joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor ecx, ecx
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x8c
mov edi, dword [esp + 0xa4]
mov dword [esp + 0x20], 0x47f45c
mov dword [esp + 0x3c], 0
mov esi, dword [esp + 0xa0]
movzx edx, byte [edi + 0x19]
mov ebx, dword [edi + 0x28]
mov dword [esp + 0x24], edi
mov dword [esp + eax + 0x40], ecx
add eax, 4
cmp eax, 0x20
jb 0x43fcb7
mov dword [esp + 0x6c], ebx
lea eax, [esp + 0x20]
lea ebx, [esp + 0x28]
movzx edx, dl
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0x7fffffff
mov dword [esp + 0x70], 0x80000000
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
call fcn.004422c0
mov edx, dword [edi + 0x30]
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], edx
mov edx, dword [edi + 0x34]
mov dword [esp + 0x78], edx
mov edx, dword [esi]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [edx + 0x28]
mov ebp, eax
test eax, eax
je 0x43fdc0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x40]
cmp dword [esp + 0x30], eax
je 0x43fde0
sub ebx, ebp
add ebx, dword [esp + 0x34]
test ebx, ebx
jle 0x43fd72
mov eax, dword [esp + 0x3c]
mov edx, dword [eax]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [edx + 0xc]
add dword [esp + 0x68], ebx
mov eax, dword [esp + 0x64]
cmp eax, 1
je 0x43fdd0
cmp ebp, dword [esp + 0x28]
jbe 0x43fd93
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43fdc0
sub ebp, dword [esp + 0x2c]
cmp ebp, dword [esp + 0x38]
jg 0x43fdc0
add eax, 1
mov dword [edi + 0x14], eax
test byte [esp + 0xa8], 2
jne 0x43fdaf
mov eax, dword [esi]
mov eax, dword [eax + 0x14]
cmp eax, 0x466fa0
jne 0x43fdf0
add esp, 0x8c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x8c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [edi + 0x18], 1
jmp 0x43fd99
add ebx, 0x10
sub ebx, ebp
jmp 0x43fd5a
mov dword [esp], esi
call eax
test al, al
mov byte [esp + 0x1f], al
jne 0x43fdaf
mov dword [esp], esi
call fcn.0043fa40
movzx eax, byte [esp + 0x1f]
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x463d30
Capabilities:
Resolve dns

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov edi, dword [esp + 0x30]
mov esi, dword [edi + 0x3c]
mov ebx, dword [edi + 0x38]
mov dword [edi], fcn.00463d30
cmp esi, ebx
je 0x463d6e
lea esi, [esi]
mov eax, dword [ebx]
lea edx, [eax - 0xc]
cmp eax, method.std::string.swap_std::string_
jne 0x463da8
add ebx, 0xc
cmp esi, ebx
jne 0x463d58
mov ebx, dword [edi + 0x38]
test ebx, ebx
je 0x463d83
mov eax, dword [edi + 0x40]
mov dword [esp], ebx
sub eax, ebx
mov dword [esp + 4], eax
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov eax, dword [edi + 0x28]
lea edx, [eax - 0xc]
cmp eax, method.std::string.swap_std::string_
jne 0x463dd0
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x463df0
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x463d64
lea eax, [esp + 0x1b]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00451180
jmp 0x463d64
mov ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x463d90
lea eax, [esp + 0x1b]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00451180
jmp 0x463d90
call sub.cygwin1.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x463e00
Capabilities:
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x3c], edx
xor edx, edx
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov dword [eax], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
call sub.cygwin1.dll_getaddrinfo
test eax, eax
jne 0x463e5a
mov eax, dword [esp + 0x3c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x463e55
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.cygwin1.dll___stack_chk_fail
mov dword [esp], 0x10
mov ebx, eax
call sub.cygstdc_6.dll___cxa_allocate_exception
mov dword [esp], ebx
mov dword [esp + 0x18], eax
call sub.cygwin1.dll_gai_strerror
mov edi, eax
