joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a7d0
Capabilities:
Create directory
Terminate process
Write file on windows

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov edi, dword [eax]
movsx eax, byte [edi]
lea ebx, [edi + 1]
lea ecx, [eax - 0x30]
mov edx, eax
sub eax, 0x30
cmp cl, 9
jbe 0x41a807
jmp 0x41a85b
cmp eax, 0x19999999
ja 0x41a875
lea ecx, [eax + eax*4]
add ebx, 1
lea edx, [edx + ecx*2 - 0x30]
cmp edx, eax
jb 0x41a875
mov eax, edx
mov dword [esi], ebx
movsx edx, byte [ebx]
mov edi, ebx
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x41a7f0
lea ecx, [edx - 0x4b]
and ecx, 0xfd
jne 0x41a850
cmp eax, 0x3fffff
ja 0x41a875
mov ecx, eax
shl ecx, 0xa
cmp dl, 0x4d
je 0x41a86a
mov eax, ecx
lea edx, [edi + 1]
mov dword [esi], edx
movzx ecx, byte [edi + 1]
cmp cl, 0x69
jne 0x41a84b
lea edx, [edi + 2]
mov dword [esi], edx
movzx ecx, byte [edi + 2]
cmp cl, 0x42
je 0x41a854
pop ebx
pop esi
pop edi
ret
add edx, 1
mov dword [esi], edx
jmp 0x41a850
sub edx, 0x4b
xor eax, eax
and edx, 0xfd
je 0x41a834
jmp 0x41a850
shl eax, 0x14
cmp ecx, 0x3fffff
jbe 0x41a834
mov eax, str.error:_numeric_value_overflows_32_bit_unsigned_int
call fcn.0041a030
nop

Function at 0x41a880
Capabilities:
Create directory
Terminate process
Write file on windows

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov edi, dword [eax]
movsx eax, byte [edi]
lea ebx, [edi + 1]
lea ecx, [eax - 0x30]
mov edx, eax
sub eax, 0x30
cmp cl, 9
jbe 0x41a8b7
jmp 0x41a90b
cmp eax, 0x19999999
ja 0x41a925
lea ecx, [eax + eax*4]
add ebx, 1
lea edx, [edx + ecx*2 - 0x30]
cmp edx, eax
jb 0x41a925
mov eax, edx
mov dword [esi], ebx
movsx edx, byte [ebx]
mov edi, ebx
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x41a8a0
lea ecx, [edx - 0x4b]
and ecx, 0xfd
jne 0x41a900
cmp eax, 0x3fffff
ja 0x41a925
mov ecx, eax
shl ecx, 0xa
cmp dl, 0x4d
je 0x41a91a
mov eax, ecx
lea edx, [edi + 1]
mov dword [esi], edx
movzx ecx, byte [edi + 1]
cmp cl, 0x69
jne 0x41a8fb
lea edx, [edi + 2]
mov dword [esi], edx
movzx ecx, byte [edi + 2]
cmp cl, 0x42
je 0x41a904
pop ebx
pop esi
pop edi
ret
add edx, 1
mov dword [esi], edx
jmp 0x41a900
sub edx, 0x4b
xor eax, eax
and edx, 0xfd
je 0x41a8e4
jmp 0x41a900
shl eax, 0x14
cmp ecx, 0x3fffff
jbe 0x41a8e4
mov eax, str.error:_numeric_value_overflows_size_t
call fcn.0041a030
nop
Function at 0x41ad20
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], str.pathname___NULL
mov dword [esp + 8], str.trimLeadingCurrentDirConst
mov dword [esp + 4], 0x34e
mov dword [esp], str.util.c
call sub.cygwin1.dll___assert_func
lea esi, [esi]
nop

Function at 0x41ad50
Capabilities:
Create directory
Terminate process
Write file on windows

Disassembly:
sub esp, 0x2c
mov eax, dword [0x432028]
test eax, eax
jle 0x41ad8c
call sub.cygwin1.dll___getreent
mov dword [esp + 0x10], str.table___NULL
mov dword [esp + 0xc], 0x1e0
mov dword [esp + 8], str.util.c
mov dword [esp + 4], str.Error_:__s___i_:__s
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
nop

Function at 0x41ada0
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x3c
mov dword [esp], eax
mov dword [esp + 0x2c], eax
call sub.cygwin1.dll_strlen
mov dword [esp], esi
mov ebx, eax
call sub.cygwin1.dll_strlen
mov edi, eax
lea eax, [ebx + eax + 2]
mov dword [esp], eax
call sub.cygwin1.dll_malloc
mov ecx, dword [esp + 0x2c]
test eax, eax
je 0x41ae1b
mov dword [esp + 8], ebx
mov ebp, eax
mov dword [esp + 4], ecx
add ebx, ebp
mov dword [esp], eax
call sub.cygwin1.dll_memcpy
cmp byte [esi], 0x2e
mov byte [ebx], 0
je 0x41ae11
cmp byte [ebx - 1], 0x2f
je 0x41adfd
mov byte [ebx], 0x2f
add ebx, 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.cygwin1.dll_memcpy
mov byte [ebx + edi], 0
add esp, 0x3c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [0x432028], 0
jle 0x41ae54
call sub.cygwin1.dll___getreent
mov dword [esp + 0x10], str.outDirBuffer___NULL
mov dword [esp + 0xc], 0x36f
mov dword [esp + 8], str.util.c
mov dword [esp + 4], str.Error_:__s___i_:__s
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
Function at 0x41ae60
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
test eax, eax
je 0x41aea5
mov dword [esp], eax
mov ebx, eax
call sub.cygwin1.dll_strlen
test eax, eax
je 0x41aec9
mov dword [esp + 4], 0x2f
mov dword [esp], ebx
call sub.cygwin1.dll_strrchr
test eax, eax
je 0x41ae98
mov byte [eax], 0
add esp, 0x18
pop ebx
ret
mov eax, 0x2e
mov word [ebx], ax
add esp, 0x18
pop ebx
ret
mov dword [esp + 0xc], str.pathname___NULL
mov dword [esp + 8], str.convertPathnameToDirName
mov dword [esp + 4], 0x329
mov dword [esp], str.util.c
call sub.cygwin1.dll___assert_func
mov dword [esp + 0xc], str.len___0
mov dword [esp + 8], str.convertPathnameToDirName
mov dword [esp + 4], 0x32d
mov dword [esp], str.util.c
call sub.cygwin1.dll___assert_func
lea esi, [esi]
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x41af5f
movzx edx, byte [eax]
cmp dl, 0x2e
je 0x41af40
cmp dl, 0x2f
sete dl
movzx edx, dl
add eax, edx
mov edx, dword [ecx]
test edx, edx
je 0x41af5f
movzx ecx, byte [edx]
cmp cl, 0x2e
je 0x41af50
cmp cl, 0x2f
sete cl
movzx ecx, cl
add edx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
add esp, 0xc
jmp fcn.00423288
cmp byte [eax + 1], 0x2f
jne 0x41af14
movzx edx, byte [eax + 2]
add eax, 2
jmp 0x41af09
cmp byte [edx + 1], 0x2f
jne 0x41af2d
movzx ecx, byte [edx + 2]
add edx, 2
jmp 0x41af22
call fcn.0041ad20
lea esi, [esi]
lea esi, [esi]
nop
Function at 0x41af70
Capabilities:
Create directory
Write file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x70
test eax, eax
je 0x41b0d5
movzx ecx, byte [ebx]
mov eax, edx
mov edx, ebx
cmp cl, 0x2e
je 0x41b040
cmp cl, 0x2f
sete cl
movzx ecx, cl
add edx, ecx
call fcn.0041ada0
mov esi, eax
test eax, eax
je 0x41b0cb
lea eax, [esp + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.cygwin1.dll__stat64
test eax, eax
jne 0x41b090
mov eax, dword [esp + 0x20]
mov edx, eax
and edx, 0xf000
cmp edx, 0x4000
jne 0x41b060
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.cygwin1.dll_mkdir
mov ebx, eax
test eax, eax
jne 0x41b000
xor ebx, ebx
mov dword [esp], esi
call sub.cygwin1.dll_free
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call sub.cygwin1.dll___errno
cmp dword [eax], 0x11
je 0x41afec
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov edi, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], str.zstd:_failed_to_create_DIR__s:__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x41afee
cmp byte [ebx + 1], 0x2f
jne 0x41af9b
movzx ecx, byte [ebx + 2]
lea edx, [ebx + 2]
jmp 0x41af90
call sub.cygwin1.dll___getreent
mov dword [esp + 8], ebx
mov dword [esp + 4], str.zstd:_expected_directory:__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov eax, 0x1ed
jmp 0x41afda
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.cygwin1.dll_strerror
mov edi, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.zstd:_failed_to_get_DIR_stats__s:__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov eax, 0x1ed
jmp 0x41afda
mov ebx, 0xfffffff4
jmp 0x41aff6
call fcn.0041ad20
lea esi, [esi]

Function at 0x41b0e0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x2c]
test esi, esi
jne 0x41b150
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
call sub.cygwin1.dll_getchar
mov dword [esp + 4], eax
mov ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x41b188
cmp ebx, 0xffffffff
je 0x41b13f
cmp ebx, 0xa
je 0x41b13f
lea esi, [esi]
call sub.cygwin1.dll_getchar
cmp eax, 0xffffffff
je 0x41b13f
cmp eax, 0xa
jne 0x41b130
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
call sub.cygwin1.dll___getreent
mov esi, 1
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x24
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.stdin_is_an_input___not_proceeding._n
call sub.cygwin1.dll_fwrite
add esp, 0x14
mov eax, esi
pop ebx
pop esi
ret
call sub.cygwin1.dll___getreent
mov esi, 1
mov eax, dword [eax + 0xc]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
jmp 0x41b120
Function at 0x41bcf0
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
lea eax, [esi*4]
mov dword [esp], eax
call sub.cygwin1.dll_malloc
test eax, eax
je 0x41bd37
mov dword [esp], 0x10
mov ebx, eax
call sub.cygwin1.dll_malloc
test eax, eax
je 0x41bd3b
mov dword [eax], ebx
mov dword [eax + 4], 0
mov dword [eax + 0xc], esi
mov dword [eax + 8], 0
add esp, 0x14
pop ebx
pop esi
ret
xor eax, eax
jmp 0x41bd31
call fcn.0041ad50

Function at 0x41bd40
Capabilities:
Terminate process

Disassembly:
push ebx
sub esp, 0x18
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jae 0x41bd64
mov ebx, dword [esp + 0x24]
mov ecx, dword [edx]
mov dword [ecx + eax*4], ebx
add eax, 1
mov dword [edx + 8], eax
add esp, 0x18
pop ebx
ret
mov dword [esp + 0xc], str.fnt__tableSize___fnt__tableCapacity
mov dword [esp + 8], str.UTIL_refFilename
mov dword [esp + 4], 0x202
mov dword [esp], str.util.c
call sub.cygwin1.dll___assert_func
lea esi, [esi]
nop
Function at 0x41c220
Capabilities:
Create directory
Terminate process

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, ebx
jmp 0x41c239
cmp byte [eax - 1], 0x2f
je 0x41c251
add eax, 1
mov dword [esp + 4], 0x42981d
mov dword [esp], eax
call sub.cygwin1.dll_strstr
test eax, eax
je 0x41c270
cmp ebx, eax
jne 0x41c230
movzx edx, byte [eax + 2]
test dl, dl
je 0x41c25e
cmp dl, 0x2f
jne 0x41c236
xor ebx, ebx
add esp, 0x18
mov eax, ebx
pop ebx
ret
test ebx, ebx
je 0x41c2af
movzx eax, byte [ebx]
cmp al, 0x2e
je 0x41c2a0
cmp al, 0x2f
sete al
movzx eax, al
add ebx, eax
mov eax, dword [esp + 0x24]
mov edx, ebx
call fcn.0041ada0
mov ebx, eax
call fcn.0041ae60
add esp, 0x18
mov eax, ebx
pop ebx
ret
cmp byte [ebx + 1], 0x2f
jne 0x41c285
movzx eax, byte [ebx + 2]
add ebx, 2
jmp 0x41c27b
call fcn.0041ad20
lea esi, [esi]
lea esi, [esi]
nop
Function at 0x41c970
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov eax, dword [edi]
mov dword [esp + 8], edx
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0041c6a0
test eax, eax
je 0x41c9c7
mov esi, dword [edi]
mov ebx, eax
test esi, esi
je 0x41c9be
mov eax, dword [esi]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov dword [esp], esi
call sub.cygwin1.dll_free
mov dword [edi], ebx
add esp, 0x20
pop ebx
pop esi
pop edi
ret
cmp dword [0x432028], 0
jle 0x41ca00
call sub.cygwin1.dll___getreent
mov dword [esp + 0x10], str.newFNT___NULL
mov dword [esp + 0xc], 0x448
mov dword [esp + 8], str.util.c
mov dword [esp + 4], str.Error_:__s___i_:__s
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x24]
lea edi, [esi*4]
mov dword [esp], edi
call sub.cygwin1.dll_malloc
test eax, eax
je 0x41ca69
mov ebx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.cygwin1.dll_memcpy
mov dword [esp], 0x10
call sub.cygwin1.dll_malloc
test eax, eax
je 0x41ca6d
mov dword [eax], ebx
mov dword [eax + 4], 0
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
add esp, 0x10
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x41ca62
call fcn.0041ad50
lea esi, [esi]
lea esi, [esi]
mov eax, dword [0x43202c]
test eax, eax
je 0x41ca90
ret
sub esp, 0x1c
mov dword [esp], 0xa
call sub.cygwin1.dll_sysconf
cmp eax, 0xffffffff
je 0x41cab0
mov dword [0x43202c], eax
add esp, 0x1c
ret
mov dword [0x43202c], 1
mov eax, 1
add esp, 0x1c
ret
Function at 0x41cf50
Capabilities:
Delete file

Disassembly:
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x70
lea esi, [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.0041b1b0
test eax, eax
jne 0x41cfb0
cmp dword [0x42601c], 1
jg 0x41cf80
add esp, 0x70
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 8], edi
mov dword [esp + 4], str.zstd:_Failed_to_stat__s_while_trying_to_remove_it_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp], esi
call fcn.0041b220
mov ebx, eax
test eax, eax
jne 0x41cff0
cmp dword [0x42601c], 1
jle 0x41cf75
call sub.cygwin1.dll___getreent
mov dword [esp + 8], edi
mov dword [esp + 4], str.zstd:_Refusing_to_remove_non_regular_file__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp], edi
call sub.cygwin1.dll_remove
add esp, 0x70
mov ebx, eax
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x420510
Capabilities:
Terminate process
Write file on windows

Disassembly:
push edi
mov edi, eax
push esi
mov esi, edx
push ebx
sub esp, 0x10
mov dword [esp], ecx
call fcn.00410170
mov dword [esp], eax
mov ebx, eax
call fcn.00405220
test eax, eax
jne 0x420547
mov dword [esp], edi
call sub.cygwin1.dll_free
mov dword [esp], esi
call sub.cygwin1.dll_free
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov eax, dword [0x42601c]
cmp eax, 4
jg 0x420561
test eax, eax
jg 0x42058a
mov dword [esp], 0xb
call sub.cygwin1.dll_exit
call sub.cygwin1.dll___getreent
mov dword [esp + 8], str.ZSTD_freeDStream_ress.dctx_
mov dword [esp + 4], str._s__n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
cmp dword [0x42601c], 0
jle 0x4205b2
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.zstd:
call sub.cygwin1.dll_fwrite
cmp dword [0x42601c], 4
jle 0x4205e3
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], 0x7ff
mov dword [esp + 8], str.fileio.c
mov dword [esp + 4], str.Error_defined_at__s__line__i_:__n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
cmp dword [0x42601c], 0
jle 0x420555
call sub.cygwin1.dll___getreent
mov dword [esp + 8], 0xb
mov dword [esp + 4], str.error__i_:
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
cmp dword [0x42601c], 0
jle 0x420555
mov dword [esp], ebx
call fcn.00405230
mov ebx, eax
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.cygwin1.dll_fputs
cmp dword [0x42601c], 0
jle 0x420555
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], 0x429bfd
call sub.cygwin1.dll_fwrite
jmp 0x420555
Function at 0x420690
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp], 0x74
call sub.cygwin1.dll_malloc
test eax, eax
je 0x420760
mov dword [eax], 0
mov dword [eax + 0x58], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax + 0xc], 1
mov dword [eax + 0x54], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 1
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0x270f
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0xffffffce
mov dword [eax + 0x28], 0x16
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0x270f
mov dword [eax + 0x3c], 0x270f
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x70], 0
add esp, 0x1c
ret
cmp dword [0x42601c], 0
jg 0x420782
cmp dword [0x42601c], 4
jg 0x42084b
mov dword [esp], 0x15
call sub.cygwin1.dll_exit
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.zstd:
call sub.cygwin1.dll_fwrite
cmp dword [0x42601c], 4
jg 0x42084b
cmp dword [0x42601c], 0
jle 0x420776
call sub.cygwin1.dll___getreent
mov dword [esp + 8], 0x15
mov dword [esp + 4], str.error__i_:
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
cmp dword [0x42601c], 0
jle 0x420776
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x24
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.Allocation_error_:_not_enough_memory
call sub.cygwin1.dll_fwrite
cmp dword [0x42601c], 0
jle 0x420776
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], 0x429bfd
call sub.cygwin1.dll_fwrite
jmp 0x420776
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], 0x172
mov dword [esp + 8], str.fileio.c
mov dword [esp + 4], str.Error_defined_at__s__line__i_:__n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x4207b7
Function at 0x420880
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp], 0x1c
call sub.cygwin1.dll_malloc
test eax, eax
je 0x4208c7
mov dword [eax + 0xc], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax], 1
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
add esp, 0x1c
ret
cmp dword [0x42601c], 0
jg 0x4208e9
cmp dword [0x42601c], 4
jg 0x4209b2
mov dword [esp], 0x15
call sub.cygwin1.dll_exit
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.zstd:
call sub.cygwin1.dll_fwrite
cmp dword [0x42601c], 4
jg 0x4209b2
cmp dword [0x42601c], 0
jle 0x4208dd
call sub.cygwin1.dll___getreent
mov dword [esp + 8], 0x15
mov dword [esp + 4], str.error__i_:
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
cmp dword [0x42601c], 0
jle 0x4208dd
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x24
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.Allocation_error_:_not_enough_memory
call sub.cygwin1.dll_fwrite
cmp dword [0x42601c], 0
jle 0x4208dd
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], 0x429bfd
call sub.cygwin1.dll_fwrite
jmp 0x4208dd
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], 0x194
mov dword [esp + 8], str.fileio.c
mov dword [esp + 4], str.Error_defined_at__s__line__i_:__n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x42091e
Function at 0x421030
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x44]
lea eax, [esi*4]
mov dword [esp], eax
mov dword [esp + 0x1c], eax
call sub.cygwin1.dll_malloc
test eax, eax
je 0x42116a
mov ebx, eax
xor edi, edi
test esi, esi
je 0x421148
lea esi, [esi]
mov eax, dword [esp + 0x40]
mov ebp, dword [eax + edi*4]
mov dword [esp + 4], 0x2f
mov dword [esp], ebp
call sub.cygwin1.dll_strrchr
test eax, eax
je 0x421130
add eax, 1
mov dword [ebx + edi*4], eax
add edi, 1
cmp edi, esi
jne 0x421068
mov dword [esp + 0xc], 0x41b480
mov dword [esp + 8], 4
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.cygwin1.dll_qsort
mov ebp, dword [ebx]
cmp esi, 1
je 0x421115
mov eax, dword [esp + 0x1c]
lea esi, [ebx + 4]
add eax, ebx
mov dword [esp + 0x1c], eax
jmp 0x4210db
mov ebp, edi
add esi, 4
cmp dword [esp + 0x1c], esi
je 0x421115
mov edi, dword [esi]
mov dword [esp], ebp
mov dword [esp + 4], edi
call fcn.00423288
test eax, eax
jne 0x4210d0
call sub.cygwin1.dll___getreent
mov dword [esp + 8], ebp
add esi, 4
mov dword [esp + 4], str.WARNING:_Two_files_have_same_filename:__s_n
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov ebp, dword [esi - 4]
cmp dword [esp + 0x1c], esi
jne 0x4210db
mov dword [esp], ebx
call sub.cygwin1.dll_free
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + edi*4], ebp
add edi, 1
cmp esi, edi
jne 0x421068
jmp 0x421094
mov dword [esp + 0xc], 0x41b480
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.cygwin1.dll_qsort
jmp 0x421115
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], 0x41
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.Unable_to_malloc_new_str_array__not_checking_for_name_collisions_n
call sub.cygwin1.dll_fwrite
mov eax, 1
jmp 0x42111f
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x401047
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x40108f
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x401060
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x401094
test ecx, ecx
je 0x40108f
test edi, edi
ja 0x401055
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401091
Function at 0x40264f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor ecx, ecx
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x402657
mov dword [ecx*4 + 0x48bc80], eax
inc ecx
cmp ecx, 0x100
jb 0x402652
mov edx, 0x800
jmp 0x4026a4
mov eax, dword [ecx*4 + 0x48b880]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x48bc80]
inc ecx
mov dword [ecx*4 + 0x48bc7c], eax
cmp ecx, edx
jb 0x402683
mov dword [0x48a390], 0x4026c7
call fcn.00410af4
test eax, eax
jne 0x4026c5
mov dword [0x48a390], 0x402763
pop esi
ret

Function at 0x402fe5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [esi]
test edi, edi
je 0x40302d
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x402ffe
mov eax, edi
and dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x403032
test ecx, ecx
je 0x40302d
test edi, edi
ja 0x402ff3
xor eax, eax
pop edi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40302f