joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b62c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [0x5993b8]
cmp eax, 1
je 0x43b671
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_link
test eax, eax
je 0x43b663
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43b692
cmp dword [ebp - 0xc], 0x11
je 0x43b692
jmp 0x43b672
nop
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_rename
test eax, eax
je 0x43b6cb
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004bb651
cmp dword [ebp - 0xc], 0
je 0x43b6ce
cmp dword [ebp - 0xc], 0x11
je 0x43b6ce
mov dword [esp], 0x5a6849
call fcn.004379fc
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b572d
call fcn.004374ec
jmp 0x43b705
nop
jmp 0x43b6cf
nop
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0044d488
test eax, eax
je 0x43b700
mov dword [esp], str.unable_to_set_permission_to__s
call fcn.004379fc
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b5782
call fcn.004374ec
jmp 0x43b705
mov eax, 0
leave
ret

Function at 0x43b874
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0043b840
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004376ab
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00492789
mov dword [esp + 4], str.tmp_obj_XXXXXX
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0043779e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x124
mov dword [esp], eax
call fcn.004bb378
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x43b9a5
cmp dword [ebp - 0x10], 0
je 0x43b9a5
call sub.cygwin1.dll___errno
mov eax, dword [eax]
cmp eax, 2
jne 0x43b9a5
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004376ab
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00492789
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x1ff
mov dword [esp], eax
call sub.cygwin1.dll_mkdir
test eax, eax
je 0x43b960
call sub.cygwin1.dll___errno
mov eax, dword [eax]
cmp eax, 0x11
je 0x43b960
mov eax, 0xffffffff
jmp 0x43b9a8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp], eax
call fcn.0044d488
test eax, eax
je 0x43b979
mov eax, 0xffffffff
jmp 0x43b9a8
mov dword [esp + 4], str._tmp_obj_XXXXXX
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0043779e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [esp + 4], 0x124
mov dword [esp], eax
call fcn.004bb378
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x43de1a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
cmp dl, al
je 0x43de34
mov eax, 0
jmp 0x43de72
add dword [ebp + 0xc], 1
add dword [ebp + 0x10], 1
sub dword [ebp + 8], 2
cmp dword [ebp + 8], 1
ja 0x43de1d
cmp dword [ebp + 8], 0
je 0x43de6d
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
xor eax, edx
movzx eax, al
and eax, 0xf0
test eax, eax
je 0x43de6d
mov eax, 0
jmp 0x43de72
mov eax, 1
pop ebp
ret
Function at 0x44adde
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jne 0x44adf4
mov eax, 0
jmp 0x44ae7b
mov dword [esp], str.GIT_PAGER
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44ae2e
mov eax, dword [0x61ca10]
test eax, eax
jne 0x44ae26
mov dword [esp + 4], 0
mov dword [esp], 0x44ad9e
call fcn.0041a267
mov eax, dword [0x61ca10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44ae43
mov dword [esp], str.PAGER
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x44ae50
mov dword [ebp - 0xc], str.less
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x44ae71
mov dword [esp + 4], 0x5a8128
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x44ae78
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x44ae7d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str.LESSFRX_LV_c
call fcn.004ba79d
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004d0077
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jns 0x44aec8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004d0342
mov dword [esp + 4], eax
mov dword [esp], str.malformed_build_time_PAGER_ENV:__s
call fcn.004b54c7
mov dword [ebp - 0xc], 0
jmp 0x44af48
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], 0x3d
mov dword [esp], eax
call sub.cygwin1.dll_strchr
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x44af03
mov dword [esp], str.malformed_build_time_PAGER_ENV
call fcn.004b54c7
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x44af44
mov eax, dword [ebp - 0x18]
mov byte [eax], 0x3d
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004962f4
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jl 0x44aed1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_free
nop
leave
ret
Function at 0x44b104
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x61ca18]
test eax, eax
je 0x44b11d
mov eax, dword [0x61ca18]
jmp 0x44b1b1
mov dword [0x61ca18], 0x50
mov dword [0x61ca14], 1
mov dword [esp], str.COLUMNS
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44b16e
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_atoi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x44b16e
mov eax, dword [ebp - 0x10]
mov dword [0x61ca18], eax
mov dword [0x61ca14], 0
jmp 0x44b1ac
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5401
mov dword [esp], 1
call sub.cygwin1.dll_ioctl
test eax, eax
jne 0x44b1ac
movzx eax, word [ebp - 0x16]
test ax, ax
je 0x44b1ac
movzx eax, word [ebp - 0x16]
movzx eax, ax
mov dword [0x61ca18], eax
mov dword [0x61ca14], 0
mov eax, dword [0x61ca18]
leave
ret

Function at 0x44b1b3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
call fcn.0050aa76
test eax, eax
je 0x44b1f0
call fcn.0044b104
mov ebx, eax
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], 0x5a81a6
mov dword [esp + 8], ebx
mov dword [esp + 4], str._r_s_r
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x44b218
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str._re_K
call sub.cygwin1.dll_fwrite
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x44cfe8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x24], 0x61d2e4
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x44d129
mov eax, dword [ebp + 8]
lea edx, [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], str.__prefix__
mov dword [esp], eax
call fcn.0044b76d
test eax, eax
je 0x44d049
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0042cb25
jmp 0x44d140
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x7e
jne 0x44d102
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x2f
mov dword [esp], eax
call fcn.0044b810
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x44d0cc
mov dword [esp], str.HOME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x44d12c
cmp dword [ebp + 0xc], 0
je 0x44d0b8
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.00493d03
jmp 0x44d0fc
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.0044b97b
jmp 0x44d0fc
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0044cfaf
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x44d12f
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x18]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.0044b97b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.0044b97b
mov dword [esp + 4], 0
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.00491d0b
jmp 0x44d140
nop
jmp 0x44d130
nop
jmp 0x44d130
nop
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.00491cd8
mov eax, 0
leave
ret
Function at 0x44e458
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
jne 0x44e488
mov dword [esp + 0xc], str.subdir
mov dword [esp + 8], str.xdg_config_home_for
mov dword [esp + 4], 0x605
mov dword [esp], str.path.c
call sub.cygwin1.dll___assert_func
cmp dword [ebp + 0xc], 0
jne 0x44e4b2
mov dword [esp + 0xc], 0x5a8414
mov dword [esp + 8], str.xdg_config_home_for
mov dword [esp + 4], 0x606
mov dword [esp], str.path.c
call sub.cygwin1.dll___assert_func
mov dword [esp], str.XDG_CONFIG_HOME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44e4f4
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x44e4f4
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x5a842d
call fcn.0044c977
jmp 0x44e531
mov dword [esp], str.HOME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x44e52c
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], str._s_.config__s__s
call fcn.0044c977
jmp 0x44e531
mov eax, 0
leave
ret

Function at 0x4573f9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
and eax, 1
test eax, eax
je 0x457467
mov dword [esp], str.GIT_ASKPASS
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x45742d
mov eax, dword [0x61c3b8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x457442
mov dword [esp], str.SSH_ASKPASS
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x457467
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test al, al
je 0x457467
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004572cd
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4574d8
mov dword [esp + 4], 1
mov dword [esp], str.GIT_TERMINAL_PROMPT
call fcn.00419cc6
test eax, eax
je 0x4574b1
mov eax, dword [ebp + 0xc]
and eax, 2
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004e8274
mov dword [ebp - 0xc], eax
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov dword [ebp - 0x14], eax
jmp 0x4574b8
mov dword [ebp - 0x14], str.terminal_prompts_disabled
cmp dword [ebp - 0xc], 0
jne 0x4574d8
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.could_not_read__s_s
call fcn.004b54c7
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x45c471
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_INDEX_VERSION
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0x10], 0
jne 0x45c4e5
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0047909e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x68]
test eax, eax
js 0x45c4b1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jbe 0x45c4bd
cmp dword [ebp - 0xc], 4
jbe 0x45c4e0
mov dword [esp], str.index.version_set__but_the_value_is_invalid._nUsing_version__i
call fcn.00458e80
mov dword [esp + 4], 3
mov dword [esp], eax
call fcn.004b57fa
mov eax, 3
jmp 0x45c53e
mov eax, dword [ebp - 0xc]
jmp 0x45c53e
mov dword [esp + 8], 0xa
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_strtoul
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
jne 0x45c518
cmp dword [ebp - 0xc], 1
jbe 0x45c518
cmp dword [ebp - 0xc], 4
jbe 0x45c53b
mov dword [esp], str.GIT_INDEX_VERSION_set__but_the_value_is_invalid._nUsing_version__i
call fcn.00458e80
mov dword [esp + 4], 3
mov dword [esp], eax
call fcn.004b57fa
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x462aed
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0xc], str.init.defaultbranch
mov dword [ebp - 0x10], str.init.defaultBranch
mov dword [ebp - 0x1c], 0
mov dword [esp], str.GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x462b38
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x462b38
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.004ba79d
mov dword [ebp - 0x1c], eax
jmp 0x462b70
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041aca5
test eax, eax
jns 0x462b70
mov dword [esp], str.could_not_retrieve___s_
call fcn.00461d25
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b54c7
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x462ba7
mov dword [esp], str.master
call fcn.004ba79d
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0xc], 0
jne 0x462ba7
mov ebx, dword [ebp - 0x1c]
mov dword [esp], str.Using__s_as_the_name_for_the_initial_branch._This_default_branch_name_nis_subject_to_change._To_configure_the_initial_branch_name_to_use_in_all_nof_your_new_repositories__which_will_suppress_this_warning__call:_n_n_tgit_config___global_init.defaultBranch__name__n_nNames_commonly_chosen_instead_of_master_are_main__trunk_and_ndevelopment._The_just_created_branch_can_be_renamed_via_this_command:_n_n_tgit_branch__m__name__n
call fcn.00461d25
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004cf9f3
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x5aa710
call fcn.00493f3d
mov dword [ebp - 0x18], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.00462091
test eax, eax
je 0x462bf6
mov ebx, dword [ebp - 0x1c]
mov dword [esp], str.invalid_branch_name:__s___s
call fcn.00461d25
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b54c7
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x46394d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x9c], eax
mov dword [esp + 8], 0x88
mov dword [esp + 4], 0
lea eax, [ebp - 0x90]
mov dword [esp], eax
call sub.cygwin1.dll_memset
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x463a00
lea eax, [ebp - 0x90]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x463870
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00466308
mov eax, 0
jmp 0x463aab
lea eax, [ebp - 0x90]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x463606
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00466308
mov eax, dword [ebp - 0x7c]
test eax, eax
jne 0x463a74
mov eax, dword [ebp + 0x10]
and eax, 1
test eax, eax
je 0x463a59
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x3dd
mov dword [esp], str.refs.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov dword [esp], str.log_for__s_is_empty
call fcn.00461d25
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b54c7
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x463a82
mov eax, 0
jmp 0x463aab
lea eax, [ebp - 0x90]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4638cb
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00466367
mov eax, 1
leave
ret
Function at 0x46b3de
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 4
mov dword [esp], eax
call fcn.00434ef5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_unlink
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_symlink
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
cmp dword [ebp - 0xc], 0
je 0x46b455
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2a
mov dword [esp + 4], 1
mov dword [esp], str.no_symlink___falling_back_to_symbolic_ref_n
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x486071
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], str.PATH
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0x61d2e4
cmp dword [ebp - 0xc], 0
je 0x4860b2
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x4860bc
mov eax, 0
jmp 0x48617b
mov dword [esp + 4], 0x3a
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00485b3f
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00485be9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x48611c
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00492789
mov dword [esp + 4], 0x2f
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00485c80
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00485cdc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00486037
test eax, eax
je 0x486152
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00491d0b
jmp 0x48617b
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test al, al
je 0x48616a
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4860bc
nop
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00491cd8
mov eax, 0
leave
ret
Function at 0x487ddd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0x20
jne 0x487e42
call fcn.00487d95
test eax, eax
je 0x487dfe
mov dword [esp], 0x8d
call fcn.00487dcc
mov dword [esp + 4], 0
mov dword [esp], 0xd
call sub.cygwin1.dll_signal
mov dword [esp], 0xd
call sub.cygwin1.dll_raise
mov dword [esp + 8], 0x8d
mov dword [esp + 4], 0x48b
mov dword [esp], str.run_command.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
nop
leave
ret

Function at 0x489ee3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_COMMON_DIR
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x489f17
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004896e6
mov eax, 1
jmp 0x489f29
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00489f2b
leave
ret