test esi, esi
je 0x463f4a
lea eax, [esp + 0x2b]
lea ebx, [esp + 0x38]
mov dword [esp + 4], str.Bad_IP_address__
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00467290
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00451158
mov edx, dword [eax]
lea esi, [esp + 0x34]
mov dword [esp + 0x34], edx
mov dword [eax], method.std::string.swap_std::string_
mov dword [esp + 4], 0x477af0
mov dword [esp], esi
call fcn.00451158
mov edx, dword [eax]
mov dword [esp + 0x30], edx
mov dword [eax], method.std::string.swap_std::string_
mov dword [esp + 4], edi
lea edi, [esp + 0x30]
mov dword [esp], edi
call fcn.00451158
mov edx, dword [eax]
lea ebp, [esp + 0x2c]
mov dword [esp + 0x2c], edx
mov dword [eax], method.std::string.swap_std::string_
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00462400
mov dword [esp], ebp
call fcn.004510f0
mov dword [esp], edi
call fcn.004510f0
mov dword [esp], esi
call fcn.004510f0
mov dword [esp], ebx
call fcn.004510f0
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x462650
mov dword [esp + 4], 0x47df0c
mov dword [esp], eax
call sub.cygstdc_6.dll___cxa_throw
mov esi, eax
jmp 0x463f7a
mov esi, str._null_
jmp 0x463e7e
mov dword [esp], ebp
call fcn.004510f0
mov ebp, dword [esp + 0x1c]
mov dword [esp], edi
call fcn.004510f0
mov dword [esp], esi
mov esi, ebp
call fcn.004510f0
mov dword [esp], ebx
call fcn.004510f0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sub.cygstdc_6.dll___cxa_free_exception
mov dword [esp], esi
call sub.cyggcc_s_1.dll__Unwind_Resume
mov dword [esp + 0x1c], eax
jmp 0x463f54
Function at 0x464230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x24]
cmp eax, method.std::string.swap_std::string_
jne 0x4642a8
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x464263
mov edx, dword [ebx + 0x20]
mov dword [esp], eax
sub edx, eax
mov dword [esp + 4], edx
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov eax, dword [ebx + 0x14]
lea edx, [eax - 0xc]
cmp eax, method.std::string.swap_std::string_
jne 0x4642d0
mov eax, dword [ebx + 4]
test eax, eax
je 0x464288
mov edx, dword [ebx + 0xc]
mov dword [esp], eax
sub edx, eax
mov dword [esp + 4], edx
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov eax, dword [ebx]
lea edx, [eax - 0xc]
cmp eax, method.std::string.swap_std::string_
jne 0x4642f0
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x464310
add esp, 0x28
pop ebx
ret
mov ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x46424b
lea edx, [eax - 0xc]
lea eax, [esp + 0x1b]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00451180
jmp 0x46424b
mov ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x464270
lea eax, [esp + 0x1b]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00451180
jmp 0x464270
mov ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x464294
lea eax, [esp + 0x1b]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00451180
jmp 0x464294
call sub.cygwin1.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x464320
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ecx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
cmp edx, 0xffffffff
jne 0x464341
mov edx, dword [eax + 0x38]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 3
cmp edx, eax
jae 0x46440e
lea ebx, [ecx + edx*8]
mov eax, dword [ebx + 4]
test eax, eax
je 0x464380
mov eax, dword [eax + 4]
cmp eax, 1
jne 0x464380
mov eax, dword [ebx]
mov edx, dword [esp + 0x1c]
sub edx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x464409
add esp, 0x24
pop ebx
pop esi
ret
mov edx, dword [ebx]
lea eax, [esp + 0x13]
mov dword [esp + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.00467640
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], 0
mov esi, dword [ebx + 4]
mov dword [esp + 0x18], 0
mov dword [ebx], eax
mov dword [ebx + 4], edx
test esi, esi
je 0x464367
lock sub dword [esi + 4], 1
je 0x4643f0
mov esi, dword [esp + 0x18]
test esi, esi
je 0x464365
lock sub dword [esi + 4], 1
jne 0x464365
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 8]
lock sub dword [esi + 8], 1
jne 0x464365
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0xc]
jmp 0x464365
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 8]
lock sub dword [esi + 8], 1
jne 0x4643c5
mov eax, dword [esi]
mov dword [esp], esi
call dword [eax + 0xc]
jmp 0x4643c5
call sub.cygwin1.dll___stack_chk_fail
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x4791c4
call fcn.00450fe0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x464430
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ecx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x58]
cmp edx, 0xffffffff
je 0x464560
cmp ebx, 0xffffffff
je 0x464568
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 3
cmp edx, eax
jae 0x464595
lea edi, [ecx + edx*8]
mov eax, dword [edi + 4]
test eax, eax
je 0x4644c0
mov eax, dword [eax + 4]
cmp eax, 1
jne 0x4644c0
mov ebp, dword [edi]
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
sub eax, edx
sar eax, 2
imul eax, eax, 0xaaaaaaab
cmp ebx, eax
jae 0x464581
lea eax, [ebx + ebx*2]
lea eax, [edx + eax*4]
mov edx, dword [esp + 0x2c]
sub edx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x46457c
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi]
mov dword [esp], 0x28
mov dword [esp + 0x1c], eax
call sub.cygwin1.dll___wrap__Znwj
mov dword [eax + 4], 1
lea ebp, [eax + 0x10]
mov esi, eax
mov dword [eax + 8], 1
mov dword [eax], 0x47f7d4
mov eax, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.00469a90
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x24], edx
mov dword [edi], ebp
mov dword [edi + 4], esi
test eax, eax
je 0x464487
lock sub dword [eax + 4], 1
jne 0x464485
mov edx, dword [eax]
mov dword [esp + 0x1c], eax
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [esp + 0x1c]
mov edx, 0xffffffff
lock xadd dword [eax + 8], edx
cmp edx, 1
jne 0x464485
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 0xc]
jmp 0x464485
mov edx, dword [eax + 0x38]
cmp ebx, 0xffffffff
jne 0x46456b
mov ebx, dword [eax + 0x34]
cmp edx, 0xffffffff
jne 0x464461
mov edx, dword [eax + 0x38]
jmp 0x464461
call sub.cygwin1.dll___stack_chk_fail
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x476ff0
call fcn.00450fe0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0x476ff0
call fcn.00450fe0
mov ebx, eax
mov dword [esp + 4], 0x28
mov dword [esp], esi
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4645d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov ebp, dword [esp + 0x40]
mov edx, dword [ebp + 0x48]
test edx, edx
je 0x464602
mov eax, dword [ebp + 0x58]
mov ecx, eax
sub ecx, edx
sub eax, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x46461a
mov edx, dword [ebp + 0x20]
mov dword [esp], eax
sub edx, eax
mov dword [esp + 4], edx
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x464632
mov edx, dword [ebp + 0x14]
mov dword [esp], eax
sub edx, eax
mov dword [esp + 4], edx
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov edi, dword [ebp + 4]
mov esi, dword [ebp]
cmp edi, esi
jne 0x464647
jmp 0x46467b
add esi, 8
cmp edi, esi
je 0x464678
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x464640
lock sub dword [ebx + 4], 1
jne 0x464640
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
lock sub dword [ebx + 8], 1
jne 0x464640
mov eax, dword [ebx]
add esi, 8
mov dword [esp], ebx
call dword [eax + 0xc]
cmp edi, esi
jne 0x464647
lea esi, [esi]
nop
mov esi, dword [ebp]
test esi, esi
je 0x464690
mov eax, dword [ebp + 8]
mov dword [esp], esi
sub eax, esi
mov dword [esp + 4], eax
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x4646a4
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.cygwin1.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x38]
call fcn.004143b0
mov eax, dword [ebx + 0x20]
call fcn.004143b0
mov eax, dword [esp + 0xc]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x4646e9
mov eax, dword [ebx + 8]
add esp, 0x18
pop ebx
jmp fcn.004143b0
call sub.cygwin1.dll___stack_chk_fail
nop
nop
Function at 0x469a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov ebx, dword [esi + 4]
sub ebx, dword [esi]
mov dword [esp + 0x18], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
je 0x469b90
cmp ebx, 0x7ffffff8
ja 0x469baa
mov dword [esp], ebx
call sub.cygwin1.dll___wrap__Znwj
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add ebx, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov edi, dword [esi + 4]
mov ebx, dword [esi]
cmp ebx, edi
je 0x469b68
mov esi, eax
jmp 0x469b39
cmp ecx, sym.imp.cygstdc_6.dll_std::string::_Rep::_S_empty_rep_storage
jne 0x469ba0
mov dword [esi], eax
mov eax, dword [ebx + 4]
add ebx, 0xc
add esi, 0xc
movzx edx, byte [ebx - 4]
mov dword [esi - 8], eax
movzx eax, byte [esi - 4]
and edx, 7
and eax, 0xfffffff8
or eax, edx
mov byte [esi - 4], al
cmp edi, ebx
je 0x469b70
mov eax, dword [ebx]
mov edx, dword [eax - 4]
lea ecx, [eax - 0xc]
lea ebp, [eax - 4]
test edx, edx
jns 0x469b08
lea eax, [esp + 0x2b]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.00451178
jmp 0x469b14
mov esi, dword [esp + 0x1c]
lea esi, [esi]
mov eax, dword [esp + 0x18]
mov dword [eax + 4], esi
mov eax, dword [esp + 0x2c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x469bb8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x1c], 0
jmp 0x469ae5
lock add dword [ebp], 1
jmp 0x469b14
test ebx, ebx
jns 0x469bb3
call fcn.00450fd0
call fcn.00451018
call sub.cygwin1.dll___stack_chk_fail
mov dword [esp], eax
call sub.cygstdc_6.dll___cxa_begin_catch
mov ebx, dword [esp + 0x1c]
cmp esi, ebx
je 0x469bda
mov dword [esp], ebx
add ebx, 0xc
call fcn.004510f0
jmp 0x469bc9
call sub.cygstdc_6.dll___cxa_rethrow
mov ebx, eax
call sub.cygstdc_6.dll___cxa_end_catch
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
mov edx, dword [edi + 8]
sub edx, eax
test eax, eax
je 0x469c01
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
Function at 0x469c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov edi, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x24], eax
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x3c], eax
xor eax, eax
mov eax, edi
sub eax, ecx
sar eax, 2
cmp eax, 0x1fffffff
je 0x469d6b
test eax, eax
mov edx, 1
cmovne edx, eax
xor ebx, ebx
add eax, edx
mov edx, dword [esp + 0x1c]
setb bl
sub edx, ecx
test ebx, ebx
jne 0x469d28
test eax, eax
jne 0x469d58
mov dword [esp + 0x20], 0
xor ebp, ebp
mov eax, dword [esp + 0x24]
lea ebx, [ebp + edx + 4]
sub edi, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ebp + edx], eax
lea eax, [ebx + edi]
mov dword [esp + 0x24], eax
test edx, edx
jg 0x469cd0
test edi, edi
jg 0x469d00
test ecx, ecx
jne 0x469cec
mov eax, dword [esp + 0x24]
mov dword [esi], ebp
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x3c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x469d77
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp], ebp
mov dword [esp + 0x28], ecx
call sub.cygwin1.dll_memmove
test edi, edi
mov ecx, dword [esp + 0x28]
jg 0x469d00
mov eax, dword [esi + 8]
mov dword [esp], ecx
sub eax, ecx
mov dword [esp + 4], eax
call sub.cygstdc_6.dll_operator_delete_void__unsigned_int_
jmp 0x469ca3
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 0x28], ecx
call fcn.004513c4
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x469ca3
jmp 0x469cec
mov ebx, 0x7ffffffc
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
call sub.cygwin1.dll___wrap__Znwj
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebp, eax
lea eax, [eax + ebx]
mov dword [esp + 0x20], eax
jmp 0x469c7e
mov ebx, 0x1fffffff
cmp eax, ebx
cmova eax, ebx
lea ebx, [eax*4]
jmp 0x469d2d
mov dword [esp], 0x4789cf
call fcn.00450ff0
call sub.cygwin1.dll___stack_chk_fail
nop
nop
nop
nop
Function at 0x46a3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x14], eax
mov edi, eax
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
cmp edx, ecx
je 0x46a4fb
mov edi, dword [edi + 4]
mov eax, edi
sub eax, edx
cmp edx, edi
je 0x46a4a3
mov ebp, eax
sar ebp, 3
test eax, eax
jle 0x46a4a3
mov dword [esp + 0x18], ecx
mov ebx, edx
mov esi, ecx
mov edi, ebp
mov dword [esp + 0x1c], edx
jmp 0x46a443
add ebx, 8
add esi, 8
sub edi, 1
je 0x46a490
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebx + 4], 0
mov ebp, dword [esi + 4]
mov dword [ebx], 0
mov dword [esi], eax
mov dword [esi + 4], ecx
test ebp, ebp
je 0x46a438
lock sub dword [ebp + 4], 1
jne 0x46a438
mov ecx, dword [ebp]
mov dword [esp], ebp
call dword [ecx + 8]
lock sub dword [ebp + 8], 1
jne 0x46a438
mov ecx, dword [ebp]
add ebx, 8
mov dword [esp], ebp
add esi, 8
call dword [ecx + 0xc]
sub edi, 1
jne 0x46a443
lea esi, [esi]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edi, dword [eax + 4]
mov eax, edi
sub eax, edx
lea ebp, [ecx + eax]
cmp ebp, edi
je 0x46a4fb
mov dword [esp + 0x18], ecx
mov esi, ebp
jmp 0x46a4bf
add esi, 8
cmp esi, edi
je 0x46a4f0
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x46a4b8
lock sub dword [ebx + 4], 1
jne 0x46a4b8
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 8]
lock sub dword [ebx + 8], 1
jne 0x46a4b8
mov eax, dword [ebx]
add esi, 8
mov dword [esp], ebx
call dword [eax + 0xc]
cmp esi, edi
jne 0x46a4bf
lea esi, [esi]
nop
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax + 4], ebp
mov eax, dword [esp + 0x2c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x46a511
add esp, 0x3c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.cygwin1.dll___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x46a5c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
sub eax, edi
sar eax, 3
cmp eax, 0xfffffff
je 0x46a6f9
test eax, eax
mov ecx, 1
cmovne ecx, eax
add eax, ecx
setb cl
movzx ecx, cl
mov esi, ecx
mov ecx, ebx
sub ecx, edi
test esi, esi
jne 0x46a6c0
test eax, eax
jne 0x46a6e6
mov dword [esp + 0x14], 0
mov esi, 8
xor ebp, ebp
mov eax, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp + ecx + 4], edx
mov dword [ebp + ecx], eax
cmp ebx, edi
je 0x46a675
mov esi, ebx
mov dword [esp + 0x1c], edi
mov edx, dword [esp + 0x10]
mov ecx, ebp
sub esi, edi
mov eax, edi
mov dword [esp + 0x18], esi
lea esi, [esi]
nop
mov esi, dword [eax]
mov edi, dword [eax + 4]
add eax, 8
add ecx, 8
mov dword [ecx - 8], esi
mov dword [ecx - 4], edi
cmp eax, ebx
jne 0x46a650
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
lea esi, [ebp + esi + 8]
mov edx, dword [esp + 0x10]
cmp ebx, edx
je 0x46a699
sub edx, ebx
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp + 0x10], edx
call fcn.004513c4
mov edx, dword [esp + 0x10]
add esi, edx
test edi, edi
je 0x46a6a5
mov dword [esp], edi
call fcn.004512c4
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x14]
mov dword [eax], ebp
mov dword [eax + 4], esi
mov dword [eax + 8], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x7ffffff8
mov dword [esp], esi
mov dword [esp + 0x18], ecx
call sub.cygwin1.dll___wrap__Znwj
mov ecx, dword [esp + 0x18]
mov ebp, eax
lea eax, [eax + esi]
mov dword [esp + 0x14], eax
lea esi, [ebp + 8]
jmp 0x46a61f
mov esi, 0xfffffff
cmp eax, esi
cmova eax, esi
lea esi, [eax*8]
jmp 0x46a6c5
mov dword [esp], 0x47b969
call fcn.00450ff0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop