joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef036
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
lea eax, [ebp - 0x68]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll__stat64
test eax, eax
jns 0x4ef05c
mov eax, 0xffffffff
jmp 0x4ef08a
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_utime
test eax, eax
jns 0x4ef085
mov eax, 0xffffffff
jmp 0x4ef08a
mov eax, 0
leave
ret

Function at 0x4f2106
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 0xc]
and eax, 1
test eax, eax
setne al
movzx eax, al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 2
test eax, eax
setne al
movzx eax, al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x658]
mov eax, dword [eax + 0x84]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, 1
je 0x4f216a
mov dword [esp + 8], str.run_diff_index_must_be_passed_exactly_one_tree
mov dword [esp + 4], 0x25f
mov dword [esp], str.diff_lib.c
call fcn.004b58e7
call fcn.004a06cf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0042d8d8
cmp dword [ebp - 0x14], 0
je 0x4f21b5
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004f1f33
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
lea eax, [ebp - 0x81]
mov dword [esp], eax
call fcn.00431d1a
mov dword [ebp - 0xc], eax
jmp 0x4f21d5
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, 4
mov dword [esp + 4], eax
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004f0692
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004f1df8
test eax, eax
je 0x4f221d
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x26f
mov dword [esp], str.diff_lib.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
cmp dword [ebp - 0x10], 0
je 0x4f222a
mov edx, 0x5bc78a
jmp 0x4f222f
mov edx, 0x5bc787
mov eax, dword [ebp + 8]
add eax, 0x4a4
mov dword [esp + 8], edx
mov dword [esp + 4], 0x5bc8db
mov dword [esp], eax
call fcn.004faaa3
call fcn.00503c4e
mov eax, dword [ebp + 8]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00503dab
mov eax, dword [ebp + 8]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00503345
mov dword [esp], str.GIT_TRACE_PERFORMANCE
call fcn.004f0722
test eax, eax
je 0x4f22a9
call fcn.004a0ce9
mov dword [esp + 0x10], str.diff_index
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x275
mov dword [esp], str.diff_lib.c
call fcn.004a093a
mov eax, 0
leave
ret
Function at 0x4f22b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8fc
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x1b4]
mov dword [esp + 8], 0
lea edx, [ebp - 0x8f0]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0047eb0d
mov eax, dword [ebp + 0xc]
add eax, 0x170
mov dword [esp + 4], eax
lea eax, [ebp - 0x8f0]
add eax, 0x70
mov dword [esp], eax
call fcn.0045005f
lea eax, [ebp - 0x8f0]
add eax, 0x4a4
mov dword [esp], eax
call fcn.004fe1f4
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x44c]
mov ebx, edx
mov edx, 0x71
mov edi, eax
mov esi, ebx
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x8f0]
mov dword [esp], eax
call fcn.004f1df8
test eax, eax
je 0x4f2374
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x283
mov dword [esp], str.diff_lib.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
lea eax, [ebp - 0x8f0]
add eax, 0x70
mov dword [esp], eax
call fcn.004501fc
mov eax, 0
add esp, 0x8fc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4f422f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x164]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004f7f16
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_fputs
cmp dword [ebp + 0x24], 0
jle 0x4f4281
mov eax, dword [ebp + 0x24]
lea edx, [eax - 1]
mov eax, dword [ebp + 0x20]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xa
jne 0x4f4281
mov eax, 1
jmp 0x4f4286
mov eax, 0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4f4293
sub dword [ebp + 0x24], 1
cmp dword [ebp + 0x24], 0
jle 0x4f42b2
mov eax, dword [ebp + 0x24]
lea edx, [eax - 1]
mov eax, dword [ebp + 0x20]
add eax, edx
movzx eax, byte [eax]
cmp al, 0xd
jne 0x4f42b2
mov eax, 1
jmp 0x4f42b7
mov eax, 0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4f42c4
sub dword [ebp + 0x24], 1
cmp dword [ebp + 0x24], 0
jne 0x4f42d4
cmp dword [ebp + 0x1c], 0
je 0x4f43c7
cmp dword [ebp + 0x14], 0
je 0x4f4321
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xcc]
mov dword [esp + 4], eax
mov dword [esp], 1
call fcn.004dbec5
test eax, eax
je 0x4f4321
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.e_7m
call sub.cygwin1.dll_fwrite
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0xc], 0
je 0x4f4340
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x1c], 0
je 0x4f4358
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_fputc
cmp dword [ebp + 0x24], 0
je 0x4f43ca
cmp dword [ebp + 0x10], 0
je 0x4f439d
cmp dword [ebp + 0xc], 0
je 0x4f4384
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0xc]
je 0x4f4384
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 0x24]
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
mov dword [ebp - 0xc], 1
jmp 0x4f43cb
nop
jmp 0x4f43cb
nop
cmp dword [ebp - 0xc], 0
je 0x4f43e3
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
cmp dword [ebp - 0x18], 0
je 0x4f43fc
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0xd
call sub.cygwin1.dll_fputc
cmp dword [ebp - 0x14], 0
je 0x4f4415
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.cygwin1.dll_fputc
nop
leave
ret
Function at 0x4f9870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x4f9a4a
mov dword [ebp - 0xc], 0
jmp 0x4f9a3a
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004f7f16
mov edx, dword [ebp + 0xc]
mov edx, dword [edx + 0x164]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x10]
and eax, 2
test al, al
je 0x4f98fd
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x164]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], 0x5bd2ec
call sub.cygwin1.dll_fwrite
jmp 0x4f9938
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
mov ebx, dword [eax + 0x24]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + 0x164]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], str._llu_t_llu_t
mov dword [esp], esi
call sub.cygwin1.dll_fprintf
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xe8]
test eax, eax
je 0x4f99ca
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004f88ea
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x10]
and eax, 4
test al, al
jne 0x4f998f
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xe8]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x164]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004581c3
jmp 0x4f9a36
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x164]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x164]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xe8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_putc
jmp 0x4f9a36
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 0x10]
and eax, 4
test al, al
je 0x4f9a13
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x164]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.cygwin1.dll_putc
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x164]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004581c3
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x164]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004581c3
add dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jl 0x4f9891
jmp 0x4f9a4b
nop
add esp, 0x30
pop ebx
pop esi
pop ebp
ret
Function at 0x50aa76
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.TERM
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x50aaa8
mov dword [esp + 4], str.dumb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x50aaaf
mov eax, 1
jmp 0x50aab4
mov eax, 0
leave
ret

Function at 0x50aab6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_EDITOR
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
call fcn.0050aa76
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], 0
jne 0x50aaea
mov eax, dword [0x61c3b4]
test eax, eax
je 0x50aaea
mov eax, dword [0x61c3b4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x50ab05
cmp dword [ebp - 0x10], 0
jne 0x50ab05
mov dword [esp], str.VISUAL
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x50ab1a
mov dword [esp], str.EDITOR
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x50ab2d
cmp dword [ebp - 0x10], 0
je 0x50ab2d
mov eax, 0
jmp 0x50ab3d
cmp dword [ebp - 0xc], 0
jne 0x50ab3a
mov dword [ebp - 0xc], 0x5bf9d8
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x514b46
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x514b8b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x514b8b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x164]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
jmp 0x514b8c
nop
leave
ret
Function at 0x516836
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x61d2e4
mov dword [ebp - 0xc], 0
mov eax, dword [0x61dfb4]
mov dword [esp], eax
call fcn.00514b46
cmp dword [ebp + 8], 0
je 0x51694d
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516823
test eax, eax
je 0x516927
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.005169d1
mov dword [ebp - 0xc], 1
jmp 0x516927
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516656
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x608]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
cmp dword [ebp - 0xc], 0
jne 0x516914
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x608]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.cygwin1.dll_putc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00514b46
mov dword [esp + 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00514a05
cmp dword [ebp - 0xc], 0
jne 0x516940
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516823
test eax, eax
je 0x5168a0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00491cd8
jmp 0x51694e
nop
leave
ret

Function at 0x516950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0x61d2e4
mov eax, dword [0x61dfb4]
mov dword [esp], eax
call fcn.00514b46
cmp dword [ebp + 8], 0
je 0x5169ce
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516656
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x608]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.00491cd8
jmp 0x5169cf
nop
leave
ret

Function at 0x5169d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0x61d2e4
mov eax, dword [0x61dfb4]
mov dword [esp], eax
call fcn.00514b46
cmp dword [ebp + 8], 0
je 0x516a4f
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516730
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x608]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.00491cd8
jmp 0x516a50
nop
leave
ret
Function at 0x516a52
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0x61d2e4
mov dword [ebp - 0xc], 0
mov eax, dword [0x61dfb4]
mov dword [esp], eax
call fcn.00514b46
cmp dword [ebp + 8], 0
jne 0x516a98
mov eax, 0
jmp 0x516b59
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516823
test eax, eax
je 0x516ab1
mov eax, 0
jmp 0x516b59
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516656
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x608]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
mov dword [esp + 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00514a05
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516823
test eax, eax
jne 0x516b4a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x608]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.cygwin1.dll_putc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00514b46
jmp 0x516ab1
nop
lea eax, [ebp - 0x18]
mov dword [esp], eax
call fcn.00491cd8
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x516b5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], eax
jmp 0x516bf0
mov dword [esp + 4], 0xa
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x516b9a
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x516bae
mov eax, dword [ebp + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
add eax, edx
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
cmp dword [ebp - 0x14], 0
je 0x516bea
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test al, al
je 0x516bea
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00516950
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x516b6f
nop
nop
leave
ret
Function at 0x51ed5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x1c], al
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0051ed32
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
lea edx, [eax + 1]
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0051ed32
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jbe 0x51edc9
mov eax, dword [ebp - 0xc]
sub eax, 1
movzx eax, byte [eax]
cmp al, 0xa
jne 0x51edc9
sub dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov eax, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
movsx eax, byte [ebp - 0x1c]
mov edx, dword [ebp + 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_putc
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov edx, eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x20]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov eax, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.cygwin1.dll_putc
cmp dword [ebp - 0x10], 0
jne 0x51ee74
mov eax, dword [ebp + 0x24]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str._No_newline_at_end_of_file_n
call sub.cygwin1.dll_fwrite
nop
leave
ret
Function at 0x526856
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0xa0]
and edx, 0xfffffffd
mov byte [eax + 0xa0], dl
mov eax, dword [ebp + 8]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00503dab
mov eax, dword [ebp + 8]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00501ca8
test eax, eax
je 0x5268d2
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x590]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x590], 0x800
mov eax, dword [ebp + 8]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00503345
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x590], edx
mov eax, 0
jmp 0x526a3f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc0]
test eax, eax
je 0x526a2a
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x99]
and eax, 0xffffff80
test al, al
jne 0x526a2a
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00525cdb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x590]
and ah, 0xf7
test eax, eax
je 0x526a2a
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x9a]
and eax, 1
test al, al
je 0x526a2a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xbc]
cmp eax, 5
je 0x526a2a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xbc]
mov dword [esp], eax
call fcn.004507aa
test eax, eax
jne 0x526a2a
mov dword [ebp - 0xc], 0x12
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x640]
test eax, eax
je 0x5269c6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x640]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x644]
mov ecx, dword [ebp + 8]
add ecx, 0x4a4
mov dword [esp + 4], edx
mov dword [esp], ecx
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x608]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0xa0]
and eax, 2
test al, al
jne 0x526a11
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x590]
and eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jne 0x526a11
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x608]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x5c33b2
call sub.cygwin1.dll_fwrite
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x608]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.cygwin1.dll_putc
mov eax, dword [ebp + 8]
add eax, 0x4a4
mov dword [esp], eax
call fcn.00503345
mov eax, 1
leave
ret
Function at 0x53ba24
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 0x50
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_memset
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 2
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 1
mov eax, dword [ebp + 8]
add eax, 0x34
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00491c81
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0x44]
and edx, 0xfffffffe
mov byte [eax + 0x44], dl
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0053b8a3
mov dword [esp], str.GIT_MERGE_VERBOSITY
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x53bae3
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_strtol
mov edx, dword [ebp + 8]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
cmp eax, 4
jle 0x53baf8
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
nop
leave
ret
Function at 0x5435ea
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
jne 0x54360c
mov dword [esp], str.GIT_NOTES_REF
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x54361a
mov eax, dword [0x61c3d0]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x543627
mov dword [ebp - 0xc], str.refs_notes_commits
mov eax, dword [ebp - 0xc]
leave
ret