joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48bc94
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x48bccd
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
jmp 0x48bcd2
mov eax, 0
leave
ret

Function at 0x48c682
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
jne 0x48c6a4
mov dword [esp], 0x5b1d88
call fcn.004ae00f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0048a619
test eax, eax
jne 0x48c82d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
call fcn.004b5211
mov dword [ebp - 0x20], eax
mov dword [esp], 0x5b1dad
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x48c7cf
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x48c7cf
lea eax, [ebp - 0xe8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x48c7cf
mov eax, dword [ebp - 0xe8]
test eax, eax
jne 0x48c758
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xdc]
mov ebx, eax
xor bh, 0
mov dword [ebp - 0xf0], ebx
mov eax, edx
xor ah, 0
mov dword [ebp - 0xec], eax
mov ecx, dword [ebp - 0xf0]
mov ebx, dword [ebp - 0xec]
mov eax, ebx
or eax, ecx
test eax, eax
je 0x48c7cf
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x48c7cf
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0xe8]
cmp edx, eax
jne 0x48c7cf
mov ecx, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], edx
mov eax, ecx
xor eax, dword [ebp - 0xf0]
mov esi, eax
mov eax, ebx
xor eax, dword [ebp - 0xec]
mov edi, eax
mov eax, edi
or eax, esi
test eax, eax
jne 0x48c7cf
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048a549
jmp 0x48c7e1
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048a549
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp dword [ebp - 0x1c], eax
jae 0x48c822
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
sub eax, 1
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0048a2c4
test eax, eax
jne 0x48c822
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048a4ed
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048a549
nop
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x496c18
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_rmdir
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x496c37
call fcn.00496c03
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x497a00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.00497736
mov dword [ebp - 0x10], eax
mov dword [esp], str.TMPDIR
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x497a2a
mov dword [ebp - 0xc], str._tmp
mov eax, dword [ebp - 0x10]
lea edx, [eax + 0x18]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5b312d
mov dword [esp], edx
call fcn.0048b459
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b4c31
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
test eax, eax
jns 0x497a8c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00497823
mov eax, 0
jmp 0x497a9a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0049779c
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x498213
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x62f624
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
cmp al, 0x22
je 0x498256
mov dword [esp + 4], 0x3a
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x4982a4
mov dword [esp + 4], 0x22
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00498064
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.00450c52
mov dword [esp + 4], 0x22
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00498064
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4982db
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5b3318
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048ee75
jmp 0x49830b
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x3a
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_c_s
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048ee75
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0048a820
nop
leave
ret
Function at 0x498ca3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 8]
and eax, 1
test al, al
je 0x498cc2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
jmp 0x498e6b
cmp dword [ebp + 0xc], 0
jne 0x498cd7
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
jmp 0x498cda
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x498d1e
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movzx eax, al
test eax, eax
je 0x498d1e
mov dword [esp + 4], 0x5b34ca
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x498d1e
mov dword [esp + 4], 0x5b34cc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcasecmp
test eax, eax
jne 0x498d2d
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
jmp 0x498e58
mov dword [esp + 4], 0x5b34d2
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x498d5b
mov dword [esp + 4], 0x5b34d4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcasecmp
test eax, eax
jne 0x498d6a
mov eax, dword [ebp + 8]
mov dword [eax + 4], 2
jmp 0x498e58
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strlen
cmp eax, 1
jne 0x498daa
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movzx eax, al
movzx eax, byte [eax + str._________AA__A__________________]
movzx eax, al
and eax, 2
test eax, eax
je 0x498daa
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_atoi
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
jmp 0x498e58
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00498c6b
test eax, eax
je 0x498e28
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0x209
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll__open64
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x498e10
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.could_not_open__s_for_tracing:__s
call fcn.004ae342
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00498ea0
jmp 0x498e58
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 8]
or edx, 2
mov byte [eax + 8], dl
jmp 0x498e58
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.unknown_trace_value_for__s:__s_n_________If_you_want_to_trace_into_a_file__then_please_set__s_n_________to_an_absolute_pathname__starting_with___
call fcn.004ae342
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00498ea0
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 8]
or edx, 1
mov byte [eax + 8], dl
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
leave
ret
Function at 0x49b506
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call fcn.0049b316
test eax, eax
jle 0x49b57a
mov eax, dword [0x62f6fc]
mov dword [ebp - 0xc], eax
jmp 0x49b56f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x49b56b
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x49b56b
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0049a95a
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x49b51f
jmp 0x49b57b
nop
leave
ret

Function at 0x49b6f8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_TRACE2_PARENT_NAME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0x59bdac
call fcn.0049b5db
cmp dword [ebp - 0xc], 0
je 0x49b758
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x49b758
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x59bdac
call fcn.0049b6ce
mov dword [esp + 4], 0x2f
mov dword [esp], 0x59bdac
call fcn.0049b672
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x59bdac
call fcn.0049b6ce
mov eax, dword [0x59bdb4]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], str.GIT_TRACE2_PARENT_NAME
call sub.cygwin1.dll_setenv
nop
leave
ret

Function at 0x49bf2a
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.cygwin1.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x49bf5e
mov eax, 0xffffffff
jmp 0x49bfd3
mov word [ebp - 0x7e], 1
mov dword [esp + 8], 0x6c
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x7e]
add eax, 2
mov dword [esp], eax
call sub.cygwin1.dll_strlcpy
mov dword [esp + 8], 0x6e
lea eax, [ebp - 0x7e]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_connect
cmp eax, 0xffffffff
jne 0x49bfc6
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_close
call sub.cygwin1.dll___errno
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, 0xffffffff
jmp 0x49bfd3
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
leave
ret
Function at 0x49c6a2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59bdc0]
test eax, eax
jne 0x49c759
mov dword [esp], str.GIT_TRACE2_PARENT_SID
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x49c735
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test al, al
je 0x49c735
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jmp 0x49c6f7
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x2f
jne 0x49c6f3
mov eax, dword [0x62f70c]
add eax, 1
mov dword [0x62f70c], eax
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x49c6dc
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x59bdbc
call fcn.0049c527
mov dword [esp + 4], 0x2f
mov dword [esp], 0x59bdbc
call fcn.0049c4cb
mov eax, dword [0x62f70c]
add eax, 1
mov dword [0x62f70c], eax
call fcn.0049c551
mov eax, dword [0x59bdc4]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], str.GIT_TRACE2_PARENT_SID
call sub.cygwin1.dll_setenv
jmp 0x49c75a
nop
leave
ret

Function at 0x49c85a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0xa
jbe 0x49c889
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.tr2_sysenv_get_invalid_var__d
mov dword [esp + 4], 0x64
mov dword [esp], str.trace2_tr2_sysenv.c
call fcn.004ae42f
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x59bde0
movzx eax, byte [eax + 0xc]
and eax, 1
test al, al
jne 0x49c90a
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x59bde0
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49c8f5
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x49c8f5
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x59bde8
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004b4201
mov edx, dword [ebp + 8]
shl edx, 4
add edx, 0x59bde8
mov dword [edx], eax
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x59bde0
movzx edx, byte [eax + 0xc]
or edx, 1
mov byte [eax + 0xc], dl
mov eax, dword [ebp + 8]
shl eax, 4
add eax, 0x59bde8
mov eax, dword [eax]
leave
ret
Function at 0x4a35b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2c], 0x62f624
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x38], 0x62f624
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.004a3aa6
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a363c
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp + 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a3660
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x4a3660
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.cygwin1.dll_fputc
mov dword [ebp - 0xc], 0
jmp 0x4a3788
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx edx, byte [eax]
movzx eax, byte [0x59b450]
cmp dl, al
je 0x4a3783
mov eax, dword [0x59c088]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004a2ba6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x4a3728
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.004a2c4b
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4a36eb
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004a34c2
mov dword [esp + 4], 0
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0048a853
mov ebx, eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.0048a853
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004a2d8a
jmp 0x4a3784
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
test eax, eax
jne 0x4a3784
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004a16d5
mov dword [esp + 4], 0x5b462d
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004a16ff
mov dword [esp + 4], 0
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0048a853
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004a2d8a
jmp 0x4a3784
nop
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xc], eax
jb 0x4a366c
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.004a3d44
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4a6956
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59c1e0]
test eax, eax
jns 0x4a69bf
mov dword [esp], str.GIT_ALLOW_PROTOCOL
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a69b5
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x3a
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x59c1e4
call fcn.0048eb5c
mov dword [esp], 0x59c1e4
call fcn.0048e9d5
mov dword [0x59c1e0], 1
jmp 0x4a69bf
mov dword [0x59c1e0], 0
mov eax, dword [0x59c1e0]
test eax, eax
je 0x4a69cf
mov eax, 0x59c1e4
jmp 0x4a69d4
mov eax, 0
leave
ret

Function at 0x4adfd6
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x59c204]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x5b56e9
call fcn.004adfd6

Function at 0x4ae00f
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59c218]
call eax
test eax, eax
je 0x4ae06c
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x29
mov dword [esp + 4], 1
mov dword [esp], str.fatal:_recursion_detected_in_die_handler_n
call sub.cygwin1.dll_fwrite
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0xb1
mov dword [esp], str.usage.c
call fcn.00499d7f
mov dword [esp], eax
call sub.cygwin1.dll_exit
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x59c208]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax

Function at 0x4ae15c
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x420
mov eax, dword [0x59c218]
call eax
test eax, eax
je 0x4ae1be
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2f
mov dword [esp + 4], 1
mov dword [esp], str.fatal:_recursion_detected_in_die_errno_handler_n
call sub.cygwin1.dll_fwrite
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0xd9
mov dword [esp], str.usage.c
call fcn.00499d7f
mov dword [esp], eax
call sub.cygwin1.dll_exit
lea eax, [ebp + 0xc]
mov dword [ebp - 0x40c], eax
mov ebx, dword [0x59c208]
mov esi, dword [ebp - 0x40c]
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x408]
mov dword [esp], eax
call fcn.004ae086
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
Function at 0x4ae365
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.BUG:__s:_d:
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.cygwin1.dll_snprintf
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x108]
mov dword [esp], eax
call fcn.004adc7c
mov eax, dword [0x62f7e8]
test eax, eax
je 0x4ae3cd
call sub.cygwin1.dll_abort
mov dword [0x62f7e8], 1
mov eax, dword [ebp - 0x10c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x136
mov dword [esp], str.usage.c
call fcn.00499e6c
mov eax, dword [0x62f7e0]
test eax, eax
je 0x4ae42a
mov eax, dword [0x62f7e0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x139
mov dword [esp], str.usage.c
call fcn.00499d7f
mov dword [esp], eax
call sub.cygwin1.dll_exit
call sub.cygwin1.dll_abort

Function at 0x4b5405
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_gethostname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b5434
mov eax, dword [ebp + 0xc]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4b5550
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
cmp dword [ebp + 8], eax
jne 0x4b5602
mov eax, dword [0x59c220]
test eax, eax
jns 0x4b55ea
mov dword [esp], str.GIT_FLUSH
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b55a2
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x59c220], eax
jmp 0x4b55ea
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fileno
lea edx, [ebp - 0x70]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll__fstat64
test eax, eax
jne 0x4b55e0
mov eax, dword [ebp - 0x60]
and eax, 0xf000
cmp eax, 0x8000
jne 0x4b55e0
mov dword [0x59c220], 1
jmp 0x4b55ea
mov dword [0x59c220], 0
mov eax, dword [0x59c220]
test eax, eax
je 0x4b5602
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0xc]
cwde
and eax, 0x40
test eax, eax
je 0x4b5633
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
test eax, eax
je 0x4b5634
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0047ff85
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.write_failure_on__s
call fcn.004ae15c
nop
leave
ret
Function at 0x4b57b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
cmp dword [ebp + 0x10], eax
je 0x4b57e8
mov dword [esp], str.fwrite_error
call fcn.004ae15c
nop
leave
ret