joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ade0e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59a140]
test eax, eax
jns 0x4ade77
mov dword [esp], str.GIT_ALLOW_PROTOCOL
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ade6d
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0x3a
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x59a144
call fcn.00496014
mov dword [esp], 0x59a144
call fcn.00495e8d
mov dword [0x59a140], 1
jmp 0x4ade77
mov dword [0x59a140], 0
mov eax, dword [0x59a140]
test eax, eax
je 0x4ade87
mov eax, 0x59a144
jmp 0x4ade8c
mov eax, 0
leave
ret

Function at 0x4b548e
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x59a164]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax

Function at 0x4b54ae
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x5b3c99
call fcn.004b548e

Function at 0x4b54c7
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x59a178]
call eax
test eax, eax
je 0x4b5524
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x29
mov dword [esp + 4], 1
mov dword [esp], str.fatal:_recursion_detected_in_die_handler_n
call sub.cygwin1.dll_fwrite
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0xb1
mov dword [esp], str.usage.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x59a168]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
call eax

Function at 0x4b5614
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x420
mov eax, dword [0x59a178]
call eax
test eax, eax
je 0x4b5676
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x2f
mov dword [esp + 4], 1
mov dword [esp], str.fatal:_recursion_detected_in_die_errno_handler_n
call sub.cygwin1.dll_fwrite
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0xd9
mov dword [esp], str.usage.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
lea eax, [ebp + 0xc]
mov dword [ebp - 0x40c], eax
mov ebx, dword [0x59a168]
mov esi, dword [ebp - 0x40c]
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x408]
mov dword [esp], eax
call fcn.004b553e
mov dword [esp + 4], esi
mov dword [esp], eax
call ebx
Function at 0x4b581d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.BUG:__s:_d:
mov dword [esp + 4], 0x100
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.cygwin1.dll_snprintf
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x108]
mov dword [esp], eax
call fcn.004b5134
mov eax, dword [0x61d4a8]
test eax, eax
je 0x4b5885
call sub.cygwin1.dll_abort
mov dword [0x61d4a8], 1
mov eax, dword [ebp - 0x10c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x136
mov dword [esp], str.usage.c
call fcn.004a1324
mov eax, dword [0x61d4a0]
test eax, eax
je 0x4b58e2
mov eax, dword [0x61d4a0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x139
mov dword [esp], str.usage.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
call sub.cygwin1.dll_abort

Function at 0x4bb9a1
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_gethostname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4bb9d0
mov eax, dword [ebp + 0xc]
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4bbaec
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
cmp dword [ebp + 8], eax
jne 0x4bbb9e
mov eax, dword [0x59a17c]
test eax, eax
jns 0x4bbb86
mov dword [esp], str.GIT_FLUSH
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4bbb3e
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_atoi
test eax, eax
sete al
movzx eax, al
mov dword [0x59a17c], eax
jmp 0x4bbb86
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fileno
lea edx, [ebp - 0x70]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll__fstat64
test eax, eax
jne 0x4bbb7c
mov eax, dword [ebp - 0x60]
and eax, 0xf000
cmp eax, 0x8000
jne 0x4bbb7c
mov dword [0x59a17c], 1
jmp 0x4bbb86
mov dword [0x59a17c], 0
mov eax, dword [0x59a17c]
test eax, eax
je 0x4bbb9e
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0xc]
cwde
and eax, 0x40
test eax, eax
je 0x4bbbcf
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
test eax, eax
je 0x4bbbd0
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00487ddd
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.write_failure_on__s
call fcn.004b5614
nop
leave
ret
Function at 0x4bbd4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fwrite
cmp dword [ebp + 0x10], eax
je 0x4bbd84
mov dword [esp], str.fwrite_error
call fcn.004b5614
nop
leave
ret
Function at 0x4c3d14
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00479fc2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x84]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call fcn.0045be83
cmp dword [ebp - 0x10], 0
js 0x4c3d8f
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0045e88c
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.004bcebe
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004c3b75
test eax, eax
je 0x4c3de1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004bcd75
mov ebx, eax
mov dword [esp], str.cannot__s:_You_have_unstaged_changes.
call fcn.004bcd75
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b5782
call fcn.004bcaa4
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004c3c07
test eax, eax
je 0x4c3e49
cmp dword [ebp - 0xc], 0
je 0x4c3e18
mov dword [esp], str.additionally__your_index_contains_uncommitted_changes.
call fcn.004bcd75
mov dword [esp], eax
call fcn.004b5782
call fcn.004bcaa4
jmp 0x4c3e42
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004bcd75
mov ebx, eax
mov dword [esp], str.cannot__s:_Your_index_contains_uncommitted_changes.
call fcn.004bcd75
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004b5782
call fcn.004bcaa4
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x4c3e97
cmp dword [ebp + 0x10], 0
je 0x4c3e6d
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x5b5c64
call fcn.004b5782
call fcn.004bcaa4
cmp dword [ebp + 0x18], 0
jne 0x4c3e97
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0xa3e
mov dword [esp], str.wt_status.c
call fcn.004a1237
mov dword [esp], eax
call sub.cygwin1.dll_exit
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4c9d91
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0xc3d2e1f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x60], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x68], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x6c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x70], 0
nop
pop ebp
ret
Function at 0x4cc666
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x5be0cd19
nop
pop ebp
ret
Function at 0x4da131
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x84]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4da169
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call fcn.004d9269
test eax, eax
je 0x4da169
mov eax, 1
jmp 0x4da16e
mov eax, 0
mov dword [ebp - 0x24], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
lea eax, [ebp - 0x50]
mov dword [esp], eax
call fcn.004da088
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffe
jne 0x4da267
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], str.BUG:_There_are_unmerged_index_entries:_n
call sub.cygwin1.dll_fwrite
mov dword [ebp - 0x1c], 0
jmp 0x4da23e
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
shl eax, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
shr eax, 0xc
and eax, 3
test eax, eax
je 0x4da23a
mov eax, dword [ebp - 0x2c]
lea esi, [eax + 0x64]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x38]
mov edi, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
shr eax, 0xc
and eax, 3
mov ebx, eax
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], str.BUG:__d__.s_n
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
ja 0x4da1d8
mov dword [esp + 8], str.unmerged_index_entries_when_writing_inmemory_index
mov dword [esp + 4], 0x2be
mov dword [esp], str.cache_tree.c
call fcn.004b58e7
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x18]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004b3542
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4db1e5
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0x61d2e4
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00493233
test eax, eax
jns 0x4db221
mov eax, 0xffffffff
jmp 0x4db2f7
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_chdir
test eax, eax
jns 0x4db259
call sub.cygwin1.dll___errno
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00491cd8
call sub.cygwin1.dll___errno
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
mov eax, 0xffffffff
jmp 0x4db2f7
mov dword [esp], str.GIT_TRACE_SETUP
call fcn.004db087
test eax, eax
je 0x4db29b
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.setup:_chdir_from__s_to__s
mov dword [esp + 8], 0x599cd8
mov dword [esp + 4], 0x41
mov dword [esp], str.chdir_notify.c
call fcn.004a0885
mov eax, dword [0x59d34c]
mov dword [ebp - 0xc], eax
jmp 0x4db2de
mov eax, dword [ebp - 0xc]
sub eax, 0xc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edx
call eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x59d34c
jne 0x4db2a5
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00491cd8
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4dbfcb
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x4dbfed
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_fputs
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
test al, al
je 0x4dc02f
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x5b9f15
call sub.cygwin1.dll_fwrite
nop
leave
ret
Function at 0x4e6fc4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [esp], 0
call sub.cygwin1.dll_time
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x50]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4e7038
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x54]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
lea edx, [ebp - 0x78]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll__stat64
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x54]
mov eax, dword [ebp - 0xc]
shl eax, 2
add eax, edx
mov eax, dword [eax]
lea edx, [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_utime
add dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c]
cmp dword [ebp - 0xc], eax
jb 0x4e6fea
nop
nop
leave
ret

Function at 0x4e9acc
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], 1
mov dword [esp + 0x10], 4
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 8
mov dword [esp + 4], 0xffff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_setsockopt
test eax, eax
jns 0x4e9b20
mov dword [esp], str.unable_to_set_SO_KEEPALIVE_on_socket
call fcn.004e84be
mov dword [esp], eax
call fcn.004b572d
call fcn.004e82f4
nop
leave
ret

Function at 0x4e9b23
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x401
mov dword [esp + 8], 0x61d5e0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.cygwin1.dll_getnameinfo
test eax, eax
je 0x4e9b89
mov dword [esp + 8], str._unknown_
mov dword [esp + 4], 0x401
mov dword [esp], 0x61d5e0
call fcn.004bb807
mov eax, 0x61d5e0
leave
ret
Function at 0x4ea458
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.GIT_SSH_VARIANT
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4ea48f
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.ssh.variant
call fcn.0041af1d
test eax, eax
jne 0x4ea547
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], 0x5bb9c8
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x4ea4b4
mov eax, dword [ebp + 8]
mov dword [eax], 0
jmp 0x4ea548
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.plink
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x4ea4d6
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x4ea548
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.putty
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x4ea4f8
mov eax, dword [ebp + 8]
mov dword [eax], 4
jmp 0x4ea548
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.tortoiseplink
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x4ea51a
mov eax, dword [ebp + 8]
mov dword [eax], 5
jmp 0x4ea548
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], str.simple
mov dword [esp], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x4ea53c
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x4ea548
mov eax, dword [ebp + 8]
mov dword [eax], 2
jmp 0x4ea548
nop
leave
ret
Function at 0x4ea6a3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0x61d2e4
mov dword [esp], str.GIT_OVERRIDE_VIRTUAL_HOST
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ea6ea
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004ba79d
mov dword [ebp - 0x10], eax
jmp 0x4ea6f8
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004ba79d
mov dword [ebp - 0x10], eax
mov dword [esp], 0x5bb7b0
call fcn.004ae0f7
mov dword [esp + 4], 0xa
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
jne 0x4ea732
mov dword [esp + 4], 0xa
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x4ea746
mov dword [esp], str.newline_is_forbidden_in_git:___hosts_and_repo_paths
call fcn.004e84be
mov dword [esp], eax
call fcn.004b54c7
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004ea061
test eax, eax
je 0x4ea76c
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004ea0ae
mov dword [ebp - 0xc], eax
jmp 0x4ea788
mov eax, dword [ebp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004e9e9d
mov dword [ebp - 0xc], eax
mov dword [esp + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s_chost_s_c
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00492911
cmp dword [ebp + 0x18], 0
jle 0x4ea7fb
mov dword [esp + 4], 0
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.004e8364
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str.version_d_c
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00492911
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.005547b0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_free
lea eax, [ebp - 0x1c]
mov dword [esp], eax
call fcn.00491cd8
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x4eaa13
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x84
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0044e437
test eax, eax
je 0x4eaa47
mov dword [esp], str.strange_hostname__s_blocked
call fcn.004e84be
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004b54c7
call fcn.004ea414
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4eaa6d
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004ea54a
mov dword [ebp - 0x10], eax
jmp 0x4eaaac
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 0x40]
and edx, 0xffffffdf
mov byte [eax + 0x40], dl
mov dword [esp], str.GIT_SSH
call sub.cygwin1.dll_getenv
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4eaa96
mov dword [ebp - 0xc], 0x5bb7ac
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004ea54a
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4eabbd
lea edx, [ebp - 0x60]
mov eax, 0
mov ecx, 0x14
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x60], 0x61d2ec
mov dword [ebp - 0x54], 0x61d2ec
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x40]
shr al, 5
and eax, 1
and eax, 1
shl eax, 5
mov edx, eax
movzx eax, byte [ebp - 0x20]
and eax, 0xffffffdf
or eax, edx
mov byte [ebp - 0x20], al
movzx eax, byte [ebp - 0x20]
or eax, 4
mov byte [ebp - 0x20], al
movzx eax, byte [ebp - 0x20]
shr al, 2
and eax, 1
and eax, 1
lea edx, [eax + eax]
movzx eax, byte [ebp - 0x20]
and eax, 0xfffffffd
or eax, edx
mov byte [ebp - 0x20], al
movzx eax, byte [ebp - 0x20]
shr al, 1
and eax, 1
and eax, 1
mov edx, eax
movzx eax, byte [ebp - 0x20]
and eax, 0xfffffffe
or eax, edx
mov byte [ebp - 0x20], al
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.004962f4
mov dword [esp + 4], 0x5bbb79
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.004962f4
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
lea eax, [ebp - 0x60]
add eax, 0xc
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.004ea834
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.004962f4
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.004879e4
test eax, eax
je 0x4eabb5
mov eax, 1
jmp 0x4eabba
mov eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004962f4
mov eax, dword [ebp + 8]
lea ecx, [eax + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.004ea834
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004962f4
nop
mov edi, dword [ebp - 4]
leave
ret