 0xc
push dword [0x4fd7c0]
call fcn.0048bdea
add esp, 0x10
inc dword [0x4fd8a0]
cmp dword [ebp + 0xc], 0
sete al
and eax, 0xff
mov dword [0x4fd820], eax
jmp 0x48c812
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x48eb70
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0xc3d2e1f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x58], 0
pop ebp
ret
Function at 0x49db48
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp byte [eax], 0x7e
je 0x49db73
sub esp, 4
push 0x67
push str._home_wk_src_gpg4win_build_gpg4win_1.1.3_src_playground_build_gnupg_1.4.7_util_fileutil.c
push str._name__0_
call sub.msvcrt.dll__assert
mov eax, dword [ebp + 8]
mov eax, dword [eax]
inc eax
cmp byte [eax], 0x5c
je 0x49db89
mov eax, dword [ebp + 8]
mov eax, dword [eax]
inc eax
cmp byte [eax], 0
jne 0x49dbbe
sub esp, 0xc
push str.HOME
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49dbb3
sub esp, 0xc
push dword [ebp - 8]
call fcn.004a2fe0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49dbbe
mov eax, dword [ebp + 8]
inc dword [eax]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4a3df8
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 3
jne 0x4a3eca
cmp dword [ebp - 8], 0
jne 0x4a3e41
sub esp, 4
push 0x240
push str._home_wk_src_gpg4win_build_gpg4win_1.1.3_src_playground_build_gnupg_1.4.7_util_iobuf.c
push str.size
call sub.msvcrt.dll__assert
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4a3e5f
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
jmp 0x4a3fb8
push 0
push dword [ebp - 8]
push dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push dword [eax]
call sub.WSOCK32.DLL_recv
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4a3e9e
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebp - 0x18], eax
sub esp, 8
push dword [ebp - 0x18]
push str.socket_read_error:_ec_d_n
call fcn.0049d87b
add esp, 0x10
mov dword [ebp - 0x10], 0x15
jmp 0x4a3ebd
cmp dword [ebp - 0x14], 0
jne 0x4a3eb7
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
mov dword [ebp - 0x10], 0xffffffff
jmp 0x4a3ebd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
jmp 0x4a3fb8
cmp dword [ebp + 0xc], 4
jne 0x4a3f54
cmp dword [ebp - 8], 0
je 0x4a3f4a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax]
call sub.WSOCK32.DLL_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4a3f25
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebp - 0x1c], eax
sub esp, 8
push dword [ebp - 0x1c]
push str.socket_write_error:_ec_d_n
call fcn.0049d87b
add esp, 0x10
mov dword [ebp - 0x10], 0x16
jmp 0x4a3f3d
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
add dword [eax], edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
sub dword [eax], edx
cmp dword [ebp - 0xc], 0
je 0x4a3f3d
jmp 0x4a3ee6
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, edx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
jmp 0x4a3fb8
cmp dword [ebp + 0xc], 1
jne 0x4a3f7a
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
jmp 0x4a3fb8
cmp dword [ebp + 0xc], 5
jne 0x4a3f8b
mov eax, dword [ebp + 0x14]
mov dword [eax], str.sock_filter
jmp 0x4a3fb8
cmp dword [ebp + 0xc], 2
jne 0x4a3fb8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4a3faa
sub esp, 0xc
mov eax, dword [ebp - 4]
push dword [eax]
call sub.WSOCK32.DLL_closesocket
add esp, 0xc
sub esp, 0xc
push dword [ebp - 4]
call fcn.004a2f78
add esp, 0x10
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x4a4d35
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x4a4d80
mov eax, dword [ebp + 8]
cmp dword [eax], 2
jne 0x4a4d80
sub esp, 0xc
push dword [ebp + 8]
call fcn.004a6d60
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a4d80
mov eax, dword [ebp - 4]
cmp byte [eax], 0
je 0x4a4d80
sub esp, 0xc
push dword [ebp - 4]
call fcn.004a2fe0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a4dc2
mov eax, dword [ebp - 8]
cmp dword [eax + 0x30], 0
je 0x4a4db7
sub esp, 0xc
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
push dword [eax + 0x40]
push 6
mov eax, dword [ebp - 8]
push dword [eax + 0x34]
mov eax, dword [edx + 0x30]
call eax
add esp, 0x20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x40]
mov dword [ebp - 8], eax
jmp 0x4a4d86
sub esp, 0xc
push dword [ebp + 8]
call fcn.004a4b87
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x4a4df5
sub esp, 0xc
push dword [ebp - 0x10]
call sub.msvcrt.dll_remove
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x10]
call fcn.004a2f78
add esp, 0x10
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4a68e7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
cmp dword [ebp + 0xc], 0
je 0x4a68fc
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x4a6967
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x3c], eax
sub esp, 8
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x3c]
push dword [eax + 0x10]
call sub.msvcrt.dll__fstat
add esp, 0x10
test eax, eax
jne 0x4a6932
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
jmp 0x4a6a9c
sub esp, 8
sub esp, 4
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 8
push eax
push str.fstat___failed:__s_n
call fcn.0049d87b
add esp, 0x10
mov dword [ebp - 0x54], 0
jmp 0x4a6a9c
cmp dword [ebp + 8], 0
je 0x4a6a95
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
jne 0x4a6a87
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0x4a3b86
jne 0x4a6a87
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
cmp dword [0x4fde40], 0
jne 0x4a69fc
sub esp, 8
push 0
push str.kernel32.dll
call fcn.004a6b19
add esp, 0x10
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x4a69f2
sub esp, 8
push str.GetFileSizeEx
push dword [ebp - 0x48]
call fcn.004a6ad0
add esp, 0x10
mov dword [0x4fde30], eax
cmp dword [0x4fde30], 0
jne 0x4a69f2
sub esp, 0xc
push dword [ebp - 0x48]
call fcn.004a6aa1
add esp, 0x10
mov dword [0x4fde40], 1
cmp dword [0x4fde30], 0
je 0x4a6a43
sub esp, 8
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x40]
mov eax, dword [0x4fde30]
call eax
add esp, 8
test eax, eax
je 0x4a6a64
cmp dword [ebp - 0x4c], 0
jne 0x4a6a2b
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
jmp 0x4a6a9c
cmp dword [ebp + 0xc], 0
je 0x4a6a3a
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov dword [ebp - 0x54], 0
jmp 0x4a6a9c
sub esp, 8
push 0
push dword [ebp - 0x40]
call sub.KERNEL32.dll_GetFileSize
add esp, 8
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffff
je 0x4a6a64
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
jmp 0x4a6a9c
sub esp, 4
sub esp, 8
push 0
call fcn.004a0943
add esp, 0xc
push eax
push dword [ebp - 0x40]
push str.GetFileSize_for_handle__p_failed:__s_n
call fcn.0049d87b
add esp, 0x10
jmp 0x4a6a95
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40]
mov dword [ebp + 8], eax
jmp 0x4a6967
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x54]
leave
ret
Function at 0x4a87c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
sub esp, 0xc
push dword [ebp + 8]
call sub.msvcrt.dll_strlen
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a87fc
mov eax, dword [ebp - 8]
add eax, dword [ebp + 8]
dec eax
cmp byte [eax], 0x58
jne 0x4a87fc
lea eax, [ebp - 0xc]
inc dword [eax]
lea eax, [ebp - 8]
dec dword [eax]
jmp 0x4a87de
cmp dword [ebp - 0xc], 0
jne 0x4a8819
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov dword [ebp - 0x20], 0
jmp 0x4a8904
mov eax, dword [ebp - 8]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 3
ja 0x4a88ef
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
sub esp, 4
push 0
push 0
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
call fcn.0048bcee
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], 1
jbe 0x4a8899
sub esp, 4
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
mov al, byte [eax]
and eax, 0xff
push eax
lea eax, [ebp - 8]
inc dword [eax]
push str._02X
push dword [ebp - 0x18]
call sub.msvcrt.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0x18]
add dword [eax], 2
lea eax, [ebp - 0x14]
sub dword [eax], 2
jmp 0x4a885f
cmp dword [ebp - 0x14], 0
je 0x4a88c3
sub esp, 4
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1c]
mov al, byte [eax]
and eax, 0xff
and eax, 0xf
push eax
push 0x4f8f45
push dword [ebp - 0x18]
call sub.msvcrt.dll_sprintf
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x1c]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
push dword [ebp + 8]
call sub.msvcrt.dll__mkdir
add esp, 0x10
test eax, eax
jne 0x4a88e5
jmp 0x4a88ef
lea eax, [ebp - 4]
inc dword [eax]
jmp 0x4a8829
cmp dword [ebp - 4], 4
jne 0x4a88fe
mov dword [ebp - 0x20], 0
jmp 0x4a8904
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
leave
ret
Function at 0x4be4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push eax
call fcn.004be4e0
mov ebx, dword [ebp + 8]
push eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push ebx
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__15_February_2005._n_n
push eax
call sub.msvcrt.dll_fprintf
add esp, 0x10
cmp ebx, 0x3ef
je 0x4be527
sub esp, 0xc
push 3
call sub.msvcrt.dll_exit
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0x420
push 1
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4be51d
Function at 0x4be870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
push edx
push edx
xor ecx, ecx
mov eax, dword [eax + 0x34]
mov esi, dword [ebx + 0x38]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xd], al
cmp esi, 0
jle 0x4be8be
and eax, 0xff
mov edx, dword [ebx + 0x260]
mov edi, eax
lea esi, [esi]
mov eax, edx
inc ecx
shr edx, 0x18
shl eax, 8
xor edx, edi
xor eax, dword [edx*4 + 0x4d1c40]
cmp esi, ecx
mov edx, eax
mov dword [ebx + 0x260], eax
jg 0x4be8a0
mov ecx, dword [ebp - 0x14]
cmp esi, 2
mov byte [ecx + ebx + 0x58], 1
je 0x4be953
jg 0x4be933
cmp esi, 1
je 0x4be97a
mov eax, dword [ebx + 0x44]
mov byte [esi + ebx + 0x54], 1
mov edx, dword [ebx + 0x24]
mov cl, byte [ebp - 0xd]
mov byte [edx + eax], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [eax + edx], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [eax + edx], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [eax + edx], cl
mov ecx, dword [ebx + 0x44]
mov edx, dword [ebx + 0x24]
mov al, byte [ebx + 0x38]
inc ecx
sub eax, 4
mov dword [ebx + 0x44], ecx
mov byte [edx + ecx], al
mov ecx, dword [ebx + 0x44]
inc ecx
mov dword [ebx + 0x44], ecx
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 3
jne 0x4be8da
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x24]
mov cl, byte [ebp - 0xd]
mov byte [edx + eax], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [eax + edx], cl
jmp 0x4be95f
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x44]
mov cl, byte [ebp - 0xd]
mov byte [edx + eax], cl
mov edx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x24]
inc edx
mov dword [ebx + 0x44], edx
mov byte [eax + edx], cl
mov ecx, dword [ebx + 0x44]
inc ecx
mov dword [ebx + 0x44], ecx
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx + 0x24]
mov eax, dword [ebx + 0x44]
mov cl, byte [ebp - 0xd]
mov byte [edx + eax], cl
mov ecx, dword [ebx + 0x44]
inc ecx
mov dword [ebx + 0x44], ecx
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret