joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [0x47dcc8]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
test ebp, ebp
je 0x42e4c1
mov eax, esi
mov edx, edi
add eax, 1
adc edx, 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], edx
xor eax, dword [ebp + 8]
xor edx, dword [ebp + 0xc]
or edx, eax
je 0x42e523
mov eax, esi
mov edx, edi
mov dword [esp + 0xc], 1
add eax, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 4], eax
mov eax, dword [0x47dcd4]
adc edx, 0
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.00433670
mov ebp, dword [eax]
mov dword [0x47dcc8], eax
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test ebp, ebp
je 0x42e530
mov dword [esp + 0x48], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x4c], 1
mov dword [esp + 0x44], ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00433670
mov ebp, dword [ebp]
jmp 0x42e503
mov dword [esp + 4], 1
mov dword [esp], 0x200
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
call fcn.004334c0
cmp word [0x48095e], 2
mov edx, dword [esp + 0x10]
mov ebp, eax
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [edx], eax
jle 0x42e503
mov dword [esp], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
call fcn.0043ece0
mov esi, eax
call fcn.00409f30
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.__s__created_hashtable_for_dev__s_n
mov dword [esp], 2
call fcn.00420340
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
jmp 0x42e503
Function at 0x431cd0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp], edx
mov dword [esp + 0x28], eax
call sub.cygwin1.dll_strdup
test eax, eax
mov dword [esp + 0x2c], eax
je 0x431eac
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0x45dabb
mov dword [esp], eax
call sub.cygwin1.dll_strtok
test eax, eax
mov esi, eax
je 0x431e28
lea esi, [esi]
mov dword [esp + 4], 0x3d
mov dword [esp], esi
xor edi, edi
mov dword [esp + 0x38], 1
call sub.cygwin1.dll_strchr
test eax, eax
je 0x431d44
mov byte [eax], 0
add eax, 1
mov di, 1
mov dword [esp], eax
call sub.cygwin1.dll_atoi
mov dword [esp + 0x38], eax
mov eax, dword [0x453080]
test eax, eax
je 0x431e40
mov ebp, 0x453094
xor ebx, ebx
jmp 0x431d71
add ebp, 0x14
mov eax, dword [ebp - 0x14]
add ebx, 1
test eax, eax
je 0x431e40
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x431d60
lea eax, [ebx + ebx*4]
lea edx, [eax*4 + 0x453080]
mov eax, dword [edx + 0x10]
test eax, eax
js 0x431e0a
cmp eax, 1
jle 0x431e60
cmp eax, 2
jne 0x431e0a
test edi, edi
jne 0x431e8f
lea eax, [ebx + ebx*4]
lea ecx, [esp + 0x3c]
lea eax, [eax*4 + 0x453080]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], ecx
mov dword [esp + 0x3c], edx
mov edx, dword [eax + 8]
mov dword [esp + 8], edx
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.cygwin1.dll_setsockopt
test eax, eax
je 0x431e0a
call sub.cygwin1.dll___errno
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.failed_to_set_socket_option__s
mov eax, dword [eax]
mov dword [esp], 3
mov dword [esp + 4], eax
call fcn.0041f9e0
mov dword [esp + 4], 0x45dabb
mov dword [esp], 0
call sub.cygwin1.dll_strtok
test eax, eax
mov esi, eax
jne 0x431d10
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.0044e534
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], esi
mov dword [esp + 4], str.Unknown_socket_option__s_n
mov dword [esp], 3
call fcn.00420340
jmp 0x431e0a
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov eax, dword [edx + 8]
mov dword [esp + 8], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.cygwin1.dll_setsockopt
jmp 0x431de3
mov dword [esp + 8], esi
mov dword [esp + 4], str.syntax_error_____s_does_not_take_a_value_n
mov dword [esp], 3
call fcn.00420340
jmp 0x431da8
mov dword [esp], str.set_socket_options
call fcn.0041a8d0
nop
lea esi, [esi]
Function at 0x431ec0
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
xor eax, eax
sub esp, 0x44
mov esi, dword [esp + 0x50]
mov dword [esp + eax + 0x20], 0
add eax, 4
cmp eax, 0x20
jb 0x431ecb
mov eax, dword [esp + 0x54]
mov dword [esp + 4], 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call sub.cygwin1.dll_getaddrinfo
