joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c5e60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100c69b0
mov esi, dword [eax + 4]
test esi, esi
je 0x100c5f15
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100c5edc
cmp eax, esi
jne 0x100c5ed4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100c5ee4
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100c5ee4
cmp eax, esi
jne 0x100c5ee4
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.1002d640
push 0x5c
push esi
call fcn.100c9c9f
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c5f90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100c60ff
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002d640
push 0x5c
push edi
call fcn.100c9c9f
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c605d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100c6010
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100c60f5
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100c6071
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100c6074
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100c60f5
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002d640
push 0x5c
push edi
call fcn.100c9c9f
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c6106
cmp esi, eax
jne 0x100c60c5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100c6080
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c928e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100c926a
pop esi
leave
ret 8

Function at 0x7d3b4b
Capabilities:
Encode data using xor

Disassembly:
rep movsb byte es:[edi], byte [esi]
bswap si
push ecx
pop esi
push ecx
mov esi, dword [esp + 0x14]
pushfd
pushal
mov dword [esp + 8], 0xb4f68844
lea esp, [esp + 0x3c]
jmp 0x5ff08d
dec bl
inc ecx
xor bl, bl
xchg ebp, eax
shl eax, cl
rcr bl, 7
bsf ax, bx
mov eax, ebp
bt si, sp
mov bl, 1
push 0x8b811dd5
bt cx, ax
xchg dword [esp + 0xc], esi
btc si, 0xc
bts si, cx
btr si, 0xb
not esi
mov esi, edi
push esi
cmc
cmp bh, ch
cmp ah, 0x34
sub esi, eax
jmp 0x7b633f

Function at 0x7d3f16
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
call fcn.005f95a8
call fcn.005fb705
mov ebp, 0x2b52675a
push ss
scasd eax, dword es:[edi]
daa
scasb al, byte es:[edi]
cmp dword [eax + 0x33ac3701], eax
lahf
pushfd
jae 0x7d3f9f
aaa
clc
sti
invalid
add byte [eax], al
mov cl, dh
ja 0x7d401f
pop ss
sbb dh, byte [edi - 0x44fd8f31]
imul eax
push esp
scasd eax, dword es:[edi]
mov ebx, 0xaf54e8f7
dec edi
salc
jle 0x7d3fdf
push ds
out dx, al
lahf
xchg edx, eax
aaa
xor dh, bl
fimul word [ebp + 0x75]
fcomp dword [eax - 0x50f07747]
sub byte [ebx + 0x30], 0x25
ret 0x5878
mov ss, word [edi - 0x278d19fb]
popfd
xchg edi, eax
push esi
mov ebp, 0x23539e66
rcr dword [esi], cl
pushfd
jge 0x7d3fab
push ecx
clc
pop edi
ja 0x7d4022
rcl dword [eax - 0x735e379c], cl
add edi, 0x893bfcd9
jns 0x7d405a
enter 0xffffffffffff8ca1, 0xffffffffffffff81
invalid
adc byte [eax], al
and eax, 0xa0b1943c
push ecx
test dl, 0x6b
mov ebx, dword [edi + 0x49451b86]
and eax, 0xfe824645
wait
xchg byte [edi + 0x3a], cl
ret
cmp al, bl
mov esi, 0xe04d98b3
or esi, esi
xchg dword [edx + 0x2d957177], eax
mov bl, 0x98
dec ebp
loopne 0x7d4030
test byte [edi - 0x6a8e887e], 0x2d
jle 0x7d4067
cmp dl, byte [ebx]
invalid
invalid
jae 0x7d4091
sbb eax, eax
ret
cmp bl, bh
loop 0x7d3ffa
xor ebx, dword [eax]
invalid
sub al, 0xfb
fdivr dword [eax + esi*4 + 0x5e]
lcall 0xc1b1, 0x235efe09
stc
lcall 0xe095, 0x4da8a112
fsub qword [ecx + edx*4 + 0x5f749b37]
loopne 0x7d406f
movsb byte es:[edi], byte [esi]
xchg ecx, eax
aaa
wait
je 0x7d40f8
sbb byte [eax], dl
pop eax
push edi
enter 0xfffffffffffffa6b, 0xffffffffffffffd4
js 0x7d407d
ret 0x6e7e
invalid
Function at 0x405952
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [0x61e1c4]
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygcurl_4.dll_curl_multi_info_read
mov dword [ebp - 0x10], eax
jmp 0x405a3f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, 1
jne 0x405a05
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x61e238]
mov dword [ebp - 0xc], eax
jmp 0x40599f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4059b4
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
cmp edx, eax
jne 0x405996
cmp dword [ebp - 0xc], 0
je 0x4059db
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00405933
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00405852
jmp 0x405a28
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2b
mov dword [esp + 4], 1
mov dword [esp], str.Received_DONE_message_for_unknown_request__n
call sub.cygwin1.dll_fwrite
jmp 0x405a28
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ebx, eax
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Unknown_CURL_message_received:__d_n
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov eax, dword [0x61e1c4]
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygcurl_4.dll_curl_multi_info_read
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x405975
nop
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4063d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59b158]
test eax, eax
je 0x4063ff
mov eax, dword [0x59b15c]
test eax, eax
jne 0x4063f4
mov dword [esp], 0x59b140
call fcn.0041aa6d
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00406381
mov dword [esp], str.GIT_HTTP_PROXY_AUTHMETHOD
call sub.cygwin1.dll_getenv
mov dword [esp + 4], eax
mov dword [esp], 0x61e1fc
call fcn.00406355
mov eax, dword [0x61e1fc]
test eax, eax
je 0x4064c3
mov dword [ebp - 0xc], 0
jmp 0x40647d
mov eax, dword [ebp - 0xc]
mov edx, dword [eax*8 + 0x59b100]
mov eax, dword [0x61e1fc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x406479
mov dword [ebp - 0x14], 0x6f
mov eax, dword [ebp - 0xc]
mov edx, dword [eax*8 + 0x59b104]
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygcurl_4.dll_curl_easy_setopt
jmp 0x406485
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp eax, 4
jbe 0x406431
cmp dword [ebp - 0xc], 5
jne 0x4064e4
mov eax, dword [0x61e1fc]
mov dword [esp + 4], eax
mov dword [esp], str.unsupported_proxy_authentication_method__s:_using_anyauth
call fcn.004ae342
mov dword [ebp - 0x18], 0x6f
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], 0xffffffef
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygcurl_4.dll_curl_easy_setopt
jmp 0x4064e4
mov dword [ebp - 0x10], 0x6f
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], 0xffffffef
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygcurl_4.dll_curl_easy_setopt
nop
leave
ret
Function at 0x4079af
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4079d1
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
nop
leave
ret
Function at 0x40861a
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x48], 0
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x48]
mov dword [eax + 0x10], edx
jmp 0x4087b8
call fcn.004085de
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x4087b8
mov eax, dword [0x61e1c4]
lea edx, [ebp - 0x4c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygcurl_4.dll_curl_multi_timeout
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x408668
jmp 0x4087b8
mov eax, dword [ebp - 0x4c]
cmp eax, 0xffffffff
jne 0x408680
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xc350
jmp 0x4086c6
mov ecx, dword [ebp - 0x4c]
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
sar ecx, 0x1f
mov edx, ecx
sub eax, edx
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x4c]
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
sar eax, 6
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x3e8
mov eax, ecx
sub eax, edx
imul eax, eax, 0x3e8
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 2
jmp 0x4086ed
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov dword [eax + edx*4], 0
cmp dword [ebp - 0xc], 0
jne 0x4086dc
lea eax, [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 2
jmp 0x408713
sub dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [eax + edx*4], 0
cmp dword [ebp - 0x10], 0
jne 0x408702
lea eax, [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 2
jmp 0x408739
sub dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov dword [eax + edx*4], 0
cmp dword [ebp - 0x14], 0
jne 0x408728
mov eax, dword [0x61e1c4]
lea edx, [ebp - 0x3c]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x30]
mov dword [esp + 8], edx
lea edx, [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygcurl_4.dll_curl_multi_fdset
mov eax, dword [ebp - 0x3c]
test eax, eax
jns 0x40878e
mov eax, dword [ebp - 0x44]
test eax, eax
jg 0x408780
mov eax, dword [ebp - 0x40]
cmp eax, 0xc350
jle 0x40878e
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0xc350
mov eax, dword [ebp - 0x3c]
lea edx, [eax + 1]
lea eax, [ebp - 0x44]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.cygwin1.dll_select
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x408635
nop
nop
leave
ret
Function at 0x40fa0a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x62f624
mov dword [esp], 0x5a31c8
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40fa70
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
je 0x40fa70
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0040eb8d
mov dword [esp + 4], 0x20
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0040eb00
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.004502af
mov dword [esp + 4], 0x3d
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0040eb00
cmp dword [ebp + 0xc], 0
je 0x40faad
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.004502af
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 0x5a31c8
call sub.cygwin1.dll_setenv
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.0048a820
nop
leave
ret
Function at 0x413532
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_CONFIG_SYSTEM
call sub.cygwin1.dll_getenv
mov dword [esp], eax
call fcn.0040e9a5
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x413564
mov dword [esp], str._etc_gitconfig
call fcn.004291e1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0044521b
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x41357b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_CONFIG_GLOBAL
call sub.cygwin1.dll_getenv
mov dword [esp], eax
call fcn.0040e9a5
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
jne 0x4135cb
mov dword [esp + 4], 0
mov dword [esp], 0x5a3f1a
call fcn.00444508
mov dword [ebp - 0xc], eax
mov dword [esp], 0x5a3f27
call fcn.00445a53
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
nop
leave
ret

Function at 0x4135de
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41360c
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00411bac
jmp 0x41360f
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x413611
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41365c
lea eax, [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0041155d
test eax, eax
jne 0x41365c
mov dword [esp], str.failed_to_parse__s
call fcn.0040ec46
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004ae00f
mov eax, dword [ebp + 0xc]
leave
ret

Function at 0x418598
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 1
mov dword [esp + 0x10], 4
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 8
mov dword [esp + 4], 0xffff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_setsockopt
test eax, eax
jns 0x4185ec
mov dword [esp], str.unable_to_set_SO_KEEPALIVE_on_socket
call fcn.00416f8a
mov dword [esp], eax
call fcn.004ae275
call fcn.00416dc0
nop
leave
ret
Function at 0x4185ef
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x401
mov dword [esp + 8], 0x61e2c0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_getnameinfo
test eax, eax
je 0x418655
mov dword [esp + 8], 0x5a4865
mov dword [esp + 4], 0x401
mov dword [esp], 0x61e2c0
call fcn.004b526b
mov eax, 0x61e2c0
leave
ret
Function at 0x418f24
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_SSH_VARIANT
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x418f5b
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.ssh.variant
call fcn.00414835
test eax, eax
jne 0x419013
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], 0x5a4a0c
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x418f80
mov eax, dword [ebp + 8]
mov dword [eax], 0
jmp 0x419014
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.plink
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x418fa2
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x419014
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.putty
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x418fc4
mov eax, dword [ebp + 8]
mov dword [eax], 4
jmp 0x419014
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.tortoiseplink
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x418fe6
mov eax, dword [ebp + 8]
mov dword [eax], 5
jmp 0x419014
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.simple
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x419008
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x419014
mov eax, dword [ebp + 8]
mov dword [eax], 2
jmp 0x419014
nop
leave
ret
Function at 0x41916f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0x62f624
mov dword [esp], str.GIT_OVERRIDE_VIRTUAL_HOST
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4191b6
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004b4201
mov dword [ebp - 0x10], eax
jmp 0x4191c4
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004b4201
mov dword [ebp - 0x10], eax
mov dword [esp], 0x5a47f4
call fcn.004a6c3f
mov dword [esp + 4], 0xa
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
jne 0x4191fe
mov dword [esp + 4], 0xa
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x419212
mov dword [esp], str.newline_is_forbidden_in_git:___hosts_and_repo_paths
call fcn.00416f8a
mov dword [esp], eax
call fcn.004ae00f
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00418b2d
test eax, eax
je 0x419238
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00418b7a
mov dword [ebp - 0xc], eax
jmp 0x419254
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00418969
mov dword [ebp - 0xc], eax
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s_chost_s_c
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.0048b459
cmp dword [ebp + 0x18], 0
jle 0x4192c7
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00416e30
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str.version_d_c
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.0048b459
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004483c8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.0048a820
mov eax, dword [ebp - 0xc]
leave
ret