joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4053c0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, eax
test esi, esi
je 0x4053f9
push ebx
mov ebx, ecx
add ebx, 0x190
push edi
mov edi, dword [ebx]
test edi, edi
je 0x4053ec
call fcn.00409065
mov edx, dword [ebx]
push 0
push str.InstallBroken
call fcn.00408923
pop ecx
pop ecx
mov eax, dword [esi]
push 0
push 0
mov ecx, esi
call dword [eax + 0x14]
pop edi
pop ebx
push 1
call fcn.0042eb0b
pop esi

Function at 0x405469
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x448d60
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x45fd70]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push esi
push edi
mov eax, dword [0x45fd70]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
lea eax, [esp + 0xec]
push eax
push 0x202
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor ebx, ebx
cmp eax, ebx
je 0x4054d7
push 0xffffffffffffffff
push 0x10
push 0xbd0
call fcn.00424055
jmp 0x40563b
push 0x404db3
call fcn.0042e7c5
pop ecx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 8
mov dword [esp + 0x2c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push ebx
lea eax, [esp + 0x30]
push eax
xor edi, edi
lea eax, [esp + 0x20]
inc edi
push eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call sub.gdiplus.dll_GdiplusStartup
call fcn.0042869e
mov ecx, esi
call fcn.00427926
push ebx
push str.042B0D65_EF5B_4E3F_ADFF_86C726E4F053
push ebx
lea ecx, [esp + 0x28]
call fcn.004286d7
mov dword [esp + 0x290], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4055ac
lea ecx, [esp + 0x14]
call fcn.00408979
mov byte [esp + 0x290], 1
mov esi, 0xbcb
push esi
lea ecx, [esp + 0x18]
call fcn.0040197c
test eax, eax
jne 0x405579
call fcn.004228fb
call fcn.00425611
push dword [eax + 0x10]
lea eax, [esp + 0x18]
push esi
push eax
call fcn.004013f9
add esp, 0xc
push ebx
push ebx
push dword [esp + 0x1c]
call fcn.0042400c
mov byte [esp + 0x290], bl
lea ecx, [esp + 0x14]
call fcn.004089a3
jmp 0x40562a
push esi
call fcn.00405401
push str.SlimWare_Utilities_Inc
mov ecx, esi
call fcn.00428762
call fcn.00425611
mov eax, dword [eax + 0x10]
lea ecx, [esi + 0xb8]
push eax
call fcn.00401648
or dword [esi + 0xac], 0xffffffff
lea eax, [esp + 0x3c]
push eax
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xc0], ebx
call fcn.004042a7
mov byte [esp + 0x290], 2
lea eax, [esp + 0x3c]
mov ecx, eax
mov dword [esi + 0x20], eax
call fcn.0041c207
push dword [esp + 0x18]
call sub.gdiplus.dll_GdiplusShutdown
mov byte [esp + 0x290], bl
lea ecx, [esp + 0x3c]
call fcn.0040437d
or dword [esp + 0x290], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0042871f
xor eax, eax
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.0042d9ad
mov esp, ebp
pop ebp
ret
Function at 0x405ab4
Capabilities:
Delete file

Disassembly:
push 4
mov eax, 0x4484b9
call fcn.00432960
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CProgressPage.0
mov dword [ebp - 4], 3
xor edi, edi
cmp dword [esi + 0x118], edi
je 0x405afc
lea ebx, [esi + 0x110]
mov eax, edi
mov ecx, ebx
call fcn.00404d2e
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc edi
cmp edi, dword [esi + 0x118]
jne 0x405ae2
mov byte [ebp - 4], 2
lea ecx, [esi + 0x178]
call fcn.0042899e
mov byte [ebp - 4], 1
lea ecx, [esi + 0x124]
call fcn.0042899e
mov byte [ebp - 4], 0
lea ecx, [esi + 0x110]
call fcn.00424261
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0040e8cd
call fcn.00432a38
ret
Function at 0x4090fd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x40910f
mov eax, 0x80070057
jmp 0x409158
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x40913b
jle 0x409158
and eax, 0xffff
or eax, 0x80070000
jmp 0x409158
push dword [edi + 0xc]
push dword [edi + 8]
push 3
push esi
push str.InstallerOverlay
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
jne 0x40912d
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x40915d
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x10000
mov edi, 0x8007000e
call fcn.0042f224
mov ebx, eax
xor esi, esi
cmp ebx, esi
pop ecx
je 0x40920a
push 0x7fff
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4091aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x4091a6
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x40920a
push esi
push esi
push 3
push esi
push 1
push Ordinal_4
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x409192
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x409192
cmp dword [ebp - 4], 0x7fffffff
jg 0x40920a
push esi
push esi
push esi
push 2
push esi
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, esi
je 0x409192
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
je 0x409192
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x409cb5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x50]
push esi
push eax
mov dword [ebp - 0x54], 0x44
call fcn.0042e4c0
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x1000000
push esi
push esi
push esi
call fcn.00403f2d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.004040de
cmp edi, esi
jne 0x409d14
xor eax, eax
jmp 0x409d27
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a47c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x45fd70]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x44733f
call fcn.00432960
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push 0x452658
mov ecx, edi
call fcn.0040153f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0x218]
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x40a4fe
lea eax, [ebp]
push eax
mov ecx, edi
call fcn.00401648
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x218]
call fcn.004089a3
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0042d9ad
add ebp, 0x20c
leave
ret
Function at 0x40a531
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x45fd70]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x34
mov eax, 0x447c08
call fcn.00432960
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea edi, [ebp + 0x218]
call fcn.0040a9ba
mov ecx, dword [ebp - 0x20]
push 0x4513ec
call fcn.0040153f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x3c], esi
call fcn.0040153f
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push dword [ebp - 0x24]
push Ordinal_4
call esi
cmp eax, ebx
jne 0x40a6fc
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x18], ebx
je 0x40a6fc
mov dword [ebp - 0x1c], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0x104
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x30], eax
jne 0x40a6e9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040153f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.00408979
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
push eax
push 0xf003f
push ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call esi
cmp eax, ebx
jne 0x40a6d1
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str.DisplayName
call fcn.0040153f
mov byte [ebp - 4], 5
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x40]
call fcn.0040a47c
pop ecx
pop ecx
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x14]
call fcn.00401ab7
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.004089a3
lea edi, [ebp - 0x14]
call fcn.0040a9ba
push dword [ebp + 0x218]
mov ecx, edi
call fcn.004024de
test eax, eax
jne 0x40a6d1
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str.UninstallString
call fcn.0040153f
mov byte [ebp - 4], 7
push dword [ebp - 0x28]
mov byte [ebp - 4], 4
lea edi, [ebp - 0x34]
call fcn.0040a47c
pop ecx
pop ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x20]
push eax
call fcn.00401ab7
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.004089a3
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.004089a3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.004089a3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], 0x104
je 0x40a5dd
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004089a3
mov byte [ebp - 4], bl
lea ecx, [ebp + 0x218]
call fcn.004089a3
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0042d9ad
add ebp, 0x20c
leave
ret
Function at 0x40a745
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x234
mov eax, 0x448434
call fcn.004329c9
xor ebx, ebx
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP
lea ecx, [ebp - 0x22c]
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0040153f
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x228]
push eax
push 0x20019
push ebx
push dword [ebp - 0x22c]
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40a8af
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x220], ebx
je 0x40a8af
mov dword [ebp - 0x224], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x224]
mov dword [ebp - 0x220], 0x104
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x230], eax
jne 0x40a893
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040153f
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax - 0xc]
cmp ecx, ebx
jle 0x40a885
movzx eax, word [eax]
cmp ax, 0x76
jne 0x40a885
push 0x76
lea eax, [ebp - 0x21c]
push eax
call fcn.0040a93f
push dword [ebp - 0x21c]
lea ebx, [ebp - 0x240]
call fcn.00405ef1
mov eax, dword [ebp - 0x23c]
cmp eax, dword [esi + 4]
jb 0x40a883
ja 0x40a861
mov eax, dword [ebp - 0x240]
cmp eax, dword [esi]
jbe 0x40a883
push dword [ebp - 0x21c]
lea ebx, [ebp - 0x238]
call fcn.00405ef1
mov eax, dword [ebp - 0x238]
mov dword [esi], eax
mov eax, dword [ebp - 0x234]
mov dword [esi + 4], eax
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x21c]
call fcn.004089a3
inc dword [ebp - 0x224]
cmp dword [ebp - 0x230], ebx
mov dword [ebp - 0x220], 0x104
je 0x40a7c3
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.004089a3
mov eax, esi
call fcn.00432a4c
ret

Function at 0x40a8d2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x45fd70]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.0042e4c0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jne 0x40a921
cmp dword [ebp - 0x78], 2
jae 0x40a927
cmp dword [ebp - 0x7c], 6
ja 0x40a927
xor eax, eax
jmp 0x40a92a
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0042d9ad
add ebp, 0x98
leave
ret
Function at 0x413500
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax + 0x34]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x38], esi
lea ebx, [esi + 1]
jle 0x41353a
push ebp
push edi
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebp, ecx
shr ebp, 0x18
xor ebp, edi
shl ecx, 8
xor ecx, dword [ebp*4 + 0x45e040]
add esi, ebx
mov dword [eax + 0x260], ecx
cmp esi, dword [eax + 0x38]
jl 0x413514
pop edi
pop ebp
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x4135c2
sub ecx, ebx
je 0x4135a7
sub ecx, ebx
je 0x41359b
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
Function at 0x414b10
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x414b2b
mov eax, dword [esp + 8]
test eax, eax
je 0x414cff
mov dword [eax], edi
pop edi
ret 0x1c
cmp byte [edi + 0x1390], 0
jne 0x414b50
mov eax, dword [esp + 8]
test eax, eax
je 0x414b42
mov dword [eax], 0xffffffff
mov dword [edi + 0x13c4], 0xffffffff
pop edi
ret 0x1c
mov eax, dword [edi]
push eax
call fcn.00431a21
add esp, 4
test eax, eax
je 0x414b7b
mov eax, dword [esp + 8]
test eax, eax
je 0x414b6d
mov dword [eax], 0xfffffffa
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
ret 0x1c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x414b89
mov dword [eax], 0
push ebp
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x414b99
mov dword [ebp], 0
push ebx
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x414ba8
mov dword [ebx], 0
push esi
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x414bb7
mov dword [esi], 0
cmp dword [esp + 0x1c], 0
jne 0x414c9e
cmp dword [edi + 0x13c4], 0
jne 0x414c3e
lea ebp, [edi + 4]
mov edi, edi
push 2
lea eax, [edi + 0x1394]
mov esi, 0x1388
push eax
mov dword [edi + 0x13a8], esi
mov dword [edi + 0x13a4], ebp
call fcn.00413910
mov ebx, eax
cmp ebx, 3
je 0x414bff
cmp ebx, 4
jne 0x414c83
