joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417583
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0x6c
mov eax, 0x45a8a8
call fcn.0043f20e
mov edi, 0x47d010
mov edx, 0x464838
mov ecx, edi
mov dword [ebp - 0x14], 0x80070057
call fcn.004029b1
test eax, eax
je 0x417790
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040151c
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ebx, [ebp - 0x10]
call fcn.00416b9f
pop ecx
mov dword [ebp - 4], 1
push 0x5c
mov esi, ebx
call fcn.004087e6
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.00408928
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00408807
mov byte [ebp - 4], 3
call fcn.00408629
push 0x22
mov ecx, ebx
call fcn.00403fe3
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x417628
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00408a6c
mov edx, str.LaunchAs
mov ecx, edi
xor esi, esi
call fcn.004029b1
cmp eax, ebx
je 0x417683
push str.AsInvoker
push eax
call fcn.0043a0da
test eax, eax
pop ecx
pop ecx
jne 0x417683
inc esi
call fcn.00416b31
test al, al
je 0x417683
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.00417de0
add esp, 0xc
cmp byte [ebp + 8], bl
mov dword [ebp - 0x14], eax
je 0x41767a
mov ecx, dword [0x47ce88]
push ebx
call fcn.00429090
cmp dword [ebp - 0x14], ebx
jge 0x417758
push 0x40
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], 0x44
call fcn.0043a060
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.0041845d
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00415f4e
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov edi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.0040c78f
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040c78f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4176fd
mov dword [ebp - 0x14], ebx
jmp 0x417705
call fcn.004030e7
mov dword [ebp - 0x14], eax
cmp byte [ebp + 8], bl
je 0x417737
mov ecx, dword [0x47ce88]
push ebx
call fcn.00429090
push 0xea60
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x417737
push ebx
push 0x417401
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp dword [ebp - 0x14], ebx
jl 0x41774c
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x30]
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.0041253c
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004053eb
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004053eb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0041253c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0041253c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0041253c
mov eax, dword [ebp - 0x14]
call fcn.0043f2e6
ret
Function at 0x418a0f
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x418a2b
and dword [esi], eax
and dword [esi + 4], eax
jmp 0x418aa1
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
push eax
mov dword [ebp - 8], eax
call fcn.0042812a
xor ebx, ebx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x418a4e
mov dword [esi], ebx
jmp 0x418a9e
push eax
push dword [ebp - 8]
xor edi, edi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x418a93
and dword [ebp - 8], ebx
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x463d58
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueW
cmp dword [ebp - 4], 0x34
jb 0x418a93
mov eax, dword [ebp - 8]
test eax, eax
je 0x418a93
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov ebx, ecx
push dword [ebp - 0xc]
call fcn.00428125
pop ecx
mov dword [esi], edi
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop ebx
leave
ret
Function at 0x419870
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
cmp byte [eax + 0x29], 0
je 0x41988a
mov eax, 1
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
xor edi, edi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 8]
push edx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
cmp eax, edi
jne 0x4198c2
mov ecx, dword [ebp - 8]
xor eax, eax
mov dword [ebp - 4], ecx
cmp eax, edi
push esi
mov esi, eax
jne 0x4199e2
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.InstallerData
push ecx
mov dword [ebp - 0xc], edi
call ebx
test eax, eax
jne 0x4198f7
mov edi, dword [ebp - 0xc]
test eax, eax
mov esi, eax
jne 0x4199d7
lea edx, [ebp + 0xc]
push edx
call fcn.0040d728
push 0x7fff
lea eax, [ebp + 0xc]
push eax
call fcn.0040d6ca
test al, al
jne 0x41994a
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040d702
test edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x419932
push edi
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x41993c
push eax
call esi
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
cmp byte [edx + 0x28], 0
jne 0x4199bc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x10], 0x7fff
mov ecx, dword [ebp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
push 0
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4199bc
mov edx, dword [ebp + 0xc]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x419960
call fcn.00408979
mov esi, eax
lea eax, [ebp + 0xc]
push eax
call fcn.0040d702
test edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4199a7
push edi
call ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x4199f9
push eax
call ebx
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
add ecx, 0x10
mov dword [ebp - 0x10], ecx
call fcn.0041a310
test eax, eax
jne 0x419a07
lea ecx, [ebp + 0xc]
push ecx
call fcn.0040d702
test edi, edi
je 0x4199e2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00408979
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4199f9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push ecx
mov ebx, eax
call fcn.0041a4a0
cmp dword [ebx + 0xc], 0
mov dword [ebp + 8], eax
je 0x419a43
mov esi, dword [ebx + 4]
test esi, esi
mov ebx, dword [ebx]
je 0x419a4b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x419a55
cmp dword [ebp + 8], 0
jne 0x419a04
jmp 0x4199ce
push 0x80004005
call fcn.004017da
mov eax, esi
jmp 0x41998a
Function at 0x41acd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x41ad0a
call fcn.004030e7
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x41ad5e
call fcn.004030e7
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x41b150
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 8
cmp dword [esi + 0x7c], eax
jne 0x41b1cb
push ebx
push edi
lea edi, [esi + 0x28]
mov ecx, edi
lea ebx, [eax + 1]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.0041efd0
test eax, eax
jne 0x41b1a1
cmp dword [esi + 0x38], eax
je 0x41b1a1
mov edi, dword [edi + 0x14]
cmp dword [edi - 0xc], eax
je 0x41b18c
test edi, edi
je 0x41b18c
mov dword [esi + 0x40], eax
jmp 0x41b1a1
mov eax, dword [esi + 0x30]
test eax, eax
je 0x41b1a1
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x34]
mov ebx, 3
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [esi + 0x8c]
push 0
push ecx
push edx
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
test eax, eax
pop edi
pop ebx
jne 0x41b1c8
call fcn.004030e7
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x7c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41fe00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov dl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x41fe4b
movzx esi, dl
push edi
nop
mov ecx, dword [eax + 0x260]
mov edi, ecx
shr edi, 0x18
shl ecx, 8
xor edi, esi
xor ecx, dword [edi*4 + 0x476040]
mov dword [eax + 0x260], ecx
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
jl 0x41fe20
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x41fed9
sub ecx, ebx
je 0x41febb
sub ecx, ebx
je 0x41feaf
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4212b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4212c3
mov dword [edi], 0
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x42142a
cmp dword [ebp + 0x10], 0
mov dword [esi + 0x13c4], 0
je 0x42142a
mov ebx, dword [ebp + 0x14]
test ebx, ebx
jl 0x42142a
cmp byte [esi + 0x1390], 0
jne 0x421311
test edi, edi
je 0x421300
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [esi]
push eax
call fcn.0043e146
add esp, 4
test eax, eax
je 0x42133b
test edi, edi
je 0x42132a
mov dword [edi], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test ebx, ebx
jne 0x42135a
test edi, edi
je 0x421349
mov dword [edi], 0
pop edi
mov dword [esi + 0x13c4], 0
pop esi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x1394]
mov dword [esi + 0x1398], ebx
push 0
lea ebx, [esi + 4]
push eax
mov dword [eax], ecx
mov dword [esi + 0x13a8], 0x1388
mov dword [esi + 0x13a4], ebx
call fcn.00420230
cmp eax, 1
jne 0x4213f9
jmp 0x421390
mov eax, dword [esi + 0x13a8]
cmp eax, 0x1388
jae 0x4213c9
mov edx, dword [esi]
push edx
mov edi, 0x1388
sub edi, eax
push edi
push 1
push ebx
call fcn.0043cea8
add esp, 0x10
cmp edi, eax
jne 0x42140c
mov eax, dword [esi]
push eax
call fcn.0043e146
add esp, 4
test eax, eax
jne 0x42140c
mov edi, dword [ebp + 8]
cmp dword [esi + 0x1398], 0
je 0x42133f
push 0
lea eax, [esi + 0x1394]
mov dword [esi + 0x13a8], 0x1388
push eax
mov dword [esi + 0x13a4], ebx
call fcn.00420230
cmp eax, 1
je 0x421390
test edi, edi
je 0x4213ff
mov dword [edi], eax
pop edi
mov dword [esi + 0x13c4], eax
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x421419
mov dword [eax], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x10
test edi, edi
je 0x421434
mov dword [edi], 0xfffffffe
test esi, esi
je 0x421442
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x421450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x42146d
mov eax, dword [ebp + 8]
test eax, eax
je 0x42163c
mov dword [eax], edi
pop edi
pop ebp
ret 0x1c
cmp byte [edi + 0x1390], 0
jne 0x421492
mov eax, dword [ebp + 8]
test eax, eax
je 0x421483
mov dword [eax], 0xffffffff
mov dword [edi + 0x13c4], 0xffffffff
pop edi
pop ebp
ret 0x1c
mov eax, dword [edi]
push eax
call fcn.0043e146
add esp, 4
test eax, eax
je 0x4214bd
mov eax, dword [ebp + 8]
test eax, eax
je 0x4214ae
mov dword [eax], 0xfffffffa
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
pop ebp
ret 0x1c
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4214ca
mov dword [ecx], 0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4214d7
mov dword [eax], 0
push ebx
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x4214e5
mov dword [ebx], 0
push esi
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x4214f3
mov dword [esi], 0
cmp dword [ebp + 0x10], 0
jne 0x4215de
cmp dword [edi + 0x13c4], 0
jne 0x42157e
jmp 0x421510
lea eax, [edi + 4]
mov dword [edi + 0x13a4], eax
push 2
lea eax, [edi + 0x1394]
mov esi, 0x1388
push eax
mov dword [edi + 0x13a8], esi
call fcn.00420230
mov ebx, eax
cmp ebx, 3
je 0x421542
cmp ebx, 4
jne 0x4215c2
mov eax, dword [edi + 0x13a8]
cmp eax, esi
jae 0x421573
mov ecx, dword [edi]
push ecx
sub esi, eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0043cea8
add esp, 0x10
cmp esi, eax
jne 0x4215a4
mov edx, dword [edi]
push edx
call fcn.0043e146
add esp, 4
test eax, eax
jne 0x4215a4
cmp ebx, 4
jne 0x421510
mov esi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x1c]
mov eax, dword [edi]
push eax
call fcn.0043e146
add esp, 4
test eax, eax
jne 0x4215d8
mov ecx, dword [edi]
push ecx
call fcn.0043d846
mov edx, dword [edi]
push edx
call fcn.0043e146
add esp, 8
test eax, eax
je 0x4215d8
mov eax, dword [ebp + 8]
test eax, eax
je 0x4215b1
mov dword [eax], 0xfffffffa
pop esi
pop ebx
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 8]
test eax, eax
je 0x4215cb
mov dword [eax], ebx
pop esi
mov dword [edi + 0x13c4], ebx
pop ebx
pop edi
pop ebp
ret 0x1c
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4215ea
mov edx, dword [edi + 0x139c]
mov dword [ecx], edx
test eax, eax
je 0x4215f6
mov ecx, dword [edi + 0x13a0]
mov dword [eax], ecx
test ebx, ebx
je 0x421602
mov edx, dword [edi + 0x13ac]
mov dword [ebx], edx
test esi, esi
je 0x42160e
mov eax, dword [edi + 0x13b0]
mov dword [esi], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x42161b
mov dword [eax], 0
lea ecx, [edi + 0x1394]
push ecx
mov dword [edi + 0x13c4], 0
call fcn.00420380
push edi
call fcn.00439c62
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
ret 0x1c
Function at 0x421850
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.00421830
mov esi, dword [ebp + 8]
push eax
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__10_December_2007._n_n
call fcn.0043e175
add eax, 0x40
push eax
call fcn.0043e40b
add esp, 0x10
cmp esi, 0x3ef
jne 0x421892
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call fcn.0043e175
add eax, 0x40
push eax
call fcn.0043e40b
add esp, 8
push 3
call fcn.0043ca90
int3
Function at 0x421a50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor edx, edx
cmp ebx, edx
push edi
je 0x421a60
mov dword [ebx], edx
mov edi, dword [ebp + 0xc]
cmp edi, edx
je 0x421c37
mov eax, dword [ebp + 0x10]
cmp eax, edx
mov dword [edi + 0x13c4], edx
je 0x421c37
mov ecx, dword [ebp + 0x14]
cmp ecx, edx
jl 0x421c37
cmp byte [edi + 0x1390], dl
je 0x421aab
cmp ebx, edx
je 0x421a99
mov dword [ebx], 0xffffffff
mov dword [edi + 0x13c4], 0xffffffff
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
cmp ecx, edx
jne 0x421ac3
cmp ebx, edx
je 0x421ab5
mov dword [ebx], edx
mov dword [edi + 0x13c4], edx
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
mov dword [edi + 0x13a4], eax
mov eax, dword [edi]
push esi
push eax
mov dword [edi + 0x13a8], ecx
call fcn.0043e146
add esp, 4
test eax, eax
jne 0x421b85
cmp dword [edi + 0x1398], 0
jne 0x421b34
mov esi, dword [edi]
call fcn.00421160
test al, al
jne 0x421b34
mov ecx, dword [edi]
push ecx
push 0x1388
lea esi, [edi + 4]
push 1
push esi
call fcn.0043e7f6
mov edx, dword [edi]
push edx
mov ebx, eax
call fcn.0043e146
add esp, 0x14
test eax, eax
jne 0x421bc7
mov dword [edi + 0x138c], ebx
mov dword [edi + 0x1398], ebx
mov ebx, dword [ebp + 8]
mov dword [edi + 0x1394], esi
lea eax, [edi + 0x1394]
push eax
call fcn.004218a0
test eax, eax
jne 0x421ba2
mov esi, dword [edi]
call fcn.00421160
test al, al
je 0x421b65
cmp dword [edi + 0x1398], 0
jne 0x421b65
cmp dword [edi + 0x13a8], 0
ja 0x421bfc
cmp dword [edi + 0x13a8], 0
je 0x421c19
mov ecx, dword [edi]
push ecx
call fcn.0043e146
add esp, 4
test eax, eax
je 0x421ae3
test ebx, ebx
je 0x421b8f
mov dword [ebx], 0xfffffffa
pop esi
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
cmp eax, 4
jne 0x421be7
test ebx, ebx
je 0x421bad
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
sub eax, dword [edi + 0x13a8]
pop esi
mov dword [edi + 0x13c4], 4
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test eax, eax
je 0x421b8f
mov dword [eax], 0xfffffffa
pop esi
mov dword [edi + 0x13c4], 0xfffffffa
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x421bed
mov dword [ebx], eax
pop esi
mov dword [edi + 0x13c4], eax
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x421c06
mov dword [ebx], 0xfffffff9
pop esi
mov dword [edi + 0x13c4], 0xfffffff9
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
test ebx, ebx
je 0x421c23
mov dword [ebx], 0
mov eax, dword [ebp + 0x14]
pop esi
mov dword [edi + 0x13c4], 0
pop edi
pop ebx
pop ebp
ret 0x10
cmp ebx, edx
je 0x421c41
mov dword [ebx], 0xfffffffe
cmp edi, edx
je 0x421c4f
mov dword [edi + 0x13c4], 0xfffffffe
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x10
Function at 0x428bde
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x4577e3
call fcn.0043f241
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00433371
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x428c29
call fcn.00433371
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x428c3a
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x428c47
or eax, 0xffffffff
jmp 0x428da3
mov ecx, esi
call fcn.00428725
mov dword [ebp - 0x14], eax
call fcn.0042b878
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x428cc5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x428cc5
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x428cc5
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.004285d6
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x428cc5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x428cc5
mov ecx, ebx
call fcn.004290b1
test eax, eax
je 0x428cc5
push 0
mov ecx, ebx
call fcn.004290cc
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0042d100
push dword [ebp - 0x14]
call fcn.0042b7d0
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.004289e6
xor edi, edi
cmp eax, edi
je 0x428d22
test byte [esi + 0x3c], 0x10
je 0x428d0c
push 4
pop edi
mov ecx, esi
call fcn.00428f98
test ax, 0x100
je 0x428d02
push 5
pop edi
push edi
mov ecx, esi
call fcn.0042b398
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x428d22
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00429133
or dword [ebp - 4], 0xffffffff
jmp 0x428d4d
cmp dword [ebp - 0x28], edi
je 0x428d5b
push 1
mov ecx, ebx
call fcn.004290cc
cmp dword [ebp - 0x2c], edi
je 0x428d6b
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x428d84
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x428d84
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0042875f
cmp dword [esi + 0x58], edi
je 0x428da0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0043f2e6
ret