joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4194df
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x84
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00445957
test eax, eax
je 0x419513
mov dword [esp], str.strange_hostname__s_blocked
call fcn.00416f8a
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ae00f
call fcn.00418ee0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x419539
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00419016
mov dword [ebp - 0x10], eax
jmp 0x419578
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0x40]
and edx, 0xffffffdf
mov byte [eax + 0x40], dl
mov dword [esp], str.GIT_SSH
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x419562
mov dword [ebp - 0xc], 0x5a47f0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00419016
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x419689
lea edx, [ebp - 0x60]
mov eax, 0
mov ecx, 0x14
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x60], 0x62f62c
mov dword [ebp - 0x54], 0x62f62c
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x40]
shr al, 5
and eax, 1
and eax, 1
shl eax, 5
mov edx, eax
movzx eax, byte [ebp - 0x20]
and eax, 0xffffffdf
or eax, edx
mov byte [ebp - 0x20], al
movzx eax, byte [ebp - 0x20]
or eax, 4
mov byte [ebp - 0x20], al
movzx eax, byte [ebp - 0x20]
shr al, 2
and eax, 1
and eax, 1
lea edx, [eax + eax]
movzx eax, byte [ebp - 0x20]
and eax, 0xfffffffd
or eax, edx
mov byte [ebp - 0x20], al
movzx eax, byte [ebp - 0x20]
shr al, 1
and eax, 1
and eax, 1
mov edx, eax
movzx eax, byte [ebp - 0x20]
and eax, 0xfffffffe
or eax, edx
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.0048ee3c
mov dword [esp + 4], 0x5a4bbd
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.0048ee3c
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
lea eax, [ebp - 0x60]
add eax, 0xc
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.00419300
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.0048ee3c
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.0047fb8c
test eax, eax
je 0x419681
mov eax, 1
jmp 0x419686
mov eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0048ee3c
mov eax, dword [ebp + 8]
lea ecx, [eax + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00419300
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0048ee3c
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x41b5b1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_TEST_DATE_NOW
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41b5e8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_atoi
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
jmp 0x41b5fb
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_gettimeofday
nop
leave
ret

Function at 0x4268e4
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x426905
mov eax, 0
jmp 0x42692e
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048ee3c
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x3fffffff
shl eax, 2
add eax, edx
mov eax, dword [eax]
leave
ret
Function at 0x426930
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov ecx, 0
mov eax, 0x18
and eax, 0xfffffffc
mov edx, eax
mov eax, 0
mov dword [ebp + eax - 0x28], ecx
add eax, 4
cmp eax, edx
jb 0x42694a
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 0x62f62c
mov dword [esp + 4], 0x5a61a9
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.004268e4
mov dword [ebp - 0x28], eax
mov dword [esp + 4], 0x5a60e7
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.004268e4
mov dword [ebp - 0x24], eax
mov dword [esp + 4], str.GIT_GRAFT_FILE
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.004268e4
mov dword [ebp - 0x20], eax
mov dword [esp + 4], str.GIT_INDEX_FILE
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.004268e4
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0x5a6094
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.004268e4
mov dword [ebp - 0x18], eax
mov dword [esp], 0x5a6235
call sub.cygwin1.dll_getenv
test eax, eax
je 0x4269f6
mov dword [ebp - 0x14], 1
mov eax, dword [0x62f280]
lea edx, [ebp - 0x28]
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004717e4
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.0048f067
mov dword [esp], str.GIT_NO_REPLACE_OBJECTS
call sub.cygwin1.dll_getenv
test eax, eax
je 0x426a36
mov dword [0x59b420], 0
mov dword [esp], str.GIT_REPLACE_REF_BASE
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov eax, dword [0x61e730]
mov dword [esp], eax
call sub.cygwin1.dll_free
cmp dword [ebp - 0xc], 0
je 0x426a5d
mov eax, dword [ebp - 0xc]
jmp 0x426a62
mov eax, str.refs_replace_
mov dword [esp], eax
call fcn.004b4201
mov dword [0x61e730], eax
mov eax, dword [0x61e75c]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov dword [esp], str.GIT_NAMESPACE
call sub.cygwin1.dll_getenv
mov dword [esp], eax
call fcn.004267b1
mov dword [0x61e75c], eax
mov dword [esp], str.GIT_SHALLOW_FILE
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x426ac6
mov eax, dword [0x62f280]
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00484efa
nop
leave
ret

Function at 0x42ab8c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.LANGUAGE
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42abb6
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42abb6
mov eax, dword [ebp - 0xc]
jmp 0x42ac15
mov dword [esp + 4], 0
mov dword [esp], 6
call sub.cygintl_8.dll_libintl_setlocale
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42ac10
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42ac10
mov dword [esp + 4], 0x5a6a19
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x42ac10
mov dword [esp + 4], str.POSIX
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
je 0x42ac10
mov eax, dword [ebp - 0xc]
jmp 0x42ac15
mov eax, 0
leave
ret
Function at 0x42acbb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_TEXTDOMAINDIR
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
jne 0x42acf2
mov dword [esp], str.share_locale
call fcn.004291e1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004c8aa8
test eax, eax
jne 0x42ad0e
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
jmp 0x42ad6c
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x5a6a54
call sub.cygintl_8.dll_libintl_bindtextdomain
mov dword [esp + 4], 0x5a6a21
mov dword [esp], 6
call sub.cygintl_8.dll_libintl_setlocale
mov dword [esp + 4], 0x5a6a21
mov dword [esp], 5
call sub.cygintl_8.dll_libintl_setlocale
mov dword [esp], 0x5a6a54
call fcn.0042ac4c
mov dword [esp], 0x5a6a54
call sub.cygintl_8.dll_libintl_textdomain
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
leave
ret

Function at 0x42ae61
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x811c9dc5
jmp 0x42ae7f
mov eax, dword [ebp - 4]
imul eax, eax, 0x1000193
xor eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
movzx eax, byte [eax]
movzx eax, al
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42ae70
mov eax, dword [ebp - 4]
leave
ret

Function at 0x42ae9c
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0x811c9dc5
jmp 0x42aeca
cmp dword [ebp - 4], 0x60
jbe 0x42aebb
cmp dword [ebp - 4], 0x7a
ja 0x42aebb
sub dword [ebp - 4], 0x20
mov eax, dword [ebp - 8]
imul eax, eax, 0x1000193
xor eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov dword [ebp + 8], edx
movzx eax, byte [eax]
movzx eax, al
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42aeab
mov eax, dword [ebp - 8]
leave
ret

Function at 0x42aee7
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x42af1d
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
movzx eax, byte [eax]
movzx eax, al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x1000193
xor eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [eax - 1]
mov dword [ebp + 0xc], edx
test eax, eax
jne 0x42aefc
mov eax, dword [ebp - 4]
leave
ret
Function at 0x42af2f
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x42af75
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
movzx eax, byte [eax]
movzx eax, al
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x60
jbe 0x42af66
cmp dword [ebp - 0xc], 0x7a
ja 0x42af66
sub dword [ebp - 0xc], 0x20
mov eax, dword [ebp - 4]
imul eax, eax, 0x1000193
xor eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edx, [eax - 1]
mov dword [ebp + 0xc], edx
test eax, eax
jne 0x42af44
mov eax, dword [ebp - 4]
leave
ret

Function at 0x42af87
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x42afcc
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov dword [ebp - 8], edx
movzx eax, byte [eax]
movzx eax, al
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x60
jbe 0x42afbd
cmp dword [ebp - 0xc], 0x7a
ja 0x42afbd
sub dword [ebp - 0xc], 0x20
mov eax, dword [ebp - 4]
imul eax, eax, 0x1000193
xor eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea edx, [eax - 1]
mov dword [ebp + 0x10], edx
test eax, eax
jne 0x42af9b
mov eax, dword [ebp - 4]
leave
ret

Function at 0x42bf52
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0xffffffff
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sub.cygwin1.dll_memset
mov dword [ebp - 0x2c], 2
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_getaddrinfo
test eax, eax
jne 0x42bff8
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x42bfed
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x42bfed
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x14]
mov dword [esp + 4], 0x2e
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x42bfed
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0042bd57
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sub.cygwin1.dll_freeaddrinfo
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x42c159
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x61e974]
and eax, 2
test eax, eax
jne 0x42c231
mov eax, dword [0x59b484]
test eax, eax
jne 0x42c231
mov dword [esp], str.EMAIL
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42c1ca
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42c1ca
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x59b480
call fcn.0042bd57
mov eax, dword [0x61e96c]
or eax, 2
mov dword [0x61e96c], eax
mov eax, dword [0x61e970]
or eax, 2
mov dword [0x61e970], eax
jmp 0x42c225
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x42c201
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x42c201
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x59b480
call fcn.0042bd57
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_free
jmp 0x42c225
mov dword [esp], 0x61e960
call fcn.0042bda5
mov dword [esp + 8], 0x61e960
mov dword [esp + 4], 0x59b480
mov dword [esp], eax
call fcn.0042c0bc
mov dword [esp], 0x59b480
call fcn.0048aa07
mov eax, dword [0x59b488]
leave
ret

Function at 0x42ca33
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 2
je 0x42ca7f
cmp dword [ebp + 8], 2
ja 0x42caa0
cmp dword [ebp + 8], 0
je 0x42ca9f
cmp dword [ebp + 8], 1
jne 0x42caa0
mov dword [esp], 0x5a6ea3
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov dword [esp], 0x5a6eb3
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
jmp 0x42caa0
mov dword [esp], 0x5a6ec4
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov dword [esp], 0x5a6ed7
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
jmp 0x42caa0
nop
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0042c6fb
leave
ret

Function at 0x42cacb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [esp], 0x5a6ea3
call sub.cygwin1.dll_getenv
test eax, eax
je 0x42caf0
mov eax, dword [0x61e970]
or eax, 1
mov dword [0x61e970], eax
mov dword [esp], 0x5a6eb3
call sub.cygwin1.dll_getenv
test eax, eax
je 0x42cb0d
mov eax, dword [0x61e970]
or eax, 2
mov dword [0x61e970], eax
mov dword [esp], 0x5a6eeb
call sub.cygwin1.dll_getenv
mov esi, eax
mov dword [esp], 0x5a6eb3
call sub.cygwin1.dll_getenv
mov ebx, eax
mov dword [esp], 0x5a6ea3
call sub.cygwin1.dll_getenv
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0042c6fb
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x42cb5b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [esp], 0x5a6ec4
call sub.cygwin1.dll_getenv
test eax, eax
je 0x42cb80
mov eax, dword [0x61e96c]
or eax, 1
mov dword [0x61e96c], eax
mov dword [esp], 0x5a6ed7
call sub.cygwin1.dll_getenv
test eax, eax
je 0x42cb9d
mov eax, dword [0x61e96c]
or eax, 2
mov dword [0x61e96c], eax
mov dword [esp], str.GIT_COMMITTER_DATE
call sub.cygwin1.dll_getenv
mov esi, eax
mov dword [esp], 0x5a6ed7
call sub.cygwin1.dll_getenv
mov ebx, eax
mov dword [esp], 0x5a6ec4
call sub.cygwin1.dll_getenv
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 2
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0042c6fb
add esp, 0x20
pop ebx
pop esi
pop ebp
ret
Function at 0x430e9c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004c84f8
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x43100b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x430ed2
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x430ef1
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0042fae4
test eax, eax
je 0x430ece
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x43101d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x430f0e
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call fcn.0042fae4
test eax, eax
jne 0x430f0a
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x431020
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x14]
mov byte [eax], 0
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x430f80
mov eax, dword [ebp - 0x68]
and eax, 0xf000
cmp eax, 0x4000
je 0x431002
call sub.cygwin1.dll___errno
mov dword [eax], 0x14
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x431002
mov dword [esp + 4], 0x1ff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x430fe6
call sub.cygwin1.dll___errno
mov eax, dword [eax]
cmp eax, 0x11
jne 0x430fc8
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x430fc8
mov eax, dword [ebp - 0x68]
and eax, 0xf000
cmp eax, 0x4000
je 0x431002
call sub.cygwin1.dll___errno
mov eax, dword [eax]
cmp eax, 2
jne 0x430fdd
mov dword [ebp - 0x10], 0xfffffffc
jmp 0x431002
mov dword [ebp - 0x10], 0xffffffff
jmp 0x431002
cmp dword [ebp + 0xc], 0
je 0x431002
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004449a8
test eax, eax
je 0x431002
mov dword [ebp - 0x10], 0xfffffffe
mov eax, dword [ebp - 0x14]
movzx edx, byte [ebp - 0x15]
mov byte [eax], dl
cmp dword [ebp - 0x10], 0
jne 0x431021
cmp dword [ebp - 0xc], 0
jne 0x430ec6
jmp 0x431021
nop
jmp 0x431021
nop
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x4321e1
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_utime
test eax, eax
sete al
movzx eax, al
leave
ret
Function at 0x433c54
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [0x59b438]
cmp eax, 1
je 0x433c99
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_link
test eax, eax
je 0x433c8b
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x433cba
cmp dword [ebp - 0xc], 0x11
je 0x433cba
jmp 0x433c9a
nop
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_rename
test eax, eax
je 0x433cf3
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004b50b5
cmp dword [ebp - 0xc], 0
je 0x433cf6
cmp dword [ebp - 0xc], 0x11
je 0x433cf6
mov dword [esp], 0x5a7ec9
call fcn.00430024
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ae275
call fcn.0042fb14
jmp 0x433d2d
nop
jmp 0x433cf7
nop
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004449a8
test eax, eax
je 0x433d28
mov dword [esp], str.unable_to_set_permission_to__s
call fcn.00430024
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ae2ca
call fcn.0042fb14
jmp 0x433d2d
mov eax, 0
leave
ret

Function at 0x433e9c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00433e68
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042fcd3
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048b2d1
mov dword [esp + 4], str.tmp_obj_XXXXXX
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042fdc6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x124
mov dword [esp], eax
call fcn.004b4ddc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x433fcd
cmp dword [ebp - 0x10], 0
je 0x433fcd
call sub.cygwin1.dll___errno
mov eax, dword [eax]
cmp eax, 2
jne 0x433fcd
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042fcd3
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048b2d1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x1ff
mov dword [esp], eax
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x433f88
call sub.cygwin1.dll___errno
mov eax, dword [eax]
cmp eax, 0x11
je 0x433f88
mov eax, 0xffffffff
jmp 0x433fd0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.004449a8
test eax, eax
je 0x433fa1
mov eax, 0xffffffff
jmp 0x433fd0
mov dword [esp + 4], str._tmp_obj_XXXXXX
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042fdc6
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x124
mov dword [esp], eax
call fcn.004b4ddc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x436442
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
cmp dl, al
je 0x43645c
mov eax, 0
jmp 0x43649a
add dword [ebp + 0xc], 1
add dword [ebp + 0x10], 1
sub dword [ebp + 8], 2
cmp dword [ebp + 8], 1
ja 0x436445
cmp dword [ebp + 8], 0
je 0x436495
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
xor eax, edx
movzx eax, al
and eax, 0xf0
test eax, eax
je 0x436495
mov eax, 0
jmp 0x43649a
mov eax, 1
pop ebp
ret