Function at 0x6109b0d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0x61130634
push esi
push ebx
sub esp, 0x12c
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x104], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x100], eax
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109b10d
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x6109b118
test al, al
jne 0x6109b0fe
mov eax, 1
jmp 0x6109b11a
xor eax, eax
test eax, eax
je 0x6109b140
mov ecx, dword [ebp - 0x104]
test byte [ecx + 0x20], 0x40
je 0x6109b140
lea esi, [esi]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, str..bat
mov esi, edx
mov edi, ecx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109b15e
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x6109b169
test al, al
jne 0x6109b14f
mov eax, 1
jmp 0x6109b16b
xor eax, eax
test eax, eax
jne 0x6109b130
mov eax, dword [ebp - 0x104]
add eax, 0x50
mov dword [ebp - 0x114], eax
cmp byte [edx], 0
jne 0x6109b34b
mov eax, dword [ebp - 0x104]
sub edx, 4
add eax, 0x50
cmp edx, eax
jbe 0x6109b34b
mov esi, edx
mov edi, ecx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109b1b4
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x6109b1bf
test al, al
jne 0x6109b1a5
mov eax, 1
jmp 0x6109b1c1
xor eax, eax
test eax, eax
jne 0x6109b130
mov edi, str..cmd
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109b1e5
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x6109b1f0
test al, al
jne 0x6109b1d6
mov eax, 1
jmp 0x6109b1f2
xor eax, eax
test eax, eax
jne 0x6109b130
mov edi, str..btm
mov esi, edx
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109b216
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x6109b221
test al, al
jne 0x6109b207
mov eax, 1
jmp 0x6109b223
xor eax, eax
test eax, eax
je 0x6109b34b
jmp 0x6109b130
mov edx, dword fs:[4]
mov eax, dword [ebp - 0x28]
sub edx, 0x319c
mov dword [edx + 0xc30], eax
mov eax, dword [ebp - 0x24]
mov dword [edx + 0xc34], eax
test byte [0x6110c854], 1
jne 0x6109b4d0
cmp byte [edi], 0x23
je 0x6109b510
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
sub esp, 4
mov esi, dword [ebp + 0x14]
mov edi, str..com
cld
and eax, 0xff
lodsb al, byte [esi]
scasb al, byte es:[edi]
je 0x6109b28d
xor al, byte [eax + 0x61108b40]
cmp al, byte [edi - 1]
jne 0x6109b298
test al, al
jne 0x6109b27e
mov eax, 1
jmp 0x6109b29a
xor eax, eax
test eax, eax
jne 0x6109b130
mov eax, 0x6113064d
mov dword [ebp - 0x108], eax
xor eax, eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax + 4]
test eax, eax
jne 0x6109b2db
mov eax, dword [ebp + 0xc]
call sym._cstrdup1_4
mov ecx, dword [ebp - 0x100]
mov edx, dword [ecx]
mov dword [ecx + 4], 1
mov dword [edx], eax
mov edi, dword [ebp - 0x10c]
test edi, edi
je 0x6109b303
xor esi, esi
mov ecx, dword [ebp - 0x100]
mov dword [esp + 8], esi
mov edx, dword [ebp - 0x10c]
mov dword [esp], ecx
mov dword [esp + 4], edx
call method.av.unshift_char_const__int_
mov dword [esp], 2
lea eax, [ebp + 0x14]
mov edx, dword [ebp - 0x104]
mov dword [esp + 4], eax
mov ecx, 0x61130655
mov ebx, 1
mov eax, dword [ebp - 0x108]
call sym.__Z9find_execPKcR9path_convS0_jPS0__20
sub esp, 8
mov edx, dword [ebp - 0x100]
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x114]
mov dword [esp], edx
mov dword [esp + 4], eax
call method.av.unshift_char_const__int_
xor edi, edi
xor esi, esi
mov eax, 0x6110943c
mov dword [ebp - 0x108], edi
xor ebx, ebx
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x10c], esi
mov edx, 3
mov dword [esp + 0xc], eax
mov eax, 3
mov dword [esp + 8], eax
mov eax, 0x80000000
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x114]
mov dword [esp], ecx
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
mov ebx, eax
je 0x6109b62a
mov dword [esp], ebx
xor eax, eax
mov esi, 0x6110943c
mov dword [esp + 0x14], eax
xor eax, eax
mov edi, 2
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
call sub.KERNEL32.dll_CreateFileMappingA
sub esp, 0x18
mov esi, eax
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test esi, esi
je 0x6109b5e5
mov dword [esp], esi
xor eax, eax
xor ecx, ecx
mov dword [esp + 8], eax
xor edx, edx
mov eax, 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_MapViewOfFile
sub esp, 0x14
mov edi, eax
mov dword [esp], esi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
test edi, edi
je 0x6109b62a
mov edx, dword fs:[4]
lea ecx, [ebp - 0xf8]
sub edx, 0x319c
mov eax, dword [edx + 0xc30]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0xc34]
mov dword [edx + 0xc30], ecx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [edx + 0xc34], eax
mov dword [esp], ecx
call sym.___sjfault
test eax, eax
jne 0x6109b646
cmp byte [edi], 0x4d
jne 0x6109b230
cmp byte [edi + 1], 0x5a
je 0x6109b67d
mov edx, dword fs:[4]
mov eax, dword [ebp - 0x28]
sub edx, 0x319c
mov dword [edx + 0xc30], eax
mov eax, dword [ebp - 0x24]
mov dword [edx + 0xc34], eax
test byte [0x6110c854], 1
jne 0x6109b4d0
cmp byte [edi], 0x23
je 0x6109b510
lea esi, [esi]
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
mov eax, dword [ebp - 0x108]
sub esp, 4
test eax, eax
jne 0x6109b2b5
jmp 0x6109b270
mov edx, dword [ebp - 0x114]
mov eax, str._s_is_possibly_a_script
mov dword [esp + 0xc], eax
mov eax, str.int_av::fixup_const_char__path_conv__const_char_
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov dword [esp], 0x6110c854
call method.strace.prntf_unsigned_int__char_const__char_const__..._
cmp byte [edi], 0x23
jne 0x6109b4b0
lea esi, [esi]
lea edi, [edi]
cmp byte [edi + 1], 0x21
lea esi, [edi + 2]
jne 0x6109b4b0
mov dword [esp], esi
mov eax, 0x61130673
mov ebx, 0x61130676
mov dword [esp + 4], eax
call sym.cygwin1.dll__strspn
mov dword [esp + 4], ebx
add esi, eax
mov dword [esp], esi
call sym.cygwin1.dll__strcspn
mov dword [ebp - 0x110], eax
test eax, eax
je 0x6109b4b0
add eax, 0x1f
and eax, 0xfffffff0
call sym.cygwin1.dll__alloca
mov ecx, dword [ebp - 0x110]
lea ebx, [esp + 0x2b]
and ebx, 0xfffffff0
mov dword [esp + 4], esi
mov esi, ebx
mov dword [esp + 8], ecx
mov dword [esp], ebx
call sym.cygwin1.dll__memcpy
mov eax, dword [ebp - 0x110]
mov byte [ebx + eax], 0
mov dword [ebp - 0x108], ebx
lea esi, [esi]
lea edi, [edi]
cmp byte [esi], 0
je 0x6109b4b0
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x6109b5a6
inc esi
jmp 0x6109b590
movzx eax, byte [esi]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or dl, al
je 0x6109b5a3
mov byte [esi], 0
lea ebx, [esi + 1]
mov edx, 0x61130673
mov dword [esp], ebx
mov dword [esp + 4], edx
call sym.cygwin1.dll__strspn
add ebx, eax
cmp byte [ebx], 0
je 0x6109b4b0
mov dword [ebp - 0x10c], ebx
mov esi, ebx
dec esi
inc esi
jmp 0x6109b590
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3ee
jne 0x6109b62a
test byte [0x6110c854], 1
je 0x6109b270
mov dword [esp], 0x6110c854
mov ecx, str.zero_length_file__treat_as_script.
mov edx, str.int_av::fixup_const_char__path_conv__const_char_
mov dword [esp + 0xc], ecx
mov eax, 0x40
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x6109b270
mov eax, str._ext_build_netrel_src_cygwin_1.5.25_7_winsup_cygwin_spawn.cc
mov edx, 0x40a
call sym.__Z8seterrnoPKci_8
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
mov edx, dword [ebp - 0x104]
sub esp, 4
and dword [edx + 0x20], 0xffffffbf
mov eax, dword fs:[4]
mov edx, dword [ebp - 0x28]
sub eax, 0x319c
mov dword [eax + 0xc30], edx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc34], edx
jmp 0x6109b130
movzx edx, byte [edi + 0x19]
mov ecx, dword [ebp - 0x100]
movzx eax, byte [edi + 0x18]
shl edx, 8
or eax, edx
cmp eax, 0x3f
setbe al
test al, al
mov byte [ecx + 0xc], al
je 0x6109b6c6
mov eax, dword [ebp - 0x104]
and dword [eax + 0x20], 0xffffffbf
mov dword [esp], edi
call sub.KERNEL32.dll_UnmapViewOfFile
sub esp, 4
cmp word [ebp - 0xfa], 3
mov edx, dword [ebp - 0x100]
sete byte [edx + 0xd]
jmp 0x6109b65b
xor edx, edx
lea ecx, [ebp - 0xfa]
mov eax, edi
call sym.hook_or_detect_cygwin_char_const__void_const__unsigned_short_
test eax, eax
je 0x6109b69d
mov ecx, dword [ebp - 0x104]
or dword [ecx + 0x20], 0x40
jmp 0x6109b6a7