joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56f5c7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0x90
mov dword [esp], 1
call fcn.004baa20
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004ae0f7
mov dword [esp], str.GIT_TRANSPORT_HELPER_DEBUG
call sub.cygwin1.dll_getenv
test eax, eax
je 0x56f611
mov dword [0x62e1ac], 1
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov dword [eax], fcn.0056cf27
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0x34]
mov eax, dword [ebp + 8]
mov dword [eax + 0x38], edx
mov eax, 0
leave
ret

Function at 0x56f636
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2028
call fcn.00597adc
sub esp, eax
mov eax, dword [0x59e8d8]
test eax, eax
jns 0x56f667
mov dword [esp], str.GIT_TRANSLOOP_DEBUG
call sub.cygwin1.dll_getenv
test eax, eax
setne al
movzx eax, al
mov dword [0x59e8d8], eax
mov eax, dword [0x59e8d8]
test eax, eax
je 0x56f6be
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2000
lea eax, [ebp - 0x200c]
mov dword [esp], eax
call sub.cygwin1.dll_vsnprintf
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
lea edx, [ebp - 0x200c]
mov dword [esp + 8], edx
mov dword [esp + 4], str.Transfer_loop_debugging:__s_n
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x56f6bf
nop
leave
ret
Function at 0x577094
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
lea eax, [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
je 0x5770d0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Could_not_stat__s
call fcn.004b572d
call fcn.005768d8
jmp 0x5771a7
mov dword [esp + 4], 0x5d122f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004ceb4c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x577109
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Could_not_open__s
call fcn.004b572d
call fcn.005768d8
jmp 0x5771a7
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0057693f
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x577129
mov eax, dword [ebp - 0x10]
jmp 0x57712e
mov eax, 1
mov dword [esp], eax
call fcn.004ba857
mov edx, dword [ebp + 8]
mov dword [edx], eax
cmp dword [ebp - 0x10], 0
je 0x57718e
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_fread
cmp eax, 1
je 0x57718e
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Could_not_read__s
call fcn.004b5782
call fcn.005768d8
jmp 0x5771a7
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, 0
leave
ret
Function at 0x58115c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0x61d2e4
mov eax, dword [ebp + 0x10]
and eax, 0xf000
cmp eax, 0xe000
jne 0x5811df
lea eax, [ebp - 0x80]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll__lstat64
test eax, eax
jne 0x5811bf
mov eax, dword [ebp - 0x70]
and eax, 0xf000
cmp eax, 0x4000
jne 0x5811bf
mov eax, 0
jmp 0x58133a
mov dword [esp + 4], 0x1ff
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_mkdir
test eax, eax
setne al
movzx eax, al
jmp 0x58133a
mov eax, dword [0x599360]
test eax, eax
je 0x581216
mov eax, dword [ebp + 0x10]
and eax, 0xf000
cmp eax, 0xa000
jne 0x581216
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.cygwin1.dll_symlink
test eax, eax
setne al
movzx eax, al
jmp 0x58133a
mov eax, dword [ebp + 0x10]
and eax, 0x40
test eax, eax
je 0x581227
mov eax, 0x1ff
jmp 0x58122c
mov eax, 0x1b6
mov dword [esp + 8], eax
mov dword [esp + 4], 0xa01
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll__open64
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x581256
mov eax, 1
jmp 0x58133a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c]
mov eax, dword [eax + 0x84]
mov dword [esp + 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00577c95
test eax, eax
je 0x58129e
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004bae1c
shr eax, 0x1f
movzx eax, al
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5812e6
mov dword [esp], str.failed_to_write_to__s
call fcn.00577c50
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b572d
call fcn.0057775c
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00491cd8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_close
test eax, eax
jns 0x581328
cmp dword [ebp - 0x10], 0
jne 0x581328
mov dword [esp], str.closing_file__s
call fcn.00577c50
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b572d
call fcn.0057775c
jmp 0x58133a
cmp dword [ebp - 0x10], 0
je 0x581335
mov eax, 0xffffffff
jmp 0x58133a
mov eax, 0
leave
ret
Function at 0x585798
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004ba8d6
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x58588d
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, edx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add edx, ecx
movzx eax, byte [eax]
mov byte [edx], al
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jge 0x5857e8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x2f
jne 0x5857b8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jge 0x58589b
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049decd
test eax, eax
je 0x585821
jmp 0x58588d
mov dword [esp + 4], 0x1ff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x58588d
call sub.cygwin1.dll___errno
mov eax, dword [eax]
cmp eax, 0x11
jne 0x58587a
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 0x5c]
and eax, 1
test al, al
je 0x58587a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004bb651
test eax, eax
jne 0x58587a
mov dword [esp + 4], 0x1ff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_mkdir
test eax, eax
jne 0x58587a
jmp 0x58588d
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str.cannot_create_directory_at__s
call fcn.004b5614
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jl 0x5857b8
jmp 0x58589c
nop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
