joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c50
Capabilities:
Move file

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x89c
mov esi, dword [esp + 0x8b0]
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x425c89
mov eax, dword [esp + 0x40]
and eax, 0xf000
cmp eax, 0x8000
jne 0x425da5
mov ebx, dword [0x476090]
lea edi, [esp + 0x490]
lea ebp, [esp + 0x90]
cmp ebx, 1
jg 0x425d15
jmp 0x425db0
mov dword [esp + 4], edi
mov dword [esp], ebp
call sub.cygwin1.dll_rename
test eax, eax
je 0x425d0c
call sub.cygwin1.dll___errno
cmp dword [eax], 2
je 0x425d0c
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [esp + 0x2c], eax
call sub.cygwin1.dll___errno
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x14], edx
mov eax, dword [eax]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], str.Failed_to_rename__s_to__s:___d___s_n
mov dword [esp], 1
call fcn.0041d940
cmp ebx, 1
je 0x425db0
mov dword [esp + 0x14], ebx
sub ebx, 1
mov dword [esp + 0x10], 0x4635c1
mov dword [esp + 0xc], esi
mov dword [esp + 8], str._s_s_d
mov dword [esp + 4], 0x400
mov dword [esp], edi
call sub.cygwin1.dll_snprintf
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0x4635c1
mov dword [esp + 0xc], esi
mov dword [esp + 8], str._s_s_d
mov dword [esp + 4], 0x400
mov dword [esp], ebp
mov dword [esp + 0x2c], eax
call sub.cygwin1.dll_snprintf
or eax, dword [esp + 0x2c]
cmp eax, 0x3ff
jbe 0x425cb0
call sub.cygwin1.dll___errno
mov dword [eax], 0x5b
jmp 0x425cc0
call sub.cygwin1.dll___errno
mov dword [eax], 0x5b
call sub.cygwin1.dll___errno
cmp dword [eax], 2
jne 0x425dfd
add esp, 0x89c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x4635c1
mov dword [esp + 0xc], esi
mov dword [esp + 8], str._s_s_d
mov dword [esp + 4], 0x400
mov dword [esp], edi
call sub.cygwin1.dll_snprintf
cmp eax, 0x3ff
ja 0x425d90
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.cygwin1.dll_rename
test eax, eax
je 0x425da5
call sub.cygwin1.dll___errno
cmp dword [eax], 2
je 0x425da5
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov ebx, eax
call sub.cygwin1.dll___errno
mov dword [esp + 0x14], ebx
mov eax, dword [eax]
mov dword [esp + 0xc], edi
mov dword [esp + 4], str.Failed_to_rename__s_to__s:___d___s_n
mov dword [esp + 0x10], eax
lea eax, [esp + 0x90]
mov dword [esp + 8], eax
mov dword [esp], 1
call fcn.0041d940
add esp, 0x89c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x428d70
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [0x478448]
test esi, esi
je 0x428da8
mov dword [esp], esi
xor ebx, ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
add dword [0x478438], edx
adc dword [0x47843c], ebx
call sub.cygz.dll_gzwrite
add esp, 0x14
pop ebx
pop esi
ret
mov ecx, dword [0x47844c]
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x428dd0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [0x478448]
test eax, eax
je 0x428ee0
mov dword [esp + 8], 4
mov dword [esp + 4], str._r_n_r_n
mov dword [esp], eax
add dword [0x478438], 4
adc dword [0x47843c], 0
call sub.cygz.dll_gzwrite
cmp eax, 4
jne 0x428ec8
cmp byte [0x478434], 0
je 0x428ecf
mov eax, dword [0x478448]
test eax, eax
je 0x428ecf
mov dword [esp], eax
call sub.cygz.dll_gzclose
test eax, eax
jne 0x428ec8
mov eax, dword [0x47844c]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
mov eax, dword [0x47844c]
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.cygwin1.dll__fseeko64
mov eax, dword [0x47844c]
mov dword [esp], eax
call sub.cygwin1.dll__ftello64
mov esi, dword [0x478440]
mov edi, dword [0x478444]
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
mov ebx, dword [0x478438]
mov eax, esi
mov dword [esp + 0x1c], edx
mov edx, edi
add eax, 0xe
mov dword [esp + 4], eax
mov eax, dword [0x47844c]
adc edx, 0
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.cygwin1.dll__fseeko64
test eax, eax
je 0x428f10
lea esi, [esi]
mov byte [0x478434], 0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x47844c]
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str._r_n_r_n
call sub.cygwin1.dll_fwrite
jmp 0x428e0a
mov eax, dword [0x47844c]
lea ebp, [esp + 0x28]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], ebp
call sub.cygwin1.dll_fread
cmp eax, 0xa
jne 0x428ec8
mov eax, dword [esp + 0x18]
mov edx, dword [0x478444]
mov dword [esp + 0xc], 0
sub eax, esi
mov dword [esp + 8], edx
mov esi, eax
mov eax, dword [0x478440]
or byte [esp + 0x2b], 4
