joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov ecx, dword [ebx]
xor edi, edi
cmp byte [ecx], 0
mov dword [ecx + 0x54], 0
js 0x4027d5
test dword [ecx + 0xb0], 0x3000
setne al
movzx edi, al
movsx edx, byte [ebx + 0x5c]
mov eax, dword [sym.imp.cygwin1.dll___ctype_ptr__]
mov eax, dword [eax]
movsx eax, byte [edx + eax + 1]
and eax, 3
dec eax
je 0x402857
mov dword [ecx + 0x50], 0
mov eax, dword [esi + 0x10]
cmp eax, dword [ebx + 0x3c]
je 0x402810
cmp eax, dword [ebx + 0x78]
je 0x402840
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
test eax, eax
jne case.0x4028c0.0
test edi, edi
je 0x402876
cmp dword [esi + 0x34], 3
ja case.0x4028c0.0
xor edi, edi
mov dword [ecx + 0x154], edi
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
mov esi, dword [ebp - 8]
mov dword [ebp + 8], ebx
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
jmp fcn.004026d0
mov dword [ebp + 0xc], esi
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebp + 8], ebx
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
jmp fcn.00410aa0
mov byte [ebx + 0x5c], 1
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0040da40
mov eax, dword [ebx]
and byte [eax + 2], 0xfb
mov ecx, dword [ebx]
jmp 0x4027eb
test dword [ecx + 0xb0], 0x3000
je 0x4028b4
cmp byte [ecx], 0
jns 0x4028b4
mov eax, dword [esi + 0x34]
cmp eax, 1
jne 0x4028b7
cmp dword [ecx + 0x148], 1
jg switch.0x004028c0
xor edx, edx
mov dword [esp + 0xc], edx
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040d570
mov eax, dword [esi + 0x34]
cmp eax, 5
ja case.0x4028c0.0
jmp dword [eax*4 + 0x423430]
cmp eax, 4
mov edi, 1
setne al
test byte [esi + 0x30], 1
movzx eax, al
mov dword [ebp - 0x10], eax
jne 0x40292f
test byte [ebx + 0x82], 8
mov edi, 5
je 0x40292f
movzx eax, word [ebx + 0x10]
lea edi, [eax - 1]
jmp 0x40292f
mov eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00408a90
mov dword [esp], ebx
mov eax, 4
mov dword [esp + 4], eax
call fcn.0040a3b0
mov dword [esp], ebx
mov eax, 1
mov dword [esp + 4], eax
call fcn.0040da40
dec edi
cmp edi, 0xffffffff
jne 0x4028f5
jmp case.0x4028c0.0
mov eax, dword [esi + 0x1c]
mov dword [ebp + 8], ebx
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp fcn.0040c5f0
mov eax, dword [esi + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0040c3a0
jmp case.0x4028c0.0
Function at 0x404f90
Capabilities:
Encode data using base64
Get socket status
Parse credit card information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00404090
mov ecx, dword [ebx]
mov dl, al
test byte [ecx + 0xb2], 8
jne 0x404fe6
movzx eax, al
sub eax, 0x23
cmp eax, 0x4c
ja case.0x404fba.37
jmp dword [eax*4 + 0x423b00]
mov eax, 3
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004088a0
lea esi, [esi]
lea edi, [edi]
add esp, 0x14
pop ebx
pop ebp
ret
mov dword [esp], ebx
movzx eax, al
mov dword [esp + 4], eax
call fcn.004045f0
add esp, 0x14
pop ebx
pop ebp
ret
mov dword [esp], ebx
call fcn.00404090
cmp al, 0x38
jne case.0x404fba.37
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00408600
mov dword [esp], ebx
call fcn.00404090
movzx eax, al
mov dword [esp + 8], eax
mov eax, 0xfffffffe
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004088c0
jmp case.0x404fba.37
mov dword [esp], ebx
call fcn.00404090
movzx eax, al
mov dword [esp + 8], eax
xor eax, eax
jmp 0x405028
mov dword [esp], ebx
call fcn.00404090
movzx eax, al
mov dword [esp + 8], eax
mov eax, 1
jmp 0x405028
mov dword [esp], ebx
call fcn.00404090
movzx eax, al
mov dword [esp + 8], eax
mov eax, 2
jmp 0x405028
mov dword [esp], ebx
call fcn.00404090
movzx eax, al
mov dword [esp + 8], eax
mov eax, 3
jmp 0x405028
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00407f80
mov ecx, 0x73
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.004073d0
jmp case.0x404fba.37
mov edx, 0x72
mov dword [esp + 4], edx
jmp 0x4050a1
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00407ff0
cmp dl, 0x3d
je 0x4051be
and dword [ecx + 0xb0], 0xffffff7f
jmp case.0x404fba.37
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00404090
mov dword [esp], ebx
mov eax, 2
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 8], eax
mov eax, 0x423afc
mov dword [esp + 4], eax
call fcn.004090f0
jmp case.0x404fba.37
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.004043d0
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00408fe0
jmp case.0x404fba.37
mov dword [esp], ebx
mov eax, 1
mov dword [esp + 4], eax
call fcn.00408800
jmp case.0x404fba.37
mov eax, 1
jmp 0x405122
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.004045c0
mov dword [esp], ebx
mov ecx, 7
mov edx, str.e__1_2c
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call fcn.00402210
jmp case.0x404fba.37
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00404850
mov dword [ebp + 8], ebx
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00404510
mov dword [esp], ebx
call fcn.0040c000
mov dword [esp], ebx
mov eax, 1
mov dword [esp + 4], eax
call fcn.0040da40
jmp case.0x404fba.37
mov eax, 2
jmp 0x404fc6
or dword [ecx + 0xb0], 0x80
jmp case.0x404fba.37
Function at 0x4055b0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
test eax, eax
je 0x4055d2
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_realloc
test eax, eax
je 0x4055dc
leave
ret
mov dword [esp], edx
call sub.cygwin1.dll_malloc
jmp 0x4055cc
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], str.rxvt:_memory_allocation_failure.__Aborting
mov dword [esp + 0xc], eax
mov eax, 0x2a
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
call fcn.00405570
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov esi, esi
lea edi, [edi]

Function at 0x405620
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_calloc
test eax, eax
je 0x40563e
leave
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], str.rxvt:_memory_allocation_failure.__Aborting
mov dword [esp + 0xc], eax
mov eax, 0x2a
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
call fcn.00405570
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]

Function at 0x405830
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_malloc
test eax, eax
je 0x405847
leave
ret
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], str.rxvt:_memory_allocation_failure.__Aborting
mov dword [esp + 0xc], eax
mov eax, 0x2a
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
call fcn.00405570
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
lea edi, [edi]
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.cygwin1.dll_signal
call fcn.004053e0
mov dword [esp + 4], ebx
mov eax, dword [eax]
mov eax, dword [eax + 0x130]
mov dword [esp], eax
call sub.cygwin1.dll_kill
call fcn.00405570
call sub.cygwin1.dll_getpid
mov dword [esp], eax
mov dword [esp + 4], ebx
call sub.cygwin1.dll_kill
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40f9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test edx, edx
mov dword [ebp - 0x10], eax
je 0x40fa38
movzx eax, word [edx + 2]
test ax, ax
movsx edi, ax
je 0x40fa38
mov esi, dword [edx + 4]
test esi, esi
je 0x40fa38
cmp word [edx], 2
je 0x40fbd7
cmp byte [esi], 0x1b
jne 0x40fa77
movzx eax, byte [esi + 1]
cmp eax, 0x5d
je 0x40fa77
jle 0x40fbc9
cmp eax, 0x78
je 0x40fc1f
mov eax, dword [ebp - 0x10]
inc esi
mov dword [esp], 0x4242a0
mov dword [esp + 0xc], eax
mov eax, 2
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
jmp 0x40fa71
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xd
je 0x40fb4b
cmp eax, 0x1b
je 0x40fb9f
cmp bl, 0x1f
jbe 0x40fad0
test bl, bl
js 0x40fb39
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
movzx eax, bl
mov dword [esp], eax
call sub.cygwin1.dll_fputc
lea eax, [edi - 1]
movsx edi, ax
test di, di
jle 0x40fb20
movzx ebx, byte [esi]
inc esi
movzx eax, bl
cmp eax, 0x5c
je 0x40faf0
jle 0x40fa40
cmp eax, 0x5e
je 0x40fb75
cmp eax, 0x7f
jne 0x40fa52
mov eax, dword [ebp - 0x10]
mov dword [esp], 0x4242a3
mov dword [esp + 0xc], eax
mov eax, 2
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
cmp bl, 0x1f
ja 0x40fa57
lea esi, [esi]
lea edi, [edi]
movzx eax, bl
mov ecx, 0x4242a6
add eax, 0x40
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x40fa71
mov eax, dword [ebp - 0x10]
mov dword [esp], 0x4242aa
mov dword [esp + 0xc], eax
mov eax, 2
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
jmp 0x40fa71
mov dword [ebp + 8], 0xa
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.cygwin1.dll_fputc
movzx eax, bl
mov edx, 0x4242ad
mov dword [esp + 8], eax
mov dword [esp + 4], edx
jmp 0x40fae3
mov eax, dword [ebp - 0x10]
mov ecx, 2
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp], 0x4242b1
call sub.cygwin1.dll_fwrite
jmp 0x40fa71
mov eax, dword [ebp - 0x10]
mov dword [esp], 0x4242b4
mov dword [esp + 0xc], eax
mov eax, 2
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
jmp 0x40fa71
mov eax, dword [ebp - 0x10]
mov ebx, 1
mov dword [esp + 4], ebx
mov dword [esp], 0x4242b7
mov dword [esp + 0xc], eax
mov eax, 2
mov dword [esp + 8], eax
call sub.cygwin1.dll_fwrite
jmp 0x40fa71
cmp eax, 0x5b
jne 0x40fa10
jmp 0x40fa77
mov eax, dword [ebp - 0x10]
mov dword [esp], 0x4242ba
mov dword [esp + 0xc], eax
mov eax, 2
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_fwrite
cmp byte [esi], 0x1b
jne 0x40fa77
cmp byte [esi + 1], 0x5d
jne 0x40fa77
cmp byte [edi + esi - 1], 7
jne 0x40fa77
jmp 0x40fa71
cmp byte [edi + esi - 1], 0xd
jne 0x40fa10
lea eax, [edi - 1]
movsx edi, ax
jmp 0x40fa10
Function at 0x412660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
lea ebx, [ebp + 0xc]
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov ecx, 6
mov edx, 1
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp], str.rxvt:
call sub.cygwin1.dll_fwrite
call sub.cygwin1.dll___getreent
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_vfprintf
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputc
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x414240
Capabilities:
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov eax, dword [ebx]
mov eax, dword [eax + 0xcf0]
test eax, eax
je 0x414287
mov dword [esp], eax
call sub.cygwin1.dll_strlen
cmp eax, 0xfff
mov esi, eax
jbe 0x414294
mov dword [ebp + 8], str.Path_too_long
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp fcn.00412660
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], 0x1001
call sub.cygwin1.dll_malloc
mov dword [ebp - 0x10], eax
test eax, eax
je 0x414357
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov byte [eax + 0x1000], 0
mov dword [esp], 0x1001
call sub.cygwin1.dll_malloc
test eax, eax
mov edi, eax
je 0x41439a
mov byte [eax], 0
mov byte [eax + 0x1000], 0
mov eax, dword [ebx]
mov eax, dword [eax + 0xcf0]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcpy
mov eax, dword [ebx]
mov eax, dword [eax + 0xcf0]
cmp byte [eax], 0x5c
je 0x41436e
mov eax, 0x1000
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], edi
mov dword [esp], 2
mov dword [esp + 8], eax
call sub.cygwin1.dll_cygwin_conv_path
test eax, eax
je 0x4143b3
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [esp], eax
call fcn.00412660
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00421030
mov dword [ebp + 8], edi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp fcn.00421030
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [ebp + 8], eax
jmp 0x414276
cmp byte [eax + 1], 0x5c
je 0x4142f9
lea eax, [esi + 1]
cmp eax, 0xfff
jbe 0x4143d6
mov dword [esp], str.Path_too_long
call fcn.00412660
mov dword [esp], edi
call fcn.00421030
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
jmp 0x414346
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [esp], eax
call fcn.00412660
jmp 0x414392
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_chdir
test eax, eax
je 0x41438a
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [esp], eax
jmp 0x414385
mov dword [esp + 8], eax
lea eax, [edi + 1]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.cygwin1.dll_memmove
jmp 0x4142f9
Function at 0x414f80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0xf
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esi]
add eax, 0x160
mov dword [esp], eax
call sub.cygwin1.dll_cfsetospeed
mov eax, 0xf
mov dword [esp + 4], eax
mov eax, dword [esi]
add eax, 0x160
mov dword [esp], eax
call sub.cygwin1.dll_cfsetispeed
mov eax, dword [esi]
mov dword [esp], 0
add eax, 0x160
mov dword [esp + 8], eax
mov eax, 2
mov dword [esp + 4], eax
call sub.cygwin1.dll_tcsetattr
mov dword [esp], 2
xor eax, eax
mov dword [esp + 4], eax
call sub.cygwin1.dll_signal
mov dword [esp + 4], edi
mov dword [esp], 3
call sub.cygwin1.dll_signal
mov dword [esp], 0x14
xor ecx, ecx
mov dword [esp + 4], ecx
call sub.cygwin1.dll_signal
mov dword [esp], 0x12
mov edx, 1
mov dword [esp + 4], edx
call sub.cygwin1.dll_signal
mov dword [esp], 0x15
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_signal
mov dword [esp], 0x16
mov eax, 1
mov dword [esp + 4], eax
call sub.cygwin1.dll_signal
test ebx, ebx
je 0x415073
mov dword [esp + 4], ebx
mov eax, dword [ebx]
mov dword [esp], eax
call sub.cygwin1.dll_execvp
add esp, 0x1c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.SHELL
call sub.cygwin1.dll_getenv
test eax, eax
mov edi, eax
je 0x4150f0
cmp byte [eax], 0
je 0x4150f0
mov dword [esp], edi
call fcn.00412630
test byte [esi + 0x80], 2
mov dword [ebp - 0x10], eax
jne 0x4150c0
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.cygwin1.dll_execlp
add esp, 0x1c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call sub.cygwin1.dll_strlen
add eax, 2
mov dword [esp], eax
call fcn.00405830
mov byte [eax], 0x2d
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebx + 1]
mov dword [esp], eax
call sub.cygwin1.dll_strcpy
mov dword [ebp - 0x10], ebx
jmp 0x41509e
mov edi, str._bin_sh
jmp 0x41508a
Function at 0x415550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x1c
nop
lea esi, [esi]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov ebx, dword [eax]
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [esi*4 + 0x424560]
mov dword [esp + 4], eax
mov eax, dword [edx + 0x7c]
mov dword [esp], eax
call fcn.0041fb6d
mov dword [ebx + esi*4 + 0xc0], eax
inc esi
cmp esi, 9
jle 0x415560
mov ecx, dword [ebp + 8]
mov edi, 1
mov esi, 0x404070
mov dword [esp + 0xc], edi
mov eax, dword [ecx]
add eax, 0xdc
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x7c]
mov dword [esp], eax
call fcn.004209a9
mov dword [esp + 4], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x7c]
mov dword [esp], eax
call fcn.0041e085
mov eax, dword [edi + 0x80]
mov edx, dword [edi]
and eax, 0x400
cmp eax, 1
sbb eax, eax
and al, 0x9b
add al, 0x80
mov byte [edx + 4], al
mov dword [esp], edi
call fcn.00414780
mov eax, dword [edi + 0x80]
test ah, 8
jne 0x4156d2
mov ebx, dword [edi]
or dword [ebx + 0xb0], 0x10000
mov eax, dword [edi + 0x80]
test ah, 0x10
je 0x41562b
or dword [ebx + 0xb0], 0x20000
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x80]
test eax, 0x40000
jne 0x41563c
or dword [ebx + 0xb0], 0x40000
cld
mov esi, dword [ebx + 0x140]
mov edx, 0x4256aa
mov eax, 4
mov edi, edx
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x41565f
or dword [ebx + 0xb0], 0x100
mov eax, dword [ebp + 8]
cmp byte [eax + 0x5c], 0
je 0x41567c
or dword [ebx + 0xb0], 0x4000
or dword [ebx + 0xb4], 0x4000
mov edx, dword [ebp + 8]
cmp word [edx + 0x74], 0
je 0x41569a
or dword [ebx + 0xb0], 0x8000
or dword [ebx + 0xb4], 0x8000
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x7c]
mov dword [esp], eax
call fcn.0041e9f9
mov edi, dword [ebp + 8]
mov dword [edi + 0xe4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004151a0
mov dword [edi + 0xe8], eax
test eax, eax
js 0x4156dc
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
jmp 0x415613
mov dword [esp], str.aborting
call fcn.00412660
mov dword [esp], 1
call sub.cygwin1.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x417a50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov esi, dword [eax + 0x39c]
test esi, esi
jne 0x417c30
mov dword [ebp - 0x18], 0
mov dword [esp], str.HOME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x417b18
mov dword [esp], eax
xor esi, esi
call sub.cygwin1.dll_strlen
mov dword [ebp - 0x20], 0
add eax, 2
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov ebx, dword [eax*4 + 0x426b38]
mov dword [esp], ebx
call sub.cygwin1.dll_strlen
mov edx, dword [ebp - 0x24]
mov dword [esp], esi
add eax, edx
mov dword [esp + 4], eax
call fcn.004055b0
mov dword [esp + 0xc], ebx
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, str._s__s
mov dword [esp + 4], eax
call sub.cygwin1.dll_sprintf
mov dword [esp], esi
mov eax, 0x428016
mov dword [esp + 4], eax
call sub.cygwin1.dll__fopen64
mov dword [ebp - 0x18], eax
test eax, eax
jne 0x417b10
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jbe 0x417aae
mov dword [esp], esi
call fcn.00421030
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00417760
mov eax, str.Rxvt
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00417760
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x417c08
mov ebx, 0x428016
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.cygwin1.dll__fopen64
test eax, eax
mov ebx, eax
je 0x417c08
mov dword [esp + 4], ebx
mov edx, str.Rxvt
mov dword [esp + 8], edx
mov dword [esp], edi
call fcn.00417760
mov dword [esp + 4], ebx
mov eax, 0x427e71
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.00417760
mov dword [esp], ebx
call sub.cygwin1.dll_fclose
mov eax, str.XTerm
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00417760
mov eax, 0x427e71
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00417760
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x417be3
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_fclose
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00421030
mov eax, dword [edi]
mov eax, dword [eax + 0xc4c]
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004089d0
mov dword [esp], str._etc_X11_app_defaults_Rxvt
mov ecx, 0x428016
mov dword [esp + 4], ecx
call sub.cygwin1.dll__fopen64
test eax, eax
mov ebx, eax
jne 0x417b6f
jmp 0x417ba1
mov dword [esp], 0x100
call fcn.00405830
mov dword [ebp - 0x14], eax
mov eax, dword [edi]
mov ebx, 0xda
mov ecx, str._etc_X11_locale___.s_app_defaults_Rxvt
mov eax, dword [eax + 0x39c]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.cygwin1.dll_sprintf
jmp 0x417a79