nop
leave
ret
Function at 0x58a8a5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x1c
call fcn.004ba857
mov dword [ebp - 0xc], eax
mov dword [esp], str.GIT_NOTES_REWRITE_MODE
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
mov dword [esp], str.GIT_NOTES_REWRITE_REF
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 1
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0x542fd4
mov dword [esp + 4], 0x14
mov dword [esp], 1
call fcn.004baa20
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
movzx edx, byte [eax + 0xc]
or edx, 1
mov byte [eax + 0xc], dl
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
cmp dword [ebp - 0x10], 0
je 0x58a986
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0058a6c2
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x58a986
mov dword [esp], str.Bad__s_value:__s
call fcn.0058a389
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], str.GIT_NOTES_REWRITE_MODE
mov dword [esp], eax
call fcn.004b5782
call fcn.0058a240
cmp dword [ebp - 0x14], 0
je 0x58a9ab
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.005434cc
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x58a747
call fcn.0041ae81
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
test eax, eax
je 0x58a9d5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 4]
test eax, eax
jne 0x58aa0b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00495bdb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, 0
jmp 0x58aa4d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 4], 2
mov dword [esp], eax
call fcn.00543812
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00495bdb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x58ad21
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_TEST_CHECKOUT_WORKERS
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x58ada5
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x58ada5
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xa
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0058ac11
test eax, eax
je 0x58ad87
mov dword [esp], str.invalid_value_for__s:__s
call fcn.0058acf3
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], str.GIT_TEST_CHECKOUT_WORKERS
mov dword [esp], eax
call fcn.004b54c7
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jg 0x58ad9a
call fcn.0049f324
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x58adfc
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.checkout.workers
call fcn.0041af40
test eax, eax
je 0x58adc8
mov edx, 1
mov eax, dword [ebp + 8]
mov dword [eax], edx
jmp 0x58addb
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jg 0x58addb
call fcn.0049f324
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.checkout.thresholdForParallelism
call fcn.0041af40
test eax, eax
je 0x58adfc
mov edx, 0x64
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
leave
ret

Function at 0x58d720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x58d769
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
test eax, eax
jne 0x58d769
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
cmp eax, 1
je 0x58d76a
call sub.cygwin1.dll___errno
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x58d76a
nop
leave
ret
Function at 0x58e38f
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [esp + 4], str.thisimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058d01b
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0058ddca
test eax, eax
js 0x58e40d
mov dword [esp + 4], str.thisimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058d01b
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00577094
test eax, eax
je 0x58e419
mov dword [ebp - 0xc], 1
jmp 0x58e55f
lea eax, [ebp - 0x20]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0058e2ac
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x58e55b
mov dword [esp + 4], str.postimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058d01b
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.cygwin1.dll_utime
test eax, eax
jns 0x58e4a1
mov dword [esp + 4], str.postimage
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0058d01b
mov ebx, eax
mov dword [esp], str.failed_utime___on__s
call fcn.0058cd71
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b57a9
mov dword [esp + 4], 0x5d5378
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004ceb4c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x58e4e2
mov dword [esp], str.could_not_open__s
call fcn.0058cd71
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b572d
call fcn.0058caac
jmp 0x58e578
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
cmp eax, 1
je 0x58e52a
mov dword [esp], str.could_not_write__s
call fcn.0058cd71
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b572d
call fcn.0058caac
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_fclose
test eax, eax
je 0x58e55e
mov dword [esp], str.writing__s_failed
call fcn.0058cd71
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b572d
call fcn.0058caac
jmp 0x58e578
nop
jmp 0x58e55f
nop
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x58e57d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [ebp - 0x14], 0
mov dword [esp + 8], 1
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00479fc2
mov dword [ebp - 0xc], 0
jmp 0x58e63b
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0xc]
shl eax, 3
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x84]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045abdd
test eax, eax
je 0x58e60c
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x2ba
mov dword [esp], str.rerere.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
mov dword [esp], str.Staged__s_using_previous_resolution.