mov dword [esp + 4], eax
mov eax, dword [0x47844c]
mov dword [esp], eax
call sub.cygwin1.dll__fseeko64
mov eax, dword [0x47844c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], ebp
call sub.cygwin1.dll_fwrite
mov eax, 8
mov edx, dword [0x478444]
mov dword [esp + 0xc], 0
mov word [esp + 0x36], ax
mov eax, dword [0x478440]
mov dword [esp + 0x32], 0x6c73000c
add eax, 0xa
mov dword [esp + 0x38], esi
mov dword [esp + 4], eax
mov eax, dword [0x47844c]
adc edx, 0
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0x3c], ebx
call sub.cygwin1.dll__fseeko64
mov eax, dword [0x47844c]
mov dword [esp + 8], 0xe
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x32]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
mov eax, dword [0x47844c]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
mov eax, dword [0x47844c]
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.cygwin1.dll__fseeko64
jmp 0x428ecf
Function at 0x4290e0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x430
mov dword [esp + 0xc], 2
lea ebx, [esp + 0x1b]
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.cygwin1.dll__fseeko64
mov dword [esp], edi
call sub.cygwin1.dll__ftello64
mov dword [esp], ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call fcn.0042ccb0
mov edx, ebx
mov eax, str.Content_Length
call fcn.00429040
cmp byte [0x478434], 0
jne 0x4291d0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], edi
call sub.cygwin1.dll__fseeko64
test eax, eax
jne 0x4291c0
movzx eax, byte [0x478434]
lea esi, [esp + 0x30]
jmp 0x4291ae
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.cygwin1.dll_fread
mov ebx, eax
test eax, eax
je 0x4291b2
mov edx, ebx
mov eax, esi
call fcn.00428d70
cmp ebx, eax
ja 0x4291f8
movzx eax, byte [0x478434]
test al, al
jne 0x429178
add esp, 0x430
pop ebx
pop esi
pop edi
ret
mov byte [0x478434], 0
xor eax, eax
jmp 0x42916b
mov edx, 2
mov eax, 0x463ba8
call fcn.00428d70
cmp eax, 2
je 0x429140
mov byte [0x478434], 0
jmp 0x429140
mov byte [0x478434], 0
add esp, 0x430
pop ebx
pop esi
pop edi
ret
Function at 0x42a3d0
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x54
mov eax, dword [0x47844c]
test eax, eax
je 0x42a54d
xor eax, eax
cmp eax, dword [0x475fc8]
sbb eax, dword [0x475fcc]
jl 0x42a590
lea esi, [esp + 0x20]
mov dword [esp + 4], 0x30
mov dword [esp], esi
call fcn.004293f0
mov eax, dword [0x478450]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
mov eax, dword [0x478450]
mov edx, esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov ecx, str.metadata:__gnu.org_software_wget_warc_MANIFEST.txt
mov dword [esp + 0x10], eax
mov eax, str.metadata
mov dword [esp + 0xc], str.text_plain
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00429b30
call fcn.004294e0
mov ebx, eax
test eax, eax
je 0x42a59f
mov dword [esp], eax
call sub.cygwin1.dll_fflush
mov eax, dword [0x475f08]
mov dword [esp + 4], 0x463e15
mov dword [esp], ebx
mov dword [esp + 8], eax
call sub.cygwin1.dll_fprintf
mov dword [esp + 0x10], ebx
mov ecx, str.metadata:__gnu.org_software_wget_warc_wget_arguments.txt
xor edx, edx
mov dword [esp + 0x14], 0xffffffff
mov eax, str.resource
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], str.text_plain
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
call fcn.00429b30
mov eax, dword [0x478454]
test eax, eax
je 0x42a52f
mov dword [esp + 0x10], eax
mov ecx, str.metadata:__gnu.org_software_wget_warc_wget.log
xor edx, edx
mov eax, str.resource
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], str.text_plain
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
call fcn.00429b30
mov dword [esp], 0
mov dword [0x478454], 0
call fcn.0041d550
mov eax, dword [0x47844c]
mov byte [0x478400], 0
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov dword [0x47844c], 0
mov eax, dword [0x478430]
test eax, eax
je 0x42a568
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov dword [0x478430], 0
mov eax, dword [0x478454]
test eax, eax
je 0x42a585
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov dword [esp], 0
call fcn.0041d550
add esp, 0x54
pop ebx
pop esi
ret
mov eax, 1
call fcn.00429570
jmp 0x42a3f6
mov dword [esp], str.Could_not_open_temporary_WARC_file._n
call sub.cygintl_8.dll_libintl_gettext
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.0041d940
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
nop
Function at 0x42b5e0
Capabilities:
Terminate process