mov eax, dword [edi + 0x13a8]
cmp eax, esi
jae 0x414c2d
mov ecx, dword [edi]
push ecx
sub esi, eax
push esi
push 1
push ebp
call fcn.00431baf
add esp, 0x10
cmp esi, eax
jne 0x414c64
mov edx, dword [edi]
push edx
call fcn.00431a21
add esp, 4
test eax, eax
jne 0x414c64
cmp ebx, 4
jne 0x414bd0
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call fcn.00431a21
add esp, 4
test eax, eax
jne 0x414c9a
mov ecx, dword [edi]
push ecx
call fcn.00431daf
mov edx, dword [edi]
push edx
call fcn.00431a21
add esp, 8
test eax, eax
je 0x414c9a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x414c72
mov dword [eax], 0xfffffffa
pop esi
pop ebx
pop ebp
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
ret 0x1c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x414c8d
mov dword [eax], ebx
pop esi
mov dword [edi + 0x13c4], ebx
pop ebx
pop ebp
pop edi
ret 0x1c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x414caa
mov ecx, dword [edi + 0x139c]
mov dword [eax], ecx
test ebp, ebp
je 0x414cb7
mov edx, dword [edi + 0x13a0]
mov dword [ebp], edx
test ebx, ebx
je 0x414cc3
mov eax, dword [edi + 0x13ac]
mov dword [ebx], eax
test esi, esi
je 0x414ccf
mov ecx, dword [edi + 0x13b0]
mov dword [esi], ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x414cdd
mov dword [eax], 0
lea edx, [edi + 0x1394]
push edx
mov dword [edi + 0x13c4], 0
call fcn.00413a50
push edi
call fcn.0042eb97
add esp, 4
pop esi
pop ebx
pop ebp
pop edi
ret 0x1c
Function at 0x414f10
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00414ef0
mov esi, dword [esp + 8]
push eax
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__10_December_2007._n_n
call fcn.00431ef9
add eax, 0x40
push eax
call fcn.004320cb
add esp, 0x10
cmp esi, 0x3ef
pop esi
jne 0x414f51
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call fcn.00431ef9
add eax, 0x40
push eax
call fcn.004320cb
add esp, 8
push 3
call fcn.0042eb0b
int3
Function at 0x41b670
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x24]
mov ebp, dword [esi + 0x268]
push edi
mov edi, dword [esi + 0x44]
cmp edi, 0x2710
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x30]
mov dword [esp + 0x10], edx
jge 0x41b6b0
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push ebp
push edi
push ecx
push eax
mov eax, edx
jmp 0x41b783
lea edx, [edi + 0x22]
test dl, 1
je 0x41b6bb
add edx, 1
add edx, ecx
cmp eax, 1
mov dword [esp + 0xc], edx
jge 0x41b6cd
mov eax, 1
jmp 0x41b6d7
cmp eax, 0x64
jle 0x41b6d7
mov eax, 0x64
lea edx, [eax - 1]
mov eax, 0x55555556
imul edx
mov eax, edx
push ebx
shr eax, 0x1f
add eax, edx
mov ebx, eax
mov eax, dword [esp + 0x14]
imul ebx, edi
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
push ebp
push edi
push eax
push edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x38], ebx
call fcn.0041af80
add esp, 0x14
cmp ebp, 3
jl 0x41b752
test edi, edi
mov dword [esp + 0x10], 1
je 0x41b724
mov dword [esp + 0x10], edi
sub ebx, dword [esp + 0x24]
sub esp, 8
mov dword [esp + 0x24], ebx
fild dword [esp + 0x24]
fidiv dword [esp + 0x18]
fstp qword [esp]
push edi
push ebx
push str._______d_work___d_block__ratio__5.2f_n
call fcn.00431ef9
add eax, 0x40
push eax
call fcn.004320cb
add esp, 0x18
cmp dword [esp + 0x24], 0
pop ebx
jge 0x41b78b
cmp ebp, 2
jl 0x41b775
push str.____too_repetitive__using_fallback_sorting_algorithm_n
call fcn.00431ef9
add eax, 0x40
push eax
call fcn.004320cb
add esp, 8
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
push ebp
push edi
push eax
mov eax, dword [esp + 0x1c]
push ecx
call fcn.0041a1f0
add esp, 0x10
or ecx, 0xffffffff
xor eax, eax
cmp dword [esi + 0x44], eax
mov dword [esi + 0x1c], ecx
jle 0x41b7b3
mov edx, dword [esp + 0x14]
lea esp, [esp]
cmp dword [edx + eax*4], 0
je 0x41b7b0
add eax, 1
cmp eax, dword [esi + 0x44]
jl 0x41b7a0
jmp 0x41b7b3
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x1c], ecx
pop edi
pop esi
pop ebp
jne 0x41b7cb
add esp, 0x10
mov dword [esp + 4], 0x3eb
jmp fcn.00414f10
add esp, 0x10
ret