joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x6f77027e
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x57bd4832
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a
Function at 0x401170
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x28
mov dword [esp + 0xc], str.mosh_1.3.2
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 8], str.mosh_1.3.2
mov dword [esp + 4], str.mosh_client___s___build__s__n
mov dword [esp], ebx
call sub.cygwin1.dll_fprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x33
mov dword [esp + 4], 1
mov dword [esp], str.Copyright_2012_Keith_Winstein__mosh_devel_mit.edu__n
call sub.cygwin1.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0xc8
mov dword [esp + 4], 1
mov dword [esp], str.License_GPLv3:_GNU_GPL_version_3_or_later__http:__gnu.org_licenses_gpl.html_._nThis_is_free_software:_you_are_free_to_change_and_redistribute_it._nThere_is_NO_WARRANTY__to_the_extent_permitted_by_law._n
call sub.cygwin1.dll_fwrite
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x4011f2
add esp, 0x28
pop ebx
ret
call sub.cygwin1.dll___stack_chk_fail
lea esi, [esi]
nop

Function at 0x401260
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
mov ebp, dword [esp + 0x50]
call sub.cygwin1.dll___getreent
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x476354
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
call sub.cygwin1.dll_abort
nop
lea esi, [esi]

Function at 0x4012b0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c
mov dword [esp + 0xc], str._shutdown_in_progress
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 8], str.MyState_Network::TransportSender_MyState_::get_current_state____with_MyState__Network::UserStream_
mov dword [esp + 4], 0x8c
mov dword [esp], str.._.._network_transportsender.h
call sub.cygwin1.dll___assert_func
lea esi, [esi]
lea esi, [esi]
Function at 0x4012f0
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
mov edi, method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.append_wchar_t_const__unsigned_int_
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
cmp ebx, edx
je 0x40134a
mov ebp, edx
mov dword [esp + 8], ecx
mov esi, edx
sub ebp, ebx
mov dword [esp + 4], 0
mov dword [esp], ebp
call fcn.004511f0
lea edi, [eax + 0xc]
mov ecx, eax
mov eax, ebx
mov edx, edi
movsx bx, byte [eax]
add eax, 1
add edx, 2
mov word [edx - 2], bx
cmp esi, eax
jne 0x401330
cmp ecx, sym.imp.cygstdc_6.dll_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_Rep::_S_empty_rep_storage
jne 0x401360
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x401372
add esp, 0x2c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
mov dword [ecx + 8], 0
mov dword [ecx], ebp
mov word [ecx + ebp*2 + 0xc], ax
jmp 0x40134a
call sub.cygwin1.dll___stack_chk_fail
nop
lea esi, [esi]
nop

Function at 0x401380
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x124
lea esi, [esp + 0x1c]
mov dword [esp + 0xc], edx
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 8], 0x476434
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], esi
call sub.cygwin1.dll_swprintf
mov dword [esp], esi
call sub.cygwin1.dll_wcslen
mov dword [esp + 4], esi
mov dword [esp + 8], eax
lea eax, [ebx + 0x14]
mov dword [esp], eax
call fcn.004511d0
mov byte [ebx + 0x18], 1
call fcn.0040bc40
add eax, 0xc1c
adc edx, 0
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], edx
mov eax, dword [esp + 0x11c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x401402
add esp, 0x124
pop ebx
pop esi
ret
call sub.cygwin1.dll___stack_chk_fail
nop
lea esi, [esi]
nop
Function at 0x4016b0
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
sub esp, 0x24
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], 2
mov dword [esp], 0
lea eax, [ebx + 0x4c]
mov dword [esp + 8], eax
call sub.cygwin1.dll_tcsetattr
test eax, eax
js 0x401760
lea eax, [ebx + 0x254]
lea esi, [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00415520
sub esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0xffffffff
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.0041e7a0
mov eax, dword [esp + 0x18]
lea edx, [eax - 0xc]
cmp eax, method.std::string.swap_std::string_
jne 0x401740
mov byte [ebx + 0x264], 1
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x401778
add esp, 0x24
pop ebx
pop esi
ret
mov ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x401726
lea eax, [esp + 0x17]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00451180
jmp 0x401726
mov dword [esp], str.tcsetattr
call sub.cygwin1.dll_perror
mov dword [esp], 1
call sub.cygwin1.dll_exit
call sub.cygwin1.dll___stack_chk_fail
mov ebx, eax
jmp 0x46be84
mov dword [esp], esi
call fcn.004510f0
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
mov dword [esp], ebp
call fcn.004510f0
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
mov dword [esp], edi
call fcn.004511b8
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
mov dword [esp], edi
call fcn.004510f0
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
mov dword [esp], edi
call fcn.004511b8
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.004511b8
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.004510f0
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
mov eax, dword [ebp - 0x1f8]
mov dword [esp], eax
call fcn.004511b8
mov dword [esp], esi
call fcn.004511b8
mov eax, dword [ebp - 0x1f4]
mov dword [esp], eax
call fcn.004511b8
mov dword [esp], edi
call fcn.004511b8
mov eax, dword [ebp - 0x1f0]
mov dword [esp], eax
call fcn.004510f0
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
mov eax, dword [ebp - 0x1ec]
mov dword [esp], eax
call fcn.004511b8
mov dword [esp], ebx
call sub.cyggcc_s_1.dll__Unwind_Resume
mov dword [esp], esi
call fcn.004511b8
lea eax, [ebp - 0x1d0]
mov dword [ebp - 0x1f4], eax
jmp 0x46bf12
Function at 0x4023b0
Capabilities:
Execute command
Query environment variable
Resolve function by parsing pe exports
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebx
sub esp, 0x38
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], 0x5401
mov dword [esp], 0
lea eax, [ebx + 0x78]
mov dword [esp + 8], eax
call sub.cygwin1.dll_ioctl
test eax, eax
js 0x402460
mov eax, dword [ebx + 0x250]
movzx edx, word [ebx + 0x78]
movzx ecx, word [ebx + 0x7a]
cmp byte [eax + 0x20c], 0
je 0x402420
add ebx, 0x1d0
mov dword [esp], ebx
call fcn.00404a30
mov eax, 1
mov edx, dword [esp + 0x2c]
sub edx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x402470
add esp, 0x38
pop ebx
ret
mov dword [esp + 0x28], edx
add eax, 0x174
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 1
mov dword [esp + 0x18], 0xffff
mov dword [esp + 0x14], 0x47f35c
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x1c], 0x47f29c
mov dword [esp + 0x24], ecx
call fcn.00401410
jmp 0x4023f9
mov dword [esp], str.ioctl_TIOCGWINSZ
call sub.cygwin1.dll_perror
xor eax, eax
jmp 0x40240c
call sub.cygwin1.dll___stack_chk_fail
nop
lea esi, [esi]
lea esi, [esi]
Function at 0x403dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, eax
push ebx
sub esp, 0x24
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x28]
cmp eax, dword [edx + 0x30]
jge 0x403e42
mov ecx, dword [edx + 0x2c]
cmp dword [esi + 0x10], ecx
jge 0x403e8f
cmp byte [edx + 0x79], 0
jne 0x403e6b
lea ebx, [edx + 0x2c]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp], ebx
call fcn.00418b40
mov eax, dword [esi + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00418c10
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x403e66
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x476ebc
mov dword [esp + 8], str.void_Overlay::ConditionalCursorMove::apply_Terminal::Framebuffer__uint64_t__const
mov dword [esp + 4], 0x9e
mov dword [esp], str.terminaloverlay.cc
call sub.cygwin1.dll___assert_func
call sub.cygwin1.dll___stack_chk_fail
mov dword [esp + 0xc], str._fb.ds.origin_mode
mov dword [esp + 8], str.void_Overlay::ConditionalCursorMove::apply_Terminal::Framebuffer__uint64_t__const
mov dword [esp + 4], 0xa0
mov dword [esp], str.terminaloverlay.cc
call sub.cygwin1.dll___assert_func
mov dword [esp + 0xc], str.col___fb.ds.get_width__
mov dword [esp + 8], str.void_Overlay::ConditionalCursorMove::apply_Terminal::Framebuffer__uint64_t__const
mov dword [esp + 4], 0x9f
mov dword [esp], str.terminaloverlay.cc
call sub.cygwin1.dll___assert_func
nop
lea esi, [esi]
lea esi, [esi]
nop
Function at 0x403f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, eax
push edi
push esi
push ebx
mov ebx, edx
sub esp, 0xbc
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0xac], eax
xor eax, eax
cmp edx, 0x3b
jle 0x404068
mov eax, edx
mov ecx, 0x88888889
mov esi, ebx
imul ecx
sar esi, 0x1f
lea eax, [edx + ebx]
sar eax, 5
mov edx, eax
sub eax, esi
sub edx, esi
imul edi, edx, 0x3c
mov edx, ebx
sub edx, edi
mov edi, eax
cmp ebx, 0xe0f
jle 0x404000
mov dword [esp + 0x14], edx
mul ecx
mov eax, edi
mov dword [esp + 8], str._d:_02d:_02d
mov dword [esp + 4], pe_nt_image_headers32
mov ecx, edx
mov edx, 0x91a2b3c5
shr ecx, 5
imul ecx, ecx, 0x3c
sub eax, ecx
mov dword [esp + 0x10], eax
mov eax, ebx
imul edx
add edx, ebx
sar edx, 0xb
sub edx, esi
lea esi, [esp + 0x2c]
mov dword [esp + 0xc], edx
mov dword [esp], esi
call sub.cygwin1.dll_snprintf
mov dword [esp], esi
call sub.cygwin1.dll_strlen
mov ebx, eax
mov eax, method.std::string.swap_std::string_
test ebx, ebx
je 0x404044
lea eax, [esp + 0x2b]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00451170
mov edx, eax
lea eax, [eax + 0xc]
cmp ebx, 1
je 0x404030
cmp ebx, 4
jae 0x404098
test ebx, ebx
je 0x404038
movzx ecx, byte [esp + 0x2c]
mov byte [edx + 0xc], cl
test bl, 2
je 0x404038
movzx ecx, word [esp + ebx + 0x2a]
mov word [eax + ebx - 2], cx
jmp 0x404038
lea esi, [esp + 0x2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._d:_02d
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], esi
call sub.cygwin1.dll_snprintf
jmp 0x403f9a
movzx ecx, byte [esp + 0x2c]
mov byte [edx + 0xc], cl
cmp edx, sym.imp.cygstdc_6.dll_std::string::_Rep::_S_empty_rep_storage
jne 0x4040c0
mov dword [ebp], eax
mov eax, dword [esp + 0xac]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x4040d3
add esp, 0xbc
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ecx]
lea esi, [esp + 0x2c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], str._d__s
mov dword [esp + 0x10], eax
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], esi
call sub.cygwin1.dll_snprintf
jmp 0x403f9a
mov ecx, dword [esp + 0x2c]
lea edi, [edx + 0x10]
and edi, 0xfffffffc
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + ebx + 0x28]
mov dword [eax + ebx - 4], ecx
mov ecx, eax
sub ecx, edi
sub esi, ecx
add ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
jmp 0x404038
mov dword [edx + 8], 0
mov dword [edx], ebx
mov byte [edx + ebx + 0xc], 0
jmp 0x404044
call sub.cygwin1.dll___stack_chk_fail
lea esi, [esi]
nop
Function at 0x4044c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0xc], eax
xor eax, eax
mov ebx, dword [esp + 0x20]
call fcn.0040bc40
mov dword [ebx], eax
mov dword [ebx + 4], edx
call fcn.0040bc40
mov dword [ebx + 0x10], method.std::string.swap_std::string_
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x14], method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.append_wchar_t_const__unsigned_int_
mov byte [ebx + 0x18], 0
mov dword [ebx + 0x20], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
mov byte [ebx + 0x28], 1
mov eax, dword [esp + 0xc]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x40451d
add esp, 0x18
pop ebx
ret
call sub.cygwin1.dll___stack_chk_fail
lea esi, [esi]
lea esi, [esi]
push ebx
sub esp, 0x28
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov ebx, dword [esp + 0x30]
call fcn.0040bc40
cmp eax, dword [ebx + 0x20]
sbb edx, dword [ebx + 0x24]
jae 0x404568
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x4045d0
add esp, 0x28
pop ebx
ret
mov eax, dword [ebx + 0x14]
mov eax, dword [eax - 4]
test eax, eax
mov eax, dword [ebx + 0x14]
jle 0x404590
lea edx, [eax - 0xc]
cmp eax, method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.append_wchar_t_const__unsigned_int_
jne 0x4045b0
mov dword [ebx + 0x14], method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.append_wchar_t_const__unsigned_int_
jmp 0x404550
cmp eax, method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.append_wchar_t_const__unsigned_int_
je 0x404550
xor edx, edx
mov dword [eax - 4], 0
mov dword [eax - 0xc], 0
mov word [eax], dx
jmp 0x404550
mov ecx, 0xffffffff
lock xadd dword [eax - 4], ecx
test ecx, ecx
jg 0x40457f
lea eax, [esp + 0x1b]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.004511f8
jmp 0x40457f
call sub.cygwin1.dll___stack_chk_fail
nop
lea esi, [esi]
lea esi, [esi]
Function at 0x4045e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, 0x7ffffffe
push esi
push ebx
sub esp, 0x2c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov esi, dword [esp + 0x40]
call fcn.0040bc40
mov ecx, dword [esi + 0x20]
mov ebx, dword [esi + 0x24]
sub ecx, eax
sbb ebx, edx
cmp edi, ecx
mov edi, 0
sbb edi, ebx
jae 0x40461c
mov ecx, 0x7fffffff
xor ebx, ebx
mov edi, eax
sub edi, dword [esi]
mov ebp, edx
sbb ebp, dword [esi + 4]
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 0xc], ebp
mov ebp, 0x1964
cmp ebp, dword [esp + 8]
mov ebp, edi
sbb ebp, dword [esp + 0xc]
jb 0x404670
sub eax, dword [esi + 8]
sbb edx, dword [esi + 0xc]
mov esi, 0x2710
cmp esi, eax
sbb edi, edx
jb 0x4046a0
mov eax, ecx
mov edx, dword [esp + 0x1c]
sub edx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x4046b0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xea60
cmp eax, dword [esp + 8]
sbb edi, dword [esp + 0xc]
mov eax, 0x3e8
mov edx, 0
jae 0x40468e
mov eax, 0xbb8
cmp eax, ecx
sbb edx, ebx
cmovb ecx, eax
jmp 0x404651
mov eax, 0x3e8
xor edx, edx
cmp eax, ecx
sbb edx, ebx
cmovb ecx, eax
jmp 0x404651
call sub.cygwin1.dll___stack_chk_fail
nop
lea esi, [esi]
lea esi, [esi]
Function at 0x404b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x2c], edx
xor edx, edx
mov ebx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ebp, dword [ebx + 0x40]
mov edi, dword [ebx + 0x44]
lea esi, [ebx + 0x1c]
cmp esi, dword [ebx + 0x1c]
je 0x404c20
mov eax, dword [ebx + 0x20]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
xor ecx, ebp
xor edx, edi
or edx, ecx
jne 0x404b90
mov eax, dword [esp + 0x2c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x404c2f
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x30]
mov dword [esp + 0x1c], ecx
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 0x2c]
mov dword [esp], 0x38
add eax, 1
adc edx, 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call sub.cygwin1.dll___wrap__Znwj
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x1c]
mov byte [eax + 0x1c], 0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x20], ebp
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], 0xffffffff
mov dword [eax + 0x2c], 0xffffffff
mov dword [eax + 8], 0x47f7b4
mov dword [eax + 0x30], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00451078
cmp esi, dword [ebx + 0x1c]
je 0x404c34
mov eax, dword [ebx + 0x20]
mov byte [eax + 0x1c], 1
jmp 0x404b6e
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x38]
mov dword [esp + 0x1c], ecx
jmp 0x404b9a
call sub.cygwin1.dll___stack_chk_fail
call fcn.00403ec0
nop
lea esi, [esi]
Function at 0x405340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x14
mov edx, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0xc], edx
xor edx, edx
mov eax, dword [esp + 0x20]
mov edx, 1
lea ecx, [eax + 0x1c]
cmp dword [eax + 0x1c], ecx
je 0x405380
mov eax, dword [esp + 0xc]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x4053b1
add esp, 0x14
mov eax, edx
pop ebx
pop esi
ret
mov esi, dword [eax + 0x14]
lea ebx, [eax + 0x14]
cmp esi, ebx
je 0x4053ad
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
cmp eax, ecx
je 0x4053a7
lea esi, [esi]
movzx edx, byte [eax + 0x14]
test dl, dl
jne 0x405362
add eax, 0x48
cmp eax, ecx
jne 0x405398
mov esi, dword [esi]
cmp esi, ebx
jne 0x40538a
xor edx, edx
jmp 0x405362
call sub.cygwin1.dll___stack_chk_fail
lea esi, [esi]
lea esi, [esi]
Function at 0x407de0
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
mov edi, eax
push esi
sub edx, edi
push ebx
mov esi, edx
sub esp, 0x2c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], edx
call fcn.00451170
mov ebx, eax
lea ebp, [eax + 0xc]
cmp esi, 1
je 0x407e48
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.004513c4
cmp ebx, sym.imp.cygstdc_6.dll_std::string::_Rep::_S_empty_rep_storage
jne 0x407e56
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x407e66
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [edi]
mov byte [ebx + 0xc], al
cmp ebx, sym.imp.cygstdc_6.dll_std::string::_Rep::_S_empty_rep_storage
je 0x407e2e
mov dword [ebx + 8], 0
mov dword [ebx], esi
mov byte [ebx + esi + 0xc], 0
jmp 0x407e2e
call sub.cygwin1.dll___stack_chk_fail
nop
lea esi, [esi]

Function at 0x407e70
Capabilities:
Terminate process

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x2c
mov eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
cmp esi, edx
je 0x407ef0
test esi, esi
je 0x407f15
mov ebx, edx
mov dword [esp + 8], ecx
sub ebx, esi
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.00451170
mov edi, eax
lea ebp, [eax + 0xc]
cmp ebx, 1
je 0x407ee0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], ebp
call fcn.004513c4
cmp edi, sym.imp.cygstdc_6.dll_std::string::_Rep::_S_empty_rep_storage
jne 0x407f00
mov eax, dword [esp + 0x1c]
sub eax, dword [sym.imp.cygwin1.dll___stack_chk_guard]
jne 0x407f10
add esp, 0x2c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [esi]
mov byte [edi + 0xc], al
jmp 0x407ec2
mov ebp, method.std::string.swap_std::string_
jmp 0x407eca
mov dword [edi + 8], 0
mov dword [edi], ebx
mov byte [edi + ebx + 0xc], 0
jmp 0x407eca
call sub.cygwin1.dll___stack_chk_fail
mov dword [esp], 0x477308
call fcn.00450ff8
nop
lea esi, [esi]
lea esi, [esi]