joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aede0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x128
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0
mov esi, dword [edi + 0xc]
mov dword [esp + 0x18], esi
test esi, esi
je 0x4af204
test edx, edx
je 0x4af204
movzx eax, byte [edx]
lea ecx, [eax + 1]
add eax, 0xffffffed
xor ecx, 1
dec ecx
mov dword [esp + 0x20], ecx
cmp eax, 0x7f
ja 0x4af11f
movzx eax, byte [eax + 0x4ae62c]
jmp dword [eax*4 + 0x4ae60c]
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.004ae570
mov dword [esp + 0x24], eax
add esp, 4
mov eax, dword [esi + 0xc]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x10], eax
jg 0x4af14d
mov ecx, esi
call fcn.0049cd20
test eax, eax
jne 0x4af186
mov eax, dword [esp + 0x18]
inc dword [esi + 0xc]
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0x14]
mov word [eax + ecx*4], 0x1b
lea ecx, [eax + ecx*4]
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
cmp dword [ebp + 0xc], eax
setne al
mov dword [ecx + 0xc], eax
mov byte [ecx + 3], 0
mov dword [ecx + 0x10], 0
mov byte [esi + 0x6e], 0
cmp dword [esp + 0x1c], 0
je 0x4af1c4
mov al, byte [edi + 0x15]
mov byte [esp + 0x17], al
cmp al, 8
jae 0x4af1c4
xor ecx, ecx
lea eax, [edi + 0x60]
nop dword [eax]
mov edx, dword [esp + 0x1c]
cmp dword [eax + 0x10], edx
je 0x4af1c0
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x4af1a0
movzx eax, byte [esp + 0x17]
mov dword [edi + eax*4 + 0x18], edx
inc byte [edi + 0x15]
jmp 0x4af1c4
mov byte [eax + 9], 1
mov edx, dword [esp + 0x2c]
test edx, edx
je 0x4af204
mov al, byte [edi + 0x15]
mov byte [esp + 0x17], al
cmp al, 8
jae 0x4af204
xor ecx, ecx
lea eax, [edi + 0x60]
nop dword [eax]
cmp dword [eax + 0x10], edx
je 0x4af200
inc ecx
add eax, 0x18
cmp ecx, 0xa
jl 0x4af1e0
movzx eax, byte [esp + 0x17]
mov dword [edi + eax*4 + 0x18], edx
inc byte [edi + 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [eax + 9], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4af2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x4af435
test edi, edi
je 0x4af435
movzx ecx, word [esi + 2]
push ebx
test ecx, 0x1000
jne 0x4af42c
movzx eax, word [edi + 2]
test eax, 0x1000
jne 0x4af42c
xor al, cl
test al, 0x10
jne 0x4af42c
mov al, byte [esi]
cmp al, byte [edi]
jne 0x4af42c
mov edx, dword [edi + 8]
mov ecx, dword [esi + 8]
call fcn.004af2b0
test eax, eax
je 0x4af42c
mov edx, dword [edi + 0xc]
mov ecx, dword [esi + 0xc]
call fcn.004af2b0
test eax, eax
je 0x4af42c
mov eax, dword [esi + 0x10]
mov ecx, dword [edi + 0x10]
test eax, eax
je 0x4af37f
test ecx, ecx
je 0x4af42c
mov edx, dword [eax]
cmp edx, dword [ecx]
jne 0x4af42c
xor ebx, ebx
test edx, edx
jle 0x4af387
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax + eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [edx + eax]
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0xc]
mov edx, dword [edx + eax]
call fcn.004af2b0
test eax, eax
je 0x4af42c
mov eax, dword [esi + 0x10]
inc ebx
mov edx, dword [ebp - 4]
add edx, 0x14
mov dword [ebp - 4], edx
cmp ebx, dword [eax]
jl 0x4af350
jmp 0x4af387
test ecx, ecx
jne 0x4af42c
mov eax, dword [esi + 0x18]
cmp eax, dword [edi + 0x18]
jne 0x4af42c
mov eax, dword [esi + 0x20]
cmp eax, dword [edi + 0x20]
jne 0x4af42c
mov eax, dword [esi + 0x24]
cmp eax, dword [edi + 0x24]
jne 0x4af42c
mov eax, 0x800
test word [esi + 2], ax
je 0x4af3c4
test word [edi + 2], ax
je 0x4af42c
mov eax, dword [esi + 4]
cmp eax, dword [edi + 4]
jmp 0x4af41e
cmp byte [esi], 0x98
je 0x4af420
mov esi, dword [esi + 4]
test esi, esi
je 0x4af420
test word [edi + 2], ax
jne 0x4af42c
mov edx, dword [edi + 4]
test edx, edx
je 0x4af42c
mov bl, byte [esi]
test bl, bl
je 0x4af408
mov al, bl
sub esi, edx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x51e778]
cmp al, byte [ecx + 0x51e778]
jne 0x4af408
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x4af3e7
movzx eax, bl
movzx ecx, byte [eax + 0x51e778]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x51e778]
sub ecx, eax
jne 0x4af42c
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp edi, esi
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b1810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
mov edx, ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
push edi
mov edi, eax
test eax, eax
je 0x4b183d
cmp byte [eax], cl
je 0x4b1835
inc edi
cmp byte [edi], cl
jne 0x4b1830
sub edi, eax
and edi, 0x3fffffff
mov eax, 1
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
cmp dword [edx + 4], eax
jle 0x4b1905
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
xor esi, 1
cmp eax, 2
cmovge esi, eax
test ebx, ebx
je 0x4b18c3
mov eax, dword [edx + 8]
mov ecx, esi
add ecx, ecx
mov edx, dword [eax + ecx*8]
mov ecx, dword [ebp + 8]
mov bl, byte [ecx]
test bl, bl
je 0x4b18a5
sub ecx, edx
mov al, bl
mov dword [ebp - 0x14], ecx
mov edi, ecx
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x51e778]
cmp al, byte [ecx + 0x51e778]
jne 0x4b18a2
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x4b1881
mov edi, dword [ebp - 4]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x51e778]
movzx eax, bl
mov ebx, dword [ebp + 8]
movzx eax, byte [eax + 0x51e778]
sub eax, ecx
jne 0x4b18e6
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
add esi, esi
mov edx, dword [ebp - 0x18]
push edi
mov ecx, dword [eax + esi*8 + 0xc]
add ecx, 4
call fcn.0048f4a0
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0x4b18fc
jmp 0x4b18e9
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [edx + 4]
jl 0x4b1856
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4b1910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
push esi
mov esi, eax
push edi
test eax, eax
je 0x4b193d
cmp byte [eax], dl
je 0x4b1935
nop dword [eax]
inc esi
cmp byte [esi], dl
jne 0x4b1930
sub esi, eax
and esi, 0x3fffffff
mov eax, dword [ecx + 4]
mov edi, 1
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], eax
cmp eax, edi
jle 0x4b1a05
push ebx
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x18], ebx
nop word [eax + eax]
mov eax, edi
xor eax, 1
cmp edi, 2
cmovge eax, edi
add eax, eax
mov ecx, dword [ebx + eax*8 + 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4b19cc
mov edx, dword [ebx + eax*8]
mov bl, byte [ecx]
test bl, bl
je 0x4b19b4
mov edi, ecx
mov al, bl
sub edi, edx
nop word [eax + eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x51e778]
cmp al, byte [ecx + 0x51e778]
jne 0x4b19b1
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x4b1990
mov edi, dword [ebp - 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x51e778]
movzx eax, bl
movzx eax, byte [eax + 0x51e778]
sub eax, ecx
jne 0x4b19e9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x14
push esi
call fcn.0048f4a0
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x4b19fc
jmp 0x4b19ec
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0x14]
jl 0x4b1960
pop ebx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b6580
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ebp + 0x1c]
test edx, edx
jne 0x4b6608
test ebx, ebx
jne 0x4b65a0
test edi, edi
je 0x4b6608
mov edx, 0x523a74
test ebx, ebx
mov eax, 0x523a70
cmove eax, edx
push eax
push 0x523a7c
push ecx
call fcn.0048e330
add esp, 0xc
test ebx, ebx
je 0x4b65dc
mov edx, ebx
mov ecx, esi
call fcn.004a96e0
cmp word [ebx + 2], 0
jl 0x4b65dc
push ebx
push esi
call fcn.0048bf10
add esp, 8
mov edx, edi
mov ecx, esi
call fcn.004b5b50
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4b65ff
mov edx, edi
mov ecx, esi
call fcn.004c3030
push edi
push esi
call fcn.0048bf10
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004b5ee0
mov edx, eax
add esp, 8
mov dword [esp + 0x18], edx
test edx, edx
je 0x4b65be
movzx ecx, word [edx]
test cx, cx
je 0x4b65be
mov edi, dword [ebp + 0x10]
movsx ecx, cx
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [edx + eax*8]
mov eax, dword [edi + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
test eax, eax
je 0x4b66f3
mov ecx, dword [edi]
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x4b6660
xor edi, edi
jmp 0x4b66e1
lea ecx, [eax + 1]
test esi, esi
je 0x4b66b0
cmp byte [esi + 0x1e], 0
jne 0x4b6659
cmp byte [esi + 0xe2], 0
je 0x4b66b0
movzx eax, word [esi + 0xe0]
cmp ecx, eax
jg 0x4b66b0
mov edi, dword [esi + 0xec]
test edi, edi
je 0x4b66b0
mov eax, dword [edi]
mov dword [esi + 0xec], eax
mov eax, dword [esi + 0xe4]
inc eax
mov dword [esi + 0xe4], eax
cmp eax, dword [esi + 0xe8]
jle 0x4b66cb
mov dword [esi + 0xe8], eax
jmp 0x4b66cb
push ecx
call fcn.0048be20
mov edi, eax
add esp, 4
test edi, edi
jne 0x4b66cb
test esi, esi
je 0x4b66c7
mov byte [esi + 0x1e], 1
test edi, edi
je 0x4b66e1
mov esi, dword [esp + 0xc]
push esi
push dword [esp + 0x14]
push edi
call fcn.004df230
add esp, 0xc
mov byte [edi + esi], 0
mov ecx, edi
call fcn.0048e3c0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx - 0x28], edi
mov eax, dword [ebp + 0x14]
pop edi
mov dword [ecx - 0x20], eax
mov eax, dword [ebp + 0x1c]
pop esi
mov dword [ecx - 0x14], ebx
mov dword [ecx - 0x10], eax
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6980
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi]
mov ebx, dword [edi + 8]
add ebx, 0x14
cmp dword [ebx], 0
jne 0x4b6a35
cmp byte [esi + 0x1d0], 0
jne 0x4b6a35
mov eax, dword [edi + 0xc]
mov edx, edi
shr eax, 0xb
xor ecx, ecx
push 0x21e
and eax, 2
push eax
push ebx
call fcn.00496ee0
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b6a3e
mov eax, dword [ebx]
mov eax, dword [eax + 4]
cmp dword [eax + 0x24], 0
jne 0x4b69fa
mov eax, dword [eax]
mov eax, dword [eax + 0xa8]
mov dword [eax + 0x10], 0x7d0
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4b69fa
push 0x7d0
push eax
call dword [0x533d54]
add esp, 8
mov eax, dword [edi + 8]
mov bl, byte [edi + 0x20]
mov eax, dword [eax + 0x14]
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp byte [esi + 0xf], 0
jne 0x4b6a35
mov edi, dword [esi + 0x3c]
mov eax, dword [edi]
test eax, eax
je 0x4b6a32
cmp dword [esi + 0x48], 0
jne 0x4b6a35
cmp dword [esi + 0x4c], 0
jne 0x4b6a35
mov eax, dword [eax + 4]
push edi
call eax
add esp, 4
mov dword [edi], 0
mov byte [esi + 5], bl
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x523aa0
push esi
call fcn.0048e330
mov eax, dword [ebp - 4]
add esp, 8
mov dword [esi + 4], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4de0d5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x50c290]
test eax, eax
je 0x4de114
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4de114
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4de114
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4de114
cmp dword [ecx + 0x74], 0xe
jbe 0x4de114
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x502c90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x502cbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x502cbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401050
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], str.Usage:__s___c_t_l_filename____b_block_size____f_fragment_size__n_t__i_bytes_per_inode____I_inode_size____j____J_journal_options__n_t__N_number_of_inodes____m_reserved_blocks_percentage____o_creator_os__n_t__g_blocks_per_group____L_volume_label____M_last_mounted_directory__n_t__O_feature__..._____r_fs_revision____E_extended_option__..._____qvSV__n_tdevice__blocks_count__n
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 4], ebx
mov edx, dword [str.mke2fs]
mov dword [esp + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
nop

Function at 0x401110
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov eax, 0x6c
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.cygwin1.dll_memset
mov esi, dword [0x422740]
test esi, esi
je 0x401155
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, edi
call fcn.004010a0
mov dword [esp + 0xc], eax
mov ecx, str.___dd____dld
mov esi, eax
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.cygwin1.dll_sprintf
mov eax, 8
mov edx, 0x4f
mov dword [esp + 4], eax
lea eax, [ebx + 0x14]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.cygwin1.dll_memset
mov byte [ebx + 0x63], 0
lea eax, [esi + esi + 1]
cmp eax, 0x4f
jle 0x4011f0
mov dword [ebx + 0x64], edi
mov dword [ebx + 0x68], 0
mov dword [esp], str.MKE2FS_SKIP_PROGRESS
call sub.cygwin1.dll_getenv
test eax, eax
jne 0x4011f7
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.cygwin1.dll_fputs
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov dword [ebp + 8], eax
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sub.cygwin1.dll_fflush
mov byte [ebx + esi*2 + 0x15], 0
jmp 0x4011a1
inc dword [ebx + 0x68]
jmp 0x4011bb
Function at 0x401420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
shl eax, 9
mov dword [esp], eax
call sub.cygwin1.dll_malloc
test eax, eax
mov edi, eax
je 0x40157b
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x401490
mov eax, dword [esi + 4]
xor ecx, ecx
mov ebx, 0xfffffe00
mov edx, dword [eax + 4]
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x14]
test eax, eax
jne 0x401542
mov eax, dword [edi + 0x40]
cmp eax, 0x82564557
sete dl
cmp eax, 0x57455682
sete al
or eax, edx
test al, 1
jne 0x4014fb
lea esi, [esi]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], edi
shl ebx, 9
mov dword [esp + 8], ebx
neg ebx
call sub.cygwin1.dll_memset
mov eax, dword [esi + 4]
mov ecx, 0x200
mov edx, dword [eax + 4]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [edx + 0x10]
mov eax, dword [esi + 4]
mov edx, dword [eax + 4]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov ecx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x18]
mov edx, dword [esi + 4]
mov ebx, eax
mov eax, dword [esi + 0x14]
mov ecx, dword [edx + 4]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [ecx + 0x10]
mov dword [esp], edi
call sub.cygwin1.dll_free
test ebx, ebx
jne 0x401503
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call fcn.004105c0
mov dword [esp], str.Warning:_could_not_erase_sector__d:__s_n
mov edi, eax
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 0xc], edi
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call fcn.004105c0
mov dword [ebp - 0x14], eax
mov dword [esp], str.Warning:_could_not_read_block_0:__s_n
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x401490
mov dword [esp], str.Out_of_memory_erasing_sectors__d__d_n
call fcn.004161f0
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea edx, [ecx + ebx - 1]
mov dword [esp + 8], edx
call sub.cygwin1.dll_printf
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
Function at 0x401990
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esi
test eax, eax
mov esi, eax
mov dword [ebp - 8], ebx
je 0x4019bb
mov dword [esp + 4], edx
mov eax, 0x41c018
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.00415e10
test eax, eax
jne 0x4019c5
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], str.Invalid_filesystem_option_set:__s_n
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov esi, esi
lea edi, [edi]

Function at 0x404760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x110
mov dword [esp], 0x41e700
call fcn.004161f0
mov esi, eax
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fflush
call sub.cygwin1.dll___getreent
mov dword [esp], str.Proceed_anyway___y_n_
mov ebx, eax
call fcn.004161f0
mov edx, dword [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.cygwin1.dll_fputs
mov byte [ebp - 0x108], 0
call sub.cygwin1.dll___getreent
mov eax, dword [eax + 4]
mov edx, 0x100
mov dword [esp + 4], edx
mov dword [esp + 8], eax
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.cygwin1.dll_fgets
movsx eax, byte [ebp - 0x108]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.cygwin1.dll_strchr
test eax, eax
je 0x404806
add esp, 0x110
pop ebx
pop esi
pop ebp
ret
mov dword [esp], 1
call sub.cygwin1.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x404900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0040cda0
test eax, eax
mov ebx, eax
jne 0x4049b4
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x404950
test al, 0x10
jne 0x4049e5
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], str._s_is_mounted_
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
cmp edi, 2
jg 0x404a3b
mov dword [esp], str.will_not_make_a__s_here__n
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov dword [esp], str.while_determining_whether__s_is_mounted.
call fcn.004161f0
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebx
mov dword [esp], str.ext2fs_check_if_mount
call fcn.00410ae0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], str._s_is_apparently_in_use_by_the_system_
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
cmp edi, 2
jle 0x40497f
call sub.cygwin1.dll___getreent
mov dword [esp], str.mke2fs_forced_anyway._n
mov ebx, eax
call fcn.004161f0
mov edx, dword [ebx + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.cygwin1.dll_fputs
jmp 0x40493d
call sub.cygwin1.dll___getreent
mov dword [esp], str.mke2fs_forced_anyway.__Hope__etc_mtab_is_incorrect._n
mov ebx, eax
jmp 0x404a22
Function at 0x404a50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov dword [esp], ebx
call sub.cygwin1.dll_strlen
inc eax
mov dword [esp], eax
call sub.cygwin1.dll_malloc
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404bb4
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.cygwin1.dll_strcpy
mov ebx, dword [ebp - 0x14]
cmp byte [ebx], 0
je 0x404b5e
lea esi, [esi]
mov dword [esp], ebx
mov eax, 0x2c
mov dword [esp + 4], eax
call sub.cygwin1.dll_strchr
mov dword [ebp - 0x10], eax
test eax, eax
mov dword [ebp - 0x18], 0
je 0x404ac9
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [esp], ebx
mov eax, 0x3d
mov dword [esp + 4], eax
call sub.cygwin1.dll_strchr
mov dword [ebp - 0x20], eax
test eax, eax
je 0x404ae8
mov byte [eax], 0
inc eax
mov dword [ebp - 0x20], eax
cld
mov eax, 7
mov esi, ebx
mov edi, str.device
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x404b90
cld
mov eax, 5
mov edi, str.size
mov esi, ebx
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x404b71
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x404b40
lea eax, [ebp - 0x10]
xor ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.cygwin1.dll_strtoul
mov dword [0x4222b0], eax
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
je 0x404b43
nop
inc dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x404b53
cmp byte [ebx], 0
jne 0x404aa0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x404be2
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.cygwin1.dll_free
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cld
mov edi, str.v1_superblock
mov ecx, 0xe
mov esi, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x404b40
or dword [0x4227b0], 1
jmp 0x404b43
mov dword [esp], 0
mov eax, dword [ebp - 0x20]
xor edi, edi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call fcn.00410c60
mov dword [0x4222f0], eax
test eax, eax
je 0x404b40
jmp 0x404b43
call sub.cygwin1.dll___getreent
mov dword [esp], str.Couldnt_allocate_memory_to_parse_journal_options__n
mov ebx, eax
call fcn.004161f0
mov edx, dword [ebx + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.cygwin1.dll_fputs
mov dword [esp], 1
call sub.cygwin1.dll_exit
call sub.cygwin1.dll___getreent
mov dword [esp], str._nBad_journal_options_specified._n_nJournal_options_are_separated_by_commas__and_may_take_an_argument_which_n_tis_set_off_by_an_equals____sign._n_nValid_journal_options_are:_n_tsize_journal_size_in_megabytes__n_tdevice_journal_device__n_nThe_journal_size_must_be_between_1024_and_102400_filesystem_blocks._n_n
mov ebx, eax
call fcn.004161f0
mov edx, dword [ebx + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.cygwin1.dll_fputs
mov ecx, dword [ebp - 0x14]
mov dword [esp], ecx
call sub.cygwin1.dll_free
jmp 0x404bd6