joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x48]
mov dword [esp], 0x7c
call fcn.005c2e50
mov edx, edi
mov ebx, eax
lea ecx, [eax + 0x2c]
lea eax, [eax + 0x6c]
mov dword [esp + 8], eax
lea eax, [ebx + 0x30]
mov dword [esp + 4], eax
lea eax, [ebx + 0x68]
mov dword [esp], eax
mov eax, esi
call fcn.0043def0
test eax, eax
mov dword [ebx + 0x74], eax
je 0x43e142
mov dword [eax + 0x70], ebx
mov eax, dword [eax + 0x78]
test eax, eax
jne 0x43e138
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x43e14c
mov dword [eax + 0x68], ebx
mov eax, dword [ebx + 0x68]
test eax, eax
je 0x43e156
mov dword [eax + 0x2c], ebx
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x43e160
mov dword [eax + 0x6c], ebx
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x43e16a
mov dword [eax + 0x30], ebx
mov edx, dword [edi]
test edx, edx
je 0x43e18f
mov dword [esp + 4], esi
mov eax, dword [edx + 4]
mov dword [esp + 0x1c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [esp + 0x1c]
test eax, eax
js 0x43e25d
mov dword [ebx], edx
mov dword [edi], ebx
mov eax, dword [esp + 0x44]
mov edx, 0x43dd90
mov dword [ebx + 4], esi
mov dword [ebx + 0x10], ebp
mov dword [ebx + 0x14], 0
mov dword [ebx + 8], eax
xor eax, eax
test ebp, ebp
cmovne eax, edx
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x18], eax
mov eax, ebx
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov byte [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov byte [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0x4b9080
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x78], 0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], esi
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], edx
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
mov edx, dword [esp + 0x1c]
test eax, eax
jg 0x43e263
mov edx, edi
mov edi, dword [edx]
test edi, edi
jne 0x43e240
mov dword [ebx], edi
mov dword [edx], ebx
jmp 0x43e193
Function at 0x470430
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x2c
mov dword [esp + 0x20], ebx
mov ebx, dword [0x850c54]
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
test ebx, ebx
jne 0x4704f0
lea ebx, [esp + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], fcn.0059c460
call fcn.0048e4f0
mov edx, ebx
mov edi, eax
mov eax, esi
call fcn.00470140
test eax, eax
jne 0x4704d0
call fcn.0046f880
mov edx, ebx
mov eax, esi
call fcn.00470140
test eax, eax
jne 0x4704d0
mov eax, dword [0x850c58]
mov dword [esp], str.File___s__auto_loading_has_been_declined_by_your__auto_load_safe_path_set_to___s_.
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
call fcn.0059b580
mov ecx, dword [0x850c5c]
test ecx, ecx
je 0x470512
mov dword [esp], edi
call fcn.0048e650
xor eax, eax
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
mov dword [esp], edi
call fcn.0048e650
mov eax, 1
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
add esp, 0x2c
ret
lea eax, [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x8663bc]
mov dword [esp], eax
call fcn.0059ab70
jmp 0x470459
mov dword [esp], 0x6d7f44
call sub.msvcrt.dll_getenv
mov edx, str._HOME
mov dword [esp + 8], str..gdbinit
mov dword [esp], 0x6d7f49
test eax, eax
cmove eax, edx
mov dword [esp + 4], eax
call fcn.005c2fc0
mov dword [esp], fcn.005c2f40
mov ebx, eax
mov dword [esp + 4], eax
call fcn.0048e4f0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp], str.To_enable_execution_of_this_file_add_n_tadd_auto_load_safe_path__s_nline_to_your_configuration_file___s_._nTo_completely_disable_this_security_protection_add_n_tset_auto_load_safe_path___nline_to_your_configuration_file___s_._nFor_more_information_about_this_security_protection_see_the_n_Auto_loading_safe_path__section_in_the_GDB_manual.__E.g.__run_from_the_shell:_n_tinfo___gdb_Auto_loading_safe_path__n
mov dword [esp + 4], eax
call fcn.0059b950
mov dword [0x850c5c], 1
jmp 0x4704b5
Function at 0x480850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x44
mov esi, dword [esp + 0x78]
mov dword [esp], 0x7c
call fcn.005c2e50
mov edx, dword [esp + 0x50]
mov ecx, esi
mov ebx, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp], eax
mov eax, ebx
call fcn.00477fa0
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.00480220
cmp esi, 0x19
mov eax, dword [esp + 0x1c]
je 0x4808e3
test eax, eax
je 0x480914
sub esi, 1
cmp esi, 1
jbe 0x4808e6
mov dword [ebx + 0x40], eax
mov edx, dword [0x8662ec]
test edx, edx
jne 0x4808f4
jmp 0x480906
mov edx, eax
mov eax, dword [edx + 4]
test eax, eax
jne 0x4808f2
mov dword [edx + 4], ebx
add esp, 0x44
mov eax, ebx
pop ebx
pop esi
ret
mov dword [0x8662ec], ebx
add esp, 0x44
mov eax, ebx
pop ebx
pop esi
ret
call fcn.006a4828
lea esi, [esi]
Function at 0x4ad0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x64]
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x68]
cmp ebx, 0xffffffff
je 0x4ad1a7
mov edx, dword [esp + 0x74]
mov dword [edx], 0
mov dword [esp + 4], edx
mov dword [esp], fcn.0059c460
call fcn.0048e4f0
test ebx, ebx
mov dword [esp + 0x28], eax
jle 0x4ad2c3
imul ebx, esi
mov dword [esp], ebx
call fcn.005c2e50
mov ecx, ebx
mov ebp, eax
mov eax, dword [esp + 0x74]
mov edx, ebp
mov dword [eax], ebp
lea eax, [esp + 0x3c]
mov dword [esp], eax
mov eax, edi
call fcn.004aa3b0
mov edx, eax
sar edx, 0x1f
idiv esi
mov edx, dword [esp + 0x74]
imul eax, esi
lea ebx, [ebp + eax]
sub ebx, dword [edx]
mov eax, dword [esp + 0x78]
mov dword [eax], ebx
call fcn.00599f70
test eax, eax
jne 0x4ad1a0
mov eax, dword [0x8670a0]
test eax, eax
je 0x4ad185
call eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.0048e670
mov eax, dword [esp + 0x3c]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0059a460
jmp 0x4ad17a
mov edx, dword [esp + 0x74]
mov eax, 8
cmp dword [esp + 0x6c], 8
cmovbe eax, dword [esp + 0x6c]
xor ebp, ebp
mov dword [edx], 0
mov dword [esp + 0x20], eax
mov dword [esp + 4], edx
mov dword [esp], fcn.0059c460
call fcn.0048e4f0
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x6c]
imul eax, esi
mov dword [esp + 0x2c], eax
call fcn.00599f70
test eax, eax
jne 0x4ad298
mov eax, dword [0x8670a0]
test eax, eax
je 0x4ad1fd
call eax
mov edx, dword [esp + 0x74]
mov ebx, dword [esp + 0x6c]
mov eax, dword [edx]
sub ebx, ebp
cmp ebx, dword [esp + 0x20]
cmova ebx, dword [esp + 0x20]
test eax, eax
je 0x4ad2e4
lea edx, [ebx + ebp]
mov dword [esp + 0x24], edx
imul edx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.005c2e80
mov edx, dword [esp + 0x74]
mov ecx, ebx
imul ecx, esi
mov dword [edx], eax
mov ebx, ebp
imul ebx, esi
add ebx, eax
lea eax, [esp + 0x3c]
mov edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.004aa3b0
mov edx, eax
sar edx, 0x1f
idiv esi
imul eax, esi
lea ebp, [ebx + eax]
cmp ebx, ebp
jb 0x4ad269
jmp 0x4ad2a2
cmp ebp, ebx
jbe 0x4ad2a2
mov edx, dword [esp + 0x70]
add edi, esi
mov dword [esp], ebx
add ebx, esi
mov dword [esp + 4], esi
mov dword [esp + 8], edx
call fcn.0048a2c0
test eax, eax
jne 0x4ad265
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], 0
sub ebx, dword [eax]
jmp 0x4ad16b
call fcn.0059a460
jmp 0x4ad1f2
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x4ad30a
mov eax, dword [esp + 0x74]
sub ebx, dword [eax]
cmp ebx, dword [esp + 0x2c]
jae 0x4ad16b
mov ebp, dword [esp + 0x24]
jmp 0x4ad1e5
mov dword [esp], 1
xor ebx, ebx
call fcn.005c2e50
mov edx, dword [esp + 0x74]
mov dword [esp + 0x3c], 0
mov dword [edx], eax
jmp 0x4ad16b
mov ecx, ebx
add ebx, ebp
imul ecx, esi
mov dword [esp], ecx
mov dword [esp + 0x1c], ecx
call fcn.005c2e50
mov edx, dword [esp + 0x74]
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x1c]
mov dword [edx], eax
jmp 0x4ad23b
mov edx, dword [esp + 0x74]
sub ebx, dword [edx]
jmp 0x4ad16b
Function at 0x4be7e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov dword [esp], esi
call fcn.0042a300
test eax, eax
je 0x4be840
mov eax, dword [0x866c14]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0042a3e0
test eax, eax
mov ebx, eax
je 0x4be995
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.005e71c0
test eax, eax
je 0x4be9b6
mov eax, ebx
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
lea edi, [ebp - 0x1c]
call fcn.005c6de0
mov dword [esp], 0x6f1550
mov ebx, eax
call sub.msvcrt.dll_getenv
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004939e0
test eax, eax
mov esi, eax
js 0x4be905
mov dword [esp], ebx
call fcn.005c2f40
mov edi, dword [ebp - 0x1c]
mov dword [esp], fcn.005c2f40
mov dword [esp + 4], edi
call fcn.0048e4f0
mov eax, dword [0x866c14]
mov dword [esp + 8], esi
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004ff030
test eax, eax
mov ebx, eax
je 0x4be9df
or byte [eax + 0xb4], 1
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.005e71c0
test eax, eax
jne 0x4be831
mov dword [esp], ebx
call fcn.00599fd0
call fcn.005e5b20
mov dword [esp], eax
call fcn.005e5b30
mov dword [esp + 4], edi
mov dword [esp], str.__s:_cant_read_symbols:__s.
mov dword [esp + 8], eax
call fcn.0059a2d0
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
add eax, 0x23
and eax, 0xfffffff0
call fcn.0069df40
sub esp, eax
lea esi, [esp + 0x23]
and esi, 0xfffffff0
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcpy
mov dword [esp], eax
mov dword [ebp - 0x2c], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x2c]
add edx, eax
mov dword [edx], 0x6578652e
mov byte [edx + 4], 0
mov dword [esp], 0x6f1550
call sub.msvcrt.dll_getenv
mov dword [esp + 8], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x8000
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.004939e0
test eax, eax
mov esi, eax
jns 0x4be883
mov dword [esp + 4], ebx
mov dword [esp], fcn.005c2f40
call fcn.0048e4f0
mov dword [esp], ebx
call fcn.0059a440
call fcn.005e5b20
mov dword [esp], eax
call fcn.005e5b30
mov dword [esp + 4], esi
mov dword [esp], str.__s:_cant_open_to_read_symbols:__s.
mov dword [esp + 8], eax
call fcn.0059a2d0
mov dword [esp], ebx
call fcn.00599fd0
call fcn.005e5b20
mov dword [esp], eax
call fcn.005e5b30
mov dword [esp + 4], esi
mov dword [esp], str.__s:_cant_read_symbols:__s.
mov dword [esp + 8], eax
call fcn.0059a2d0
mov dword [esp + 4], edi
mov dword [esp], fcn.005c2f40
call fcn.0048e4f0
call fcn.005e5b20
mov dword [esp], eax
call fcn.005e5b30
mov dword [esp + 4], edi
mov dword [esp], str.__s:_cant_open_to_read_symbols:__s.
mov dword [esp + 8], eax
call fcn.0059a2d0
Function at 0x4e40a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
mov esi, edx
push ebx
sub esp, 0xbc
mov dword [esp + 0x18], eax
mov eax, dword [0x8519e8]
test eax, eax
jne 0x4e41ce
cmp dword [0x8519d4], 0
jne 0x4e41f3
mov eax, dword [0x8519cc]
mov dword [esp + 8], str._home_build_work_GCC_4_8_build_install_mingw_i686_w64_mingw32_arm_none_eabi_lib_gdbinit
mov dword [esp + 4], str._home_build_work_GCC_4_8_build_install_mingw_bin
mov dword [esp], eax
call fcn.006590f0
test eax, eax
mov ebx, eax
je 0x4e423b
mov edx, dword [sym.imp.msvcrt.dll__stati64]
lea eax, [esp + 0x80]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call edx
test eax, eax
je 0x4e4214
mov dword [esp], ebx
call fcn.005c2f40
mov dword [esp], 0x6fe32d
lea ebx, [esp + 0x50]
call sub.msvcrt.dll_getenv
mov ecx, 0xc
mov edx, eax
lea eax, [esp + 0x20]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x14]
xor eax, eax
test edx, edx
rep stosd dword es:[edi], eax
mov edi, ebx
mov cl, 0xc
rep stosd dword es:[edi], eax
je 0x4e4182
mov dword [esp + 4], edx
mov dword [esp + 8], str..gdbinit
mov dword [esp], 0x6fe332
call fcn.005c2fc0
lea edx, [esp + 0x20]
mov dword [esp + 4], edx
mov dword [0x8519f0], eax
mov dword [esp], eax
call dword [esp + 0x1c]
test eax, eax
jne 0x4e421f
mov dword [esp + 4], ebx
mov dword [esp], str..gdbinit
call dword [esp + 0x1c]
test eax, eax
jne 0x4e41c4
cmp dword [0x8519f0], 0
je 0x4e41ba
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x30
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x4e41c4
mov dword [0x8519f4], str..gdbinit
mov dword [0x8519e8], 1
mov eax, dword [0x8519ec]
mov edx, dword [esp + 0x18]
mov dword [edx], eax
mov eax, dword [0x8519f0]
mov dword [esi], eax
mov eax, dword [0x8519f4]
mov dword [ebp], eax
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x44
mov dword [esp + 4], str._home_build_work_GCC_4_8_build_install_mingw_arm_none_eabi_share_gdb
mov dword [esp], str._home_build_work_GCC_4_8_build_install_mingw_i686_w64_mingw32_arm_none_eabi_lib_gdbinit
call fcn.00649000
jmp 0x4e40cc
mov dword [0x8519ec], ebx
jmp 0x4e411d
mov eax, dword [0x8519f0]
mov dword [esp], eax
call fcn.005c2f40
mov dword [0x8519f0], 0
jmp 0x4e4182
mov edx, dword [sym.imp.msvcrt.dll__stati64]
mov dword [esp + 0x1c], edx
jmp 0x4e4115
Function at 0x50b4a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x288], 0xf00
jne 0x50b549
mov eax, dword [0x852190]
test eax, eax
je 0x50b542
mov ecx, dword [esi + 0x118]
mov edx, dword [eax + 0x118]
cmp ecx, edx
jl 0x50b4e2
jmp 0x50b4fa
mov edx, dword [eax + 0x118]
cmp edx, ecx
jle 0x50b500
mov ebx, eax
mov eax, dword [eax]
test eax, eax
jne 0x50b4d8
xor eax, eax
mov dword [esi], eax
mov dword [ebx], esi
add esp, 0x14
pop ebx
pop esi
jmp fcn.00504790
mov ebx, 0x852190
nop
cmp ecx, edx
je 0x50b514
jmp 0x50b4ec
mov edx, dword [eax + 0x118]
cmp dword [esi + 0x118], edx
jne 0x50b4ec
mov edx, dword [eax]
mov dword [ebx], edx
mov dword [eax], 0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0050b220
mov eax, dword [ebx]
test eax, eax
jne 0x50b506
mov dword [esi], eax
mov dword [ebx], esi
add esp, 0x14
pop ebx
pop esi
jmp fcn.00504790
mov ebx, 0x852190
jmp 0x50b4ea
mov eax, dword [esi + 4]
mov dword [esp + 4], str.Magic_number_of__s_target_struct_wrong_n
mov dword [esp + 8], eax
mov eax, dword [0x8663b0]
mov dword [esp], eax
call fcn.0059ac60
mov dword [esp + 8], 0x712f08
mov dword [esp + 4], 0x3e4
mov dword [esp], str._home_build_work_GCC_4_8_build_src_gdb_gdb_target.c
call fcn.0059c0c0
jmp fcn.0050b590

Function at 0x5127c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [0x8671f8]
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
sub esi, ebx
sar esi, 2
imul esi, esi, 0xcccccccd
test esi, esi
jle 0x512841
lea eax, [ebp + 0x24]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.005126c0
xor edx, edx
xor ecx, ecx
lea eax, [eax + eax*4]
shl eax, 2
add eax, dword [ebp + 0x24]
mov ebp, dword [ebx + edx]
add ecx, 1
mov dword [eax + edx], ebp
mov ebp, dword [ebx + edx + 4]
mov dword [eax + edx + 4], ebp
mov ebp, dword [ebx + edx + 8]
mov dword [eax + edx + 8], ebp
mov ebp, dword [ebx + edx + 0xc]
mov dword [eax + edx + 0xc], ebp
mov ebp, dword [ebx + edx + 0x10]
mov dword [eax + edx + 0xc], edi
mov dword [eax + edx + 0x10], ebp
add edx, 0x14
cmp ecx, esi
jne 0x512804
mov eax, dword [0x852804]
test eax, eax
je 0x512850
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x852804], 1
mov dword [esp + 0x30], 0x866760
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0050b4a0

Function at 0x5143a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov edx, dword [esp + 8]
xor eax, eax
mov ebx, dword [esp + 0xc]
add ebx, edx
cmp edx, ebx
jae 0x5143c3
imul ecx, eax, 0x1000193
movzx eax, byte [edx]
add edx, 1
xor eax, ecx
cmp edx, ebx
jne 0x5143b1
pop ebx
ret
Function at 0x548f80
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x10], 0x8660dc
mov dword [esp + 0xc], str.Use_FILE_as_core_dump_for_examining_memory_and_registers._nNo_arg_means_have_no_core_file.__This_command_has_been_superseded_by_the_n_target_core_and__detach_commands.
mov dword [esp + 8], fcn.00548860
mov dword [esp + 4], 3
mov dword [esp], str.core_file
call fcn.0043e0f0
mov dword [esp + 4], 0x4eba40
mov dword [esp], eax
call fcn.0043e0e0
mov dword [esp + 0x24], 0x866124
mov dword [esp + 0x20], 0x866104
mov dword [esp + 0x1c], 0x5487e0
mov dword [esp + 0x18], fcn.00548800
mov dword [esp + 0x14], str.Use__set_gnutarget_auto_to_specify_automatic_detection.
mov dword [esp + 0x10], str.Show_the_current_BFD_target.
mov dword [esp + 0xc], str.Set_the_current_BFD_target.
mov dword [esp + 8], 0x85eec0
mov dword [esp + 4], 3
mov dword [esp], str.gnutarget
call fcn.0043e700
mov dword [esp + 4], 0x548730
mov dword [esp], eax
call fcn.0043e0e0
mov dword [esp + 0x10], 0x866104
mov dword [esp + 0xc], 1
mov dword [esp + 8], 3
mov dword [esp + 4], str.gnutarget
mov dword [esp], 0x7229b8
call fcn.0043fa90
mov dword [esp], 0x7229ba
call sub.msvcrt.dll_getenv
test eax, eax
je 0x549077
mov dword [esp], 0x7229ba
call sub.msvcrt.dll_getenv
mov dword [esp], eax
call fcn.00548f30
add esp, 0x3c
ret
mov dword [esp], 0x72270c
call fcn.00548f30
add esp, 0x3c
ret
Function at 0x55bf40
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
cmp dword [esp + 0x5c], 1
mov ebx, dword [esp + 0x50]
mov dword [esp], 0x726bbe
sbb eax, eax
add eax, 2
mov dword [esp + 0x18], eax
call sub.msvcrt.dll_getenv
mov edx, 0x726bbb
mov dword [esp + 4], 0
test eax, eax
cmove eax, edx
mov edx, dword [esp + 0x60]
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.00598c00
test eax, eax
mov ebp, eax
je 0x55c0e5
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x54]
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], eax
mov dword [esp], ebp
call fcn.00446d20
cmp byte [eax], 0
mov esi, eax
je 0x55c0dd
lea eax, [esp + 0x2c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strtol
mov ebp, dword [esp + 0x2c]
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x55c0b5
cmp esi, ebp
je 0x55c0b5
cmp eax, dword [esp + 0x1c]
jge 0x55c0b5
test eax, eax
je 0x55c0d1
cmp dword [esp + 0x18], eax
jg 0x55c07f
mov ecx, dword [esp + 0x14]
sub eax, dword [esp + 0x18]
sub ecx, 1
cmp ecx, 0xffffffff
je 0x55c070
mov esi, dword [ebx + ecx*4]
mov edi, ecx
mov edx, ecx
cmp eax, esi
jl 0x55c029
jmp 0x55c050
mov esi, dword [ebx + edx*4]
mov edi, edx
cmp eax, esi
jge 0x55c050
sub edx, 1
cmp edx, 0xffffffff
jne 0x55c020
xor edi, edi
mov esi, dword [ebx + ecx*4]
mov dword [ebx + ecx*4 + 4], esi
sub ecx, 1
cmp ecx, edx
jne 0x55c033
mov dword [ebx + edi], eax
add dword [esp + 0x14], 1
jmp 0x55bfa5
cmp eax, esi
je 0x55bfa5
cmp edx, ecx
lea edi, [edi*4 + 4]
jl 0x55c033
mov dword [ebx + edi], eax
add dword [esp + 0x14], 1
jmp 0x55bfa5
xor edi, edi
mov dword [ebx + edi], eax
add dword [esp + 0x14], 1
jmp 0x55bfa5
mov eax, dword [esp + 0x54]
test eax, eax
mov dword [esp + 0x14], eax
jle 0x55c09f
mov edx, dword [esp + 0x54]
xor eax, eax
mov dword [ebx + eax*4], eax
add eax, 1
cmp eax, edx
jne 0x55c091
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x14], eax
jg 0x55c0c1
mov eax, dword [esp + 0x14]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Argument_must_be_choice_number
call fcn.0059a2d0
mov dword [esp + 4], eax
mov dword [esp], str.Select_no_more_than__d_of_the_above
call fcn.0059a2d0
mov dword [esp], str.cancelled
call fcn.0059a2d0
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x55c09f
mov dword [esp], str.one_or_more_choice_numbers
call fcn.004442a0
jmp fcn.0055c100
Function at 0x563680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x3c
mov dword [esp + 0x30], esi
mov esi, eax
mov eax, dword [eax + 0x14]
mov dword [esp + 0x2c], ebx
mov ebx, esi
mov dword [esp + 0x34], edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x38], ebp
cmp byte [eax], 1
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
je 0x563793
mov dword [esp], ebx
mov dword [esp + 4], 0x7274a1
call fcn.0055fb50
mov dword [esp], edi
test eax, eax
cmovne ebx, eax
call fcn.004968c0
mov dword [esp], ebx
mov ebp, eax
call fcn.0055d6a0
xor ecx, ecx
mov dword [esp + 4], 0
mov dword [esp], 1
mov edx, eax
mov eax, ebp
call fcn.00560ad0
test eax, eax
je 0x563747
mov dword [esp], edi
call fcn.00496da0
mov dword [esp], edi
mov esi, eax
call fcn.004968c0
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.005627a0
test eax, eax
mov esi, eax
js 0x5637b0
mov ebx, dword [ebx + 0x14]
mov edx, eax
mov eax, ebx
call fcn.00558e30
test eax, eax
lea eax, [esi + esi*2]
jne 0x563760
mov edx, dword [ebx + 0x18]
lea eax, [edx + eax*8]
mov esi, dword [eax + 0xc]
mov eax, esi
call fcn.0055d610
test eax, eax
jns 0x5637a0
mov eax, esi
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
ret
mov ecx, dword [ebx + 0x18]
mov edx, dword [esp + 0x18]
lea eax, [ecx + eax*8]
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x40], edi
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
add esp, 0x3c
jmp fcn.00563300
mov ebx, dword [eax + 0x14]
jmp 0x5636af
mov dword [esp + 0x40], edi
mov ecx, dword [esp + 0x1c]
mov eax, esi
mov edx, dword [esp + 0x18]
jmp 0x56377b
mov dword [esp], ebx
call fcn.004f87e0
mov esi, eax
mov eax, dword [eax + 0x14]
movzx edx, word [eax + 2]
mov byte [eax], 3
mov word [eax + 4], 0
mov dword [eax + 0x18], 0
and dx, 0xfc7f
or dl, 0x80
mov word [eax + 2], dx
mov dword [eax + 0x20], 0x708e40
mov dword [eax + 8], str._empty_
mov dword [eax + 0xc], 0
mov dword [esi + 0x10], 0
jmp 0x563747
Function at 0x599540
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x1c
mov dword [esp], str.HISTSIZE
call sub.msvcrt.dll_getenv
test eax, eax
je 0x5995d0
mov dword [esp], eax
call sub.msvcrt.dll_atoi
xor edx, edx
test eax, eax
cmovns edx, eax
mov dword [0x85f72c], edx
mov dword [esp], edx
call fcn.005cc010
mov dword [esp], str.GDBHISTFILE
call sub.msvcrt.dll_getenv
test eax, eax
je 0x5995a0
mov dword [esp], eax
call fcn.00642070
mov dword [0x85f724], eax
mov dword [esp], eax
call fcn.005d6490
add esp, 0x1c
ret
mov eax, dword [0x85f724]
test eax, eax
jne 0x59958d
mov eax, dword [0x8670ac]
mov dword [esp + 8], 0
mov dword [esp + 4], str._.gdb_history
mov dword [esp], eax
call fcn.00641f40
mov dword [0x85f724], eax
jmp 0x59958d
mov edx, dword [0x85f72c]
test edx, edx
jne 0x599568
mov dword [0x85f72c], 0x100
mov dx, 0x100
jmp 0x599568