Disassembly:
push ebx
sub esp, 0x28
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_vasprintf
mov edx, eax
mov eax, dword [esp + 0x1c]
test edx, edx
js 0x42b610
add esp, 0x28
pop ebx
ret
call sub.cygwin1.dll___errno
cmp dword [eax], 0xc
je 0x42b621
add esp, 0x28
xor eax, eax
pop ebx
ret
mov dword [esp], 0
call fcn.0041d920
mov dword [esp], str._s:__s:_Failed_to_allocate_enough_memory__memory_exhausted._n
mov ebx, dword [0x475f18]
call sub.cygintl_8.dll_libintl_gettext
mov dword [esp + 0xc], str.aprintf
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.0041d940
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
nop

Function at 0x42b7b0
Capabilities:
Set file attributes

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov dword [esp], 0
mov dword [esp + 0x1c], eax
call sub.cygwin1.dll_time
mov dword [esp], ebx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
call sub.cygwin1.dll_utime
cmp eax, 0xffffffff
je 0x42b7f0
add esp, 0x28
pop ebx
ret
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.utime__s_:__s_n
mov dword [esp], 1
call fcn.0041d940
add esp, 0x28
pop ebx
ret

Function at 0x42bc90
Capabilities:
Create directory

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x41c
mov esi, dword [esp + 0x430]
mov dword [esp], esi
call sub.cygwin1.dll_strlen
cmp eax, 0x3ff
ja 0x42bcd8
lea edx, [eax + 1]
lea ebp, [esp + 0x10]
cmp edx, 4
jb 0x42bd80
mov ecx, dword [esi + edx - 4]
shr eax, 2
mov edi, ebp
mov dword [esp + edx + 0xc], ecx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov esi, ebp
jmp 0x42bce6
mov dword [esp], esi
lea ebp, [esp + 0x10]
call fcn.00447e10
mov esi, eax
xor ebx, ebx
cmp byte [esi], 0x2f
sete bl
add ebx, 1
movzx eax, byte [esi + ebx - 1]
test al, al
je 0x42bd0a
cmp al, 0x2f
je 0x42bd40
add ebx, 1
movzx eax, byte [esi + ebx - 1]
test al, al
jne 0x42bcfa
xor edx, edx
mov eax, esi
xor ebx, ebx
call fcn.0042b1d0
test al, al
je 0x42bdb0
cmp esi, ebp
je 0x42bd29
mov dword [esp], esi
call fcn.004376c0
add esp, 0x41c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test al, al
je 0x42bd0a
mov byte [esi + ebx - 1], 0
xor edx, edx
mov eax, esi
call fcn.0042b1d0
test al, al
je 0x42bd60
mov byte [esi + ebx - 1], 0x2f
jmp 0x42bcfe
mov dword [esp + 4], 0x1ff
mov dword [esp], esi
call sub.cygwin1.dll_mkdir
mov byte [esi + ebx - 1], 0x2f
jmp 0x42bcfe
test edx, edx
je 0x42bcd1
movzx eax, byte [esi]
mov byte [esp + 0x10], al
test dl, 2
je 0x42bcd1
movzx eax, word [esi + edx - 2]
mov esi, ebp
mov word [esp + edx + 0xe], ax
jmp 0x42bce6
mov dword [esp + 4], 0x1ff
mov dword [esp], esi
call sub.cygwin1.dll_mkdir
mov ebx, eax
jmp 0x42bd1d
Function at 0x42fe20
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [0x475f54]
test eax, eax
je 0x42fee8
xor esi, esi
call sub.cygwin1.dll_fork
mov ebx, eax
test eax, eax
js 0x42ff64
je 0x42fe78
mov dword [esp], str.Continuing_in_background__pid__d._n
call sub.cygintl_8.dll_libintl_gettext
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.cygwin1.dll_printf
mov eax, esi
test al, al
jne 0x42ff38
mov dword [esp], 0
call sub.cygwin1.dll_exit
lea esi, [esi]
nop
call sub.cygwin1.dll_setsid
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 4]
mov dword [esp + 4], 0x46458f
mov dword [esp], str._dev_null
mov dword [esp + 8], eax
call sub.cygwin1.dll__freopen64
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x4643dc
mov dword [esp], str._dev_null
mov dword [esp + 8], eax
call sub.cygwin1.dll__freopen64
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 4], 0x4643dc
mov dword [esp], str._dev_null
mov dword [esp + 8], eax
call sub.cygwin1.dll__freopen64
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
cmp byte [0x475f24], 0
je 0x42fefe
cmp byte [0x476088], 0
je 0x42fe32
mov dword [esp + 8], 0x475f54
mov dword [esp + 4], 0
mov dword [esp], str.wget_log
call fcn.0042fd10
test eax, eax
je 0x42fe32
mov dword [esp], eax
mov esi, 1
call sub.cygwin1.dll_fclose
jmp 0x42fe34
mov eax, dword [0x475f54]
mov dword [esp], eax
call fcn.00439a30
mov dword [esp], str.Output_will_be_written_to__s._n
mov ebx, eax
call sub.cygintl_8.dll_libintl_gettext
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.cygwin1.dll_printf
jmp 0x42fe67
mov dword [esp], str.fork
call sub.cygwin1.dll_perror
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
Function at 0x430350
Capabilities:
Encode data using base64

Disassembly:
push edi
push esi
push ebx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
lea edi, [ecx + esi - 2]
cmp ecx, edi
jae 0x4303dc
lea esi, [esi]
nop
movzx eax, byte [ecx]
add ebx, 4
add ecx, 3
shr al, 2
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 4], al
movzx edx, byte [ecx - 3]
movzx eax, byte [ecx - 2]
shl edx, 4
shr al, 4
and edx, 0x30
movzx eax, al
movzx eax, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 3], al
movzx edx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl edx, 2
shr al, 6
and edx, 0x3c
movzx eax, al
movzx eax, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 2], al
movzx eax, byte [ecx - 1]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 1], al
cmp edi, ecx
ja 0x430370
mov eax, esi
mov edx, 0xaaaaaaab
mul edx
mov eax, edx
and edx, 0xfffffffe
shr eax, 1
add edx, eax
mov eax, esi
sub eax, edx
cmp eax, 1
je 0x430458
cmp eax, 2
jne 0x430448
movzx eax, byte [ecx]
add ebx, 4
shr al, 2
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 4], al
movzx edx, byte [ecx]
movzx eax, byte [ecx + 1]
shl edx, 4
shr al, 4
and edx, 0x30
movzx eax, al
movzx eax, byte [edx + eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 3], al
movzx eax, byte [ecx + 1]
mov byte [ebx - 1], 0x3d
shl eax, 2
and eax, 0x3c
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 2], al
mov byte [ebx], 0
mov eax, ebx
sub eax, dword [esp + 0x18]
pop ebx
pop esi
pop edi
ret
movzx eax, byte [ecx]
add ebx, 4
shr al, 2
movzx eax, al
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 4], al
movzx eax, byte [ecx]
shl eax, 4
and eax, 0x30
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_KMGTPE]
mov byte [ebx - 3], al
mov eax, 0x3d3d
mov word [ebx - 2], ax
mov eax, ebx
sub eax, dword [esp + 0x18]
mov byte [ebx], 0
pop ebx
pop esi
pop edi
ret

Function at 0x4331d0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
ret
Function at 0x437470
Capabilities:
Hash data using sha256

Disassembly:
push esi
push ebx
sub esp, 0xc4
mov eax, dword [esp + 0xd4]
lea ebx, [esp + 0x14]
mov dword [esp + 0x14], 0x6a09e667
mov dword [esp + 8], ebx
mov esi, dword [esp + 0xd8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x18], 0xbb67ae85
mov dword [esp], eax
mov dword [esp + 0x1c], 0x3c6ef372
mov dword [esp + 0x20], 0xa54ff53a
mov dword [esp + 0x24], 0x510e527f
mov dword [esp + 0x28], 0x9b05688c
mov dword [esp + 0x2c], 0x1f83d9ab
mov dword [esp + 0x30], 0x5be0cd19
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x3c], 0
call fcn.00437150
mov eax, ebx
call fcn.00437020
xor eax, eax
lea esi, [esi]
mov edx, dword [ebx + eax*4]
bswap edx
mov dword [esi + eax*4], edx
add eax, 1
cmp eax, 8
jne 0x437508
add esp, 0xc4
mov eax, esi
pop ebx
pop esi
ret
Function at 0x43ae80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
mov esi, edx
mov edx, ecx
push ebx
mov ebx, eax
sub esp, 0x2c
mov eax, dword [eax + 8]
mov edi, dword [ebx + 4]
cmp eax, edi
jae 0x43af40
mov ecx, dword [ebx + 0x14]
mov ebp, dword [ebx + 0xc]
mov dword [esp + 0x10], ecx
mov edi, dword [ebx]
lea edi, [edi + eax*8]
mov dword [edi], esi
mov esi, edx
and esi, 0xfffc00ff
cmp dl, 6
sete cl
mov dword [edi + 4], esi
mov esi, ecx
cmp dl, 5
jne 0x43aecd
cmp dword [ebx + 0x5c], 1
setg cl
mov esi, ecx
movzx edx, byte [edi + 6]
shl esi, 4
and edx, 0xffffffef
or edx, esi
mov byte [edi + 6], dl
mov ecx, dword [esp + 0x10]
mov dword [ebp + eax*4], 0xffffffff
mov eax, dword [ebx + 8]
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, dword [ebx + 8]
lea edx, [eax + eax*2]
mov eax, dword [ebx + 0x18]
lea eax, [eax + edx*4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, dword [ebx + 8]
lea edx, [eax + 1]
mov dword [ebx + 8], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [edi + edi]
mov dword [esp + 0x14], eax
cmp eax, 0x15555555
ja 0x43b038
mov eax, edi
mov dword [esp + 0x1c], ecx
shl eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0044ac90
test eax, eax
je 0x43b038
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
lea ecx, [edi*8]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], ecx
call fcn.0044ac90
mov ecx, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0044ac90
add edi, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x14]
shl edi, 3
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0044ac90
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call fcn.0044ac90
mov edi, eax
test ebp, ebp
je 0x43b010
mov edx, dword [esp + 0x18]
test edx, edx
je 0x43b010
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43b010
test edi, edi
mov edx, dword [esp + 0x1c]
je 0x43b010
mov eax, dword [esp + 0x18]
mov dword [ebx + 0xc], ebp
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [ebx + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 8]
jmp 0x43aea5
mov dword [esp], ebp
call fcn.004376c0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004376c0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
call fcn.004376c0
mov dword [esp], edi
call fcn.004376c0
mov eax, 0xffffffff
jmp 0x43af2e
Function at 0x443ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0xcc
mov edi, dword [esp + 0xe0]
mov esi, dword [esp + 0xe0]
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], ecx
and edi, 0x1000000
and esi, 0x20
mov eax, dword [esp + 0x2c]
mov ebp, dword [ebx]
movzx edx, byte [eax + 4]
mov eax, edx
jmp dword [edx*4 + 0x465610]
Function at 0x447f70
Capabilities:
Query environment variable

Disassembly:
push edi
mov edi, 0xc0000601
push esi
mov esi, eax
add eax, 2
push ebx
mov ebx, esi
sub esp, 0x10
movzx edx, word [eax]
test dx, dx
jne 0x447fbd
jmp 0x448013
lea ecx, [edx - 0x21]
cmp cx, 0x1f
ja 0x447fa5
bt edi, ecx
jae 0x447fa5
cmp word [ebx + 4], 0x28
je 0x448020
cmp dx, 0x29
je 0x448070
mov ebx, eax
lea eax, [ebx + 2]
movzx edx, word [ebx + 2]
test dx, dx
je 0x448013
cmp dx, 0x5b
jne 0x447f90
mov edx, dword [0x478784]
test edx, edx
je 0x448048
movzx edx, word [ebx + 4]
cmp dx, 0x21
je 0x448038
mov eax, dword [0x478784]
test eax, eax
jns 0x447fe6
cmp dx, 0x5e
je 0x448038
add ebx, 4
cmp dx, 0x5d
jne 0x448005
movzx edx, word [ebx + 2]
add ebx, 2
jmp 0x448005
movzx edx, word [eax]
mov ebx, eax
lea eax, [ebx + 2]
cmp dx, 0x5d
je 0x447fb4
test dx, dx
jne 0x448000
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop edi
ret
lea eax, [ebx + 4]
call fcn.00447f70
cmp word [eax], 0
mov ebx, eax
jne 0x447fb1
jmp 0x448013
movzx edx, word [ebx + 6]
add ebx, 6
jmp 0x447fe9
mov dword [esp], str.POSIXLY_CORRECT
call sub.cygwin1.dll_getenv
cmp eax, 1
sbb eax, eax
or eax, 1
mov dword [0x478784], eax
jmp 0x447fcd
add esp, 0x10
lea eax, [ebx + 4]
pop ebx
pop esi
pop edi
ret

Function at 0x448080
Capabilities:
Query environment variable

Disassembly:
push edi
mov edi, 0xc0000601
push esi
mov esi, eax
add eax, 1
push ebx
mov ebx, esi
sub esp, 0x10
movzx edx, byte [eax]
test dl, dl
jne 0x4480c9
jmp 0x448111
lea ecx, [edx - 0x21]
cmp cl, 0x1f
ja 0x4480b3
bt edi, ecx
jae 0x4480b3
cmp byte [ebx + 2], 0x28
je 0x448120
cmp dl, 0x29
je 0x448170
mov ebx, eax
lea eax, [ebx + 1]
movzx edx, byte [ebx + 1]
test dl, dl
je 0x448111
cmp dl, 0x5b
jne 0x4480a0
mov edx, dword [0x478784]
test edx, edx
je 0x448148
movzx edx, byte [ebx + 2]
cmp dl, 0x21
je 0x448138
mov eax, dword [0x478784]
test eax, eax
jns 0x4480ef
cmp dl, 0x5e
je 0x448138
add ebx, 2
cmp dl, 0x5d
jne 0x448105
movzx edx, byte [ebx + 1]
add ebx, 1
jmp 0x448105
movzx edx, byte [eax]
mov ebx, eax
lea eax, [ebx + 1]
cmp dl, 0x5d
je 0x4480c1
test dl, dl
jne 0x448100
add esp, 0x10
mov eax, esi
pop ebx
pop esi
pop edi
ret
lea eax, [ebx + 2]
call fcn.00448080
cmp byte [eax], 0
mov ebx, eax
jne 0x4480be
jmp 0x448111
movzx edx, byte [ebx + 3]
add ebx, 3
jmp 0x4480f2
mov dword [esp], str.POSIXLY_CORRECT
call sub.cygwin1.dll_getenv
cmp eax, 1
sbb eax, eax
or eax, 1
mov dword [0x478784], eax
jmp 0x4480d8
add esp, 0x10
lea eax, [ebx + 2]
pop ebx
pop esi
pop edi
ret