Function at 0x6109ab00
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x6112e534
push esi
push ebx
sub esp, 0x12c
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x104], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x100], eax
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109ab3d
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6109ab48
test al, al
jne 0x6109ab2e
mov eax, 1
jmp 0x6109ab4a
xor eax, eax
test eax, eax
je 0x6109ab70
mov ecx, dword [ebp - 0x104]
test byte [ecx + 0x20], 0x40
je 0x6109ab70
lea esi, [esi]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, str..bat
mov esi, edx
mov edi, ecx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109ab8e
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6109ab99
test al, al
jne 0x6109ab7f
mov eax, 1
jmp 0x6109ab9b
xor eax, eax
test eax, eax
jne 0x6109ab60
mov eax, dword [ebp - 0x104]
add eax, 0x50
mov dword [ebp - 0x114], eax
cmp byte [edx], 0
jne 0x6109ad7b
mov eax, dword [ebp - 0x104]
sub edx, 4
add eax, 0x50
cmp edx, eax
jbe 0x6109ad7b
mov esi, edx
mov edi, ecx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109abe4
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6109abef
test al, al
jne 0x6109abd5
mov eax, 1
jmp 0x6109abf1
xor eax, eax
test eax, eax
jne 0x6109ab60
mov edi, str..cmd
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109ac15
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6109ac20
test al, al
jne 0x6109ac06
mov eax, 1
jmp 0x6109ac22
xor eax, eax
test eax, eax
jne 0x6109ab60
mov edi, str..btm
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109ac46
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6109ac51
test al, al
jne 0x6109ac37
mov eax, 1
jmp 0x6109ac53
xor eax, eax
test eax, eax
je 0x6109ad7b
jmp 0x6109ab60
mov edx, dword fs:[4]
mov eax, dword [ebp - 0x28]
sub edx, 0x319c
mov dword [edx + 0xc30], eax
mov eax, dword [ebp - 0x24]
mov dword [edx + 0xc34], eax
test byte [0x6110a820], 1
jne 0x6109af00
cmp byte [edi], 0x23
je 0x6109af40
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
sub esp, 4
mov esi, dword [ebp + 0x14]
mov edi, str..com
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109acbd
xor al, byte [eax + 0x61106b3c]
cmp al, byte [edi - 1]
jne 0x6109acc8
test al, al
jne 0x6109acae
mov eax, 1
jmp 0x6109acca
xor eax, eax
test eax, eax
jne 0x6109ab60
mov eax, 0x6112e54d
mov dword [ebp - 0x108], eax
xor eax, eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 4]
test eax, eax
jne 0x6109ad0b
mov eax, dword [ebp + 0xc]
call sym._cstrdup1_4
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx]
mov dword [ecx + 4], 1
mov dword [edx], eax
mov edi, dword [ebp - 0x10c]
test edi, edi
je 0x6109ad33
xor esi, esi
mov ecx, dword [ebp - 0x100]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0x10c]
mov dword [esp], ecx
mov dword [esp + 4], edx
call method.av.unshift_char_const__int_
mov dword [esp], 2
lea eax, [ebp + 0x14]
mov edx, dword [ebp - 0x104]
mov dword [esp + 4], eax
mov ecx, 0x6112e555
mov ebx, 1
mov eax, dword [ebp - 0x108]
call sym.__Z9find_execPKcR9path_convS0_jPS0__20
sub esp, 8
mov edx, dword [ebp - 0x100]
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x114]
mov dword [esp], edx
mov dword [esp + 4], eax
call method.av.unshift_char_const__int_
xor edi, edi
xor esi, esi
mov eax, 0x61107420
mov dword [ebp - 0x108], edi
xor ebx, ebx
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x10c], esi
mov edx, 3
mov dword [esp + 0xc], eax
mov eax, 3
mov dword [esp + 8], eax
mov eax, 0x80000000
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x114]
mov dword [esp], ecx
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebx, eax
je 0x6109b05a
mov dword [esp], ebx
xor eax, eax
mov esi, 0x61107420
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, 2
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
call sub.KERNEL32.dll_CreateFileMappingA
sub esp, 0x18
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test esi, esi
je 0x6109b015
mov dword [esp], esi
xor eax, eax
xor ecx, ecx
mov dword [esp + 8], eax
xor edx, edx
mov eax, 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_MapViewOfFile
sub esp, 0x14
mov edi, eax
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test edi, edi
je 0x6109b05a
mov edx, dword fs:[4]
lea ecx, [ebp - 0xf8]
sub edx, 0x319c
mov eax, dword [edx + 0xc30]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0xc34]
mov dword [edx + 0xc30], ecx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [edx + 0xc34], eax
mov dword [esp], ecx
call sym.___sjfault
test eax, eax
jne 0x6109b076
cmp byte [edi], 0x4d
jne 0x6109ac60
cmp byte [edi + 1], 0x5a
je 0x6109b0ad
mov edx, dword fs:[4]
mov eax, dword [ebp - 0x28]
sub edx, 0x319c
mov dword [edx + 0xc30], eax
mov eax, dword [ebp - 0x24]
mov dword [edx + 0xc34], eax
test byte [0x6110a820], 1
jne 0x6109af00
cmp byte [edi], 0x23
je 0x6109af40
lea esi, [esi]
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0x108]
sub esp, 4
test eax, eax
jne 0x6109ace5
jmp 0x6109aca0
mov edx, dword [ebp - 0x114]
mov eax, str._s_is_possibly_a_script
mov dword [esp + 0xc], eax
mov eax, str.int_av::fixup_const_char__path_conv__const_char_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6110a820
call method.strace.prntf_unsigned_int__char_const__char_const__..._
cmp byte [edi], 0x23
jne 0x6109aee0
lea esi, [esi]
lea edi, [edi]
cmp byte [edi + 1], 0x21
lea esi, [edi + 2]
jne 0x6109aee0
mov dword [esp], esi
mov eax, 0x6112e573
mov ebx, 0x6112e576
mov dword [esp + 4], eax
call sym.cygwin1.dll__strspn
mov dword [esp + 4], ebx
add esi, eax
mov dword [esp], esi
call sym.cygwin1.dll__strcspn
mov dword [ebp - 0x110], eax
test eax, eax
je 0x6109aee0
add eax, 0x1f
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov ecx, dword [ebp - 0x110]
lea ebx, [esp + 0x2b]
and ebx, 0xfffffff0
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp + 8], ecx
mov dword [esp], ebx
call sym.cygwin1.dll__memcpy
mov eax, dword [ebp - 0x110]
mov byte [ebx + eax], 0
mov dword [ebp - 0x108], ebx
lea esi, [esi]
lea edi, [edi]
cmp byte [esi], 0
je 0x6109aee0
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x6109afd6
inc esi
jmp 0x6109afc0
movzx eax, byte [esi]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or dl, al
je 0x6109afd3
mov byte [esi], 0
lea ebx, [esi + 1]
mov edx, 0x6112e573
mov dword [esp], ebx
mov dword [esp + 4], edx
call sym.cygwin1.dll__strspn
add ebx, eax
cmp byte [ebx], 0
je 0x6109aee0
mov dword [ebp - 0x10c], ebx
mov esi, ebx
dec esi
inc esi
jmp 0x6109afc0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3ee
jne 0x6109b05a
test byte [0x6110a820], 1
je 0x6109aca0
mov dword [esp], 0x6110a820
mov ecx, str.zero_length_file__treat_as_script.
mov edx, str.int_av::fixup_const_char__path_conv__const_char_
mov dword [esp + 0xc], ecx
mov eax, 0x40
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6109aca0
mov eax, str._ext_build_netrel_src_cygwin_1.5.24_2_winsup_cygwin_spawn.cc
mov edx, 0x409
call sym.__Z8seterrnoPKci_8
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
mov edx, dword [ebp - 0x104]
sub esp, 4
and dword [edx + 0x20], 0xffffffbf
mov eax, dword fs:[4]
mov edx, dword [ebp - 0x28]
sub eax, 0x319c
mov dword [eax + 0xc30], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc34], edx
jmp 0x6109ab60
movzx edx, byte [edi + 0x19]
mov ecx, dword [ebp - 0x100]
movzx eax, byte [edi + 0x18]
shl edx, 8
or eax, edx
cmp eax, 0x3f
setbe al
test al, al
mov byte [ecx + 0xc], al
je 0x6109b0f6
mov eax, dword [ebp - 0x104]
and dword [eax + 0x20], 0xffffffbf
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
sub esp, 4
cmp word [ebp - 0xfa], 3
mov edx, dword [ebp - 0x100]
sete byte [edx + 0xd]
jmp 0x6109b08b
xor edx, edx
lea ecx, [ebp - 0xfa]
mov eax, edi
call sym.hook_or_detect_cygwin_char_const__void_const__unsigned_short_
test eax, eax
je 0x6109b0cd
mov ecx, dword [ebp - 0x104]
or dword [ecx + 0x20], 0x40
jmp 0x6109b0d7