test eax, eax
jne 0x431f78
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x431f74
mov eax, dword [ebx + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x18]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.cygwin1.dll_bind
cmp eax, 0xffffffff
jne 0x431f60
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x431f23
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_freeaddrinfo
mov eax, 0xffffffff
add esp, 0x44
pop ebx
pop esi
ret
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_freeaddrinfo
add esp, 0x44
mov eax, esi
pop ebx
pop esi
ret
xor eax, eax
jmp 0x431f49
mov dword [esp], eax
call sub.cygwin1.dll_gai_strerror
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], str.rsync:_getaddrinfo__s:__s_n
mov dword [esp], 3
mov dword [esp + 8], eax
call fcn.00420340
mov eax, 0xffffffff
jmp 0x431f56
Function at 0x4334a0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
test edx, edx
je 0x4334b1
cmp byte [edx], 0
jne 0x4334b3
repz ret
jmp fcn.00431cd0
Function at 0x434b10
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x58]
lea edi, [ebx + 4]
mov ecx, ebx
mov dword [ebx], 0
mov dword [ebx + 0x7c], 0
and edi, 0xfffffffc
sub ecx, edi
sub ecx, 0xffffff80
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sub.cygwin1.dll_getpeername
test eax, eax
jne 0x434bb4
cmp word [ebx], 0x17
je 0x434b70
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [ebx + 8]
test ebp, ebp
jne 0x434b5e
mov edi, dword [ebx + 0xc]
test edi, edi
jne 0x434b5e
cmp dword [ebx + 0x10], 0xffff0000
jne 0x434b5e
mov eax, dword [ebx]
mov edx, dword [ebx + 0x14]
mov ecx, 2
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov word [ebx], cx
mov dword [esi], 0x10
shr eax, 0x10
mov dword [ebx + 4], edx
mov word [ebx + 2], ax
jmp 0x434b5e
call sub.cygwin1.dll___errno
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.getpeername_on_fd_d_failed
mov eax, dword [eax]
mov dword [esp], 6
mov dword [esp + 4], eax
call fcn.0041f9e0
mov dword [esp + 8], 0xad
mov dword [esp + 4], str.clientname.c
mov dword [esp], 0xa
call fcn.00412fd0
lea esi, [esi]
lea edi, [edi]

Function at 0x434c00
Capabilities:
Query environment variable
Resolve dns

Disassembly:
push ebx
sub esp, 0xb8
mov edx, dword [0x47dfa4]
mov dword [esp + 0x2c], pe_nt_image_headers32
test edx, edx
jne 0x434c8f
mov eax, dword [0x47d96c]
mov dword [0x47dfa4], 1
test eax, eax
je 0x434ca0
mov dword [esp + 8], 0x64
mov dword [esp + 4], str.0.0.0.0
mov dword [esp], 0x47df40
call sub.cygwin1.dll_strlcpy
mov dword [esp], str.REMOTE_HOST
call sub.cygwin1.dll_getenv
test eax, eax
je 0x434d04
mov dword [esp + 8], 0x64
mov dword [esp + 4], eax
mov dword [esp], 0x47df40
call sub.cygwin1.dll_strlcpy
mov dword [esp + 4], 0x20
mov dword [esp], 0x47df40
call sub.cygwin1.dll_strchr
test eax, eax
je 0x434c8f
mov byte [eax], 0
add esp, 0xb8
mov eax, 0x47df40
pop ebx
ret
lea eax, [esp + 0x2c]
lea ebx, [esp + 0x30]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00434b10
mov eax, dword [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x64
mov dword [esp + 8], 0x47df40
mov dword [esp + 4], eax
call sub.cygwin1.dll_getnameinfo
add esp, 0xb8
mov eax, 0x47df40
pop ebx
ret
mov dword [esp], str.SSH_CONNECTION
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x434c5c
mov dword [esp], str.SSH_CLIENT
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x434c5c
mov dword [esp], str.SSH2_CLIENT
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x434c5c
jmp 0x434c8f
Function at 0x434d50
Capabilities:
Resolve dns

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.cygwin1.dll_getnameinfo
test eax, eax
mov ebx, eax
je 0x434dde
mov dword [esp], esi
mov dword [esp + 8], edi
mov dword [esp + 4], str.UNKNOWN
call sub.cygwin1.dll_strlcpy
mov dword [esp], ebx
call sub.cygwin1.dll_gai_strerror
mov esi, eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.00434c00
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.name_lookup_failed_for__s:__s_n
mov dword [esp], 6
call fcn.00420340
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
