Incorrect Function Decompiling.

[RobR89]

Describe the bug
While de-compiling a program the following bytes failed to decode.
0x8b 0x4d 0x10 0x83 0xc4 0x04

The program is x86 - 32 bit.
As far as I can see they should result in the following instructions.

0x8b 0x4d 0x10 mov ecx,DWORD PTR [ebp+0x10]
0x83 0xc4 0x04 add esp,0x4

[RobR89]

Ok, I got the listing view to show the proper instructions instead of just ??.
However, the de-compiler still does not recognize them and says the function does not terminate.
/* WARNING: Subroutine does not return */

The bytes for the file are as follows:
8b 4d 10 85 c9 74 1c 83 7f 14 08 72 04 8b 07 eb
02 8b c7 03 c9 51 50 53 e8 ce 4b 13 00 8b 4d 10
83 c4 0c 83 7f 14 08 72 0e 8b 17 52 e8 3c 1a 00
00 8b 4d 10 83 c4 04 89 1f 89 77 14 89 4f 10 83
fe 08 72 02 8b fb 33 d2 66 89 14 4f 8b 4d f4 64
89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 0c 00

It appears in the listing as:
assume FS_OFFSET = <UNKNOWN>
8b 4d 10 MOV ECX,dword ptr [EBP + 0x10]
83 c4 04 ADD ESP,0x4
assume FS_OFFSET = 0xffdff000

[LukeSerne]

Are you sure this is the entire function? The assembly seems a bit weird and doesn't show a clear prologue.

Either way, I saved the bytes to a file and imported them as x86:LE:32:default (gcc) (4.6). By pressing D, I disassembled the data, and it seems to disassemble fine. Additionally, it also decompiles fine. The only issue with the decompiled result seems to be that the decompiler is confused about the context (notice the variables prefixed by unaff_), and doesn't know about the two functions that are called and their calling convention (notice their names: func_0x...). For completeness, here's the disassembly and decompilation I get in collapsible sections:

The disassembly of the provided bytes

                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                               void __cdecl FUN_00000000(void)
             void              <VOID>         <RETURN>
                           FUN_00000000
                 ram:00000000 8b 4d 10        MOV                 ECX, dword ptr [EBP + 0x10]
                 ram:00000003 85 c9           TEST                ECX, ECX
                 ram:00000005 74 1c           JZ                  LAB_00000023
                 ram:00000007 83 7f 14 08     CMP                 dword ptr [EDI + 0x14], 0x8
                 ram:0000000b 72 04           JC                  LAB_00000011
                 ram:0000000d 8b 07           MOV                 EAX, dword ptr [EDI]
                 ram:0000000f eb 02           JMP                 LAB_00000013
                           LAB_00000011                                    XREF[1]:     0000000b(j)  
                 ram:00000011 8b c7           MOV                 EAX, EDI
                           LAB_00000013                                    XREF[1]:     0000000f(j)  
                 ram:00000013 03 c9           ADD                 ECX, ECX
                 ram:00000015 51              PUSH                ECX
                 ram:00000016 50              PUSH                EAX
                 ram:00000017 53              PUSH                EBX
                 ram:00000018 e8 ce 4b        CALL                SUB_00134beb
                              13 00
                 ram:0000001d 8b 4d 10        MOV                 ECX, dword ptr [EBP + 0x10]
                 ram:00000020 83 c4 0c        ADD                 ESP, 0xc
                           LAB_00000023                                    XREF[1]:     00000005(j)  
                 ram:00000023 83 7f 14 08     CMP                 dword ptr [EDI + 0x14], 0x8
                 ram:00000027 72 0e           JC                  LAB_00000037
                 ram:00000029 8b 17           MOV                 EDX, dword ptr [EDI]
                 ram:0000002b 52              PUSH                EDX
                 ram:0000002c e8 3c 1a        CALL                SUB_00001a6d
                              00 00
                 ram:00000031 8b 4d 10        MOV                 ECX, dword ptr [EBP + 0x10]
                 ram:00000034 83 c4 04        ADD                 ESP, 0x4
                           LAB_00000037                                    XREF[1]:     00000027(j)  
                 ram:00000037 89 1f           MOV                 dword ptr [EDI], EBX
                 ram:00000039 89 77 14        MOV                 dword ptr [EDI + 0x14], ESI
                 ram:0000003c 89 4f 10        MOV                 dword ptr [EDI + 0x10], ECX
                 ram:0000003f 83 fe 08        CMP                 ESI, 0x8
                 ram:00000042 72 02           JC                  LAB_00000046
                 ram:00000044 8b fb           MOV                 EDI, EBX
                           LAB_00000046                                    XREF[1]:     00000042(j)  
                 ram:00000046 33 d2           XOR                 EDX, EDX
                 ram:00000048 66 89 14 4f     MOV                 word ptr [EDI + ECX*0x2], DX
                 ram:0000004c 8b 4d f4        MOV                 ECX, dword ptr [EBP + -0xc]
                 ram:0000004f 64 89 0d        MOV                 dword ptr FS:[0x0], ECX
                              00 00 00 00
                 ram:00000056 59              POP                 ECX
                 ram:00000057 5f              POP                 EDI
                 ram:00000058 5e              POP                 ESI
                 ram:00000059 5b              POP                 EBX
                 ram:0000005a 8b e5           MOV                 ESP, EBP
                 ram:0000005c 5d              POP                 EBP
                 ram:0000005d c2 0c 00        RET                 0xc

The decompilation of the provided bytes

void FUN_00000000(void)

{
  int iVar1;
  undefined4 *unaff_EBX;
  int unaff_EBP;
  uint unaff_ESI;
  undefined4 *unaff_EDI;
  undefined4 *in_FS_OFFSET;
  
  iVar1 = 0;
  if (*(int *)(unaff_EBP + 0x10) != 0)
  {
    func_0x00134beb();
    iVar1 = *(int *)(unaff_EBP + 0x10);
  }
  if ((uint)unaff_EDI[5] > 7)
  {
    func_0x00001a6d(*unaff_EDI);
    iVar1 = *(int *)(unaff_EBP + 0x10);
  }
  *unaff_EDI = unaff_EBX;
  unaff_EDI[5] = unaff_ESI;
  unaff_EDI[4] = iVar1;
  if (unaff_ESI > 7)
  {
    unaff_EDI = unaff_EBX;
  }
  *(undefined2 *)((int)unaff_EDI + iVar1 * 2) = 0;
  *in_FS_OFFSET = *(undefined4 *)(unaff_EBP + -0xc);
  return;
}

Could you clarify what you mean by "incorrect function decompiling"? Is there a particular part of the decompiled result that is different from what you expected?

[RobR89]

Not entirely sure whats going on with the code. But I've found the same issue in another location. It also has a couple lines that don't get processed properly and are in a block noted with...
assume FS_OFFSET =
ignored code.
assume FS_OFFSET = 0xffdff000

In all three cases I've found so far it seams to be that the de-compiled code should be something like...
val = 1; if(firstCondition){ DoAThing; } val=2 if(secondCondition){ DoAThing; }
Where DoAThing is identical code and was optimized so the code for 'DoAThing' only exists once.
So, It's looking less like a bug and more like a confusing bit of code that can't be clearly understood by the de-compiler.

[LukeSerne]

Could you paste in the full decompiler result of a function where you're seeing this issue, and then (separately) explain what you consider confusing about it? That way, it's easier to help you. Maybe there is a small trick to get the decompiler to work properly, or there is an actual issue in the decompiler. Either way, having a full concrete example is going to help a lot.