call fcn.0058cd71
mov ebx, eax
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00493dcc
add dword [ebp - 0xc], 1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0xc]
cmp edx, eax
ja 0x58e5b2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x84]
mov dword [esp + 8], 3
lea edx, [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045fcfa
test eax, eax
je 0x58e684
mov dword [esp], str.unable_to_write_new_index_file
call fcn.0058cd71
mov dword [esp], eax
call fcn.004b54c7
nop
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x5972bd
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0x1505
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0x1e
cmp eax, 0x10
sete al
movzx eax, al
mov dword [ebp - 0x10], eax
jmp 0x597425
cmp dword [ebp - 0x10], 0
je 0x597322
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 0xd
jne 0x597409
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp + 0xc], eax
jbe 0x597409
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 0xa
jne 0x597409
jmp 0x597421
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str._________AA__A__________________]
movzx eax, al
and eax, 1
test eax, eax
je 0x597409
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x59734c
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp + 0xc], eax
jbe 0x597381
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str._________AA__A__________________]
movzx eax, al
and eax, 1
test eax, eax
je 0x597381
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 0xa
jne 0x597348
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp + 0xc], eax
jbe 0x597399
mov eax, dword [ebp - 8]
add eax, 1
movzx eax, byte [eax]
cmp al, 0xa
jne 0x5973a0
mov eax, 1
jmp 0x5973a5
mov eax, 0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
and eax, 2
test eax, eax
jne 0x597420
mov eax, dword [ebp + 0x10]
and eax, 4
test eax, eax
je 0x5973d1
cmp dword [ebp - 0x14], 0
jne 0x5973d1
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
xor dword [ebp - 4], 0x20
jmp 0x597420
mov eax, dword [ebp + 0x10]
and eax, 8
test eax, eax
je 0x597420
cmp dword [ebp - 0x14], 0
jne 0x597420
jmp 0x5973fc
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
xor dword [ebp - 4], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 0xc], eax
jne 0x5973e3
jmp 0x597420
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movsx eax, al
xor dword [ebp - 4], eax
jmp 0x597421
nop
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x59743b
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 0xa
jne 0x5972e9
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x59744b
mov eax, dword [ebp - 8]
add eax, 1
jmp 0x59744e
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x597458
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0x1505
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0x1e
test eax, eax
je 0x5974ab
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.005972bd
jmp 0x5974d8
mov eax, dword [ebp - 4]
shl eax, 5
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
movsx eax, al
xor dword [ebp - 4], eax
add dword [ebp - 8], 1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x5974bd
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
cmp al, 0xa
jne 0x597492
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x5974cd
mov eax, dword [ebp - 8]
add eax, 1
jmp 0x5974d0
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4039e0
Capabilities:
Set current directory

Disassembly:
test al, al
je 0x4039f4
inc dword [0x4d8814]
add dword [0x4d4b04], 0x108
mov edx, dword [0x4d4b04]
push esi
push edi
mov ecx, 0x42
mov esi, 0x4d72e0
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0xc]
mov esi, edx
mov dword [esi + 0x2c], ecx
test al, al
je 0x403a23
push 0
mov eax, 0x4d96d0
call fcn.0041e1a0
cmp dword [0x4d8844], 0
mov dword [0x4da1c8], 0
mov dword [0x4da1cc], 0
je 0x403a5b
mov eax, dword [0x4d5d24]
test eax, eax
je 0x403a4f
mov eax, dword [eax]
test eax, eax
jne 0x403a54
mov eax, 0x4af9bc
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0x10], 0
jne 0x403adf
or ecx, 0xffffffff
cmp byte [esi + 0xee], 0
jne 0x403a8a
xor eax, eax
cmp byte [esp + 0x14], 0x65
sete al
mov byte [esi + 0xee], al
test al, al
je 0x403a8a
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
cmp dword [0x4da1d4], 0
je 0x403a9c
cmp dword [0x4da1d0], 0
jne 0x403aa5
cmp byte [esi + 0xee], 0
je 0x403adf
cmp byte [esi + 0xee], 0
mov byte [esi + 0xec], 0
jne 0x403adf
cmp dword [0x4da1d4], 0
jge 0x403ac7
pop edi
mov dword [esi + 0xe0], ecx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xdc], eax
mov edx, dword [0x4da1d4]
mov dword [esi + 0xe0], edx
pop edi
pop esi
ret