ret

Function at 0x434df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
mov edx, 0x72
push ebx
sub esp, 0x40
mov ebx, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov word [esp + 0x3e], dx
mov dword [esp + 0x26], 0x706d6f63
mov dword [esp + 0x2a], 0x5f657261
mov dword [esp + 0x2e], 0x72646461
movzx eax, word [ebx]
mov edx, dword [ecx + 4]
mov dword [esp + 0x32], 0x6f666e69
mov dword [esp + 0x36], 0x636f735f
mov dword [esp + 0x3a], 0x6464616b
cmp edx, eax
jne 0x434e60
cmp edx, 2
je 0x434e92
cmp edx, 0x17
mov esi, 1
je 0x434ec0
add esp, 0x40
mov eax, esi
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x10], eax
lea eax, [esp + 0x26]
mov dword [esp + 0xc], edx
mov dword [esp + 4], str._s:_response_family__d____d_n
mov dword [esp], 6
mov esi, 1
mov dword [esp + 8], eax
call fcn.00420340
add esp, 0x40
mov eax, esi
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 4
mov eax, dword [ecx + 0x18]
add ebx, 4
mov dword [esp], ebx
add eax, 4
mov dword [esp + 4], eax
call sub.cygwin1.dll_memcmp
add esp, 0x40
mov esi, eax
mov eax, esi
pop ebx
pop esi
pop edi
ret
mov eax, dword [ecx + 0x10]
mov edi, dword [ecx + 0x18]
cmp eax, 0x1b
jbe 0x434f00
lea eax, [edi + 8]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
lea eax, [ebx + 8]
mov dword [esp], eax
call sub.cygwin1.dll_memcmp
test eax, eax
jne 0x434e51
mov eax, dword [edi + 0x18]
cmp dword [ebx + 0x18], eax
setne al
movzx eax, al
mov esi, eax
jmp 0x434e51
mov dword [esp + 0xc], eax
lea eax, [esp + 0x26]
mov dword [esp + 4], str._s:_too_short_sockaddr_in6__length_d_n
mov dword [esp], 6
mov dword [esp + 8], eax
call fcn.00420340
jmp 0x434e51
Function at 0x434f30
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
xor eax, eax
sub esp, 0x44
mov esi, dword [esp + 0x54]
movzx edx, word [esi]
mov dword [esp + eax + 0x20], 0
add eax, 4
cmp eax, 0x20
jb 0x434f3e
lea eax, [esp + 0x1c]
mov dword [esp + 4], 0
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], 2
mov dword [esp + 0x28], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call sub.cygwin1.dll_getaddrinfo
test eax, eax
mov ebx, eax
jne 0x43502d
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x434fa7
jmp 0x435079
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
je 0x434fd3
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00434df0
test eax, eax
jne 0x434fa0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x435079
mov dword [esp], eax
call sub.cygwin1.dll_freeaddrinfo
add esp, 0x44
xor eax, eax
pop ebx
pop esi
ret
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x435079
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call fcn.00434c00
mov ecx, dword [esp + 0x58]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_is_not_a_known_address_for___s_:_spoofed_address__n
mov dword [esp], 6
mov dword [esp + 0xc], ecx
call fcn.00420340
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], str.UNKNOWN
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call sub.cygwin1.dll_strlcpy
mov eax, dword [esp + 0x1c]
jmp 0x434fc3
mov dword [esp], eax
call sub.cygwin1.dll_gai_strerror
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], str.forward_name_lookup_for__s_failed:__s_n
mov dword [esp], 6
mov dword [esp + 8], eax
call fcn.00420340
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], str.UNKNOWN
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp], eax
call sub.cygwin1.dll_strlcpy
add esp, 0x44
mov eax, ebx
pop ebx
pop esi
ret
mov eax, dword [esp + 0x58]
mov dword [esp + 4], str.no_known_address_for___s_:_spoofed_address__n
mov dword [esp], 6
mov dword [esp + 8], eax
call fcn.00420340
jmp 0x43500b
Function at 0x4350a0
Capabilities:
Resolve dns

Disassembly:
mov edx, dword [0x47df24]
test edx, edx
je 0x4350b0
mov eax, 0x47dec0
ret
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
lea ebx, [esp + 0x50]
mov dword [esp + 8], 0x64
mov dword [esp + 4], str.UNKNOWN
mov dword [esp], 0x47dec0
call sub.cygwin1.dll_strlcpy
mov edi, ebx
xor eax, eax
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov eax, dword [0x47d96c]
mov dword [0x47df24], 1
test eax, eax
jne 0x435191
lea eax, [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp + 0x28], pe_nt_image_headers32
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf0]
mov dword [esp], eax
call fcn.00434b10
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], 0x64
mov dword [esp + 0x14], 0x47de40
mov dword [esp + 0x10], 0x64
mov dword [esp + 0xc], 0x47dec0
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0xf0]
mov dword [esp], eax
call fcn.00434d50
test eax, eax
jne 0x435181
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xc], 0x64
mov dword [esp + 8], 0x47dec0
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00434f30
add esp, 0xdc
mov eax, 0x47dec0
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0xf0]
mov edi, str.0.0.0.0
mov dword [esp], eax
call fcn.00434c00
mov ecx, 8
mov esi, eax
mov ebp, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x435181
xor eax, eax
mov dword [esp + eax + 0x30], 0
add eax, 4
cmp eax, 0x20
jb 0x4351b4
lea eax, [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], ebp
mov dword [esp + 0x30], 4
mov dword [esp + 0x38], 1
mov dword [esp + 0xc], eax
lea eax, [esp + 0x30]
mov dword [esp + 8], eax
call sub.cygwin1.dll_getaddrinfo
test eax, eax
jne 0x435255
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 4]
cmp edx, 2
je 0x4352a0
cmp edx, 0x17
jne 0x435280
mov edx, dword [eax + 0x18]
mov dword [esp + 0x28], 0x1c
mov ecx, dword [edx]
mov dword [esp + 0x50], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x54], ecx
mov ecx, dword [edx + 8]
mov dword [esp + 0x58], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x5c], ecx
mov ecx, dword [edx + 0x10]
mov dword [esp + 0x60], ecx
mov ecx, dword [edx + 0x14]
mov dword [esp + 0x64], ecx
mov edx, dword [edx + 0x18]
mov dword [esp + 0x68], edx
mov dword [esp], eax
call sub.cygwin1.dll_freeaddrinfo
jmp 0x43511f
mov dword [esp], eax
call sub.cygwin1.dll_gai_strerror
mov dword [esp + 8], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.malformed_address__s:__s_n
mov dword [esp], 6
call fcn.00420340
jmp 0x435181
mov dword [esp + 8], 0x8d
mov dword [esp + 4], str.clientname.c
mov dword [esp], 0xa
call fcn.00412fd0
lea esi, [esi]
mov edx, dword [eax + 0x18]
mov dword [esp + 0x28], 0x10
mov ecx, dword [edx]
mov dword [esp + 0x50], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x54], ecx
mov ecx, dword [edx + 8]
mov dword [esp + 0x58], ecx
mov edx, dword [edx + 0xc]
mov dword [esp + 0x5c], edx
jmp 0x435248
Function at 0x4398a0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
js 0x4398b0
cmp eax, dword [0x47e104]
jl 0x4398c4
mov eax, dword [0x47e1ac]
mov edx, 0x45f108
test eax, eax
cmove eax, edx
jmp fcn.00438c90
imul eax, eax, 0xa8
add eax, dword [0x47e100]
mov eax, dword [eax + 0x54]
test eax, eax
je 0x4398b0
jmp fcn.00438c90
Function at 0x43d470
Capabilities:
Encode data using base64

Disassembly:
test eax, eax
je 0x43d5d4
push ebp
push edi
mov ecx, 2
push esi
push ebx
mov edi, 0x460574
mov esi, eax
mov ebx, eax
sub esp, 0x27c
repe cmpsb byte [esi], byte es:[edi]
je 0x43d541
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0044e6a4
test eax, eax
mov ebp, eax
js 0x43d646
lea eax, [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0041f510
cmp eax, 0xffffffff
je 0x43d5d7
test byte [esp + 0x20], 6
jne 0x43d616
call sub.cygwin1.dll__geteuid32
test eax, eax
jne 0x43d4eb
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x43d685
lea edi, [esp + 0x70]
mov dword [esp + 8], 0x1ff
mov dword [esp], ebp
mov dword [esp + 4], edi
call sub.cygwin1.dll_read
mov dword [esp], ebp
mov esi, eax
call sub.cygwin1.dll_close
test esi, esi
jle 0x43d5a0
mov byte [esp + esi + 0x70], 0
mov dword [esp + 4], 0x460625
mov dword [esp], edi
call sub.cygwin1.dll_strtok
test eax, eax
je 0x43d5a0
mov dword [esp], eax
call sub.cygwin1.dll_strdup
add esp, 0x27c
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 4]
lea edi, [esp + 0x70]
mov dword [esp + 4], 0x200
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.cygwin1.dll_fgets
