joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b516
Capabilities:
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048a824
test eax, eax
je 0x48b543
mov eax, 0
jmp 0x48b6e7
mov dword [esp], str.GIT_WORK_TREE
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x48b560
mov eax, dword [0x61c3ec]
test eax, eax
je 0x48b5fb
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
cmp edx, eax
je 0x48b59f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048979a
test eax, eax
jne 0x48b59f
mov dword [esp + 4], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004cf61b
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_chdir
test eax, eax
je 0x48b5c5
mov dword [esp], str.cannot_come_back_to_cwd
call fcn.00489755
mov dword [esp], eax
call fcn.004b5614
mov eax, dword [ebp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048b1aa
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x10]
jmp 0x48b6e7
mov eax, dword [0x59936c]
test eax, eax
jle 0x48b654
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
cmp edx, eax
setne al
movzx eax, al
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042a880
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_chdir
test eax, eax
je 0x48b64a
mov dword [esp], str.cannot_come_back_to_cwd
call fcn.00489755
mov dword [esp], eax
call fcn.004b5614
mov eax, 0
jmp 0x48b6e7
mov dword [esp], 0x5af2fc
call fcn.0042a564
mov dword [esp + 4], 0x5af28f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x48b68a
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042a880
mov dword [0x599c60], 0
mov dword [0x599c64], 1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
cmp edx, eax
ja 0x48b6b2
mov eax, 0
jmp 0x48b6e7
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.004cea94
cmp dword [ebp + 0x10], eax
je 0x48b6c9
add dword [ebp + 0x10], 1
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0048968a
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 0x10]
add eax, edx
leave
ret
Function at 0x48b6e9
Capabilities:
Query environment variable
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x5af2fc
call fcn.0048a824
test eax, eax
je 0x48b717
mov eax, 0
jmp 0x48b86a
mov dword [esp + 8], 1
mov dword [esp + 4], 0x5af6b6
mov dword [esp], str.GIT_IMPLICIT_WORK_TREE
call sub.cygwin1.dll_setenv
mov dword [esp], str.GIT_WORK_TREE
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x48b74c
mov eax, dword [0x61c3ec]
test eax, eax
je 0x48b7c7
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
cmp edx, eax
je 0x48b770
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ba90c
jmp 0x48b775
mov eax, 0x5af2fc
mov dword [0x61d14c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_chdir
test eax, eax
je 0x48b7a0
mov dword [esp], str.cannot_come_back_to_cwd
call fcn.00489755
mov dword [esp], eax
call fcn.004b5614
mov eax, dword [0x61d14c]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0048b1aa
jmp 0x48b86a
mov dword [0x599c60], 1
mov dword [0x599c64], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
cmp edx, eax
je 0x48b851
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_chdir
test eax, eax
je 0x48b80e
mov dword [esp], str.cannot_come_back_to_cwd
call fcn.00489755
mov dword [esp], eax
call fcn.004b5614
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.004cea94
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
cmp edx, eax
cmovge eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004895f3
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0042a880
jmp 0x48b865
mov dword [esp + 4], 0
mov dword [esp], 0x5af2fc
call fcn.0042a880
mov eax, 0
leave
ret
Function at 0x49314c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x493185
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
jmp 0x49318a
mov eax, 0
leave
ret

Function at 0x493b3a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
jne 0x493b5c
mov dword [esp], 0x5b0330
call fcn.004b54c7
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00491ad1
test eax, eax
jne 0x493ce5
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
call fcn.004bb7ad
mov dword [ebp - 0x20], eax
mov dword [esp], 0x5b0355
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x493c87
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x493c87
lea eax, [ebp - 0xe8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x493c87
mov eax, dword [ebp - 0xe8]
test eax, eax
jne 0x493c10
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xdc]
mov ebx, eax
xor bh, 0
mov dword [ebp - 0xf0], ebx
mov eax, edx
xor ah, 0
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0xf0]
mov ebx, dword [ebp - 0xec]
mov eax, ebx
or eax, ecx
test eax, eax
je 0x493c87
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x493c87
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0xe8]
cmp edx, eax
jne 0x493c87
mov ecx, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], edx
mov eax, ecx
xor eax, dword [ebp - 0xf0]
mov esi, eax
mov eax, ebx
xor eax, dword [ebp - 0xec]
mov edi, eax
mov eax, edi
or eax, esi
test eax, eax
jne 0x493c87
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00491a01
jmp 0x493c99
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00491a01
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [ebp - 0x1c], eax
jae 0x493cda
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
sub eax, 1
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0049177c
test eax, eax
jne 0x493cda
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004919a5
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00491a01
nop
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x49e0d0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_rmdir
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49e0ef
call fcn.0049e0bb
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x49eeb8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.0049ebee
mov dword [ebp - 0x10], eax
mov dword [esp], str.TMPDIR
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49eee2
mov dword [ebp - 0xc], str._tmp
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0x18]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5b16d5
mov dword [esp], edx
call fcn.00492911
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004bb1cd
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
test eax, eax
jns 0x49ef44
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049ecdb
mov eax, 0
jmp 0x49ef52
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049ec54
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x49f6cb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x61d2e4
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
cmp al, 0x22
je 0x49f70e
mov dword [esp + 4], 0x3a
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x49f75c
mov dword [esp + 4], 0x22
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0049f51c
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0045808e
mov dword [esp + 4], 0x22
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0049f51c
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49f793
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5b18c0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0049632d
jmp 0x49f7c3
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x3a
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_c_s
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0049632d
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00491cd8
nop
leave
ret
Function at 0x4a015b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 8]
and eax, 1
test al, al
je 0x4a017a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
jmp 0x4a0323
cmp dword [ebp + 0xc], 0
jne 0x4a018f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
jmp 0x4a0192
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a01d6
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movzx eax, al
test eax, eax
je 0x4a01d6
mov dword [esp + 4], 0x5b1a7a
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x4a01d6
mov dword [esp + 4], 0x5b1a7c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcasecmp
test eax, eax
jne 0x4a01e5
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
jmp 0x4a0310
mov dword [esp + 4], 0x5b1a82
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x4a0213
mov dword [esp + 4], 0x5b1a84
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcasecmp
test eax, eax
jne 0x4a0222
mov eax, dword [ebp + 8]
mov dword [eax + 4], 2
jmp 0x4a0310
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strlen
cmp eax, 1
jne 0x4a0262
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str._________AA__A__________________]
movzx eax, al
and eax, 2
test eax, eax
je 0x4a0262
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_atoi
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
jmp 0x4a0310
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004a0123
test eax, eax
je 0x4a02e0
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0x209
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll__open64
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4a02c8
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.could_not_open__s_for_tracing:__s
call fcn.004b57fa
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004a0358
jmp 0x4a0310
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 8]
or edx, 2
mov byte [eax + 8], dl
jmp 0x4a0310
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.unknown_trace_value_for__s:__s_n_________If_you_want_to_trace_into_a_file__then_please_set__s_n_________to_an_absolute_pathname__starting_with___
call fcn.004b57fa
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004a0358
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 8]
or edx, 1
mov byte [eax + 8], dl
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
leave
ret
Function at 0x4a29be
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.004a27ce
test eax, eax
jle 0x4a2a32
mov eax, dword [0x61d3bc]
mov dword [ebp - 0xc], eax
jmp 0x4a2a27
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4a2a23
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x4a2a23
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004a1e12
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x4a29d7
jmp 0x4a2a33
nop
leave
ret

Function at 0x4a2bb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_TRACE2_PARENT_NAME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0x599d1c
call fcn.004a2a93
cmp dword [ebp - 0xc], 0
je 0x4a2c10
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x4a2c10
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x599d1c
call fcn.004a2b86
mov dword [esp + 4], 0x2f
mov dword [esp], 0x599d1c
call fcn.004a2b2a
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x599d1c
call fcn.004a2b86
mov eax, dword [0x599d24]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], str.GIT_TRACE2_PARENT_NAME
call sub.cygwin1.dll_setenv
nop
leave
ret

Function at 0x4a33e2
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.cygwin1.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4a3416
mov eax, 0xffffffff
jmp 0x4a348b
mov word [ebp - 0x7e], 1
mov dword [esp + 8], 0x6c
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x7e]
add eax, 2
mov dword [esp], eax
call sub.cygwin1.dll_strlcpy
mov dword [esp + 8], 0x6e
lea eax, [ebp - 0x7e]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_connect
cmp eax, 0xffffffff
jne 0x4a347e
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_close
call sub.cygwin1.dll___errno
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, 0xffffffff
jmp 0x4a348b
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x4a3b5a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x599d30]
test eax, eax
jne 0x4a3c11
mov dword [esp], str.GIT_TRACE2_PARENT_SID
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a3bed
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test al, al
je 0x4a3bed
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x4a3baf
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2f
jne 0x4a3bab
mov eax, dword [0x61d3cc]
add eax, 1
mov dword [0x61d3cc], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x4a3b94
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x599d2c
call fcn.004a39df
mov dword [esp + 4], 0x2f
mov dword [esp], 0x599d2c
call fcn.004a3983
mov eax, dword [0x61d3cc]
add eax, 1
mov dword [0x61d3cc], eax
call fcn.004a3a09
mov eax, dword [0x599d34]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], str.GIT_TRACE2_PARENT_SID
call sub.cygwin1.dll_setenv
jmp 0x4a3c12
nop
leave
ret

Function at 0x4a3d12
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0xa
jbe 0x4a3d41
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.tr2_sysenv_get_invalid_var__d
mov dword [esp + 4], 0x64
mov dword [esp], str.trace2_tr2_sysenv.c
call fcn.004b58e7
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x599d40
movzx eax, byte [eax + 0xc]
and eax, 1
test al, al
jne 0x4a3dc2
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x599d40
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a3dad
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x4a3dad
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x599d48
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004ba79d
mov edx, dword [ebp + 8]
shl edx, 4
add edx, 0x599d48
mov dword [edx], eax
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x599d40
movzx edx, byte [eax + 0xc]
or edx, 1
mov byte [eax + 0xc], dl
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x599d48
mov eax, dword [eax]
leave
ret
Function at 0x4aaa6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0x61d2e4
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x38], 0x61d2e4
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.004aaf5e
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4aaaf4
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp + 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4aab18
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x4aab18
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.cygwin1.dll_fputc
mov dword [ebp - 0xc], 0
jmp 0x4aac40
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax]
movzx eax, byte [0x5993d0]
cmp dl, al
je 0x4aac3b
mov eax, dword [0x599fe8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004aa05e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4aabe0
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.004aa103
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4aaba3
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004aa97a
mov dword [esp + 4], 0
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.00491d0b
mov ebx, eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.00491d0b
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004aa242
jmp 0x4aac3c
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4aac3c
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004a8b8d
mov dword [esp + 4], 0x5b2bdd
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004a8bb7
mov dword [esp + 4], 0
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.00491d0b
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004aa242
jmp 0x4aac3c
nop
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
jb 0x4aab24
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.004ab1fc
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
leave
ret