joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4137bb
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x22c
mov eax, 0x451ec1
call fcn.0043b197
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [ebp - 0x21c], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x224]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x224], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x4138d0
lea ecx, [ebp - 0x21c]
call fcn.004084bb
cmp eax, esi
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x21c], ecx
jne 0x4138d0
lea eax, [ebp - 0x230]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push ecx
mov dword [ebp - 0x220], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x228], 1
jmp 0x4138cc
cmp word [ebp - 0x218], 0x76
jne 0x413892
lea eax, [ebp - 0x216]
push eax
lea ebx, [ebp - 0x230]
call fcn.0041537c
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [edi + 4]
jb 0x413892
mov eax, dword [ebp - 0x230]
ja 0x41388d
cmp eax, dword [edi]
jbe 0x413892
mov dword [edi], eax
mov dword [edi + 4], ecx
lea eax, [ebp - 0x238]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x220], 0x104
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x228]
cmp eax, esi
je 0x41385a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.004084bb
mov eax, edi
call fcn.0043b21a
ret

Function at 0x4138e7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46cd08]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.00436130
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
jne 0x413940
cmp dword [ebp - 0x110], 3
jae 0x413946
cmp dword [ebp - 0x114], 5
ja 0x413946
xor eax, eax
jmp 0x413949
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004355b1
leave
ret
Function at 0x413955
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push 0x220
mov eax, 0x450701
call fcn.0043b197
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov ecx, ebx
call fcn.00401b67
mov dword [ebp - 0x228], esi
call fcn.004133b2
test al, al
je 0x413a7a
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.00401af4
push str.SOFTWAREMicrosoftWindowsCurrentVersion
lea ecx, [ebp - 0x224]
call fcn.0040151c
mov byte [ebp - 4], 2
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push edi
push dword [ebp - 0x224]
mov dword [ebp - 0x21c], edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x413a5a
lea ecx, [ebp - 0x220]
call fcn.004084bb
cmp eax, edi
mov ecx, dword [ebp - 0x21c]
mov dword [ebp - 0x220], ecx
jne 0x413a5a
push str.ProgramFilesDir
lea eax, [ebp - 0x220]
push eax
lea esi, [ebp - 0x21c]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x21c], 0x104
call fcn.0040e87c
test eax, eax
jne 0x413a5a
mov eax, edi
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040151c
mov byte [ebp - 4], 4
push dword [eax]
push str._ProgramFiles_
push ebx
call fcn.00408150
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x21c]
call fcn.00401b44
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x220]
call fcn.004084bb
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00401b44
xor edi, edi
mov eax, dword [ebx]
cmp dword [eax - 0xc], edi
je 0x413a8c
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413aae
mov esi, dword [ebp + 8]
mov eax, 0x3fff
push eax
push eax
mov ecx, ebx
call fcn.0040c3c7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.0040530e
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00401b44
mov eax, ebx
call fcn.0043b21a
ret
Function at 0x4141b8
Capabilities:
Identify system language via api

Disassembly:
push 8
mov eax, 0x44f55b
call fcn.0043b12e
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push str.en_us
call fcn.004152a6
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
push 0x45dc84
push 0x17
push edi
push 0x4599dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jl 0x414222
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push dword [ebp + 8]
mov ebx, eax
add esi, 0x34
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
push ebx
call dword [esi]
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x414232
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
call fcn.0043b206
ret
Function at 0x4154e4
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x415500
and dword [esi], eax
and dword [esi + 4], eax
jmp 0x415576
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 8], eax
call fcn.00424555
xor ebx, ebx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x415523
mov dword [esi], ebx
jmp 0x415573
push eax
push dword [ebp - 8]
xor edi, edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x415568
and dword [ebp - 8], ebx
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x45a4a0
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 4], 0x34
jb 0x415568
mov eax, dword [ebp - 8]
test eax, eax
je 0x415568
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov ebx, ecx
push dword [ebp - 0xc]
call fcn.0042455a
pop ecx
mov dword [esi], edi
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop ebx
leave
ret
Function at 0x416340
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp byte [eax + 0x29], 0
je 0x41635a
mov eax, 1
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
xor edi, edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
cmp eax, edi
jne 0x416392
mov ecx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 4], ecx
cmp eax, edi
push esi
mov esi, eax
jne 0x4164b2
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.InstallerData
push ecx
mov dword [ebp - 0xc], edi
call ebx
test eax, eax
jne 0x4163c7
mov edi, dword [ebp - 0xc]
test eax, eax
mov esi, eax
jne 0x4164a7
lea edx, [ebp + 0xc]
push edx
call fcn.0040d2b1
push 0x7fff
lea eax, [ebp + 0xc]
push eax
call fcn.0040d279
test al, al
jne 0x41641a
lea ecx, [ebp + 0xc]
push ecx
call fcn.004120e4
test edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416402
push edi
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x41640c
push eax
call esi
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
cmp byte [edx + 0x28], 0
jne 0x41648c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x10], 0x7fff
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x41648c
mov edx, dword [ebp + 0xc]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x416430
call fcn.00408b78
mov esi, eax
lea eax, [ebp + 0xc]
push eax
call fcn.004120e4
test edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416477
push edi
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x4164c9
push eax
call ebx
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
add ecx, 0x10
mov dword [ebp - 0x10], ecx
call fcn.00416de0
test eax, eax
jne 0x4164d7
lea ecx, [ebp + 0xc]
push ecx
call fcn.004120e4
test edi, edi
je 0x4164b2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00408b78
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4164c9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push ecx
mov ebx, eax
call fcn.00416f90
cmp dword [ebx + 0xc], 0
mov dword [ebp + 8], eax
je 0x416513
mov esi, dword [ebx + 4]
test esi, esi
mov ebx, dword [ebx]
je 0x41651b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x416525
cmp dword [ebp + 8], 0
jne 0x4164d4
jmp 0x41649e
push 0x80004005
call fcn.004017c5
mov eax, esi
jmp 0x41645a
Function at 0x4177c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x4177fa
call fcn.00403031
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x41784e
call fcn.00403031
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4181d0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 0xc]
sub esp, 8
push esi
xor esi, esi
cmp ax, si
je 0x4181f4
cmp ax, 1
je 0x4181f4
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [0x4718f4]
mov edx, dword [eax + 0xc]
push ebx
push edi
mov ecx, 0x4718f4
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call edx
mov ebx, dword [ebp + 8]
mov edi, eax
add edi, 0x10
cmp dword [ebx + 0x44], esi
mov dword [ebp + 0x18], edi
je 0x4182d9
mov edx, dword [ebx + 0x48]
xor eax, eax
cmp edx, esi
jbe 0x41823f
mov esi, dword [ebx + 0x40]
mov ecx, esi
lea ecx, [ecx]
cmp dword [ecx], 0
jne 0x418252
add eax, 1
add ecx, 4
cmp eax, edx
jb 0x418230
xor eax, eax
test eax, eax
mov esi, eax
je 0x4182b8
test esi, esi
mov edx, esi
mov dword [ebp + 8], edx
jne 0x418257
jmp 0x41828e
mov eax, dword [esi + eax*4]
jmp 0x418241
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x41828c
mov edi, dword [ebx + 0x48]
mov eax, dword [esi + 0xc]
xor edx, edx
div edi
add edx, 1
jmp 0x418270
cmp edx, edi
jae 0x418289
mov eax, dword [ebx + 0x40]
cmp dword [eax + edx*4], 0
lea eax, [eax + edx*4]
je 0x418282
mov ecx, dword [eax]
add edx, 1
test ecx, ecx
je 0x418270
mov edx, dword [ebp + 8]
mov esi, ecx
mov eax, dword [edx]
cmp dword [eax - 0xc], 0
je 0x4182b1
mov ecx, dword [edx + 4]
cmp dword [ecx - 0xc], 0
je 0x4182b1
push ecx
push eax
push str._s:__s_r_n
lea edi, [ebp + 0x18]
call fcn.004193c0
add esp, 0xc
test esi, esi
jne 0x418247
mov edi, dword [ebp + 0x18]
mov eax, dword [edi - 0xc]
test eax, eax
je 0x4182d9
cmp dword [edi - 4], 1
mov dword [ebp - 4], eax
jle 0x4182d6
mov ecx, eax
push ecx
lea ecx, [ebp + 0x18]
call fcn.00401857
mov edi, dword [ebp + 0x18]
mov dword [ebp - 8], edi
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebx + 0x80]
push 0
push 0
push 0
push 0
push edx
push eax
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x41830d
mov ecx, dword [ebx + 0x80]
push 0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x41833b
call fcn.00403031
mov esi, eax
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x418330
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x14
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x418357
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x41c230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov dl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x41c27b
movzx esi, dl
push edi
nop
mov ecx, dword [eax + 0x260]
mov edi, ecx
shr edi, 0x18
shl ecx, 8
xor edi, esi
xor ecx, dword [edi*4 + 0x46b040]
mov dword [eax + 0x260], ecx
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
jl 0x41c250
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x41c309
sub ecx, ebx
je 0x41c2eb
sub ecx, ebx
je 0x41c2df
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d6e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41d6f3
mov dword [edi], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41d85a
cmp dword [ebp + 0x10], 0
mov dword [esi + 0x13c4], 0
je 0x41d85a
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jl 0x41d85a
cmp byte [esi + 0x1390], 0
jne 0x41d741
test edi, edi
je 0x41d730
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [esi]
push eax
call fcn.00439c7d
add esp, 4
test eax, eax
je 0x41d76b
test edi, edi
je 0x41d75a
mov dword [edi], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test ebx, ebx
jne 0x41d78a
test edi, edi
je 0x41d779
mov dword [edi], 0
pop edi
mov dword [esi + 0x13c4], 0
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1394]
mov dword [esi + 0x1398], ebx
push 0
lea ebx, [esi + 4]
push eax
mov dword [eax], ecx
mov dword [esi + 0x13a8], 0x1388
mov dword [esi + 0x13a4], ebx
call fcn.0041c660
cmp eax, 1
jne 0x41d829
jmp 0x41d7c0
mov eax, dword [esi + 0x13a8]
cmp eax, 0x1388
jae 0x41d7f9
mov edx, dword [esi]
push edx
mov edi, 0x1388
sub edi, eax
push edi
push 1
push ebx
call fcn.00439e0b
add esp, 0x10
cmp edi, eax
jne 0x41d83c
mov eax, dword [esi]
push eax
call fcn.00439c7d
add esp, 4
test eax, eax
jne 0x41d83c
mov edi, dword [ebp + 8]
cmp dword [esi + 0x1398], 0
je 0x41d76f
push 0
lea eax, [esi + 0x1394]
mov dword [esi + 0x13a8], 0x1388
push eax
mov dword [esi + 0x13a4], ebx
call fcn.0041c660
cmp eax, 1
je 0x41d7c0
test edi, edi
je 0x41d82f
mov dword [edi], eax
pop edi
mov dword [esi + 0x13c4], eax
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x41d849
mov dword [eax], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test edi, edi
je 0x41d864
mov dword [edi], 0xfffffffe
test esi, esi
je 0x41d872
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x41d880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x41d89d
mov eax, dword [ebp + 8]
test eax, eax
je 0x41da6c
mov dword [eax], edi
pop edi
pop ebp
ret 0x1c
cmp byte [edi + 0x1390], 0
jne 0x41d8c2
mov eax, dword [ebp + 8]
test eax, eax
je 0x41d8b3
mov dword [eax], 0xffffffff
mov dword [edi + 0x13c4], 0xffffffff
pop edi
pop ebp
ret 0x1c
mov eax, dword [edi]
push eax
call fcn.00439c7d
add esp, 4
test eax, eax
je 0x41d8ed
mov eax, dword [ebp + 8]
test eax, eax
je 0x41d8de
mov dword [eax], 0xfffffffa
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
pop ebp
ret 0x1c
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x41d8fa
mov dword [ecx], 0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x41d907
mov dword [eax], 0
push ebx
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x41d915
mov dword [ebx], 0
push esi
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x41d923
mov dword [esi], 0
cmp dword [ebp + 0x10], 0
jne 0x41da0e
cmp dword [edi + 0x13c4], 0
jne 0x41d9ae
jmp 0x41d940
lea eax, [edi + 4]
mov dword [edi + 0x13a4], eax
push 2
lea eax, [edi + 0x1394]
mov esi, 0x1388
push eax
mov dword [edi + 0x13a8], esi
call fcn.0041c660
mov ebx, eax
cmp ebx, 3
je 0x41d972
cmp ebx, 4
jne 0x41d9f2
mov eax, dword [edi + 0x13a8]
cmp eax, esi
jae 0x41d9a3
mov ecx, dword [edi]
push ecx
sub esi, eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.00439e0b
add esp, 0x10
cmp esi, eax
jne 0x41d9d4
mov edx, dword [edi]
push edx
call fcn.00439c7d
add esp, 4
test eax, eax
jne 0x41d9d4
cmp ebx, 4
jne 0x41d940
mov esi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x1c]
mov eax, dword [edi]
push eax
call fcn.00439c7d
add esp, 4
test eax, eax
jne 0x41da08
mov ecx, dword [edi]
push ecx
call fcn.0043a00b
mov edx, dword [edi]
push edx
call fcn.00439c7d
add esp, 8
test eax, eax
je 0x41da08
mov eax, dword [ebp + 8]
test eax, eax
je 0x41d9e1
mov dword [eax], 0xfffffffa
pop esi
pop ebx
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 8]
test eax, eax
je 0x41d9fb
mov dword [eax], ebx
pop esi
mov dword [edi + 0x13c4], ebx
pop ebx
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x41da1a
mov edx, dword [edi + 0x139c]
mov dword [ecx], edx
test eax, eax
je 0x41da26
mov ecx, dword [edi + 0x13a0]
mov dword [eax], ecx
test ebx, ebx
je 0x41da32
mov edx, dword [edi + 0x13ac]
mov dword [ebx], edx
test esi, esi
je 0x41da3e
mov eax, dword [edi + 0x13b0]
mov dword [esi], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x41da4b
mov dword [eax], 0
lea ecx, [edi + 0x1394]
push ecx
mov dword [edi + 0x13c4], 0
call fcn.0041c7b0
push edi
call fcn.00436094
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
ret 0x1c
Function at 0x41dc80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0041dc60
mov esi, dword [ebp + 8]
push eax
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__10_December_2007._n_n
call fcn.0043a155
add eax, 0x40
push eax
call fcn.0043a32b
add esp, 0x10
cmp esi, 0x3ef
jne 0x41dcc2
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call fcn.0043a155
add eax, 0x40
push eax
call fcn.0043a32b
add esp, 8
push 3
call fcn.00439225
int3
Function at 0x41de80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
cmp ebx, edx
push edi
je 0x41de90
mov dword [ebx], edx
mov edi, dword [ebp + 0xc]
cmp edi, edx
je 0x41e067
mov eax, dword [ebp + 0x10]
cmp eax, edx
mov dword [edi + 0x13c4], edx
je 0x41e067
mov ecx, dword [ebp + 0x14]
cmp ecx, edx
jl 0x41e067
cmp byte [edi + 0x1390], dl
je 0x41dedb
cmp ebx, edx
je 0x41dec9
mov dword [ebx], 0xffffffff
mov dword [edi + 0x13c4], 0xffffffff
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
cmp ecx, edx
jne 0x41def3
cmp ebx, edx
je 0x41dee5
mov dword [ebx], edx
mov dword [edi + 0x13c4], edx
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
mov dword [edi + 0x13a4], eax
mov eax, dword [edi]
push esi
push eax
mov dword [edi + 0x13a8], ecx
call fcn.00439c7d
add esp, 4
test eax, eax
jne 0x41dfb5
cmp dword [edi + 0x1398], 0
jne 0x41df64
mov esi, dword [edi]
call fcn.0041d590
test al, al
jne 0x41df64
mov ecx, dword [edi]
push ecx
push 0x1388
lea esi, [edi + 4]
push 1
push esi
call fcn.0043a716
mov edx, dword [edi]
push edx
mov ebx, eax
call fcn.00439c7d
add esp, 0x14
test eax, eax
jne 0x41dff7
mov dword [edi + 0x138c], ebx
mov dword [edi + 0x1398], ebx
mov ebx, dword [ebp + 8]
mov dword [edi + 0x1394], esi
lea eax, [edi + 0x1394]
push eax
call fcn.0041dcd0
test eax, eax
jne 0x41dfd2
mov esi, dword [edi]
call fcn.0041d590
test al, al
je 0x41df95
cmp dword [edi + 0x1398], 0
jne 0x41df95
cmp dword [edi + 0x13a8], 0
ja 0x41e02c
cmp dword [edi + 0x13a8], 0
je 0x41e049
mov ecx, dword [edi]
push ecx
call fcn.00439c7d
add esp, 4
test eax, eax
je 0x41df13
test ebx, ebx
je 0x41dfbf
mov dword [ebx], 0xfffffffa
pop esi
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
cmp eax, 4
jne 0x41e017
test ebx, ebx
je 0x41dfdd
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
sub eax, dword [edi + 0x13a8]
pop esi
mov dword [edi + 0x13c4], 4
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x41dfbf
mov dword [eax], 0xfffffffa
pop esi
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x41e01d
mov dword [ebx], eax
pop esi
mov dword [edi + 0x13c4], eax
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x41e036
mov dword [ebx], 0xfffffff9
pop esi
mov dword [edi + 0x13c4], 0xfffffff9
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x41e053
mov dword [ebx], 0
mov eax, dword [ebp + 0x14]
pop esi
mov dword [edi + 0x13c4], 0
pop edi
pop ebx
pop ebp
ret 0x10
cmp ebx, edx
je 0x41e071
mov dword [ebx], 0xfffffffe
cmp edi, edx
je 0x41e07f
mov dword [edi + 0x13c4], 0xfffffffe
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10