test eax, eax
je 0x43d5a0
mov eax, edi
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x43d567
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
sub eax, edi
mov esi, eax
jmp 0x43d50d
mov dword [esp + 8], ebx
mov dword [esp + 4], str.ERROR:_failed_to_read_a_password_from__s_n
mov dword [esp], 3
call fcn.00420340
mov dword [esp + 8], 0xd6
mov dword [esp + 4], str.authenticate.c
mov dword [esp], 1
call fcn.00412fd0
xor eax, eax
ret
call sub.cygwin1.dll___errno
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.stat__s_
mov eax, dword [eax]
mov dword [esp], 3
mov dword [esp + 4], eax
call fcn.0041f9e0
mov dword [esp + 8], 0xc0
mov dword [esp + 4], str.authenticate.c
mov dword [esp], 1
call fcn.00412fd0
mov dword [esp + 4], str.ERROR:_password_file_must_not_be_other_accessible_n
mov dword [esp], 3
call fcn.00420340
mov dword [esp + 8], 0xc4
mov dword [esp + 4], str.authenticate.c
mov dword [esp], 1
call fcn.00412fd0
call sub.cygwin1.dll___errno
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.could_not_open_password_file__s
mov eax, dword [eax]
mov dword [esp], 3
mov dword [esp + 4], eax
call fcn.0041f9e0
mov dword [esp + 8], 0xbb
mov dword [esp + 4], str.authenticate.c
mov dword [esp], 1
call fcn.00412fd0
mov dword [esp + 4], str.ERROR:_password_file_must_be_owned_by_root_when_running_as_root_n
mov dword [esp], 3
call fcn.00420340
mov dword [esp + 8], 0xc8
mov dword [esp + 4], str.authenticate.c
mov dword [esp], 1
call fcn.00412fd0
lea esi, [esi]
lea edi, [edi]
Function at 0x43e250
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, dword [esp + 0x44]
test ebx, ebx
je 0x43e2b0
cmp byte [ebx], 0
mov eax, str.nobody
cmove ebx, eax
mov eax, dword [0x47d8a0]
call fcn.0043d470
test eax, eax
je 0x43e2c0
lea esi, [esp + 0x10]
mov edx, dword [esp + 0x48]
mov ecx, esi
call fcn.0043d7b0
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], str._s__s_n
mov dword [esp], eax
call fcn.0042cfa0
add esp, 0x34
pop ebx
pop esi
ret
mov ebx, str.nobody
jmp 0x43e268
mov dword [esp], str.RSYNC_PASSWORD
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x43e276
mov dword [esp], str.Password:
call sub.cygwin1.dll_getpass
mov edx, 0x4606d8
test eax, eax
cmove eax, edx
jmp 0x43e276
Function at 0x43f960
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
ret

Function at 0x4403e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
ret
Function at 0x44a220
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [esp], str.PATH
call sub.cygwin1.dll_getenv
mov edx, dword [ebp + 8]
test edx, edx
je 0x44a36a
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x2f
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x44a270
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strdup
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
je 0x44a36a
mov dword [esp], ebx
call sub.cygwin1.dll_strlen
lea esi, [eax + 1]
add eax, 0x1f
and eax, 0xfffffff0
call fcn.0044e3e0
sub esp, eax
lea ecx, [esp + 0x23]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
and ecx, 0xfffffff0
mov dword [esp], ecx
mov edi, ecx
call sub.cygwin1.dll_strlcpy
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strlen
lea eax, [esi + eax + 1]
mov dword [esp], eax
mov dword [ebp - 0x1c], eax
call fcn.0044e664
test eax, eax
mov ebx, eax
jne 0x44a316
jmp 0x44a36a
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4643c5
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call sub.cygwin1.dll_snprintf
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.cygwin1.dll_access
test eax, eax
je 0x44a374
mov edi, esi
add edi, 1
je 0x44a362
cmp byte [esi + 1], 0
je 0x44a362
mov dword [esp + 4], 0x3a
mov dword [esp], edi
call sub.cygwin1.dll_strchr
test eax, eax
mov esi, eax
jne 0x44a2d0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4643c5
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call sub.cygwin1.dll_snprintf
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.cygwin1.dll_access
test eax, eax
je 0x44a374
mov dword [esp], ebx
call fcn.0044e534
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret